C

Consilio

Machine learning drives several capabilities a client pays for, and the businesses underneath would carry on without it. Nine AI products are named and separately marketed, including Guided AI Review and Native AI Review for responsiveness classification, AI PrivDetect and AI PrivGen for privilege work, AI Summarize, AI Investigate, Aurora Verity Review and the narrative analysis acquired with TrueLaw in June 2025. The models are described as built in house and fine tuned for legal document classification, with AI PrivGen trained on thousands of court approved privilege log entries.

The scale claimed around them is large: more than 1,300 analytics engagements a year, over 250 million documents analyzed and more than 40 dedicated AI team members. Sightline is a complete eDiscovery and legal hold platform without any of it. Aurora's core promise, freedom from platform lock in and visibility across matters, is not a machine learning promise. The AI is also delivered wrapped in labor: AI Guides validate the prompts, privilege review experts check every generated description, and the company frames the work as a hybrid in which technology enhances rather than replaces judgment.

Accuracy is asserted repeatedly and measured nowhere. The claims are specific in language and empty of numbers: descriptions that are accurate, defensible and court ready, results that are reliable and consistent, and a system trained on thousands of court approved privilege log entries. The one figure published concerns effort rather than correctness, a reduction in attorney hours of up to seventy percent on privilege log creation, hedged as what clients report.

The Sightline, Aurora and AI PrivGen pages and the privacy policy, searched, show no accuracy rate, recall or precision statistic, validation protocol, test set or error analysis. That absence is conspicuous for privilege classification, where a false negative discloses a privileged communication and cannot be undone. Nothing describes grounding either, with no citation of the underlying document from a generated log entry and no retrieval method.

The substitute for measurement is people: privilege review experts provide oversight to ensure accuracy and defensibility, which is a control rather than evidence. Eight of the nine AI product pages were not opened and may say more.

Human oversight is the delivery model here, and it is described with specificity. The framing is the AI Trust Gap, and the answer given is a hybrid in which advanced AI is combined with seasoned professionals and guided by human oversight at every step, so that legal teams retain full control. The people are named as roles. AI Guides bring three stated types of expertise, review design, legal domain knowledge, and AI prompting and validation, and they refine and validate prompts so outputs fit the matter.

AI PrivGen publishes a four stage flow ending in a quality assurance step where privilege review experts check generated descriptions before delivery. Aurora adds control on the customer side, with AI adopted at the client's own pace and the client choosing which models and review platforms operate on its data. Those pages and the privacy policy, checked, publish no threshold at which a model declines to answer, no confidence signal, no description of what happens when a generated description is wrong, and no correction route. The oversight model is well staffed and undocumented at the point of failure.

Operational scale is published in quantity, and customer outcomes are not attributed to anyone. The scale figures are specific: more than 1,300 analytics engagements a year, over 250 million documents analyzed, more than 120 review managers trained on the AI suite, over 40 AI team members, upwards of 210 terabytes ingested monthly, more than 7,000 servers, over 30,000 matters hosted and fifteen or more data centers. Those describe the vendor rather than what changed for a client.

The one customer figure is a reduction in attorney hours of up to seventy percent on privilege log creation, attributed only to what clients report, with no named organization, matter, date or method. No named customer appeared on the Sightline, Aurora or AI PrivGen pages or in the site navigation on 31 August 2026. The customer success section of the flagship AI product page still carries its unfilled template instruction, asking for a headline highlighting customer results with numbers to maximize credibility.

The Sightline page's expert section renders roughly one hundred cards all reading Full Name and Job Title. A case study library exists and was not opened, so it may say more.

Confidentiality is asserted clearly and in general terms, and the document that would bind it is not published. The privacy policy states that all client data is treated as confidential, whether it includes personally identifiable information, protected health information or simply nonpublic information. It says handling policies keep data and devices protected from unauthorized access while in Consilio's possession, supported by strict access control policies, network segregation and background screening of all employees and contractors.

The AI PrivGen page states that privileged content never leaves Consilio's secure environment and that attorney client confidentiality is maintained, with processing on private data centers rather than public cloud. The contractual layer is missing. No terms of service, master agreement or data processing addendum is published, so there is no readable commitment on training with client material, no client or matter segregation model, no ethical wall description and no work product treatment.

The privacy policy states that Consilio acts primarily as data processor for client services, which places the operative terms in client contracts a buyer cannot read in advance.

Nothing published addresses the advice line, and no document on the site would carry it. The footer inventory is a privacy policy, privacy rights requests, an antislavery statement, a cookies policy, a cookies preference manager and a PAIA manual. There is no terms of service, disclaimer page or professional responsibility statement. Nothing states that output is not legal advice, that no attorney client relationship arises with Consilio, or where responsibility sits when a generated privilege description proves wrong.

No bar or ethics authority is named anywhere, including ABA Formal Opinion 512. The exposure is sharper than for a pure software vendor, because Consilio's own reviewers and privilege experts exercise legal judgment on client matters as part of the service, and the published material does not address the professional responsibility questions that raises. A supervision and competence posture is published: human oversight is promised at every step, and technology is said to enhance rather than replace critical legal judgment. That describes how the work is done, not who answers for it.

Principles and a staffing model are published; a governance framework a buyer could audit is not. The published material is organized around the AI Trust Gap. It names ethical concerns and the absence of clear governance frameworks as an industry problem, and answers with expert oversight, client choice over which models run, and processing on private infrastructure. The privacy policy recites the right not to be subject to a decision based solely on automated processing.

It also states that Consilio complies with applicable CCPA and CPPA requirements, including those on risk assessments, cybersecurity and automated decision making technologies. The Sightline, Aurora and AI PrivGen pages and the privacy policy, searched, show no responsible AI page, no accountable owner for model behavior, no prerelease testing regime, no model documentation and nothing on bias or uneven output. Models that classify responsiveness and privilege determine which documents a reviewing lawyer ever sees, and uneven performance across custodians, languages or document types is left unaddressed. A chief information security officer is named, for security rather than for AI.

The privacy policy carries a substantial safeguarding section that covers most of this ground, and it is the only substantive document published on the site. Certifications are stated with the holding entity distinguished. Consilio is certified to ISO/IEC 27001:2022 and HITRUST CSF, its collocated data centers to either ISO 27001 or SOC 2 Type 2, and its UK data center and offices hold Cyber Essentials Plus. Named controls include a chief information security officer, enterprise policies reviewed by management, a vendor management program with supplier vetting and periodic security audits, and network segregation using a DMZ and multiple firewalls.

They also include intrusion detection and prevention, third party monitoring, background screening of all staff and contractors, incident management, disaster recovery and business continuity policies, and daily incremental and weekly full backups. A list of current third party suppliers is published at a stated public URL. No retention period is published, since the Data Retention and Disposal Policy is named but obtainable only by email. There is no deletion commitment for client data and no breach notification timeframe. Policy updated 17 August 2026.

Nothing is published on who bears the loss when the system is wrong, because no customer agreement of any kind is published. The footer legal inventory was read. It consists of a privacy policy, a privacy rights request portal, an antislavery statement, a cookies policy, a cookies preference manager and a PAIA manual. There is no terms of service, master services agreement, service level agreement, data processing addendum or acceptable use policy.

Nothing therefore states a liability cap, an indemnity in either direction, a warranty on the software or on generated output, an insurance position, a limitation period, a governing law or a forum. A buyer cannot read the allocation of risk in advance at any level, and the only route to it is a negotiated contract. Consilio hosts more than thirty thousand matters across fifteen or more data centers and publishes none of it.

Integration is the product rather than a feature, and the named connections are to competing platforms. Aurora is described as platform agnostic and deliberately upstream of review, integrating with Relativity, Relativity Server, Everlaw and Sightline. Its stated purpose is to free an organization from lock in to a single vendor so it can select the optimal platform for each matter. Supporting mechanics are named: enhanced autoloaders and data mapping that reduce processing volumes, and a version of AI Investigate built for Relativity Server so the AI reaches data held in a third party platform.

On collection, Aurora is said to connect with an organization's data sources, from email servers and cloud storage to collaboration platforms and enterprise systems. No individual data source is named, only categories. No document management, matter management, electronic billing or filing integration is named, no API or developer documentation is published, and nothing describes what moves in which direction or what a client must configure.

Checked the Sightline, Aurora and AI PrivGen pages and the navigation; the technology partners page was not opened and may say more.

The deployment model is stated plainly and repeatedly as the company's central differentiator. Everything runs on Consilio's own private hosted infrastructure and not on the public cloud, a point made on the Sightline, Aurora and AI PrivGen pages alike, with the argument that privileged content never reaches a public cloud provider. The estate is quantified at more than fifteen global data centers, over seven thousand servers and more than thirty thousand matters hosted, with offices and data centers across North America, Europe and Asia.

Residency is addressed in part. Aurora promises complete data sovereignty in the client's chosen jurisdiction, and its UK and European launch is stated to be hosted in Consilio's UK data center with GDPR and UK data protection compliance. ITAR compliance is claimed, and transfers across borders run through an intracompany data transfer agreement incorporating the EU Standard Contractual Clauses and the UK Addendum. No list of data center locations is published, so a buyer cannot check which jurisdictions are available. There is no tenancy model and no distinction between where data is stored and where model inference happens.

The certifications are real and current and stated with care about which entity holds what, and there is no security page or trust center to put them in. Consilio itself is certified to ISO/IEC 27001:2022 and HITRUST CSF. Its collocated data centers are certified to either ISO 27001 or SOC 2 Type 2, so the SOC 2 attaches to the facilities rather than to Consilio. The UK data center and offices hold Cyber Essentials Plus, and ITAR compliance is claimed.

Consilio is certified to the EU-US Data Privacy Framework with the UK Extension and the Swiss-US Framework, lodged with the US Department of Commerce and verifiable on the public register, with JAMS named as the recourse provider and the Federal Trade Commission as having jurisdiction. That is the one attestation a buyer can confirm without asking. All of this sits inside a privacy policy. No auditor is named, no scope, coverage period or report date is given for the ISO or HITRUST certifications, and no route is published for obtaining any report.

The vendor says the models are its own and stops there. The models are described as custom built and developed in house, hosted on Consilio's private cloud, and fine tuned for legal document classification. AI PrivGen models are described as trained on legal privilege concepts and on thousands of court approved privilege log entries, and TrueLaw's technology was integrated following the June 2025 acquisition. A buyer cannot establish whether any third party foundation model sits beneath the fine tuning, and if so whose.

No model name, version or provider appears anywhere, no inference location is stated apart from the data residency claims, and there is no notice commitment on model change. The AI product pages say the models are custom built in house, while Aurora is marketed on letting clients use AI models they choose and avoiding lock in to proprietary models, which implies third party models in the stack. Nothing published reconciles the two. A list of current third party suppliers is published at a stated URL and was not opened; it may say more.

No pricing information is published at any level, including the unit of charge, and no pricing page exists. The full primary navigation covering solutions, expertise, technology, resources and about, and the complete footer, were read: there is no pricing entry in either. No rate, no unit, no tier or package names, no volume band, no term length and no statement of what implementation or managed review adds. Every call to action across the Sightline, Aurora and AI PrivGen pages is a demo request or a contact form.

The one place pricing appears at all is as an argument about other vendors: Aurora's marketing states that public-cloud platforms trap legal teams in rigid contracts with annual price hikes of eight to twenty percent, and offers complete cost visibility across a portfolio as the remedy. A platform sold substantially on controlling and making visible the buyer's legal technology spend publishes nothing about its own.

Coverage is documented across several dimensions with real substance, and nowhere states a limit. Practice areas are enumerated as litigation and arbitration, global investigations, antitrust and competition, cyber incident response, corporate transactions, and risk and compliance. Industries are enumerated separately as financial services, pharmaceutical and life sciences and healthcare, insurance, transportation and mobility, consumer brands, and technology.

Service lines run to eight, including eDiscovery, analytics and AI, document review, risk management and compliance, talent, cyber incident response, data forensics and investigations, and legal transformation. Product-level coverage is more specific still, with Sightline published against regulatory response, cyber incident response, data subject access requests, early case assessment, PII and PHI detection and review, multimedia review, small matters and investigations, and AI PrivGen against complex litigation, multi-party matters, regulatory investigations and mergers and acquisitions.

The buyer types are named as multinational law firms, corporations and government organizations, and the site is published in nine locales. What is absent is any boundary: no practice area or data type is identified as unsupported, no jurisdictional limit is stated, and no matter size threshold appears, though a distinct Small Matters module implies the range is deliberate.