AttiFin AI

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

AttiFin is an AI assistant with nothing underneath it. Research, drafting and summarisation are the three capabilities the product sells and each is model-driven; there is no document management system, workflow engine or matter database that would still function if the models were removed. Section 2 of the terms of service defines the Service as an AI-powered legal assistant optimised for UK law that helps you research, draft and summarise, which is the whole of what is offered. Section 15 treats the models as the company's own intellectual property alongside the software. This is an AI-native product rather than a legacy platform carrying an AI layer.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

The AI Policy at Annex B of the privacy policy states that answers are designed to be grounded in verified UK and client sources and to be citable and auditable so a reviewer can trace a statement back to its source, and the home page repeats that every answer is fully cited and instantly verifiable. No accuracy figure is published anywhere, no test set is described, and no retrieval method is set out beyond a claim that the platform indexes UK legal sources. There is no sample output, documentation or reachable product surface on which a reader could confirm that citations resolve. Grounding is asserted as a commitment rather than demonstrated, which is what holds this at C; the AI Policy's own acknowledgement that AI systems can produce inaccurate, incomplete or unrepresentative output keeps it clear of a bare no-hallucination claim. Checked home page, AI Policy, terms of service and privacy policy on 4 September 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Human review is a contractual requirement here rather than a marketing line. The terms of service open with a statement that AttiFin is a research and productivity tool and not a provider of legal advice, and that a qualified human professional must review and take responsibility for any work product before it is relied upon. The Acceptable Use Policy separately prohibits providing legal advice from output without human review and prohibits automated decisions that materially affect a person's rights without human supervision, and section 11 of the privacy policy states that no solely automated decision-making within the meaning of Article 22 UK GDPR takes place. The Book a Demo page claims a human review checkpoint before any consequential action is taken. What is missing is the control structure: no threshold at which the system stops is published, nothing describes what the product does when it cannot ground an answer, and there is no account of what happens after an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

One testimonial is published, attributed to a leading UK family law practice, claiming the team's research and first-draft time was cut significantly. No customer is named anywhere on the site, no figure is attached to the claim, and no date is given. There are no case studies, no customer stories page and no logo strip. The terms of service contemplate live paid subscriptions, free trials and signed Order Forms, so production use is provided for in the agreement, but nothing published evidences it. Checked home page, Book a Demo page, terms of service and privacy policy on 4 September 2026.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The privilege treatment is unusually direct for a vendor of this size. Section 8 of the terms recognises that customer content may attract both legal advice privilege and litigation privilege and the solicitor's duty of confidentiality under paragraph 6.3 of the SRA Code of Conduct, states that nothing in the terms is intended to waive privilege and that no use in accordance with them should be treated as waiving it, and commits to notifying the customer before any compelled disclosure of material identified as privileged so privilege can be asserted. Training is prohibited in the agreement itself rather than on a policy page, and sub-processors are contractually barred from it; retention is set by the customer and deletion runs within 30 days of termination across primary storage and derived search and caching copies. The position on model providers is stated: other than cloud storage providers, sub-processors will not retain or log customer content for human review. What is absent is segregation between matters. Separation is documented at the customer level through logical separation and role-based access control with content processed in the customer's own tenant, and no matter-level wall is described for a firm buyer. That single gap holds this at B.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The advice line is stated in the first paragraph a reader meets rather than buried in a footer: AttiFin is a research and productivity tool and not a provider of legal advice, output may be inaccurate, incomplete or out of date, and nothing in the Service relieves a regulated professional of their duties of competence, supervision and confidentiality. The jurisdiction limit is the product's entire positioning rather than a caveat, stated as optimised for UK law and trained on UK legislation and case law, with the terms governed by the laws of England and Wales, and the SRA Code of Conduct named to the paragraph. The Acceptable Use Policy adds a specific EU limb prohibiting a judicial authority from using the Service to research and interpret facts and apply the law to a concrete set of facts. There is no consumer-facing surface and the product is sold only to regulated professionals and their organisations, so the band's limb on disclosure to non-lawyer audiences does not bite; every limb that does apply is met in the agreement.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

An AI Policy is published as Annex B to the privacy policy and incorporated into the terms by reference, which is more than most vendors of this size publish. It commits to compliance with UK requirements and the EU Artificial Intelligence Act, cited by regulation number 2024/1689, to AI literacy among staff who develop and operate the models, to procedures for obtaining rights and licences in data sets, and to testing that monitors the accuracy, reliability and suitability of output alongside change-management processes. Each of those is a single sentence with nothing behind it: no owner inside the company is named for AI governance, no testing regime is described, and no results are published. The section headed Accuracy, bias and technical measures says nothing about bias — no testing, no findings, no populations or matter types considered — which is the clearest gap in an otherwise carefully drafted document.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Retention is published as a table with distinct periods in section 10 of the privacy policy: uploaded documents, conversations and AI-generated drafts are set by the customer's own retention policy and deleted within 30 days of termination; demo and enquiry records at 24 months; billing records generally six years. Deletion is specific about scope, naming primary storage and derived copies held in search and caching layers, and stating that backup copies are overwritten on the standard backup cycle rather than deleted individually. Encryption in transit and at rest, logical separation between customers, role-based access control, centrally managed keys rotated on a regular cycle and security monitoring are all described, and breach practice is stated on both sides of the controller and processor line including notification to the Information Commissioner's Office within 72 hours where AttiFin is controller. The one element of the set that is missing is the subprocessor list, which section 6 expressly declines to publish and offers only by email request.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

The allocation of loss is fully readable before signing. Section 13 gives a vendor-side indemnity against third-party intellectual property infringement claims with named carve-outs for customer content, customer breach and unapproved combinations. Section 14 sets a general cap at the total fees paid or payable in the 12 months before the event, and then a separate Data Breach Cap at twice that figure for claims arising from breach of the data protection or confidentiality obligations that causes a personal data breach of customer data. Section 12 warrants for paid use that the Service will perform materially in accordance with the documentation and be provided with reasonable skill and care, and places free trials on an as-is basis. No insurance position was located on the home page, terms of service, privacy policy or Book a Demo page on 4 September 2026. What keeps this off the top band is the subject of the recourse rather than any missing clause: the indemnity runs to intellectual property, and section 12 expressly declines to warrant that output will be accurate or complete, so the published answer to what the vendor stands behind when its output is wrong is a clear one and it is nothing.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

No practice system integration is named anywhere. The home page states that AttiFin works alongside existing systems and invites the reader to connect their documents and existing tools, but no document management system, word processor, email client, matter management platform, CLM or e-billing product is identified. The privacy policy names identity, single sign-on and file-import providers as categories of recipient and describes importing selected files from a connected account, which is generic connectivity rather than integration into the systems legal work already lives in. There is no integrations page, no developer documentation and no help centre. The site's entire published inventory is the home page, a Book a Demo page, the terms of service, the privacy policy with its two annexes, and a cookie policy, so this is a thin site rather than an unreachable one. Checked 4 September 2026.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Residency is the most detailed disclosure on the site. The platform is hosted in the United Kingdom and all customer data — uploaded documents, queries run and content generated — is stored in the UK. Section 7 of the privacy policy then publishes a table of every optional feature that moves anything abroad, naming what is processed and where: live web search sends the search query only to the United States with personal data minimised and redacted where technically possible and uploaded documents never transferred; single sign-on, document import, transactional email delivery and EEA-hosted AI inference are each listed separately with their own scope. Safeguards are named specifically as UK adequacy regulations including the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment completed beforehand, and a customer requiring strict UK-only processing can disable the optional features and have the configuration confirmed in writing. Tenancy is stated separately: content is processed within the customer's own tenant with logical separation between customers. The band's limb on what changes between tiers has nothing to bite on, because AttiFin publishes a single deployment in a single region rather than a set of options; the limbs that do apply, the regions available and processing location as distinct from storage location, are both answered precisely, and the latter is the limb most records on this axis miss. One thing a reader should know: section 7 still carries an unremoved instruction addressed to the site owner to delete the box before publishing, together with the replacement wording intended for when the optional features move to UK-hosted providers, so the section describes a transitional state the vendor intends to change. Checked 4 September 2026.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

No independent security attestation was located. There is no trust centre or trust portal, no SOC 2 or ISO certification is claimed, no auditor is named and no report is offered under any access tier. The site carries no security badges at all, so there is nothing unsupported on display either, which is why this sits at the floor rather than in the badges-without-scope band. Both section 10 of the terms and section 8 of the privacy policy state that further detail on security measures is available under a confidentiality agreement, which places the underlying material behind an executed agreement rather than a self-service request. The measures themselves are described in prose — encryption, logical separation, role-based access, key rotation, monitoring — but description by the vendor is not attestation by a third party. Checked home page, terms of service, privacy policy, Book a Demo page and site footer on 4 September 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Where the models run is disclosed and who supplies them is not. Section 6 of the privacy policy names AI model providers as a category of recipient that processes document extracts and queries to generate answers, summaries and drafts, and section 7 states that inference happens in the UK except where a customer configures an EEA-hosted model, with the live web search feature sending queries to the United States. Change notification is committed on both surfaces: the terms and the privacy policy each promise advance notice of any intended addition or replacement of a sub-processor together with an opportunity to object. No model is named and no provider is identified, and section 15 of the terms goes further, classing the identity of AttiFin's suppliers as its own confidential information provided for the customer's evaluation and oversight only, which sits awkwardly against the home page's sovereign-by-design framing. Architecture described without the providers named is the middle band in its own words.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level. There is no pricing page, no tier names, no feature split and no unit of charge; the only route to a number is the Book a Demo form. Section 7 of the terms establishes that fees are set in an Order Form, are payable in pounds sterling and are exclusive of VAT, and section 6 records that free trials may be offered with limited features, capacity or duration, but currency and tax treatment are payment mechanics rather than a published price or a published structure. No VendorPricing row is written, because nothing lifted this axis off the floor. Checked home page, Book a Demo page, terms of service, privacy policy and site footer on 4 September 2026; no pricing surface exists on the site.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The buyer is described only in the broadest terms. The home page addresses UK lawyers and UK legal teams, promises everything your firm needs in one specialist platform, and says drafting is trained for your practice area without naming a single practice area the product supports. The only practice area appearing anywhere on the site is in the unattributed testimonial, which cites a family law practice. There are no segment pages distinguishing firm size, in-house teams, government or legal aid work, and no statement of where the product stops. Coverage is claimed broadly with no published evidence that the breadth is real. The jurisdiction boundary the vendor does state clearly, that this is built for UK law only, is credited on the professional responsibility axis and is not counted twice here.