Eudia

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

There is no conventional product underneath. Eudia holds no repository, no matter management and no contract lifecycle system of its own: the systems of record stay where they are, at Google Drive, SharePoint, Box, Salesforce, DocuSign, Onit and LinkSquares, and Eudia connects to them. What it sells is the intelligence layer, described as codifying proprietary data and institutional knowledge into enterprise-grade legal agents, marketed as expert digital twins and an Enterprise Brain. Remove the models and nothing remains to sell, because everything Eudia adds is model-produced. The one qualification worth naming is that delivery is partly human: Forward-Deployed Engineers is one of the seven listed solutions, and the separately branded Eudia Counsel arm runs on the same platform. Neither displaces the models as the thing the buyer pays for. Verified 2 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

One grounding claim is published and nothing stands behind it. The home page states that Eudia connects systems, documents and workflows to ensure every decision is grounded in real-time, organization-specific context. No retrieval method is described, no source-linking behaviour is documented, no accuracy figure appears anywhere, and no test set or evaluation is published on any surface read. The trust centre lists AI Security and AI Risk Management as items but their contents sit behind an access request and were not read, so nothing in them is credited here. Checked the home page, integrations page, success stories, terms of use, privacy policy and the trust centre index on 2 September 2026. The claim is what keeps this off D; the absence of any mechanism or measurement is what holds it at C. Verified 2 September 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The autonomy claim is unusually explicit and the oversight account is a word. Eudia sells Decision Self-Service, described as delivering governed intelligence across the enterprise, and the site's own framing is that the Enterprise Brain makes the business self-sufficient without scaling headcount. That describes business users obtaining legal answers without the legal team in the loop, which is the strongest autonomy position of any record built in this pull. Against it, oversight appears only as adjectives: intelligence is said to be secure, governed and auditable. Nothing published names a review point, an approval step, a confidence threshold, a mode in which an agent stops, or what happens after an agent is wrong. Human in the loop appears as a phrase rather than a described control, which is the C band exactly. Verified 2 September 2026.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Three named enterprises, each with a figure and a dedicated case study. Duracell is reported at 50 per cent savings on contracting costs using the AI Contracting MIND; Graybar at 98 per cent faster diligence, described as contract review falling from four hours to five minutes using the AI M&A MIND; and Cargill at a 50 per cent reduction in contracting research time using Contract Insights, with Rishi Varma, Chief Legal and Compliance Officer, quoted by name and title on the home page. These are Fortune 500 legal departments rather than logos, which is real deployment evidence. What holds it below A is that the success stories index carries no dates and no measurement basis for any of the three figures, and the individual case studies were not opened this pass. Verified 2 September 2026.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

For a platform sold to Fortune 500 legal departments, nothing a buyer can read before signing addresses how client confidences are handled. No customer agreement, master subscription agreement or data processing addendum is published: the only agreement on the site is a website terms of use, and the privacy policy states expressly that it does not apply to personal information stored on behalf of customers, which is governed instead by contracts with the relevant customer. That leaves every question this axis asks unanswered in public. No training commitment for customer content, no privilege or work product treatment, no matter or tenant segregation, no retention or deletion terms, and no statement of what the named model providers may retain. The commitments are not absent from the business, they are unreadable in advance: a Data Protection Policy and an AI Training Data and Bias document exist on the trust centre behind an access request that was not completed. A commitment that lives only in a sales conversation is what the C band describes. Verified 2 September 2026.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The only disclaimers published are in the website terms of use and they are scoped to the website. Section 5.1 says site content is for informational purposes and that the reader is solely responsible for verifying its accuracy, and section 11 disclaims all warranties for the Site and the Technology used to operate it. Nothing states that platform output is not legal advice, and nothing addresses supervision, competence or jurisdiction limits. Against that, the marketing describes the product in decision terms: Decision Self-Service delivering governed intelligence across the enterprise, agents encoding expert judgment, and an Enterprise Brain that makes the business self-sufficient. The audience question is live rather than theoretical, because that positioning points at business users outside the legal department. Boilerplate in the terms alongside marketing that describes the product in advice terms is the C band. No bar or ethics guidance is engaged on any surface read. Verified 2 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Eudia holds ISO/IEC 42001:2023, listed as a current certification in the public compliance section of its trust centre alongside SOC 2 Type 2, ISO/IEC 27001 and GDPR. That is a published, independently audited AI management system standard rather than a self-authored principles page, and it is the strongest governance evidence located in this pull so far. The trust centre also carries a dedicated AI section listing AI Training Data and Bias, AI Security and AI Risk Management, so the vendor has assembled bias material; its contents sit behind an access request and were not read, and nothing in them is credited here. What the top band asks for beyond a framework is still missing from anything public: no individual or function is named as accountable for model behaviour, and no testing result or bias finding is disclosed. Verified 2 September 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Of the five things this axis names, one is publicly readable. The subprocessor list is public and specific, naming Elastic, Amazon Web Services, Anthropic, OpenAI and Microsoft Azure. The other four are not. Retention and deletion for customer content are addressed nowhere: the privacy policy's retention section covers personal information Eudia holds as controller and says only that it is kept as long as necessary, and that policy expressly excludes data held on behalf of customers. No incident or breach notification commitment is published, and no access control detail beyond the fact of SOC 2 Type 2 and ISO 27001 attestation. The trust centre inventory shows the material exists, listing Data Breach Notifications, Certificates of Destruction, Data Asset Classification, Access Monitoring, a Data Protection Policy and a Backup Policy, all behind an access request that was not completed. This is a grade about publication rather than about whether the controls exist, and one request would likely change it. Verified 2 September 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

The published allocation of loss does not reach the product. Eudia's only published agreement is a website terms of use, which by its own first sentence governs use of content available at www.eudia.com. It carries a total cumulative liability cap of five hundred dollars at section 13, an indemnity running only from the user to Eudia at section 12, and a full warranty disclaimer at section 11. Section 5.2 states that access to specific areas of the Site is subject to a further agreement called an Annex, which is where platform terms sit and which is not published. So a buyer evaluating the Enterprise Brain cannot read any indemnity, cap, carve out or output warranty that applies to it. What is locatable is the existence of cyber insurance, listed as a document on the trust centre behind an access request. A standard limitation clause that disclaims the exposure, with the operative terms reachable only through a negotiated agreement, is the C band. The five hundred dollar figure is recorded because a reader will find it, not because it governs the platform. Verified 2 September 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Seven integrations are named and grouped by function into document storage, contract management, revenue and business systems, and agreement execution: Google Drive, SharePoint, Box, Onit, Salesforce, LinkSquares and DocuSign. That is a genuine reach into the systems an in-house department's work already lives in, including two legal-specific ones in Onit and LinkSquares. Each carries a single line of marketing copy describing an outcome rather than a mechanism, for instance that the Salesforce connection links legal workflows with deal and customer data. Nothing states what synchronises, in which direction, on what trigger, or what a customer must configure, and no developer documentation, API reference or implementation guide was located anywhere on the site. Named connections without a description of what they actually move is the B band. Verified 2 September 2026.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery is evident and neither of the two things this axis asks for is stated. The trust centre names Azure under infrastructure and the subprocessor list adds Amazon Web Services, so the hosting providers are known, but naming a cloud provider identifies infrastructure rather than answering where a customer's data sits. No region or residency option is published anywhere, and the privacy policy points the other way, saying only that Eudia is headquartered in the United States, works with service providers in the United States and other countries, and that information may be stored in those or other locations outside the reader's home country. No tenancy model is stated: nothing describes the platform as multi-tenant, single-tenant or privately deployed. Under the co-equal limbs rule either one would clear this band and neither is present. Verified 2 September 2026.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

This is the strongest trust surface located in the pull so far. A SafeBase-hosted trust centre at trust.eudia.com renders publicly and lists four current standards by name, SOC 2 Type 2, ISO/IEC 27001, GDPR and ISO/IEC 42001:2023, alongside an inventory of thirteen documents including a SOC 2 Report, a Pentest Report, a Security Whitepaper, a Network Diagram and a Data Flow Diagram, plus third-party security grades from SecurityScorecard and Qualys SSL Labs. What is public is the inventory; the reports themselves sit behind a Get access flow. The portal describes that flow as starting a security review and requesting access without stating whether it fulfils on an email and a click-through or routes to a sales conversation, so the access tier could not be established and the lower tier is graded, which is why this is not an A. No auditor is named and no coverage period appears on any public page. Verified 2 September 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The providers are named publicly, which most of this pull does not manage. The trust centre's subprocessor entry lists Anthropic and OpenAI as model providers alongside Elastic, Amazon Web Services and Microsoft Azure as infrastructure, and it is readable without completing any access request. Two of the four things the top band asks for are absent. The models themselves are not named, only the houses they come from, and naming a provider does not satisfy the separate limb requiring the models underneath be identified. Nothing commits to notifying customers when the supply chain changes, and no subprocessor change-notification term is published, which is unsurprising given that no customer agreement or data processing addendum is published at all. Where the models run is not stated. Verified 2 September 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level, including the unit of charge. Checked the home page, the full navigation and footer, the five solution pages as listed in the navigation, the government page, the integrations page, the success stories index, the terms of use, the privacy policy and the trust centre on 2 September 2026. No pricing page exists in the site's own navigation or footer, and the only commercial route offered anywhere is Schedule a demo or Book a demo. Solution areas are named and so are three product units, the AI Contracting MIND, the AI M&A MIND and Contract Insights, but a product structure is not a pricing structure: no tier, no seat or consumption unit, no term and no figure appears. Verified 2 September 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is described with real substance on both dimensions the band asks about. Practice areas are enumerated as five named solutions: marketing compliance, contracting and deal acceleration, decision self-service, mergers and acquisitions, and litigation. Buyer segments are stated and separated, with an enterprise track and a distinct government track described as purpose-built for government acquisition teams, which is an unusual and specific addition. The named customers bear out the enterprise claim at the top of the market, with Duracell, Graybar and Cargill. What is left open is the boundary. Nothing states what the platform does not support, no company size floor is given, no jurisdiction or geography is named, and the relationship between the platform and the separately branded Eudia Counsel services arm is not explained in coverage terms, so a buyer cannot tell where the software stops and the service begins. Verified 2 September 2026.