C
Checkbox
Checkbox is a legal intake and workflow platform for in house legal teams, built as a single front door for legal work. It captures requests from email, Slack, Microsoft Teams, Jira, Salesforce and web forms, then sorts and routes them by matter type, expertise, team capacity and business unit. Matters are managed in one place with linked documents, emails, tasks, approvals and conversations. Dashboards show demand, cycle times and workload, so the team can report on itself with numbers.
Workflow automation, built without code, handles repeat work such as NDAs, contract steps, policy questions and approvals. Self service tools and an AI legal chatbot let the business resolve routine questions without a lawyer. Checkbox AI applies generative AI across intake and workflows, and the platform integrates with Ironclad, messaging tools and CRM systems. Checkbox Technology Pty Ltd is based in Sydney, with a US affiliate, Checkbox Software, Inc. It holds SOC 2 Type II and ISO/IEC 27001:2022 and publishes its agreements and subprocessors, including its AI provider.
Customers include SAP, Coca-Cola Europacific Partners, Analog Devices, Hitachi Digital, Air New Zealand and Woolworths Group.
Checkbox, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to Checkbox
Vendors in the same categories as Checkbox whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- LLegitoLegito is a no code document automation and contract lifecycle management platform for legal, procurement, HR, finance and other back office teams, operated by Legito s.r.o. of the Czech Republic.
- BBusyLampBusyLamp is an electronic billing and outside counsel spend management product for European corporate legal departments, run in the eBilling.Space application.
- DDazychainDazychain is matter management software for small to medium in house legal departments, made by Yarris Technologies of Melbourne, with an office in Boston.
- AAjaxAjax is a passive timekeeping product for law firms that bill by the hour.
- BBigHandBigHand supplies law firms with applications for workforce allocation, document production, pricing, billing review and financial reporting.
- LLuplLupl is a legal work management platform for law firms and legal departments, owned by Elevate since August 2026.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The product is a workflow and intake system with AI applied to two steps inside it. Checkbox began as a no-code automation platform, which is what the 2022 Gartner Digital Markets recognition was for, and the architecture is still a request pipeline: capture, triage, matter management, automation, reporting. Checkbox AI is described as generative AI to streamline intake and workflow automation, with AI-powered triage routing on matter type, expertise, capacity and business unit, and a separate AI legal chatbot answering routine questions.
Those are real shipped capabilities and they accelerate steps that already existed. Remove the models and the platform still captures requests from email, Slack, Teams, Jira and Salesforce, still manages matters, still runs no-code workflows for NDAs and approvals, and still reports on cycle time and workload. The subprocessor list confirms the shape: generative AI is supplied by a third party and enabled only where the customer switches the optional features on, so the AI is a layer a buyer elects rather than the thing being bought.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
No accuracy figure exists for a product whose AI answers legal questions and routes legal work. The AI legal chatbot is marketed as giving instant legal help, and AI triage decides which lawyer gets which matter, so wrong answers and wrong routing both have consequences. No accuracy rate, benchmark, test set, evaluation, error mode or confidence measure was found on the home page, security page, legal documents or platform navigation, read.
Nothing says what the chatbot answers from, whether only the customer's own policy and FAQ content or the model's general knowledge, and no source linking is described. The only related fact is in the subprocessor annex: generative AI is supplied by OpenAI. Checkbox AI's own product page was not opened and may say more.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
What the automation does is described, but not what controls it. Requests are captured across channels, sorted and routed by AI on matter type, lawyer expertise, capacity and business unit, and matters are kept up to date automatically. Self service workflows resolve routine requests without a lawyer. The stated aim is for legal teams to focus on work that matters while the system handles the rest. What is missing is the control structure.
No review point lets a lawyer confirm or override an AI routing decision. No confidence threshold or escalation path is published for a request the system cannot classify. Nothing says what happens when a matter is misrouted or the chatbot answers a question it should have escalated. Approvals are a workflow feature the customer configures. That puts a person in the process by design, but is not oversight of the model's output.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Checkbox names its customers well, but measures little. Six people are quoted with title, employer, legal team size and company size. Jeannine Moran, Director of Legal Operations at Hitachi Digital, describes a single front door serving 40+ countries, a 60+ legal team and 16,000+ employees. Janene Asgeirsson is Chief Legal Officer at Analog Devices. Richard Conway, Deputy General Counsel and Corporate Secretary at Coca-Cola Europacific Partners, leads a 180+ legal team.
Jim Gray, VP and Head of Global Legal Operations at SAP, works with a 400+ legal team across 100,000+ employees. Linh Duong, Senior Legal Counsel at Align Technology, and Sam Bailey, Senior Legal Counsel at Air New Zealand, complete the six. One outcome figure is published: Woolworths Group cut matter volume by up to 80 percent. Another story covers NDA automation at Xero. A logo set includes BMW, PepsiCo, Telefonica, Allianz, Deloitte, PwC, Danone and Telstra.
The quotes are qualitative, the team and employee counts size the customer rather than the change, only one outcome figure was found, and no case study shows a date. None of the case studies was opened.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Checkbox's contract position on confidentiality is complete and readable in advance, but it does not expressly address training or privilege. A buyer can read a published data processing addendum before signing. It includes the EU standard contractual clauses, with Checkbox as processor and the customer as controller. Processing is limited to documented instructions and the stated purpose, and onward disclosure needs documented instructions.
Staff get access only as strictly necessary, under confidentiality. At the end, all personal data is deleted with certification or returned, at the customer's choice. Retention is the license term plus thirty days unless earlier deletion is requested in writing. The master services agreement carves data protection and privacy out of the ordinary liability cap. Two gaps. No express statement says customer content is not used to train models, though the clauses' purpose limit constrains it without naming it. And privilege and work product are never mentioned, though the product holds legal matters for in house teams.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Where the tool stops and legal advice begins goes unaddressed, on a product that markets an AI legal chatbot giving instant legal help to business users who are not lawyers. That framing makes the gap matter. The chatbot and self service workflows are designed so employees resolve legal questions without reaching a lawyer, which is exactly when a clear statement of what the tool is and is not would count. No statement says outputs are not legal advice, that no professional relationship arises, or that answers should be confirmed with counsel.
No jurisdiction limit or supervision statement appears. Only part of the master services agreement could be read, and the acceptable use policy and EULA were not opened, so a disclaimer may sit in one of those three documents.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Governance of the AI in the product goes unaddressed. There is no responsible AI page, AI policy, ethics statement, governance committee, accountable owner, testing regime or bias evaluation anywhere on the site. The navigation and footer were read in full across platform, solutions, resources, partners and company sections. What exists is information security governance, a different subject. It includes a security management system with named policy areas, thirteen listed security policies in the DPA annex, and a named Chief Information and Security Officer.
The gap matters because AI routing decides which lawyer gets which matter, and the chatbot answers questions for people who are not lawyers. Whether either performs unevenly across request types or business units is a live question nothing addresses.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Checkbox publishes every element in specific, current terms. Retention has a period: personal data is kept for the license term until thirty days after termination, unless the customer asks in writing for earlier deletion. Deletion is contractual and certified. At the end of processing, Checkbox must either delete all personal data and certify it, or return it and delete copies, at the customer's choice. Subprocessors are named with address, contact and role: Amazon Web Services for hosting and storage, Datadog for logs, SendGrid for workflow email deleted automatically after delivery, and OpenAI for generative AI where the customer turns those features on.
Changes need fifteen days' written notice, with a right to object. Incidents must be reported without undue delay, with a contact point, the nature of the breach, the people and records affected, likely consequences and measures taken. Access is limited to staff who strictly need it, under confidentiality. Data is encrypted at rest and in transit. That is backed by thirteen named policies, including a Cryptographic Standard, Data Destruction Standard and Security Incident Response Plan, and by annual third party penetration testing.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Liability is allocated mutually, with a higher cap for the risks that matter most. Each party's liability is capped at the amount paid in the twelve months before the liability arose. That cap does not apply to intellectual property infringement or misappropriation, data protection and privacy obligations, or indemnities. For those, liability runs to a stated multiple of the ordinary cap. Checkbox indemnifies the customer against third party claims that the software or services infringe intellectual property.
It may not settle on terms that impose a nonmonetary duty on the customer, or require an admission of fault, without the customer's written consent. The customer's indemnity is narrowed where a claim results from Checkbox's own negligence or breach. Missing: nothing specific to AI, no warranty on output, and no insurance position found. Only part of the agreement could be read.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Each integration is named with what it does. Slack and Microsoft Teams turn messages into matters, so a request raised in chat becomes a tracked item without leaving the channel. Gmail and Outlook capture email and track matters. Salesforce automates contract generation and approvals, the handoff from sales to legal that often breaks. Ironclad syncs contract requests and tracking, so Checkbox works alongside a CLM rather than against it, and Checkbox markets the pairing.
Jira is another intake channel. There is a technology and integration partners page and a referral and services partner program. Missing is depth. No API reference, developer documentation or connector specification was found, nothing describes field mapping or what happens when synced records conflict, and nothing lists unsupported systems. The integration pages were not opened.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Customers choose a data region, but the rest of the deployment model is described only in part. The privacy policy says Checkbox mainly stores data in the data center region the customer requests. The same passage says data may sometimes go to third parties in other places for listed purposes, where data protection laws may differ, with transfers made under applicable law. The subprocessor annex names Amazon Web Services for hosting and storage.
The EU standard contractual clauses govern transfers, with the Irish Data Protection Commission as supervisory authority. Missing: no tenancy model, so nothing says whether customers share infrastructure or get a separate environment. There is no list of the regions actually available, and nothing on what changes between deployment tiers.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Four standards are claimed by Checkbox with audit language, but none of the confirming detail is public. It says it has been externally audited and completed a SOC 2 Type II examination, holds ISO/IEC 27001:2022 certification, and complies with ISO/IEC 27017:2015 and ISO/IEC 27018:2019, the cloud personal data standard. The DPA repeats all four, putting the claim in a contract rather than only marketing. Its security management system covers network security, information handling, access control, incident response, backups, change management, risk, vulnerability and patch management, and vendor risk.
Listed controls include network intrusion detection, microsegmented firewalls, hardened system images and monitoring of all administrative access. Missing: no auditor, certificate date, examination period or scope statement appears anywhere. A trust portal at trust.checkbox.ai was not opened. The security page offers a contact form to request policies, penetration tests and SOC 2 reports.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The AI model provider is named in Checkbox's data processing addendum. Annex III lists OpenAI, LLC, with address and privacy contact, and says it provides generative AI for features in Checkbox where the customer turns those optional features on. That tells a buyer whose model is involved, that the AI is optional, and that the provider sits in the processor chain with the same fifteen day change notice and objection right as any other subprocessor.
Amazon Web Services is listed separately for infrastructure, so a reader can tell where workloads run apart from whose model reads the content. Missing: no model or model family is named, and there is no version or change notice commitment specific to the model. Nothing says what data goes to the provider, how long it is kept there, or whether zero retention applies.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Pricing is absent at every level, down to the unit of charge. The navigation and footer were read in full and include no pricing page. Every commercial route is a demo booking, a guided tour or a contact sales form. No rate, band, tier, package or per seat, per request or per matter unit was found. Nothing says what implementation or onboarding adds, which matters for a platform whose value depends on configuring workflows.
The published agreements set billing mechanics without price. Fees are defined in a Checkbox License Order, and the data processing addendum ties its retention period and its own signing to that order. Two pages address growing and enterprise legal teams, which divides the market without pricing it.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The buyer is identified with precision and the boundaries of the product are left open. Checkbox is unambiguous about who it is for, addressing in-house legal teams throughout and publishing separate pages for growing and for enterprise legal teams plus an in-house legal roles page, and the customer evidence bears the positioning out with legal teams ranging from 60 to 400 lawyers at organizations from 10,000 to 100,000 employees.
Practice coverage is expressed as request types rather than practice areas, spanning NDA automation, contract lifecycle steps, legal policy and FAQ handling, and general intake, which suits a front-door product. What is thin is everything about limits. No industry or sector segmentation is published despite a customer base spanning banking, pharmaceuticals, retail, aviation, technology and professional services. Nothing states a minimum viable team size, a request volume the product is designed for, or matter types it does not handle, and no jurisdictional scope is given for a platform sold to multinationals. The claim that it suits both growing and enterprise teams is made without describing what differs between them.
1 public document
The public pages on file for Checkbox, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Prompt and Output Retention, Ethical Walls and Matter Segregation, Third Party Request and Subpoena Notice and 1 more
Read Sep 1, 2026
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A published agreement or policy exists and none of it addresses the question either way, or the document that would answer it could not be read and the summary names the retrieval limit. The summary states which shape the silence takes: an improvement right granted that never names training, or no improvement right granted at all.
No express statement was located that customer content is not used to train or improve models, and the surrounding contractual position constrains it without naming it. The published data processing addendum incorporates the EU standard contractual clauses in the controller-to-processor module, under which Checkbox may process personal data only on documented instructions from the customer and only for the specific purpose of the transfer, stated as providing the software license.
Onward disclosure to any third party requires documented instructions. Training on customer content for Checkbox's own benefit would sit outside that purpose, so the clauses cut against it, and a reader has to reason to that conclusion rather than read it. The subprocessor annex confirms that generative AI functionality is supplied by OpenAI where the customer enables optional features, and says nothing about whether prompts or outputs passed to that provider are retained or used for training there.
Searched the DPA in full, the privacy policy, the security page and the recovered portions of the master services agreement on 1 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
A specific retention period is published and the customer cannot change it.
Customer personal data has a fixed retention period. Annex I.B of the data processing addendum says personal data is kept for the license term until thirty days after termination, unless earlier deletion is requested in writing. The standard contractual clauses add the method. At the end of processing, Checkbox must delete all personal data and certify it, or return it and delete copies, at the customer's choice. SendGrid has a tighter rule, deleting workflow email automatically after delivery.
AI is not addressed separately. Nothing states a retention or zero retention position for prompts sent to, or outputs returned by, the generative AI features, either at Checkbox or at the model provider.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
No located public material addresses walls or matter level segregation.
Staff access on Checkbox's side is limited by commitment, but no separation between customers or matters is described. Under the standard contractual clauses, staff get access to personal data only as strictly needed to manage the contract, under confidentiality. The security page adds an Information Classification Policy and monitoring of all administrative access. None of that covers separation inside the platform, which is the live question here.
Intake routes matters to particular lawyers by expertise and business unit, and self service tools show legal content to employees across the business. So who can see which matter is a permission question the customer needs answered. Nothing describes a tenancy model, a role or permission structure for customer users, or walls between business units sharing one instance.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Checkbox commits to full notice and goes further, because Clause 15 of the standard contractual clauses is part of its data processing addendum. On receiving a legally binding request from a public authority, including a court, Checkbox must promptly notify the customer, and where possible the data subject. The notice must state what data was requested, by which authority, on what legal basis, and how Checkbox responded.
Where notice is prohibited, Checkbox must use best efforts to get the prohibition waived and document those efforts. It must also review whether the request is lawful and challenge it where there are reasonable grounds to think it is not. That includes pursuing appeals, seeking interim measures to suspend the request, withholding disclosure until procedural rules require it, and giving the minimum information allowed.
Clause 15.1(c) requires periodic information on requests to the customer where permitted, but no public transparency report was found.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No legal source collection is maintained. Checkbox does not retrieve or publish primary law; it captures, routes and tracks a customer's own legal requests and automates workflows over the customer's own templates, policies and documents. The content the AI works across is therefore supplied by the customer rather than licensed by the vendor, which makes the provenance question narrower here than for a research or regulatory product.
It does not disappear entirely: the AI legal chatbot is marketed as providing instant legal help, and nothing published states what it answers from, so a buyer cannot tell whether responses are confined to their own uploaded policy and FAQ content or draw on the underlying model's general knowledge. Searched the home page, the platform navigation, the security page and the published legal set on 1 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No citator applies. The platform returns a routed matter, a generated document or an answer drawn from a customer's own material, not a legal authority whose subsequent history a user would need to verify. There is no regulatory or case-law corpus behind it and therefore no currency mechanism to describe. The nearest analog is template currency, since the workflow automation generates NDAs and other documents from customer-maintained templates, and responsibility for keeping those current sits with the customer rather than with Checkbox; nothing published addresses version control or review prompts for aging templates. Searched the home page, the platform and solutions navigation and the published legal set on 1 September 2026.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Checkbox publishes nothing on what its AI does when it cannot answer or classify, which matters in two places. The AI legal chatbot is marketed to business users as instant legal help. What it does with an out of scope question decides whether someone who is not a lawyer gets a wrong answer or is sent to a lawyer. AI triage assigns matters by type, expertise, capacity and business unit. What it does with a request it cannot categorize decides whether that request is queued for review or silently misrouted.
No confidence score, abstention path, fallback rule, escalation trigger or coverage indicator is published for either. Searched the home page, the security page, the platform navigation and the published legal documents on 1 September 2026. The Checkbox AI and AI legal chatbot product pages were not opened, and that is where such detail would sit.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
Searched the AI Hallucination Cases database maintained by Damien Charlotin at HEC Paris, together with 2026 sanctions trackers and trade coverage, on 1 September 2026, on the company name. No court order, opinion or disciplinary record naming Checkbox was located. This is a statement about the public record rather than a finding about the product. The failure mode fits poorly, since the output is a routed matter, a generated document from a customer template, or a chatbot answer consumed inside a company rather than a citation filed with a court; the analogous exposure would be a wrong answer given to a business user who acted on it without a lawyer seeing it, which would surface as a commercial dispute rather than in a sanctions docket.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Checkbox engages with no professional responsibility or ethics guidance. Nothing cites ABA Formal Opinion 512, any state bar opinion, the Law Council of Australia or a state law society, or any regulator statement on AI in legal work. Nothing says a lawyer's professional duties continue when using the platform. The gap stands out because of how the product is sold. The AI legal chatbot offers instant legal help to business users, and self service tools resolve requests without a lawyer, so the platform is built to put legal answers in front of people who are not lawyers.
Searched the home page, the security and trust page, the privacy policy, the legal index, the data processing addendum and the readable parts of the master services agreement on 1 September 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
Efficiency is the center of the marketing, and no billing or disclosure treatment exists. It cites demand and cycle time reductions, with Woolworths Group cutting matter volume by up to 80 percent. A chief legal officer is quoted arguing that expensive professionals should not be answering FAQs or negotiating low value contracts. Dashboards report cycle times and workload, the raw material a legal team would use to show its own cost of service.
The buyer is an in house team, not a firm billing a client, so fee disclosure applies only indirectly. Still, records showing which work automation handled rather than a lawyer would be exactly what an internal chargeback or shared service model needs. Nothing published addresses that, and no record built to disclose AI assisted work is described.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
Infrastructure and the AI provider are both named in a subprocessor list. Annex III of the data processing addendum names four subprocessors with address, contact details and what each does: Amazon Web Services for hosting and storage, Datadog for logs, SendGrid for workflow email, and OpenAI for generative AI where the customer turns on the optional features. So both the infrastructure and the model provider are identified.
The DPA with the EU standard contractual clauses, the master services agreement, the service level agreement and the acceptable use policy are all openly published and can be forwarded. Subprocessor changes need fifteen days' notice, with a right to object. Missing: no client facing disclosure pack assembled for the purpose, and no model or version named beneath the provider.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
A detailed activity record exists, but nothing marks the AI's part in it. Matter management shows all matters with linked documents, emails, tasks, approvals and conversations, request tracking follows each item's status, and dashboards report demand, cycle time and workload. A legal team can reconstruct what happened to a request, who handled it and when. The data processing addendum adds event logging as a technical measure.
That is a real audit trail. What it does not do is separate machine from human. Nothing says the record shows which matters AI sorted or routed rather than a person, which documents automation generated, or which answers came from the chatbot. A user could not produce an AI use disclosure from it without working that out themselves.