C

Conga CLM

The models are the engine of a core capability layered on a product that would function without them, which is B and is the vendor's own architecture. AiMe is described as a shared AI layer running across the whole commercial suite, connecting workflow data across CPQ, CLM, price optimisation and document automation and suggesting next steps, rather than as the CLM itself. Underneath sits a full contract lifecycle platform that long predates it: template and clause-library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting.

Strip AiMe out and a working CLM remains, which is precisely what the Salesforce-based edition was for years. What is recorded on the other side, because it is moving: the June 2026 platform release is described as AI-enhanced throughout, bulk import and extraction is presented as the way contracts enter the system at all, and the March 2026 AiMe release adds agents that act inside quoting and contracting workflows. The direction is toward the models becoming the product, and the record says so, but the platform is still sold and priced as a contract system with intelligence on top. Verified 12 September 2026.

Grounding is real and documented, short of any accuracy figure an outsider could test, which is B. R15 governs the inapplicable limbs: the product cites no legal authority, so authority grounding and citation-status checking do not bite and are not counted against it. What does bite is grounding and measurement, and the grounding disclosure is stronger than most in this lane. The pipeline is named component by component on the trust centre: Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing, which tells a reader how a clause becomes an assertion.

Output is grounded in the customer's own repository, playbook and clause library, extraction is described as requiring no model training by the customer, and the vendor states that AiMe surfaces how every recommendation is generated with the reasoning visible to the user and a confidence score shown wherever it makes a suggestion. Accuracy is addressed only as a disclaimer: the Artificial Intelligence Addendum states that outputs may be inaccurate, incomplete or misleading and disclaims all warranty as to accuracy or completeness.

No figure, test set, error rate or published benchmark result was located; third-party models are said to be benchmarked before release and no results are published. Verified 12 September 2026.

Modes, constraints, review surfaces and the route back to human judgement are all published, which is the A band, and most of it is contractual rather than marketing. What the system runs alone is stated as a boundary: AiMe never acts autonomously on high-stakes decisions. What constrains it is named as three specific mechanisms, agent guardrails, approval thresholds, and human-in-the-loop confirmation, each of which can be built into a workflow, which is the threshold limb answered in the product's own idiom rather than dodged.

The review surfaces are real and are the strongest part: the vendor states that AiMe surfaces how every recommendation is generated, that users see the reasoning behind AI-driven actions, and that a confidence score is shown wherever AiMe makes a suggestion, alongside redlines a user accepts or rejects and a complete audit trail of every action and approval. The route back to human judgement is contractual: the Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs, states that the customer shall not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, requires appropriate human review and independent judgment, places authorising and supervising agent actions on the customer, and records that the features are intended to support and not replace human decision-making.

One limit is recorded rather than credited: the guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI-generated outputs. Verified 12 September 2026.

A named customer without figures, which is the B band's stated shape. The published customer-story library carries dated, named accounts, and one of the three surfaced on the index page is on this product: Cotality, formerly CoreLogic, described as elevating its client service capabilities with Conga CLM, dated 5 September 2024. The other two dated stories name DigiKey on price management, dated 27 April 2026, and Kalixia at 160 times faster document generation, dated 19 March 2025, and neither is the contracting product, so they are recorded rather than credited here.

Around that sit customer logos on the product and pricing pages, Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz, which under the C band would stand in for evidence if they were all there was. What keeps the row off A is measurement and attribution together. The CLM story carries no figure. The figures that are published sit apart from any named customer: a 9 per cent revenue increase claimed beside the logo strip with no basis stated, an AI-assisted review claim of 50 per cent less review time on the features page, and three headline counters on the product page that render as zeros.

Analyst placement, G2 Leader recognition across five grids with first rankings for enterprise usability and relationships, is recorded and not credited, since analyst placement is not deployment evidence. Verified 12 September 2026.

Four of the five A limbs are met contractually and one is absent, and R33 makes the absent one decisive. Training use is addressed in the Artificial Intelligence Addendum rather than on a policy page: Conga shall not use AI Inputs or AI Outputs to train or improve any AI or machine learning model beyond the limited licence to provide, maintain or improve the Services for that customer's benefit; Customer Data shall not be used to train global or foundational models serving multiple customers; and no third party may use Customer Data or AI Output to train, fine-tune, validate, test or otherwise develop any model.

Segregation at the level an in-house buyer needs is documented: tenant environments are logically separated with dedicated encryption keys per tenant. Retention and deletion are stated in the Data Processing Addendum, which limits retention to the duration absolutely necessary and requires return and deletion at the customer's election after the agreement ends. The position on third-party model providers is explicit and unusually detailed: prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI, are not used to improve OpenAI models and are not used to improve Microsoft or third-party products, and a zero-retention arrangement is stated with each document-processing provider.

The limb that fails is privilege and work product, which is addressed nowhere on any surface read. On a product sold to legal departments to hold their agreements, that silence is the whole distance to A. Verified 12 September 2026.

A real published position on advice versus tooling, short of the supervision and competence dimension, which is B. The position is contractual and specific rather than a website disclaimer: the Artificial Intelligence Addendum states that AI-generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, makes the customer solely responsible for evaluating and validating outputs before use, and then draws the line that matters here, that the customer shall not rely on AI-generated outputs as the sole basis for any decision that may have legal, financial, regulatory or other material impact, and that appropriate human review and independent judgment should be exercised.

It extends the same allocation to agentic behaviour, making the customer responsible for determining whether agent actions are appropriate and for authorising and supervising them. C does not fire: the audience is named across published function pages, the marketing does not describe the product in advice terms, and the clause is not boilerplate. What is missing for A is the lawyer's own side. Nothing published addresses how a supervising lawyer discharges competence or oversight duties over AI-drafted contract language, nothing states which of the named buyer groups may use which capability, and no jurisdictional limit appears anywhere.

That last gap is sharper than usual on a product marketed to sales and procurement users generating contract positions in the same tenant as legal. Verified 12 September 2026.

A published governance framework with real substance, short of testing results, which is B, and it sits at the top of that band. The substance is documented and contractual, not a principles page. The Artificial Intelligence Addendum records a cross-functional AI Governance Committee responsible for oversight of AI within the Services with a focus on risk management, accountability and compliance, which periodically reviews AI-related risks, controls and mitigation measures including data protection, security and appropriate human oversight.

It commits Conga to internal policies for the ethical and responsible use of AI covering oversight of training data, bias mitigation and human interpretability, to personnel training on responsible development and deployment, and to full cooperation with a customer's own AI impact assessments and transparency obligations. Governance is anchored to a named external framework, the NIST AI Risk Management Framework, by its four core functions of Govern, Map, Measure and Manage.

The vendor also publishes its own regulatory classification, stating that its products qualify as minimal or limited risk AI systems under the EU AI Act, and states that third-party models undergo testing, bias auditing and benchmarking before release with rollback to any prior model version available within hours. What holds it off A is the limb the band names: no results are published. No bias audit finding, evaluation output, model card or statement about uneven performance across contract types or drafting conventions was located anywhere. Verified 12 September 2026.

Retention, deletion, access control, subprocessors and incident practice are all published, current and specific enough to hold the vendor to, which is the A band, and every limb rests on a document a buyer can read before signing. Retention: the Data Processing Addendum states that retention of personal data should generally not be required and that any retention is limited to the duration absolutely necessary to perform the Services, with daily backups retained for thirty days, and a zero-retention arrangement stated with each third-party document-processing provider.

Deletion: return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer able to delete within the Services and assistance where it cannot, and a prompt-compliance obligation on deletion requests under the CCPA attachment. Access control is documented control by control: role-based authorisation, least privilege, quarterly access reviews, joiner-mover-leaver revocation, VP-level approval for access escalation, multi-factor authentication, managed firewalls, host-based intrusion detection, encryption at rest and TLS at 256-bit or stronger in transit, per-tenant encryption keys, and no customer data on laptops or removable media.

Subprocessors: a published list, fifteen days' notice before appointing a new one, a right to object with a termination and refund remedy, flow-down obligations, and Conga liable for subprocessor acts as if performing them itself. Incident practice: notification within 48 hours of becoming aware under the DPA, a documented response plan with root-cause analysis, and a 24/7 security team. Verified 12 September 2026.

Liability for what the AI produces is addressed only by disclaiming it, which is the C band, and here the disclaimer is unusually explicit rather than buried in a general limitation. The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, regarding the accuracy, completeness, non-infringement or fitness for a particular purpose of any AI-generated output, that the customer is solely responsible for evaluating and validating outputs, and then that, to the maximum extent permitted by applicable law, Conga shall not be liable for any losses, damages or claims, including third-party claims, arising from the customer's use of, reliance on, or actions taken based on AI-generated outputs or actions performed by agentic AI capabilities.

That is the question this axis asks, answered in the negative and in terms. One genuine allocation runs the other way and is recorded: the Data Processing Addendum makes Conga liable for the acts and omissions of its subprocessors to the same extent as if it had performed the services directly, which matters given how much of the AI pipeline sits with third parties. A limit on this reading is stated plainly: the Master Services Agreement itself was not opened, so the general liability cap, indemnity scope and any insurance position are not established, and a reading of it could move this row.

It would have to reverse the Addendum to do so, and the Addendum is the instrument that governs the AI question. Verified 12 September 2026.

Real integrations, named and documented, short of the depth an implementer could work from, which is B. The named connections are substantial and several are structural rather than bolt-on. The product exists in two forms, one of which runs natively on the Salesforce platform and is listed on the Salesforce AppExchange, which is about as deep as a CRM integration gets. Authoring and review run inside Microsoft Word and Google Docs, Microsoft Dynamics is named on the product page, and the vendor states the platform edition connects to any CRM, ERP or procure-to-pay system.

Inside Conga's own estate the connections are described functionally: pricing, terms and configurations from CPQ flow automatically into a contract, documents are generated through Composer and signed through Conga Sign, and price optimisation feeds contract pricing. Supporting surfaces exist and are named, a product documentation site at documentation.conga.com and a developer hub at developer.conga.com. What is not established is depth.

Neither the integrations page nor the developer hub was opened, no field-level mapping or sync direction is published on the surfaces read, and the recurring claim of connecting to any CRM or ERP describes reach without describing what moves. Under R25 those two surfaces would corroborate and could lift this row; they are named here as published and unread. Verified 12 September 2026.

Deployment model is stated clearly with partial residency detail, which is B, and the model side is fully answered. Two delivery forms are published and distinguished: the original Salesforce-based application, and a full software-as-a-service edition on the Conga Advantage Platform introduced to give buyers a CLM interface independent of Salesforce. What changes between them is published and material rather than cosmetic, and it is in the agreement: the Data Processing Addendum states that for services hosted on the Salesforce platform Conga does not back up customer data and there is no recovery point objective, against daily backups retained thirty days and a one-hour recovery point objective with a twenty-four hour recovery time objective elsewhere.

Infrastructure is named, Salesforce, Amazon Web Services and Azure, with data stored on servers managed by Salesforce and AWS, and tenant environments logically separated with dedicated encryption keys. Residency is where it falls short of A. Availability is described as multi-region across the United States, the European Union and Asia-Pacific with residency options included, which names continents rather than regions; no region list or menu is published, nothing states which region a given tenant lands in or how a buyer chooses, and where processing happens is not distinguished from where data is stored.

The AI path is the sharpest instance: content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and no surface states where any of that runs. Verified 12 September 2026.

Certification is real, named and scoped, and the evidence behind it is not reachable without a customer relationship, which is B at the top of the band. A genuine trust centre exists, is ungated and is linked from the site navigation. The standards are named individually rather than displayed as a badge wall: SOC 2 Type II with a stated scope of full platform coverage and audited annually, ISO 27001, ISO 27701 described as the privacy extension to it, PCI DSS, HIPAA Security with annual audits, GDPR, CCPA, alignment to the NIST AI Risk Management Framework, and certification under the EU-US Data Privacy Framework, which is the one item a reader can independently verify because the Data Processing Addendum points to the public Department of Commerce list.

The programme behind them is documented: annual third-party penetration testing, biannual application vulnerability assessment, continuous automated threat hunting, static and dynamic code analysis before release, a severity-based patching service level, background checks, annual security training, and a published vulnerability disclosure programme. Two things hold it off A. No auditor is named, no report period, observation window or certificate number is published for any standard, and no report is carried on the trust centre itself.

The route to the evidence is the Data Processing Addendum, which makes reports available on the customer's request subject to confidentiality, so a prospective buyer cannot read the scope of what was audited before contracting. Verified 12 September 2026.

The supply chain is disclosed further than anything else in this lane and stops one limb short of A, which is B under R34. Providers are identified individually and by function, not gestured at: generative features run on Microsoft Azure OpenAI, and the document-processing agents additionally use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each named with what it does and each under a stated zero-data-retention arrangement.

Where the models run is stated, which few records manage: the Azure OpenAI Service is described as fully controlled by Microsoft, with Microsoft hosting the models in its own Azure environment and the service not interacting with any system operated by OpenAI, and the consequences are spelt out, that prompts, completions, embeddings and training data are tokenised in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third-party models.

Change notification is contractual and specific: the AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before any new subprocessor is appointed, with the name, location and activity disclosed, a right to object, and termination with a refund if no workaround is available. The limb that fails is the first one. No model is named. The addendum's closest approach is a parenthetical reference to Azure OpenAI GPT, which is a family rather than a version, and no surface states which model generates a summary or a redline or when that changes. Verified 12 September 2026.

No pricing information is published at any level, including the unit of charge, which is the D band and is the plainest instance of it in this lane. The pricing page exists, is linked from the top-level navigation, and carries no price, no band, no term, no tier table, no feature-by-tier comparison, no unit of charge, no minimum, no statement of whether the product is licensed per user, per contract or per platform, and no indication of what implementation adds.

What it does carry is a heading, a paragraph saying that every business is unique and that the vendor provides clear details about product options and associated costs, a list of six things the pricing is said to prioritise, one of which is Transparency, two customer logo strips, and a quote request form. That is a page which invites a sales conversation and nothing else, which R10 identifies as an absence rather than as structure, and it is why no VendorPricing row is written for this record.

The nearest thing to a published tier anywhere on the estate is a line on the platform page inviting the buyer to add CLM Advanced features such as a clause library, version control and redlining, which names one upgrade and three features on a product page; it is recorded here for completeness and is not pricing information. Commercial terms are not published either: the Master Services Agreement was not opened, so payment terms, renewal, uplift caps and termination rights are not established from any surface read. Verified 12 September 2026.

Segment coverage is described with real substance and the boundaries are left open, which is B. Who the product serves is published as its own navigation tier with seven named functions, Legal, Procurement, Sales, Finance, IT, Business Operations and Pricing, each with a page of its own, and the CLM material addresses legal, sales and procurement side by side with a different task list for each: legal gets workflow, authoring, AI reviewing and redlining, contract compliance and risk management, procurement gets obligation management, AI-extracted terms and pricing, and sales gets generation, AI-assisted negotiation and renewals.

Industry coverage is enumerated across seven pages, technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution, and a process tier organises the same estate by contracting stage. The published customer base bears the breadth out across airlines, insurance, media, retail and property data. What is left open holds it off A. No practice area inside a legal department is named as supported or unsupported, no statement of what the product is not for appears anywhere, nothing distinguishes which capabilities are available to a non-lawyer user in a shared tenant, and there is no jurisdictional or language coverage statement despite the product being sold and localised into German and French. Verified 12 September 2026.