D

Docusign CLM

Docusign CLM is a workflow and document system at its core: generation from templates, a clause library, a drag and drop workflow designer with more than 100 preconfigured steps for generation, review, approval, signature and storage, and a repository with reporting. That system dates from SpringCM, which Docusign agreed to buy in 2018, before generative AI was part of it. AI now drives several core functions. More than 100 pretrained models extract and report on contract data points and legal topics.

AI-Assisted Review flags nonstandard clauses and suggests redlines against a playbook. Generative features summarize agreements, draft clauses on request and answer questions about the repository. Docusign brands the engine Iris and describes it as trained on decades of contract data. Workflows can start from analytics, risk scores and contract content, so extraction feeds routing as well as search.

Docusign describes Iris as delivering accurate, secure and trusted agreement intelligence. Its AI Trust page says AI outputs have been tested for accuracy, and that diverse datasets and checks are used to correct skewed outputs before release. No figure, error rate, test set or evaluation method is published for CLM extraction, AI-Assisted Review or agreement summaries. The quantified claims on the review product are time savings, such as 72 to 80 percent saved on contract reviews, with no stated baseline.

Section 6.2 of the AI Attachment for Docusign Services, version 8 July 2026, says that given the probabilistic nature of machine learning the AI may produce output that is incorrect, and places review for accuracy on the customer. The product works from the customer's own contracts and clause library rather than from law, and nothing published describes how a summary or an answer links back to the clause it came from.

Section 6.2 of the AI Attachment makes the customer responsible for reviewing and evaluating AI output, including through human review, for accuracy and suitability. The AI Trust page says the customer has the final say to approve outputs. In the product, AI-Assisted Review suggests edits and flags risky language for a reviewer to accept or reject, and CLM workflows send agreements with nonstandard terms to review under conditional rules the customer sets.

Every action sits in an audit trail of who did what and when, with version control across drafts. Workflows can also be triggered automatically by analytics, risk scores and contract content. Nothing published sets out what an AI step may do without a person, at what confidence an extraction is held for review, or what happens after an AI output is found to be wrong.

The CLM page carries four named customer stories, each with figures and a named, titled speaker. T-Mobile Wholesale cut agreement time by 44 percent without adding headcount, with 1.8 times faster cycle time on high value agreements, quoted by Janet Sutherland, Senior Manager of Sales Enablement. Genuine Parts Company runs more than ten use cases across five departments, quoted by Keith McCarraher, Special Projects Manager.

Vestwell reports agreement packages built in 5 minutes instead of 75 and 70 percent fewer drop offs, quoted by its COO, Jon Mark. iCIMS reports that 78 percent of its agreements need no legal involvement, quoted by Courtney Dutter, Deputy General Counsel. The page also states a 449 percent return on investment, an 85 percent reduction in errors and 2,200 enterprise CLM customers, without naming the study or the customers behind those figures. No story gives a deployment date or a measurement method.

Under the Docusign Master Services Agreement, version 14 November 2022, Customer Data stays owned by the customer (3.1), confidential information may be used only for the purpose given and protected with at least reasonable care (11.1), and liability for a breach of confidentiality sits outside the twelve month fee cap (10.2). The AI Attachment treats AI output as Customer Confidential Information. Training is the other side of it.

Section 4.1 of the AI Attachment grants Docusign a perpetual license to use CLM customer data and AI output, once anonymized and aggregated, to train models, and section 4.2 lets the customer switch that off going forward with a toggle in the product. Section 4.3 of the MSA separately lets Docusign use deidentified usage data, including for training. Within a customer account, CLM folder security limits who sees which contracts. Privilege and work product are not addressed in the agreements or on the product pages.

Section 6.2 of the AI Attachment states that neither Docusign, the AI Services nor AI output provide the customer with legal advice, that suitability for any purpose is at the customer's sole discretion, and that the customer reviews output for accuracy, including through human review. The statement sits in the contract that governs CLM's AI features rather than in a site footer. CLM is sold to sales, procurement, human resources and customer experience teams as well as legal, and AI-Assisted Review proposes redlines and drafts clauses for any of those users.

Nothing published addresses who in a customer reviews an AI redline before it reaches a counterparty, how the product supports a lawyer's competence and supervision duties, or any limit by jurisdiction.

Docusign publishes AI Trust and AI Innovation Principles pages for Iris, the engine behind CLM's AI features. The AI Trust page lists encryption in transit and at rest, consent based training on aggregated and anonymized data, diverse datasets and checks to correct skewed outputs before deployment, content filtering for harmful outputs, and adoption of frameworks such as the NIST AI framework. Section 6.1 of the AI Attachment adds a warranty that, to Docusign's knowledge, it holds sufficient permissions for the data used to train its own models, defined as customer data authorized for that use, publicly available data and licensed data.

No person, committee or team is named as accountable for model behavior, no ISO/IEC 42001 certification appears, and no test results are published, including on whether output differs across contract types, languages or regions. The AI Trust page says broader AI Trust capabilities are available through sales.

The Service Schedule for Docusign CLM, version 15 September 2025, stores documents for the subscription term or until the customer deletes them, and lets an account administrator set a different retention and deletion schedule (3.1). Retrieval is free during the term and available for 90 days after it through professional services, after which Docusign may delete the account and its documents (3.2). The Data Protection Attachment, version 4 September 2024, commits to notice of a data breach without undue delay, with its nature, likely consequences and the measures taken, and to deletion of personal data on request.

Docusign's subprocessor list, last updated 18 September 2026, has its own CLM section naming each hosting and AI supplier with locations, with updates through an RSS feed and objections by email. Agreement contents are encrypted at rest, and folder security controls access inside an account. Section 4.1 of the AI Attachment lets Docusign keep training data derived from customer content after termination with no duty to delete it, and nothing states what Microsoft or Google keep from prompts.

The Master Services Agreement, version 14 November 2022, warrants that the services perform substantially as documented, with repair, replacement, or termination and a prorated refund as the remedy (8.1). Docusign indemnifies the customer against third party claims arising from its breach of confidentiality and from intellectual property infringement (9.1). Liability is capped at fees paid for the service in the twelve months before the first event, with no cap on indemnity obligations, confidentiality breaches, gross negligence or willful misconduct (10.2).

The AI Attachment narrows this for AI. Section 6.2 disclaims all warranties on AI output, says Docusign is not liable for output to the extent it includes customer data, and removes the indemnity where a claim arises from the customer's data, its own modifications or output it knew to infringe. Nothing in the agreements covers loss from an extraction or redline that is wrong, and no insurance is published.

Docusign names CLM integrations with Salesforce, for generating documents and running workflows across Salesforce Customer 360; SAP Ariba, for creating supplier agreements, ingesting third party paper and tracking workflow tasks from Ariba; and Coupa, with contracts created or updated in either system. Slack carries review notifications and actions, comments sync between Microsoft Word, Google Docs and CLM, AI-Assisted Review runs inside Word, and Docusign eSignature is built in.

The CLM API in the Docusign Developer Center offers object, task and content APIs for Salesforce and custom applications, and Docusign Monitor, sold as an extra on top of CLM, reports CLM event activity, including through Splunk. Docusign University runs courses on building custom CLM integrations. No document management system used by law firms, such as iManage or NetDocuments, is named, and the product pages do not say which fields move in which direction for each connector.

Docusign's subprocessor list places CLM hosting with Equinix in the Netherlands, the United Kingdom and the United States, Switch in the United States, and Microsoft Azure in the United States, Australia, Canada, the European Union and Japan, each by where the service is provisioned. AI processing is listed separately. Azure AI services for review, summaries and extraction run in the United States, Canada, the European Union, Australia and Japan, and Google processing for the CLM Analyzer service runs in Belgium, Canada, Germany, Switzerland, the United Kingdom and the United States.

Government editions are separate deployments. The CLM Service Schedule keeps government customer data inside Docusign's FedRAMP Moderate boundary unless a connector exports it (5.2), and the DoD Impact Level 4 edition requires a connection to NIPRnet through a boundary cloud access point (5.3). Nothing describes the tenancy model for commercial customers, and no on premises option is offered.

Docusign's certifications page lists ISO/IEC 27001:2022 certification enterprise wide, ISO/IEC 27017:2015 and 27018:2019, annual SOC 1 Type II and SOC 2 Type II audits of all production operations including data centers, and PCI DSS 4.0. Three authorizations name CLM directly: FedRAMP agency authorization, GovRAMP authorization and a Defense Information Systems Agency Impact Level 4 provisional authorization. Reports and certificates are available in the Docusign Trust Portal, and the annual CSA STAR CAIQ is public on the CSA registry.

Docusign also completes the Shared Assessments SIG, S&P Global KY3P and ProcessUnity assessments each year, and USDM assesses its 21 CFR Part 11 module annually. C5 Type II covers the eSignature product only, so it does not extend to CLM.

The CLM section of Docusign's subprocessor list, last updated 18 September 2026, names the AI suppliers feature by feature. Microsoft's Azure OpenAI Service runs AI-Assisted Review in CLM, CLM+ and the AI Extension for CLM, and agreement summaries in the AI Extension and CLM+. Azure AI Document Intelligence runs AI extraction in CLM Essentials, CLM and the AI Extension. Google processes the CLM Analyzer service. DocuSmart Inc., trading as Lexion and wholly owned by Docusign, runs the legacy version of AI-Assisted Review for select US customers.

Each entry gives the countries where it is provisioned. Updates are posted to an RSS feed customers can subscribe to, and a customer may object to a new subprocessor by email on grounds set in Docusign's Processor Policy. No model name or version is given for any provider, and section 6.1 of the AI Attachment disclaims responsibility for the data third party providers used to train their own models.

Docusign publishes no CLM price. Every call to action on the CLM page, Get Started included, goes to Contact Sales, and the site's plans and pricing links lead to eSignature and IAM plans, none of which includes CLM. The Service Schedule for Docusign CLM publishes the charging structure. CLM is a prepaid subscription measured by a seat allowance, a document count or both, depending on the edition (4). Extra seats are charged pro rata at list price for the rest of the term, and documents over the count are charged per document at list price, invoiced monthly in arrears (4.3).

Seats can be reassigned between people without penalty, and documents exported and then deleted during the term still count. Retrieval after the term ends is a paid professional services engagement. Editions named across Docusign's documents include CLM Essentials, CLM, CLM+ and the AI Extension for CLM, alongside government and DoD Impact Level 4 editions.

Docusign sells CLM to legal, sales, procurement, human resources and customer experience teams, and its named stories come from wholesale telecom, auto parts distribution, retirement plan administration and recruiting software. Government use is documented through CLM Government Products authorized under FedRAMP and GovRAMP and a DoD Impact Level 4 edition. Docusign says 2,200 enterprises use CLM for contract management, and integrations with SAP Ariba and Coupa point at procurement as well as sales contracting.

Coverage is framed by department and industry rather than by contract type or area of law. Nothing published names a minimum customer size, a law firm use, or contract types the AI handles poorly. Docusign's IAM plans page states AI extraction in English, French and German, and the CLM pages give no language list.