Consilio

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Machine learning is the engine of several capabilities a client pays for, and the businesses underneath it would carry on without it. Nine AI products are named and separately marketed: Guided AI Review and Native AI Review for responsiveness classification, AI PrivDetect and AI PrivGen for privilege work, AI Summarize, AI Investigate, Aurora Verity Review and the narrative analysis acquired with TrueLaw in June 2025. The models are described as custom-built in house and fine-tuned for legal document classification, with AI PrivGen trained on thousands of court-approved privilege log entries, and the scale claimed around them is real: more than 1,300 analytics engagements a year, over 250 million documents analysed, more than 40 dedicated AI team members. Two things hold it at this band rather than higher. Sightline is a complete eDiscovery and legal hold platform without any of it, and Aurora is a data unification and portfolio management layer whose core promise, freedom from platform lock-in and visibility across matters, is not a machine learning promise. And the AI is delivered wrapped in labour: AI Guides validate the prompts, privilege review experts quality-check every generated description, and the company's own framing is a hybrid in which technology enhances rather than replaces judgement. Graded level with Casepoint on the same reasoning.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is asserted repeatedly and measured nowhere. The claims are specific in language and empty of numbers: descriptions that are accurate, defensible and court-ready, results that are reliable and consistent, documents identified with precision, a system trained on thousands of court-approved privilege log entries so that entries contain all required elements while avoiding common pitfalls. The one figure published is about effort rather than correctness, a reduction in attorney hours of up to seventy per cent on privilege log creation, hedged as what clients report. Searched the Sightline page, the Aurora page, the AI PrivGen page and the privacy policy on 31 Aug 2026 and located no accuracy rate, no recall or precision statistic, no validation protocol, no test set and no error analysis, which is a conspicuous absence for privilege classification, where a false negative discloses a privileged communication and the consequence is not recoverable. Nothing describes grounding either: no citation of the underlying document from a generated log entry, and no retrieval method. The substitute for measurement is people, with privilege review experts providing oversight to ensure accuracy and defensibility, which is a control rather than evidence. One limb does not apply and is neither credited nor penalised: a citator or good-law check is out of scope for a product operating on a client's own collected documents. Eight of the nine AI product pages were not opened and are the rebuttal route.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Human oversight is not a caveat here, it is the delivery model, and it is described with more specificity than most vendors manage. The framing is the AI Trust Gap, and the answer given is a hybrid in which advanced AI is combined with seasoned professionals and guided by human oversight at every step, so that legal teams retain full control. The people are named as roles rather than gestured at: AI Guides bringing three stated types of expertise, review design, legal domain knowledge, and AI prompting and validation, who refine and validate prompts and ensure outputs are relevant and aligned with the matter. AI PrivGen publishes a four-stage flow ending in a named quality assurance step where privilege review experts check generated descriptions before delivery. Aurora adds customer-side control, with AI adopted at the client's own pace and the client choosing which models and review platforms operate on its data. What is not published, checked across those pages and the privacy policy on 31 Aug 2026: no threshold at which a model declines to produce an answer, no confidence or uncertainty signal exposed, no description of what happens when a generated description is wrong, and no correction route. The oversight model is well staffed and undocumented at the point of failure.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Operational scale is published in quantity and customer outcomes are not attributed to anyone. The scale figures are real and specific: more than 1,300 analytics engagements a year, over 250 million documents analysed, more than 120 review managers trained on the AI suite, over 40 AI team members, upwards of 210 terabytes ingested monthly, more than 7,000 servers, over 30,000 matters hosted and fifteen or more data centres. Those describe the vendor rather than what changed for a client. On the customer side there is one figure, a reduction in attorney hours of up to seventy per cent on privilege log creation, attributed only to what clients report, with no named organisation, no matter, no date and no method. Searched the Sightline page, the Aurora page, the AI PrivGen page and the site navigation on 31 Aug 2026 and located no named customer anywhere. Two artifacts make the gap concrete rather than theoretical. The customer success section of the flagship AI product page still carries its unfilled template instruction, reading as a headline highlighting customer results with a direction to emphasise time saving and use numbers to maximise credibility. And the Sightline page's expert section renders roughly one hundred cards all reading Full Name and Job Title. A case study library exists and was not opened, which is the rebuttal route.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Confidentiality is asserted clearly and in general terms, and the document that would bind it is not published. What is published is not nothing. The privacy policy states that all client data is treated as confidential whether it includes personally identifiable information, protected health information or simply non-public information, and that Consilio's handling policies keep data and devices protected from unauthorised access while in its possession, supported by strict access control policies, network segregation between internet-facing and sensitive storage segments, and background screening of all employees and contractors. The AI PrivGen page goes directly at privilege, stating that privileged content never leaves Consilio's secure environment and that attorney-client confidentiality is maintained, with processing on private data centres rather than public cloud. What is missing is the whole contractual layer. No terms of service, master agreement or data processing addendum is published anywhere on the property, so there is no readable commitment on training with client material, no matter or client segregation model, no ethical wall description, and no work product treatment. The privacy policy itself narrows the point, stating that Consilio acts primarily as data processor for client services, which places the operative terms in client contracts a buyer cannot read in advance. Checked the full footer inventory on 31 Aug 2026.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Nothing published addresses the advice line, and there is no document on the property that would carry it. The footer inventory is privacy policy, privacy rights requests, anti-slavery statement, cookies policy, cookies preference manager and a PAIA manual. There is no terms of service, no disclaimer page and no professional responsibility statement, so nothing states that output is not legal advice, that no attorney-client relationship arises with Consilio, or where responsibility sits when a generated privilege description proves wrong. No bar or ethics authority is named anywhere, including ABA Formal Opinion 512. The exposure is sharper here than for a pure software vendor, because Consilio's own reviewers and privilege experts exercise legal judgement on client matters as part of the service, and the published material describes that arrangement warmly without addressing the professional responsibility questions it raises. One thing does exist and is recorded rather than credited: a supervision and competence posture is published, in that human oversight is promised at every step and technology is said to enhance rather than replace critical legal judgement. That is a statement about how the work is done, not about who answers for it. Checked the Sightline, Aurora and AI PrivGen pages and the privacy policy on 31 Aug 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Principles and a staffing model are published; a governance framework a buyer could audit is not. The published material is organised around the AI Trust Gap, and it names ethical concerns and the absence of clear governance frameworks as an industry problem Aurora is meant to answer, with the answer given as expert oversight, client choice over which models run, and processing on private infrastructure. Two compliance statements sit in the privacy policy and are the closest thing to a mechanism: the right not to be subject to a decision based solely on automated processing is recited, and Consilio states that it complies with applicable CCPA and CPPA requirements including those relating to risk assessments, cybersecurity and automated decision-making technologies. Beyond that, searched the Sightline, Aurora and AI PrivGen pages and the privacy policy on 31 Aug 2026 and found no responsible AI page, no accountable owner for model behaviour, no pre-release testing regime, no model documentation and nothing at all on bias or uneven output. The gap has an edge on this product: models that classify responsiveness and privilege determine which documents a reviewing lawyer ever sees, and uneven performance across custodians, languages or document types is the question, unaddressed. A chief information security officer is named as a role, for security rather than for AI.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

The privacy policy carries a substantial safeguarding section that covers most of this ground, which matters more than usual here because it is the only substantive published document on the property. Certifications are stated with the holding entity distinguished: Consilio is certified to ISO/IEC 27001:2022 and HITRUST CSF, its collocated data centres are certified to either ISO 27001 or SOC 2 Type 2, and its UK data centre and offices hold Cyber Essentials Plus. Named controls follow: a chief information security officer heading the security team, enterprise policies reviewed by management, a vendor management programme requiring vetting and periodic security audits of suppliers, network segregation using a DMZ and multiple firewalls between internet-facing segments and sensitive storage, intrusion detection and prevention, third-party monitoring, background screening of all employees and contractors, an incident management policy, disaster recovery and business continuity policies, and a backup policy specified as data replication plus daily incremental and weekly full backups. A list of current third-party suppliers is published at a stated public URL. What is absent: no retention period for anything, since the Data Retention and Disposal Policy is named but not published and is obtainable only by email; no deletion commitment for client data; and no breach notification timeframe, the incident policy being described rather than published. Policy updated 17 Aug 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Nothing is published on who bears the loss when the system is wrong, because no customer agreement of any kind is published. The footer legal inventory was read in full on 31 Aug 2026 and consists of a privacy policy, a privacy rights request portal, an anti-slavery statement, a cookies policy, a cookies preference manager and a PAIA manual. There is no terms of service, no master services agreement, no service level agreement, no data processing addendum and no acceptable use policy. In consequence nothing states a liability cap, an indemnity in either direction, a warranty on the software or on generated output, an insurance position, a limitation period, a governing law or a forum. A buyer evaluating this vendor cannot read the allocation of risk in advance at any level, and the only route to it is a negotiated contract. The contrast within this category is the useful measure rather than the criticism: Casepoint, read the same day, publishes a complete standard agreement including a dedicated clause on AI inputs and outputs, a stated cap, named carve-outs and a seventy-two hour breach notification. Consilio hosts more than thirty thousand matters across fifteen or more data centres and publishes none of it.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Integration is the product rather than a feature, and the named connections are to competitors, which is unusual and creditable. Aurora is described as platform-agnostic and deliberately upstream of review, integrating with multiple review platforms and naming Relativity, Relativity Server, Everlaw and Sightline, with the stated purpose of freeing an organisation from single-vendor lock-in so it can select the optimal platform for each matter. Supporting mechanics are named: enhanced auto-loaders and data mapping capabilities that reduce processing volumes, and a version of AI Investigate built for Relativity Server so the AI reaches data held in a third-party platform. On collection, Aurora is said to connect with an organisation's data sources from email servers and cloud storage to collaboration platforms and enterprise systems. What is missing is depth and specificity. No individual data source is named, only categories; no document management system, matter management, e-billing or filing integration is named; no API or developer documentation was located; and nothing describes what moves in which direction or what a client must configure. Checked the Sightline, Aurora and AI PrivGen pages and the navigation on 31 Aug 2026; the technology partners page was not opened and is the rebuttal route.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The deployment model is stated plainly and repeatedly, and it is the company's central differentiator rather than a technical footnote: everything runs on Consilio's own private hosted infrastructure and not on the public cloud, a point made on the Sightline page, the Aurora page and the AI PrivGen page alike, with the argument that privileged content never reaches a public cloud provider. The estate is quantified at more than fifteen global data centres, over seven thousand servers and more than thirty thousand matters hosted, with offices and data centres across North America, Europe and Asia. Residency is addressed in part: Aurora promises complete data sovereignty in the client's chosen jurisdiction, its UK and European launch is stated to be hosted in Consilio's UK data centre with GDPR and UK data protection compliance, ITAR compliance is claimed, and cross-border transfer is handled through an intra-company data transfer agreement incorporating the EU Standard Contractual Clauses and the UK Addendum. What is not published: no list of the data centre locations, so a buyer cannot check which jurisdictions are actually available; no tenancy model; and no distinction between where data is stored and where processing or model inference happens. Read 31 Aug 2026.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

The certifications are real, current and stated with unusual care about which entity holds what, and there is no security page or trust centre anywhere to put them in. What is claimed: Consilio itself certified to ISO/IEC 27001:2022 and HITRUST CSF; its collocated data centres certified to either ISO 27001 or SOC 2 Type 2, which is a meaningful distinction most vendors blur, since the SOC 2 attaches to the facilities rather than to Consilio; UK data centre and offices certified under Cyber Essentials Plus; ITAR compliance; and certification to the EU-US Data Privacy Framework with the UK Extension and the Swiss-US Framework, lodged with the US Department of Commerce and independently verifiable on the public Data Privacy Framework register, with JAMS named as the recourse provider and the Federal Trade Commission named as having jurisdiction. That last item is the one attestation a buyer can confirm without asking. Against it: no security page exists, so all of this sits inside a privacy policy; no auditor is named; no scope, coverage period or report date is given for the ISO or HITRUST certifications; and no route is published for obtaining any report. Footer inventory checked in full on 31 Aug 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The vendor says the models are its own and stops there. What is published: AI algorithms described as custom-built and developed in house, hosted on Consilio's private cloud; models fine-tuned for legal document classification; AI PrivGen models described as specifically trained on legal privilege concepts and on thousands of court-approved privilege log entries, which is more than most vendors say about training data; and TrueLaw's technology integrated following the June 2025 acquisition. What a buyer cannot establish: whether any third-party foundation model sits beneath the fine-tuning, and if so whose; no model name, version or provider anywhere; no inference location stated as distinct from the data residency claims; and no notice commitment on model change. One unreconciled tension belongs in the record. The AI product pages say the models are custom-built in house, while Aurora is marketed on letting clients leverage AI models they choose and avoiding lock-in to proprietary models, which implies third-party models in the stack. Nothing published reconciles the two. A list of current third-party suppliers is published at a stated URL and was not opened on 31 Aug 2026; it is the most likely place for a provider name and is the rebuttal route.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level, including the unit of charge, and no pricing page exists. The full primary navigation covering solutions, expertise, technology, resources and about, and the complete footer, were read on 31 Aug 2026: there is no pricing entry in either. No rate, no unit, no tier or package names, no volume band, no term length and no statement of what implementation or managed review adds. Every call to action across the Sightline, Aurora and AI PrivGen pages is a demo request or a contact form. The one place pricing appears at all is as an argument about other vendors: Aurora's marketing states that public-cloud platforms trap legal teams in rigid contracts with annual price hikes of eight to twenty per cent, and offers complete cost visibility across a portfolio as the remedy. A platform sold substantially on controlling and making visible the buyer's legal technology spend publishes nothing about its own.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is documented across several dimensions with real substance, and nowhere states a limit. Practice areas are enumerated as litigation and arbitration, global investigations, antitrust and competition, cyber incident response, corporate transactions, and risk and compliance. Industries are enumerated separately as financial services, pharmaceutical and life sciences and healthcare, insurance, transportation and mobility, consumer brands, and technology. Service lines run to eight, including eDiscovery, analytics and AI, document review, risk management and compliance, talent, cyber incident response, data forensics and investigations, and legal transformation. Product-level coverage is more specific still, with Sightline published against regulatory response, cyber incident response, data subject access requests, early case assessment, PII and PHI detection and review, multimedia review, small matters and investigations, and AI PrivGen against complex litigation, multi-party matters, regulatory investigations and mergers and acquisitions. The buyer types are named as multinational law firms, corporations and government organisations, and the site is published in nine locales. What is absent is any boundary: no practice area or data type is identified as unsupported, no jurisdictional limit is stated, and no matter size threshold appears, though a distinct Small Matters module implies the range is deliberate. Checked 31 Aug 2026.