DataGuard

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Machine learning sits at the edges of a conventional compliance management platform. The substance of what is bought is a policy and control library, a risk register with pre-built treatment plans, an asset inventory, framework templates for ISO 27001, GDPR, NIS2, TISAX and the EU AI Act, evidence collection, and the statutory privacy workflows: record of processing, data subject requests, impact assessments and breach management. Strip the models out and all of that still functions, which is what the platform was before AI. Where AI actually appears is visible in the published plan comparison rather than in the marketing: an **AI co-pilot** listed as a feature line under Admin and Access Controls, and an **AI-assisted questionnaire processing tool for administrative support** under Trust Management, available only with the advanced security platform. AI-powered automation is named as a platform pillar included from the Base tier and the headline claim is up to forty per cent of tasks automated. That is a real layer and it is not the mechanism being sold. Recorded as a limit on this grade rather than glossed: the dedicated AI-Powered Automation page returned navigation and one line of body text, so the detail of the capability could not be read; the grade rests on the plan comparison table, which is explicit about where AI sits.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Not yet assessed.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Oversight is the explicit selling proposition and no mechanism is described. The published model is experts-in-the-loop: automate when you want it, get expert help when you need it, with certified consultants stepping in for complex decision-making and strategic review, and a dedicated platform page for the concept. That is a genuine position and it is unusual for being sold as a paid tier rather than asserted as a design principle. But the humans in that loop are **DataGuard's consultants, not the customer's own reviewers**, and access to them is what separates the Pro plan from Base, so on the Base plan the oversight described is simply absent from the purchase. Nothing published identifies a review point inside the product, no confidence or uncertainty signal is described against AI output, nothing states which automated actions require approval before taking effect, and nothing addresses what happens when the co-pilot is wrong in a record that later supports a certification audit. The dedicated Experts-in-the-Loop page was not opened in this pass.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Scale is asserted at corporate level and every performance figure is disclaimed by the vendor itself. The published claims are specific: more than 4,000 organisations across 50 or more countries, up to forty per cent of tasks automated, certification and compliance seventy-five per cent faster, fifty per cent lower costs, compliance reached in as little as three months, and a hundred per cent first-try pass rate on certification. Third-party standing is real and independently checkable, with G2 category leadership badges for Data Privacy Management across Europe, EMEA and the United Kingdom, a Consent Management high performer badge, a 4.6 rating on both G2 and Capterra, and a Gartner Peer Insights listing. What undercuts the numbers is DataGuard's own footer, which appears on every page: **all data provided is for information only, based on internal estimates, not indicative of KPIs, and given without warranty as to accuracy or reliability.** The vendor is telling a reader not to rely on its own figures, which is candid and leaves the outcome claims without a stated basis. No named customer was read; the Success Stories page was not opened in this pass.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Confidentiality is evidenced through security posture rather than through a readable commitment about customer content. What is located and solid: a trust centre publishing an ISO 27001 Statement of Applicability and reports available on request, single sign-on and granular user permissions as published plan features, an Admin and Access Controls feature group, and a company operating from Munich under German and EU data protection law selling data protection compliance as its business. What is not located is the substance this axis measures. Nothing readable states whether customer content is used to train models, no retention or deletion position for customer data was found, and no model provider is identified. **The limit is mine and is stated rather than converted into a finding**: the privacy policy and the separate platform privacy policy both returned navigation and footer with no body across three fetch attempts on two URLs, while the home and pricing pages rendered normally, so this is page-specific rather than a site property. The commitments may well exist in those documents; they could not be read on 4 September 2026 and are not credited either way.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

No position on advice versus tooling was located, on a product that sells a regulated advisory role. This matters more here than on most records because of what is actually being offered: an add-on under which the customer **nominates DataGuard as its external Data Protection Officer**, a role with statutory duties and independence requirements under Articles 37 to 39 of the GDPR, alongside an equivalent external Information Security Officer offering and consultants providing information and advice on regulatory obligations and certification requirements. Nothing published addresses where the tooling stops and advice begins, whether the platform's guided workflows and template libraries constitute advice, how the independence of a nominated DPO is preserved when the same company also sells the compliance platform being assessed, or what the customer remains responsible for. Searched the home page, pricing page, product overview, trust centre and the published Consent and Preference Management documentation on 4 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Not yet assessed.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Two limbs are answered and the rest could not be read. Access control is published as product substance rather than assertion, with single sign-on, granular user permissions and a dedicated Admin and Access Controls feature group in the plan comparison, plus role-based permissions reported in the platform's feature set. A trust centre exists at trust.dataguard.com, publishes an ISO 27001 Statement of Applicability and reports, and states its own access route plainly: documents are requested by entering an email address and the team reviews requests within 24 hours. Beyond that the set is unestablished. No retention period, no deletion commitment, no subprocessor list and no incident or breach notification practice for DataGuard's own processing was located, which is a conspicuous gap on a vendor whose product sells incident and breach management to others. As on the confidentiality axis, the reason is stated rather than dressed as an absence: both privacy policies returned no body text across three attempts, and the trust centre's Controls section did not render.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No customer agreement is published anywhere on the site, and this rests on an established page inventory rather than on a failed fetch. The footer carries exactly four legal links: Privacy Policy, Legal Notice, Cookie Policy and Trust Center. The Legal Notice is the Impressum that German law requires of any commercial website and does not govern the customer relationship. There are no terms of service, no general terms and conditions or AGB, no master subscription agreement, no service level document and no acceptable use policy in the navigation, the footer or anywhere else in the site map. No indemnity, liability cap, warranty, uptime commitment or insurance position could therefore be located. A buyer evaluating a platform that will hold its record of processing, its breach register and its certification evidence, and that may supply its nominated Data Protection Officer, has nothing to read on allocation of loss before entering a sales conversation. Checked the full navigation and footer across four rendered pages on 4 September 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Named integrations with documentation an implementer could work from, scoped to one module. The published developer documentation covers the Consent and Preference Management product and names its integrations individually with setup guides for each: Salesforce, HubSpot and Microsoft Dynamics for CRM; Braze, Brevo, Mailchimp and Salesforce Marketing Cloud for marketing automation; Auth0 and Ping Identity for identity; Snowflake for data warehousing; FormAssembly, Formstack and WordPress Contact Form 7 for forms. Alongside those sit a documented REST API with an OpenAPI reference and Postman collection, webhooks, bulk data export, import and deletion endpoints, embeddable JavaScript widgets, native and webview mobile integration paths, and single sign-on via Azure Active Directory, SAML and OpenID Connect. Two limits hold this below the top band. The documentation covers the consent module only, which is sold as an add-on rather than as the core platform, and it sits on a separate domain carrying the branding of an acquired product, last updated November 2024. The main platform's own Integrations page was not opened in this pass.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery is implied throughout and neither the tenancy model nor a region is stated. European positioning is heavy and consistent, with the company describing itself as the European leader in security and compliance software, operating from Munich, and marketing secure hosting and infrastructure built to meet strict GDPR requirements. None of that is a residency statement: no country, region or data centre is named for where customer data is stored or processed, and secure hosting built for GDPR describes an intention rather than a location. The nearest the published material comes is an enterprise-tier reference to multinationals needing region-specific configurations, which describes a configuration capability rather than a residency option a buyer could select. Nothing states whether the platform is single or multi-tenant, no dedicated or private deployment is offered at any tier, and no separation is drawn between where data sits and where any AI processing happens.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

A real trust centre with a self-serve access route, short of the naming a top grade needs. The portal at trust.dataguard.com renders, is publicly linked from the site footer, and states its own access mechanism plainly, which is the thing most portals leave ambiguous: documents are requested by clicking the document and entering an email address, requests are reviewed by the team typically within 24 hours, and anything not listed can be requested by email. That is a self-serve request fulfilled without a sales conversation rather than a form promising an account executive, which is the distinction that earns credit. One artifact is named specifically and is DataGuard's own ISMS document rather than a badge: an **ISO 27001 Statement of Applicability**, alongside a Resources section listing Reports. What is missing from the top band: no certifying body or auditor is named, no certificate number, scope or observation period is published, no date or validity period appears, and the Reports entry is generic so a buyer cannot tell which reports exist before asking. The Controls section of the portal did not render.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Not yet assessed.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

Unusually detailed package structure with no figure and no unit of charge anywhere. What is published is genuinely useful: three named tiers with stated audiences, Base as the platform alone for teams with internal expertise, Pro adding hands-on access to in-house experts, Enterprise for complex multi-entity needs; a feature comparison running across roughly fifteen areas covering ISMS documentation, training, risks, controls, vendor management, assets, trust management, admin controls, onboarding, expertise, the annual security programme and information security officer support; explicit markers showing which capabilities require the advanced platform or a dedicated expert; and seven named add-ons that establish what costs extra, including consent management, cookie management, whistleblowing, global legal analysis, exposure management, external Information Security Officer and external Data Protection Officer. A buyer can therefore work out precisely what is in and out of each tier. What no buyer can learn is what any of it costs, or even how it is metered: every tier and every route resolves to Get a quote, and no figure, band, range or charging unit appears anywhere. Nothing states whether pricing runs per seat, per entity, per framework or per employee.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is described by regulatory framework and by company size, and the buyer this index cares about is never addressed. The framework dimension is precise and is the product's real organising principle: GDPR and UK GDPR, ISO 27001, NIS2, TISAX and the EU AI Act, each with its own page, with multi-entity and multi-framework operation named as a capability and 4,000 organisations across 50 or more countries claimed. The segmentation dimension is thin and revealing. **The Solutions menu contains exactly two entries, DataGuard for SMEs and DataGuard for Corporates**, so the only buyer axis the vendor publishes is headcount. No legal, in-house counsel, data protection officer or compliance function page exists, no role is addressed by title anywhere, and no case study was read that would identify who inside a customer owns the tool. That absence is what makes the membership screen turn on function rather than on the buyer surface, and it is recorded here because it is also a coverage finding: a reader of this index cannot learn from DataGuard's own material whether the legal department is the intended owner.