C

Clarilis

Clarilis describes deterministic, template based automation as the gold standard for legal drafting and positions AI Draft as adding to it rather than replacing it. It gives the split: automation takes a draft roughly ninety percent of the way and AI Draft helps with the remaining ten. AI Draft creates new content without changing the content the rules generate, and its FAQ says firms that do not permit generative AI can disable AI Draft in an automation, leaving the rest of the platform unaffected.

What remains with it switched off is the whole product: questionnaire driven assembly of complete document suites, hundreds of maintained templates across four practice areas and five jurisdictions, house style formatting, and the managed service behind it.

There is no accuracy figure, evaluation, test set or error rate on the site. The ninety percent figure that recurs is a time saving claim about the automation, not an accuracy measure. AI Draft writes new contract language and has no authority to cite. The vendor lists what its own AI gets wrong. Users must check AI content for cross references, because the AI does not yet match references to other clauses automatically; for definitions used but not defined elsewhere; and for legal and commercial effectiveness.

The guidance ends by telling users to always treat AI generated content as a first cut. Grounding is described as matter context and codified practice area knowledge from in house lawyers, and how that grounding works is not described.

AI Draft writes new content only where a user invokes a named task, and it cannot change the drafting the automation produced. Review is built into the document itself. Every AI generated clause is highlighted in the delivered Word document, and any document containing AI content carries a notice at the top saying that content needs review. The vendor says AI content is new and, unlike automated content, has not been reviewed in advance, and lists what to check: cross references, use of definitions, and legal and commercial effectiveness.

It calls AI generated content a first cut that still needs expert review. A firm that does not permit generative AI can turn the layer off and keep the automation. Because the marking sits inside the document, it survives export, which a review state inside the platform does not.

Two customers are quoted with organizations attached. Miri Stickland, Head of Knowledge at Forsters, speaks to the risk management benefit of updates being made quickly and consistently behind the scenes. A Head of Knowledge Management at TLT, named by role only, says the solution exceeded expectations on delivery. Both link to individual customer pages, and CMS is named in a vendor blog post about faster drafting for its Scottish real estate team.

Separately, the platform material says the system cuts the time to produce document suites by around ninety percent, and that firms draft suites ninety percent faster, with no firm, date or method attached to either figure. So the named customers carry no measurement and the measurement carries no named customer. A customers section and a case studies section sit in the navigation.

On AI, neither user inputs nor AI responses are used to train the models, processing runs through zero data retention endpoints, and data is processed in region. On the platform, encryption covers data at rest and in transit, and protected links expire and use 256 bit AES. All requests are logged and verified, including IP addresses, and user level checks restrict access to particular document suites and drafts. SAML 2.0 single sign on and optional IP lockdown are offered, and development, testing and production environments are separate.

All staff pass criminal record and eligibility checks, access follows least privilege and is recorded and auditable, and system development is not outsourced. No privilege or work product treatment appears anywhere, on a platform holding transactional drafting for named clients. No customer agreement, master services agreement or data processing addendum is published, so every commitment above sits on a product page rather than in a contract.

The vendor says AI Draft does not replace professional legal judgment, that AI generated content should always be treated as a first cut that still needs expert review, and that automated content is carefully reviewed in advance while AI content is new and has not been. Nothing says Clarilis is not a law firm or that its output is not legal advice. No jurisdiction limit is drawn, although automated content spans England and Wales, Scotland, Ireland, the United States, Canada and Asia Pacific, and nothing addresses a firm's supervision or competence duties.

There is no terms of service on the site where such a statement could sit, so the position rests entirely on a product FAQ and a blog post.

Clarilis says it has signed the Litig AI Transparency Charter, links to it, and describes it as setting out commitments for organizations developing and providing legal AI, promoting responsible innovation while safeguarding ethical and professional standards. The security page adds a responsible AI section with four commitments: clear indicators separating AI from rules based drafting, processing in region through zero data retention endpoints, no use of data for model training, and respect for third party intellectual property rights.

No management system such as ISO 42001 or independent audit of AI governance is published. No accountable owner or function is named, no evaluation regime before release or results are described, and nothing covers uneven output across practice areas or jurisdictions. The ISO 27001 certification concerns information security, not AI governance.

Published controls cover encryption at rest and in transit, protected links that expire and use 256 bit AES, servers behind a firewall with all access encrypted, and separate development, testing and production environments. Data sits on encrypted file systems backed up at least daily, with horizontal scaling and resource monitoring. All requests are logged and verified, including IP addresses, and user level checks limit access to particular document suites and drafts.

SAML 2.0 single sign on comes with optional IP lockdown and configurable lockout. All staff pass criminal record and eligibility checks before hiring, access follows least privilege and is recorded and auditable, and development is not outsourced. Hosting is named as AWS and Azure, and the AI layer uses zero data retention endpoints in region. Regular penetration testing is stated. No retention period is given: the only statement is that the customer has complete control over storage and deletion of data, with no period or process described. No incident notification commitment appears, and there is no agreement for one to sit in.

Nothing published addresses who bears the loss when the product is wrong. The site footer carries two entries, a privacy policy and a sitemap. There is no terms of service, master services agreement, customer agreement or data processing addendum anywhere on the site, so no indemnity, liability cap, warranty position, warranty disclaimer, service level commitment or insurance statement is published. The product produces complete suites of transactional documents through a managed service, and nothing says who carries a defect in a maintained template. No limitation clause of any kind is published.

No integration into the systems a firm runs is published. The platform is web based and delivers finished drafts in Word in the firm's house style, which is a format and a delivery convention rather than a connection. Two named third parties appear and both are identity rather than practice systems: SAML 2.0 single sign on for authentication, and Certivox M-PIN offered as an optional additional security element. No document management system is named anywhere, so nothing addresses iManage or NetDocuments, and no matter management, ebilling, CRM or electronic signature counterparty appears.

No API, developer documentation or integrations page exists in the navigation, which carries platform, AI Draft, security, managed service, partners and working globally.

The AI Draft page says data is hosted in the customer's region via Azure, and the security page says the same for the AI layer: data is processed in region using zero data retention endpoints. The platform serves firms across England and Wales, Scotland, Ireland, the United States, Canada and Asia Pacific, and as a whole is hosted on Amazon Web Services and Microsoft Azure. Nothing says whether the platform is single tenant or multitenant, no dedicated or isolated instance is described at any tier, and no on premises or self hosted option is mentioned.

The nearest thing to a separation statement is a permission control: user level checks restrict access to particular document suites and drafts. That governs users within a customer, not the boundary between customers.

The security page says Clarilis is ISO/IEC 27001:2022 certified by BSI across the entire company and gives the certificate number, IS 677941. That covers the standard, the current revision, the certifying body and a company wide scope, plus an identifier that can be checked against the certifier's register. Regular penetration testing is stated separately on the AI Draft page. No certification date, expiry or surveillance cycle is published.

No report, statement of applicability or summary is published, and there is no trust portal. No other certification is claimed.

In the AI Draft FAQ, the vendor says it prefers OpenAI's model, hosted in Azure. The AI Draft page adds that data is hosted in the customer's region via Azure and processed through zero data retention endpoints. The vendor also says it uses a range of models depending on the drafting task and configures them with practice area knowledge from its in house lawyers, so the supply chain is plural. Its FAQ says OpenAI's model without naming which model or version, and adds that Clarilis is always exploring the latest models to ensure the best outputs.

That says the set will change, and no commitment to notify customers when it does is published. No subprocessor register is published, though AWS and Azure are named as platform infrastructure on the security page.

No pricing information is published at any level, including the unit of charge. There is no pricing page in the navigation (what we do, solutions, customers, about us and resources) or in the footer, which carries only a privacy policy and a sitemap. Every commercial route leads to the same call to action, book a demo. Nothing says whether the platform is licensed per user, template, document suite, matter or firm. Nothing addresses how the managed service is charged; the vendor's own professional support lawyers build and maintain the automation, so implementation is a service engagement rather than a setup task.

No tier names, minimum commitment or term length appears. No terms of service or master agreement is published, so no payment provisions are published either.

Four practice areas have their own product lines with counts and named content. Real estate has over seventy automated templates for commercial investment and letting in England and Wales, plus more than fifty Property Standardization Group documents for Scotland. Corporate has nearly two hundred documents covering share purchase agreements, early stage investments, share reorganizations and business purchase agreements.

Banking and finance covers leveraged and real estate finance facilities, simplified lending, security documents, legal opinions and APLMA based agreements for Asia Pacific. Private client covers wills and estate planning. Engagement letters and in house legal are addressed separately. Jurisdictional reach is stated product by product, with automated suites for Ireland, the United States and Canada, the Canadian content based on CVCA model forms.

Nothing says which practice areas or jurisdictions are not served, no firm size range is given, and no document type is named as one the platform handles poorly.