C

CosmoLex

A mature conventional platform carries a recent, narrow AI layer. The base is a complete product on its own: matter management, calendaring and tasks, document storage, time capture, billing, a client portal, and the built in trust and general accounting that most customers give as their reason for choosing it. None of that needs a model, and all of it predates the AI by years. The AI arrived in August 2026 as four named features, all shipped: AI Intake with a form builder, document summarization that pulls out key terms, obligations, deadlines and action items, and natural language filtering across the customer's own records.

CosmoLex describes them as extending its existing approach to intake and everyday administrative work, not as a reinvention. Without the models, a working practice management and accounting system remains.

Nothing addresses accuracy, and the feature where it matters most extracts deadlines. No accuracy figure, benchmark or evaluation is published for any AI feature, nothing describes how a summary is grounded in the underlying document or how a user traces an extracted item back to its page, and hallucination is not mentioned. The AI material is entirely about data handling, not output quality: the published questions and answers cover encryption, training, processing location and matter isolation, and none asks whether the output is right.

That matters here because the summarization feature is marketed as extracting deadlines and action items from pleadings, correspondence and discovery, and a missed or misread deadline is the classic malpractice event. The 2019 subscription agreement disclaims warranties of data accuracy.

No oversight model is published for any AI feature. Nothing says what a lawyer must review before relying on a document summary, whether extracted deadlines go to the calendar automatically or are proposed for confirmation, what happens to an item the system is unsure about, or where a person sits in the intake flow. CosmoLex's launch language leans toward autonomy, describing AI Intake as capturing client data and moving every intake forward without anyone touching it, presented as the benefit.

The subscription agreement predates the AI features by seven years and has no review obligation, no acceptable use provision covering generated output and no allocation of responsibility for acting on it. The one related statement is a caution, not a control: it advises firms to review their own professional responsibility obligations in their jurisdiction.

Many customers are quoted, with almost no attributable outcomes. About seventeen people are quoted across CosmoLex's pages, most with a full name and a state or province, spanning Virginia, Louisiana, Pennsylvania, Utah, Ontario, Alberta, British Columbia and Quebec. One gives an employer, a paralegal at Ramos Law. The quotes describe experience rather than measure it, and only one gives a number: a user who spends about a third of the time they did before.

Scale is asserted without attribution as thousands of small to midsize firms across North America. One outside endorsement is substantive: CosmoLex says the Canadian Bar Association selected it as its exclusive preferred practice management software. The headline efficiency claim is labeled candidly: 18 or more hours returned each week and a 15.3 times return are footnoted as modeled from third party research for a firm of five to ten attorneys, with results varying. A model is not a deployment result.

Four elements are addressed, and separation is answered directly. CosmoLex says AI summaries and outputs are limited to individual matters, so the system working on one matter cannot surface or reference information from another, and it says the isolation is designed to preserve attorney client privilege. Under that sit the platform's own controls: permissions and privilege settings for each matter, predefined roles including Administrator, Billing Only and Matter Owner, and matter owner limits on who can see documents.

On training, the AI material says documents are never used to train external AI models. Section 9 of the subscription agreement sets a mutual confidentiality regime in which the subscriber's Confidential Information expressly includes its client information, and section 9.5 takes breaches by personnel and subcontractors outside the liability limit. Two gaps remain: no model provider is named, and no retention period is stated for anything during the term.

One general pointer exists and nothing else. The home page, the practice management, document management, security and pricing pages, and the subscription agreement and its exhibits carry no statement that output is not legal advice, no account of what a user must verify, and no jurisdictional statement. The unauthorized practice question largely does not apply, since practice management and accounting software gives no legal advice.

Professional responsibility does apply, in two ways CosmoLex writes about at length on its own blog: trust accounting is governed by detailed rules whose breach draws bar discipline, and the AI now extracts deadlines from litigation documents. Neither is tied to any published guidance. The only statement is in the AI questions and answers, advising that, as with any technology, firms should review their own professional responsibility obligations in their jurisdiction. It names no rule, authority or jurisdiction.

No governance material is published: no responsible AI page, framework or principles, no person or function accountable for model behavior, no account of what is tested before an AI feature or model change ships, and no certification such as ISO 42001. The published AI material covers only data handling (encryption, training, processing location and matter isolation) and says nothing about how the models behave or how that is checked.

Nothing addresses uneven output across document types, practice areas or drafting styles, which matters for a summarizer that will meet everything from a two page retainer to a discovery production. A dedicated AI practice management page is linked in the site footer.

The security page carries real specifics, and the agreement backs several of them. Encryption is stated in transit, with 256 bit SSL, and at rest, and backups run automatically every few hours, stored encrypted in several locations. Access control is described at two levels: infrastructure controls, and security levels, roles and access privileges assigned to users, with two factor authentication by SMS. Incident practice is contractual: section 8 of the subscription agreement commits CosmoLex to report any unauthorized access promptly on discovery and to use diligent efforts to remedy the breach, while the cost of notifying affected individuals falls on the firm.

Section 13.3 gives thirty days after termination to retrieve everything before CosmoLex may irrevocably delete it. Data centers are stated to be in North America, in the United States or Canada depending on the firm's location, and core support staff are in the United States. Two things are missing: no subprocessor or vendor is named, and no retention period is stated for anything during the term.

A complete and fairly balanced allocation is published, in an agreement that predates every AI feature by seven years. Section 20 caps total liability at twelve months of fees but carves out CosmoLex's indemnity and its confidentiality obligations entirely. Section 19 excludes consequential damages with the same two carve outs, so confidentiality exposure is uncapped. Section 17 gives the customer an intellectual property indemnity with a defined series of remedies ending in termination, a refund of prepaid fees and return of data in a database format.

Section 15 is a real warranty rather than a bare disclaimer, covering reasonable efforts on uptime, freedom from material defects and conformity to the descriptions on the site, with prompt correction as the remedy. Section 9.5 takes breaches caused by CosmoLex's own personnel or subcontractors outside the security liability limit. The weakness is age, not content: the agreement is dated 19 June 2019, names CosmoLex Cloud, LLC as the contracting party under a ProfitSolv Purchaser, Inc. copyright line, and says nothing about artificial intelligence, generated output or model providers.

Many systems are named, including the ones that matter for this kind of product. Document storage integrates with NetDocuments, Box, Dropbox, OneDrive and Google Drive, so a firm with an established legal document management system can keep it. Microsoft 365 and Outlook are named, with LexShare and LexSign working inside Outlook for secure sending and signature collection. QuickBooks Online and Zapier appear on the pricing page as standard.

Exhibit B of the subscription agreement names Groupdocs Signature and HelloSign in the signature path, with Appointlet, Adobe and DocuSign licensed separately. Section 7.5 expressly allows API use, with a published quota of 1,000 calls per user license per month. No connector list or developer reference is published, nothing says what data flows in which direction for any named system, and the depth of each integration is not stated.

Two pages describe residency differently. The security page says all data is stored in United States data centers and that core support teams are in the United States and subject to its jurisdiction. The trust accounting page says data is stored in North America and, depending on the firm's location, may be held in a data center in the United States or Canada. The second fits the separate Canadian site the company runs, but it is not clear which page governs, and no page sets out the placement rule.

No cloud provider is named (Exhibit B refers only to a cloud provider based in the United States), no tenancy or isolation model is described at infrastructure level, and no region choice is offered. One AI statement helps: AI processing happens inside the customer's CosmoLex environment rather than being sent to an outside service.

A named standard, a stated cadence and a named assessor are claimed, with no document behind any of them. SOC 2 Type 2 certification is claimed on the security page and repeated on the pricing page as standard on all plans, and the infrastructure is said to be examined and pass inspection every twelve months. An independent threat assessment of the code and architecture perimeter is attributed to Phalanx Secure Solutions, Inc. No auditor is named for the SOC 2 work, no report period, issue date or scope is published, there is no trust center or portal, and there is no route to request a report.

Section 8 of the subscription agreement commits CosmoLex to publish on its site, for subscribers to review, any third party audit reports on data security, and no such report appears on the site.

Where processing happens is stated clearly; what does the processing is not. CosmoLex says all AI processing occurs within the customer's secure CosmoLex environment, and data does not leave it to be processed by an outside service. Read with the statement that documents are never used to train external AI models, that implies no third party model provider sits in the path for these features. But no model, version or provider is named.

Nothing says whether the model is built in house, licensed and self hosted, or reached through a cloud provider's own service, three very different answers to the question a firm's client would ask. No subprocessor list exists in the agreement or elsewhere, and no commitment covers notice of a change in the model set. A dedicated AI practice management page is linked from the site.

Detailed unit pricing is published in the agreement; the subscription price is not stated in the published text. Exhibit B of the subscription agreement is a real rate card for usage charges. Local call tracking costs three cents a minute and toll free five; SMS costs three cents and MMS four; extra local tracking numbers cost three dollars a month and toll free numbers five. Task routing is five cents a route and electronic signature a dollar a request.

Each user license includes 2,500 emails a month, with overage at two cents, and 1,000 API calls a month. Voice and messaging need a fifty dollar minimum prepaid balance. The trial terms are specific: ten days, no credit card, full functionality except a single bank feed connection, with the CRM and signature add ons excluded. The pricing page is headed plans and pricing and lists what every plan includes plus four named add ons.

The buyer segment is stated consistently, and little else is bounded. Small and midsize law firms are named repeatedly as the intended customer. CosmoLex addresses solo practitioners leaving larger firms, and offers multiuser support, role based access and advanced financial reporting for midsize teams with higher case volumes. Geographic coverage is shown: separate United States and Canadian offerings, data residency in either country depending on firm location, an exclusive preferred software designation from the Canadian Bar Association, and quoted users in four Canadian provinces and four American states.

Practice and boundary detail is missing. No practice area is named, no firm size band is given in numbers, and nothing says what the product does not cover, including whether the trust accounting rules it enforces are set per jurisdiction. The site navigation has a practice type section.