DISCO

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are the engine of a core capability layered on a platform that would function without them. DISCO Ediscovery is a cloud native platform covering the EDRM with upload, search, review and production, sold on speed and architecture, and it predates the generative layer: Cecilia AI was released in 2023, roughly a decade after the company was founded. What the models drive is substantial rather than peripheral, which is why this is not a C: Cecilia Q&A, Auto Review performing first pass review at scale, Doc Summaries, Timelines, and an agentic multi step reasoning engine. Fourth ediscovery record and the third B on this axis, distinguishing all three from Reveal, which was graded A because its platform was assembled around acquired model capability rather than having a model layer added to it.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is documented as a hard constraint and measurement exists without being independently checkable. Grounding is stated in absolute terms rather than as a claim about quality: Cecilia Q&A returns an answer crafted only from the customer's evidence, with citations always included, and Agentic Cecilia provides explanations of the logic, reasoning and citations to underlying documents every time. Auto Review gives a written explanation for each individual tag suggestion, so a reviewer sees why a classification was made per document. Figures are published: an Am Law 50 firm evaluating Auto Review on a specific issue tag achieved 92 percent recall and precision with a 97 percent total agreement rate, and the vendor claims performance metrics above industry standards. Those are the right metrics for review classification and they are specific. What holds this off an A is that the evaluating firm is unnamed, the evaluation is undated, and no methodology is published, so an outsider cannot check or reproduce it. Recorded as vendor reported customer results rather than as independent measurement.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A real published commitment with an unusually explicit autonomy control, short of thresholds. The distinctive element is that autonomy is user selectable rather than fixed: Agentic Cecilia offers Quick thinking and Advanced research modes and the vendor tells the customer to choose depending on need, so the depth of autonomous multi step reasoning is a decision the user makes per task. Review surfaces are concrete and per document: written explanations for each tag suggestion in Auto Review, and explanations of logic, reasoning and citations for every agentic answer. Prompts for Auto Review are crafted in collaboration with the vendor's ediscovery experts rather than left to the user alone. The vendor also positions the AI as a check on human work, suggesting it be used to verify the accuracy of review performed by human reviewers, which is an inversion worth recording. Not located as of 29 Aug 2026: any threshold at which an agentic run stops or escalates, and what the vendor commits to when an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

The strongest adoption evidence in the ediscovery category, on a materially better evidence class than marketing copy. Because the operator is a Nasdaq listed company, adoption figures appear in a regulated annual filing rather than on a web page: 1,549 customers including 330 large customers, and a 98 percent dollar based net retention rate as at 31 December 2025. A retention figure of that kind is a stronger signal of whether a product works in production than any testimonial, and it carries securities law consequences if wrong. Outcome figures are also published, though from an unnamed customer: an Am Law 50 firm reduced a first pass issue tag review from a traditional 1,000 hours to under 24 hours using Auto Review, with 92 percent recall and precision. Short of an A because no customer is named, the evaluations are undated, and no assessable method accompanies the outcome figures.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive published commitments with the training limb answered plainly, short of the other two. Training is addressed at the layer that matters and in the right direction: the vendor states the language models used in Cecilia AI are not permitted to train on customer data, and separately that confidential data is never sent to train another company's model. That is a contractual constraint on the providers rather than a description of the vendor's intentions. Supporting controls are published: full encryption in transit and at rest, SOC 2 Type 2 covering security, availability and privacy, ISO 27001, and GDPR compliance with the regulated filing detailing EU GDPR, UK GDPR and CCPA obligations and EEA and UK to US transfer mechanisms. Two gaps hold this off an A. No retention or deletion terms were located. No segregation model between users or matters was located, which matters for a platform holding entire document universes and marketed to firms handling multiple concurrent matters.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The audience is professional and the position is unstated. Users are corporate litigation teams, Am Law 200 firms and government legal teams, with no consumer surface located, and the product analyses collected evidence rather than giving advice, so the advice line question arises less sharply than for a research or drafting tool. Searched the offerings pages, the Cecilia and agentic Cecilia pages, the resources index and the security pages on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties as professional obligations, and no jurisdiction limits. Worth recording as adjacent rather than credit: Auto Review prompts are crafted in collaboration with the vendor's own ediscovery experts, which places vendor personnel inside the customer's review methodology, and nothing published addresses how that interacts with the supervising lawyer's responsibility for the review.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Risk is acknowledged in a regulated filing without a governance framework being published. The annual filing discusses AI related operational and regulatory risks explicitly alongside cybersecurity, data privacy compliance and reliance on third party model and cloud providers, which is a real acknowledgement that carries legal weight and is more than a marketing page would give. Per document explanations for every tag suggestion and per answer reasoning are genuine transparency mechanisms built into the product. Searched the offerings pages, the Cecilia and agentic Cecilia pages, the security pages and the resources index on 29 Aug 2026 and located no published AI governance framework, no AI principles document, no AI management certification such as ISO 42001, no named owner of model governance, no pre release testing regime, and nothing on uneven output across matter types, parties or populations. For a product performing autonomous first pass classification at 25,000 documents an hour, the absence of any published position on differential performance is the gap this axis exists to mark.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Substantive published policy covering most of the ground, with the control framework enumerated rather than asserted. The vendor names its security control categories individually: Communications Security, System Acquisition, Development and Maintenance, Supplier Relationships, Information Security Incident Management, Business Continuity Management, and Compliance. Naming incident management and supplier relationships as standing control categories is more than most records here provide. Also published: SOC 2 Type 2 audited annually across security, availability and privacy, ISO 27001 certification, third party penetration testing, full encryption in transit and at rest, and AWS hosting with a stated design goal of minimising data footprint. The regulated filing adds cross border transfer mechanisms for EEA and UK to US data movement. Not located as of 29 Aug 2026: a stated retention period or deletion control for customer data, prompts or Cecilia outputs, and a named subprocessor list.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Searched the offerings pages, the Cecilia and agentic Cecilia pages, the security pages, the resources index and available summaries of the annual filing on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer agreement or master terms was located on the surfaces reached. Recorded as a pure absence on those surfaces. Worth recording precisely because this operator is publicly listed and therefore discloses more than a private company must: analysis of the annual filing notes that contractual remedies and insurance coverage are areas future filings should clarify, which indicates the question is open in the regulated disclosure as well as on the marketing surfaces. Rebuttable with one link to published terms.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real integrations exist, are named individually, and cover both directions a litigation platform needs. Collection and hold integrations are named: Microsoft 365 and Google Workspace, with legal hold policies, notifications and audit trails integrated into both, plus cloud storage platforms. Migration in is addressed explicitly and unusually, with tools to ingest or convert data from other discovery systems including Relativity, Eclipse and Excel, which lowers the switching cost the platform's competitors rely on. The vendor also describes horizontal SaaS partnerships across platforms enterprise and legal teams already use. Not located as of 29 Aug 2026: a consolidated integrations index page, per integration documentation of what moves in which direction and what an administrator configures, and any legal document management connector.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery and the hosting provider are stated, and residency is not offered. AWS is named as the hosting infrastructure, with the vendor stating the platform was designed from the outset to operate in the cloud and integrates with AWS to improve security, minimise data footprint and enhance privacy controls. Cloud native architecture is a stated performance position rather than only a delivery model. What is missing is customer choice: searched the offerings pages, the security pages and the resources index on 29 Aug 2026 and located no named regions, no customer selectable residency, no tenancy model, and no on premises or private deployment option. The regulated filing identifies cross border data transfers as among the highest operational risks and details EEA and UK to US transfer mechanisms, which indicates processing concentrated in the United States and is recorded here because it bears directly on residency.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real, named, and stated with scope and cadence, short of auditor and report access. SOC 2 Type 2 is named with the audit cadence stated as annual and the trust services criteria enumerated as security, availability and privacy, which is precise. ISO 27001 is named with its scope stated as the technical and operational delivery of the service offering, and stating what a certificate actually covers is something almost no record on this index does. Third party penetration testing is stated alongside the certifications, and GDPR compliance is claimed with the regulated filing noting that maintaining certifications including ISO 27001 is a key dependency. Not located as of 29 Aug 2026: the SOC 2 coverage period, the named auditing firm for either certification, a report request route, and any trust portal.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The terms binding the model providers are disclosed and the providers are not named. Published: the language models used in Cecilia AI are not permitted to train on customer data, and confidential data is never sent to train another company's model, which tells a buyer that third party models are in the path and what constrains them. AWS is named as the hosting infrastructure. The regulated filing acknowledges reliance on third party cloud providers and software as a standing risk. Searched the offerings pages, the Cecilia and agentic Cecilia pages, the security pages and the resources index on 29 Aug 2026 and located no named model or provider, no statement of where the generative processing runs relative to the platform, no subprocessor list, and no commitment to notify customers when the supply chain changes.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

The pricing model is disclosed without a rate, and the disclosure comes from a regulated filing rather than a marketing page. The operator states in its annual filing that it revised its pricing model in 2026 to usage based, which tells a buyer the unit of charge is consumption rather than seats, a materially different commitment for an ediscovery platform where data volume drives cost and where unpredictable bills are the standing complaint of the category. Searched the offerings pages, the resources index and the security pages on 29 Aug 2026 and located no pricing page, no rate, no published unit definition and no tier structure. Recorded at C on the strength of the published pricing model, and short of higher because a buyer still cannot estimate cost from anything published.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Segment coverage is described with substance and quantified through the regulated filing. Segments named: corporate litigation teams, Am Law 200 law firms, and government, the last with a dedicated product overview for DISCO Ediscovery for Government. Scale is quantified precisely rather than claimed, at 1,549 customers including 330 large customers as at 31 December 2025. Practice coverage spans the EDRM end to end across five named products covering hold, request, ediscovery, review and case building, with published practice specific material including a paper on AI for intellectual property litigation. Not located as of 29 Aug 2026: firm size segmentation below the Am Law 200 tier, jurisdictional or language coverage stated as such, and any statement of what the platform is not built for.