Gatekeeper is a vendor and contract lifecycle management platform that treats the supplier and the agreement as one record. It covers contract intake and requests, authoring from templates and clause libraries, negotiation and redlining, approval routing with set thresholds, electronic signature compliant with ESIGN, UETA and eIDAS, a central repository with obligation and renewal tracking, and modules for vendor onboarding, third party risk, scorecards and spend.
Its AI layer, LuminIQ, launched in March 2025 as a library of agents that extract metadata, summarize contracts in plain language, review clauses against approved language, flag risk and policy breaches, find obligations, route approvals, screen third parties for financial, cyber and sanctions risk, and build workflow cards from intake documents. Published AI Terms prohibit training on customer input and require customers to label AI output before publishing it, and the data processing agreement names every subprocessor with purpose and location.
It runs on Amazon Web Services in four selectable regions, with a private cloud option, and plans include unlimited users with a quota on third parties managed. Buyers are legal, procurement and finance teams. The contracting entities are Gatekeeper Ltd of Jersey and group companies in the UK, US and Canada.
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Vendors in the same categories as Gatekeeper whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models drive a core capability on a product that works without them. Gatekeeper sold vendor and contract lifecycle software well before LuminIQ, which the vendor calls an intelligence layer added in March 2025, starting with an agent for workflow approvals. Underneath is a complete platform: repository, authoring, the Kanban workflow engine with set approval paths, electronic signature, vendor and employee portals, spend, risk register and scorecards.
The pricing page lists Gatekeeper Agents and the AI Suite as features within plans whose quota counts third party records, not AI use. The vendor now leads with agentic AI, claims more than fifty agents, and calls them a digital workforce that reads, reasons and acts. Without them, the platform still runs the lifecycle.
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is addressed only by disclaimer, and grounding is claimed without a described method. The product cites no legal authority, so citation questions do not apply. The agents work on the customer's own contracts and vendor records, summarizing agreements, matching clauses against approved language and extracting obligations, and the vendor says agents explain every decision they make. Nothing says what an explanation contains, what is retrieved, or how a proposed clause traces back to the source text.
No figure, test set, error rate or benchmark was found. AI Terms clause 6.3 says neither Gatekeeper nor any AI Provider warrants the accuracy, availability, suitability, reliability or content of Output, clause 9 excludes all warranties on the AI, and clause 6.6 requires the customer to check Output and not rely on Gatekeeper to do it.
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The agreement commits that people make the decisions, with real review tools, but sets no threshold for when agents act alone. AI Terms clause 6.5 says Output is a suggestion and does not replace a person deciding its suitability before it is published, used or relied on. Clause 6.6 requires the customer to check its accuracy, and clause 7.4 bars automated decisions that may harm individual rights without appropriate human supervision.
Review comes through the workflow engine's set approval paths and thresholds, an audit trail across the lifecycle, and the claim that agents explain every decision. The same vendor markets agents as a digital workforce that reads, reasons and acts, handling contract management and compliance checks autonomously, with no stated line between that and the rule that people decide. No threshold, confidence level, type of work or operating mode is published.
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Real deployment evidence is published, without methods. CompSource Mutual Insurance is named with figures in a January 2026 article: a 95 percent cut in executive review time per contract, 636 hours saved a year, described as 17 weeks of capacity, executives reading ten line AI summaries instead of thirteen page contracts, and less back and forth between legal, finance and procurement. Krupa Patel, Global Head of Procurement at Funding Circle, describes terminating contracts worth $1.3 million.
A Legal Operations Manager at BlaBlaCar, a Paralegal at Hakkasan Group and an Associate Corporate Counsel at Cricut are quoted without figures, and a customer story library is published. No method is given for any figure. Unattributed headline claims elsewhere, an average $1.3 million vendor cost reduction in year one, 75 percent shorter cycle times and 400 hours saved per audit, read as marketing.
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Four of five elements are met in published documents, and privilege is missing. Training use is contractual: AI Terms clause 5 says Input is not used to train or fine tune any model, proprietary or third party, and that AI Providers may not keep, access or use Input or Output for training; clause 12 repeats it and adds that no Content is kept by AI Providers beyond the session. The DPA's security schedule logically separates each customer's data, with a unique per customer encryption key from a FIPS 140-2 compliant library and a master key released only with several levels of executive approval.
Data is deleted or returned at the customer's choice, removed within 60 days of termination and from backups within a year. The AI Providers are named subprocessors barred from retention and training. Privilege and work product are not addressed anywhere, on a platform whose legal teams page invites counsel to keep their contracts in it.
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The agreement takes a position on advice versus tooling, with one notable gap. AI Terms clause 6.5 says Output is a suggestion and does not replace a person deciding its suitability, and clause 6.6 puts checking accuracy on the customer and requires a notice that Output was generated by AI tools before it is published or distributed. Clause 7.1 bars using the AI to pass Output off as human work, and clause 7.4 requires human supervision of automated decisions affecting individual rights.
Clause 7 restricts tailored financial advice without a qualified reviewer and bars health advice, but names no equivalent restriction for legal advice, on a platform sold to legal teams for clause review and redlining. No statement that Gatekeeper is not a law firm was found. Nothing addresses supervision and competence, who may operate which agent, or any jurisdictional limit.
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Governance takes the form of contract terms, with no program, testing regime or accountable owner. The AI Terms define AI Functionality, bind the AI Providers as subprocessors subject to change notice, prohibit training on Input, and set thirteen use restrictions, covering misleading users about machine authorship, unsupervised automated decisions affecting individual rights, activities with high risk of economic harm, unqualified financial advice, health advice, political campaigning and lobbying, and attempts to copy the models.
There is no responsible AI page, no named framework or certification such as ISO 42001, no one accountable for AI, nothing on testing agents before release, and nothing on uneven output across contract types, counterparty drafting or jurisdictions. The Executive Guide to AI Risk Management is marketing about managing AI risk among the reader's own suppliers, not about this vendor's AI.
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention, deletion, access control, subprocessors and incident practice are all published and specific, in the ungated Data Processing Agreement. Under the AI Terms, AI Content is processed transiently and not kept by AI Providers beyond the session; personal data is kept for the term of the agreement; and a data classification scheme drives a policy under which deleted records are permanently removed from active databases.
On termination, data is deleted or returned at the customer's choice, removed from systems within 60 days and from backups within one year, with export and erase tools in the product. Access controls include least privilege and need to know roles, two factor VPN for production, unique per customer encryption keys from a FIPS 140-2 compliant library with master key release needing several levels of executive approval, AES-256 at rest, TLS in transit, SIEM logging and STIG based configuration.
Subprocessors are named with purpose and location in Exhibit C, with 30 days' notice of change, ten business days to object and a right to terminate. Breaches are notified without undue delay and within 72 hours.
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Liability for AI output is addressed only by disclaiming it, thoroughly. AI Terms clause 9 excludes all warranties on AI Functionality, including the accuracy, availability, suitability and reliability of Content. Clause 6.4 says Gatekeeper has no liability for use of or reliance on Output or for errors in it, and clause 10.1 extends that to any damages from using or being unable to use the AI, including negligence. Clause 11 makes the customer indemnify Gatekeeper and the AI Providers against third party claims relating to Content.
Two provisions favor the buyer but do not cover wrong output: the DPA makes Gatekeeper liable for its subprocessors' breaches as if they were its own, and the vendor publishes worldwide insurance at an A rated standard, including cyber cover for IT forensics, legal advice, notification costs and credit monitoring. The Master Subscription Agreement's general cap was not read and may say more.
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations are named, short of depth an implementer could use. Gatekeeper is a NetSuite SuiteApp, described as Built for NetSuite and as NetSuite Partner of the Year 2024, and the marketplace listing describes sales teams working in Salesforce while legal works in Gatekeeper. Identity support includes SAML 2.0, OAuth 2.0, Google and Microsoft 365 single sign on, Okta and OneLogin partnerships, and SCIM 2.0 provisioning on higher plans.
A REST API is a plan feature, Gatekeeper Interconnect is offered as a no code integration product, Workato appears as an integration subprocessor in the DPA, and a Model Context Protocol connector links LuminIQ to the customer's tools. Only the NetSuite path describes what syncs and in which direction, at the level of vendor, contract and spend data. The count of supported third party solutions differs across the site, over 220 on one page and over 4,000 on another.
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Deployment options and residency are published in detail. The DPA's infrastructure table lists Amazon Web Services hosting in the USA, Ireland, Australia and Canada, and the enterprise page says customers can choose any region for data sovereignty. A Gatekeeper private cloud is offered for bespoke needs. Processing is distinguished from storage per processor: the group companies providing support and development are listed with their locations, Jersey, the UK, the US and Canada, and their transfer mechanisms, EU adequacy for the first two and Standard Contractual Clauses with encryption for the others.
AI providers have their own locations: Amazon Bedrock in the same four regions and Anthropic in the US only. Data is stored in triplicate across two data centers with separate cross connections, and stateless applications can be recreated in other regions. What the private cloud changes compared with the standard plans is not described.
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real and stated, but the evidence is gated. Named standards are ISO 27001, ISO 9001, SOC 2 Type II, completed and announced in January 2026, and SOC 1 Type 2. Both the Terms of Service and the DPA's security schedule commit Gatekeeper to keep ISO 27001 or equivalent certification for the term and not to use third party data centers without equivalent certification. The DPA provides an annual external audit to ISO 27001 standards by independent security professionals at Gatekeeper's expense, and another statement says all hosting locations are audited quarterly by two security firms.
The resulting report is confidential and provided only on written request, at most once a year, under confidentiality terms; no auditor, report period, certificate number or scope is published. A Security Center at trust.gatekeeperhq.com, hosted on Vanta, did not render on 12 September 2026 and may say more.
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Providers are named, and the models are not. The Data Processing Agreement's subprocessor table names Amazon Bedrock as an AI Provider in the USA, Ireland, Australia and Canada, and Anthropic, PBC as providing AI language model services for internal workflow automation in the United States. Changes require 30 days' notice by email, with ten business days to object and a right to terminate if no alternative exists. The AI Terms let providers use Input only to create Output and prohibit retention or training.
No model is named, and Bedrock hosts models rather than being one, so a reader learns the route but not what generates the answer. Two cross references are faulty: the AI Terms say providers are set out in clause 3, which instead points to the subprocessor list, and DPA Exhibit A refers to a list in Exhibit D, while the tables are in Exhibit C.
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Tier names and features are published, and prices are not. Three tiers are named, Pro, Enterprise and Enterprise Plus, and the unit of charge is stated: the number of third parties managed, up to 250, up to 750 and more than 750, with archived third parties not counted. A feature matrix of about twenty rows shows the differences. Users, live and archived contracts, eSignature licenses and senders, and Gatekeeper Agents are unlimited on every tier.
Higher tiers add more prebuilt and custom AI workflows, API access, Model Context Protocol connections, SCIM provisioning, remote backup and sensitive data controls. MarketIQ Full is marked as usage based. No figure, band, term, minimum or implementation cost appears, and the only route to a number is a demo request. The Master Subscription Agreement was not opened and may say more on commercial terms.
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment coverage is described in detail, with boundaries left open. Legal is one of three named buyer groups, with its own page at /legal-teams addressing clause deviations, missed approvals, policy enforcement and counsel being brought in too late, alongside procurement and finance, with the CFO named as a fourth audience on the AI page. Six use case pages cover contract creation and execution, renewals and amendments, vendor onboarding, vendor performance, third party compliance monitoring and vendor consolidation.
Named users range from a Legal Operations Manager and a Paralegal to a Global Head of Procurement. No practice area within a legal department is named as supported or unsupported, no industry pages were found, nothing says what the product is not for, and no jurisdictional coverage is stated despite four hosting regions and group companies on three continents.
The public pages on file for Gatekeeper, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
Client Data in Training, Prompt and Output Retention, Primary Law Corpus Provenance and 2 more
Read Sep 12, 2026
Ethical Walls and Matter Segregation, Third Party Request and Subpoena Notice, Outside Counsel Guideline Readiness
Read Sep 12, 2026
Good Law Verification
Read Sep 12, 2026
Refusal and Uncertainty Behavior
Read Sep 12, 2026
Billing and Fee Posture
Read Sep 12, 2026
Published structure, with no figure. Three tiers, Pro, Enterprise and Enterprise Plus, are charged by the number of third parties (vendors, suppliers, partners and customers): up to 250, up to 750 and more than 750, with archived third parties not counted. A feature matrix of about twenty rows shows what each includes. Unlimited on all tiers: users, pipeline, live and archived contracts, eSign licenses and senders, Gatekeeper Agents and MarketIQ Lite credit ratings.
Prebuilt AI workflows scale at two, two and more than two, and custom AI workflows at one, two and more than two. Higher tiers add REST API access, Model Context Protocol connections, SCIM 2.0 provisioning, remote backup and sensitive data controls. All tiers include single sign on with Google, Microsoft, OneLogin and Okta, role based access groups, the AI Suite, intake and third party portals, spend, risk register and scorecards.
MarketIQ Full, covering financial health monitoring, cyber ratings and automated risk mitigation, is usage based on all tiers. No figure, currency, term, minimum or implementation cost is published, and the AWS Marketplace listing also gives no figure.
Confidentiality and data terms: No Business Associate Agreement is offered or referred to on any surface read, and the vendor's own position is that health data is out of scope: the Data Processing Agreement's Exhibit A states that no sensitive data will be processed or transferred, defining that to include data concerning health, while acknowledging that small and limited amounts of special category data may be present in customer data on the basis that the customer is lawfully permitted to process it. What is published instead of a BAA is a full data protection estate: the DPA incorporates the EU, UK and Swiss Standard Contractual Clauses, names the competent supervisory authorities, lists every sub-processor with its location and transfer mechanism, and is accompanied by a separate EU Data Act Addendum.
Note: Tier names, quota bands and the feature matrix read from the vendor's pricing page on 12 September 2026. AI commercial terms read from the AI Terms, and processing and deletion terms from the Data Processing Agreement, both read in full the same day. No figure appears on any page found, so no entry price is recorded. The published structure gives a buyer the shape without the number. The Master Subscription Agreement was not opened, so payment, renewal, uplift and termination terms could not be read.
Gatekeeper's September 2026 release adds a Local Workflow Cards Manager access tier, whose holders can raise, edit, progress, own and delegate cards at every phase but cannot change the workflow board itself. Workflow cards also gain a Related Contracts tab that diagrams every parent, child and linked contract, colored by lifecycle status and flagged near their end date.
A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Can material a lawyer puts into this product be used to train a model?
The published terms prohibit training on customer content. Not a policy page, the agreement.
The published agreement prohibits training on customer content, without qualification, in two places. AI Terms clause 5 says Input is not used to train or fine tune any model, proprietary or third party; AI Providers may not keep, access or use Input or Output for training; Input and Output are processed transiently and not stored or reused beyond what is needed to deliver the Services; and nothing is used for model improvement, dataset building or similar purposes.
Clause 12 repeats that Gatekeeper uses no Content to train models and that AI Providers keep nothing beyond the session. The AI Terms are published ungated, form part of the Master Subscription Agreement, and under clause 2 prevail over it for AI Functionality. The clauses cover Input and Output as defined; no separate statement was found on aggregated or anonymized usage data outside that definition.
How long does the product keep what a lawyer typed, and can that be set to zero?
A specific retention period is published and the customer cannot change it.
A retention boundary is published, and the customer cannot change it. For prompts and output, the boundary is the session: AI Terms clause 12 says no Content is kept by AI Providers beyond the session, and clause 5 says Input and Output are processed transiently and not stored or reused beyond what is needed to deliver the Services, a phrase that is not itself defined. At platform level, the Data Processing Agreement keeps personal data for the term of the agreement, deletes all copies from Gatekeeper's systems within 60 days of termination unless otherwise agreed or required by law, and deletes backup data within one year.
The security schedule adds a data classification scheme under which deleted records are permanently removed from active databases and then rotated out of backups, and data no longer needed is deleted promptly after first being locked against accidental or malicious deletion.
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
The product has its own documented permission model, which the customer must administer. Separation between customers is documented in the DPA's security schedule: data is logically separated from other customers', functions and test and production systems are separated, and each customer has a unique encryption key from a FIPS 140-2 compliant library, protected by a master key whose release needs several levels of executive approval and is logged and alerted through a SIEM.
Within a tenant, least privilege and need to know roles are set out, role based access groups are a plan feature with an access matrix in the knowledge base, and SCIM 2.0 automates joiners and leavers on higher tiers. Nothing addresses separation between matters or business units within one tenant, where legal, procurement and finance share records and agents answer across the whole estate.
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Notice is committed in the published agreement where lawful, and there is no transparency report. Data Processing Agreement clause 11.1 says Gatekeeper will promptly notify the customer of any request or complaint about personal data processing that adversely affects the customer, unless law or a court order prevents it. The trigger is adverse impact rather than compelled disclosure by name, which is a narrower framing.
Clause 8.2 refers data subject requests back to the customer unless prohibited by law. Clause 11.2 lets Gatekeeper copy or keep personal data to meet legal or regulatory requirements, even after deletion is instructed. No transparency report, aggregate count of demands or reporting schedule was found.
Where does the law in this product come from, and does the vendor have the right to use it?
Sources are identified without stating the license or rights basis.
The working material is identified and its rights basis stated, while nothing is said about what the models bring. Every answer comes from the customer's own contracts, vendor records, risk data and spend, which agents read, summarize, classify and extract within the tenant. AI Terms clause 5 says the customer or its licensors own Input, warrants that the customer holds the rights and consents needed, and grants Gatekeeper a nonexclusive right to let itself and its AI Providers use Input only to generate Output.
Amazon Bedrock and Anthropic are named as AI Providers, but nothing says what their models were trained on, under what license, or how they are updated, and clause 3.3 makes AI use subject to each provider's own terms without identifying them. No outside legal or contract content is claimed.
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No published material addresses checking authority for later history, and the question does not arise in its usual form. The product cites no cases, statutes or regulations. Its agents work on the customer's own agreements and vendor records: extracting metadata, summarizing, matching clauses against approved and fallback terms, flagging policy breaches, finding obligations and screening third parties for financial, cyber and sanctions exposure.
The nearest concern is compliance screening against SOC 2, DORA and ESG criteria, where currency means whether an attestation or risk signal is still valid; nothing says how those criteria are kept current. Product pages, the AI Terms, the Data Processing Agreement and the pricing matrix were read on the date shown.
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No published material says what the product does when it cannot ground an answer. The vendor says Lumin Agents explain every decision they make and read, reason and act on data inside the platform, but explaining a decision is not the same as describing what happens when one cannot be made. Nothing says an agent declines, marks an extraction as unsupported, reports an unmatched clause, escalates, or shows a confidence score, and no evaluation was found.
The AI Terms allocate the consequences instead: clause 6.3 disclaims warranties on Output accuracy, clause 6.6 requires the customer to check Output and not rely on Gatekeeper to do it, and clause 6.5 calls Output a suggestion that does not replace a person deciding its suitability. The product pages, both published addenda and the plan matrix were read on the date shown.
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
Searched on 12 September 2026, by product and company name, against published trackers of decisions on AI fabricated citations, including coverage of the Damien Charlotin AI Hallucination Cases database and two independent sanctions trackers. None located. This covers fabricated citations only and is not a litigation history. The product name is also a common noun and the name of unrelated software, including an open source Kubernetes policy controller, so future searches need the company qualifier.
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No published material engages with bar or ethics guidance. No bar opinion is named, ABA Formal Opinion 512 does not appear, no state or Law Society guidance on generative AI is referenced, and nothing maps any agent to conduct rules. AI Terms clause 7 shows the vendor writes limits for specific professions when it chooses: it bars tailored financial advice without a qualified reviewer and bars health advice, but names neither legal advice nor any professional conduct duty, on a platform sold to legal teams.
Clause 6.6 requires customers to label AI Output before publishing it, without linking that to any court rule, bar guidance or candor duty. The vendor's blog material on the EU AI Act is general education, not an alignment statement about this product.
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
The product does not touch a fee between a lawyer and a client. It is bought by in house legal, procurement and finance teams, with the CFO named as economic buyer, and its case is about the buyer's own costs: lower vendor spend, stopped renewals, supplier consolidation, shorter cycles and fewer audit hours. Named users, a Global Head of Procurement, a Legal Operations Manager, a Paralegal and an Associate Corporate Counsel, all sit inside the organizations that own the contracts.
Savings claims include an average $1.3 million cut in vendor costs in year one, 75 percent shorter cycle times, 400 hours saved per audit, and 636 hours of executive review saved a year at CompSource Mutual Insurance. None reaches a client bill, and nothing addresses disclosure of AI use or cost in a fee context.
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A subprocessor and model provider list plus client facing disclosure material is published or available without an agreement in place.
The material a company would forward to answer a counterparty's AI clause is published and ungated. The subprocessor list sits in the Data Processing Agreement itself, at Exhibit C, in three tables naming each processor with purpose and location: Amazon Web Services hosting in four regions, the four Gatekeeper group companies with their transfer mechanisms and safeguards, and eighteen other processors from Vanta to Workato.
The same table names Amazon Bedrock as an AI Provider in four regions and Anthropic, PBC as providing AI language model services for internal workflow automation in the US. Both the DPA, which incorporates the EU, UK and Swiss Standard Contractual Clauses and names the supervisory authorities, and the AI Terms, which prohibit training on Input and bind the AI Providers to it, were read in full. New processors need 30 days' notice, with ten business days to object and termination if no workaround exists.
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a record exist, and no document level export is described. Gatekeeper makes labeling a contractual duty: AI Terms clause 6.6 requires the customer to add a notice that Output was generated by AI tools before publishing or distributing it, and clause 7.1 bars using the AI to pass Output off as human work. That is a duty imposed on the customer rather than a product feature. The vendor says agents explain every decision with full transparency and auditability, the workflow engine keeps an audit trail across intake, approval and signature, and system inputs are logged so changes can be traced to who made them.
No record identifies which model produced a passage, no model is named, nothing marks machine text against human edits in a portable form, and no disclosure template or court guidance was found.
Every grade and every signal on this index is drawn from public sources and dated. If a record is wrong, out of date, or missing an artifact the index did not locate, send the source and it will be reviewed and the record redated. Vendors are welcome to submit documentation. Nothing on this index is for sale, including a listing, a placement, or a grade.