GC AI

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are the product. Chat, drafting, contract review, playbooks, the skill library, agents and the API are all generative capabilities, and the vendor describes its differentiator as a multi model retrieval approach calling several providers plus a 20,000 line system prompt. Remove the models and nothing remains.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real and documented, short of published measurement, which is the B band. Exact Quote produces character level verifiable citations with a picture in picture source view that slides the underlying document alongside the assertion, so a reader can check a quotation against its source without leaving the answer. The corpus behind research is identified: more than 13 million US court opinions from what the vendor describes as official, authoritative sources, plus real time web research. The retrieval approach is described as multi model, calling five different models. The vendor frames the feature explicitly around a lawyer's ethical obligation to check sources, which is the right framing for what grounding is for. What keeps this off an A is measurement, and specifically one claim: the comparison page asserts accuracy via proprietary methods and multi model retrieval with no figure attached, which is the unmeasured accuracy claim this axis exists to catch. Searched the site, the feature pages, the help documentation and the blog on 29 Aug 2026 and located no accuracy figure, no hallucination rate, no test set and no evaluation methodology. No abstention path is documented either.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A real published commitment with a described control, short of the full structure. The vendor documents approve first controls on Agent Connectors: each user connects their own accounts, sensitive actions require approval before they run, an administrator enables the capability for the organisation, and API keys inherit the account's permissions so only playbooks and documents the legal team created are reachable. That is a named mechanism at the point where an agent acts on a business system, which is more than most of this market publishes. Not located as of 29 Aug 2026: what the system decides on its own inside a document review, the threshold at which it stops, and what happens after an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Real deployment evidence with substance, short of the full A bar. Ten named customer case studies are published with individually attributed quotes from named counsel at named companies including Columbia Sportswear, Arc'teryx, Snyk, Liquid Death, Eventbrite, Tipalti, Trust and Will, Viant and Jasper, and the vendor states more than 2,000 customer companies. Figures appear but attach to the aggregate rather than to a named deployment: a stated 30 percent reduction in outside counsel spend and one attributed quote reporting an hour of work reduced to ten minutes. Not located as of 29 Aug 2026: figures tied to a specific named customer with a method a reader can assess.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The only A on this axis in the index so far, and it is earned on the one limb every other vendor misses. The vendor addresses privilege directly and specifically rather than implying it: a published FAQ states that information stays privileged through contractual and technical protections, and cites United States v. Heppner, where a federal judge ruled that material put into generalist tools without confidentiality terms may not be privileged, as the reason its own terms matter. Alongside that: no training on customer data by the vendor or its providers, zero data retention agreements with the named model providers, a segregated database instance per customer, AES-256 at rest and TLS in transit, customer deletion at any time, and a published data processing agreement. Segregation here is tenant level for an in house buyer with one client, which is the right shape for this segment rather than firm style matter walls.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

A real position is published, and unusually it is engaged rather than disclaimed. The audience is stated precisely as in house counsel and legal teams, the vendor states plainly that specialised practices may be better served elsewhere and that it will recommend competitors, and it addresses a lawyer's own ethical obligation to check sources as the reason a verification feature exists. Jurisdiction is addressed in operational terms: the product works across jurisdictions worldwide and a user tells it which jurisdiction to apply for commercial contracts. Short of an A because competence and supervision duties are not addressed as such, and the jurisdiction answer describes a product setting rather than a stated limit on where the vendor's output can be relied on.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Checked the site, the security and privacy FAQ page, the trust center, the AI information page, the help documentation and the blog on 29 Aug 2026. No governance position for model behaviour was located: no named internal owner, no pre release testing regime, no published responsible AI framework, and nothing on uneven output across matter types, parties or populations. The vendor publishes substantial security and privacy governance, which is a different subject. This is the widest gap on an otherwise strong record and it is rebuttable with a single link.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Retention, deletion, access control, subprocessors and the model provider position are all published, current and specific enough to hold the vendor to. A named subprocessor list is published at a stable URL with no gate. Zero data retention agreements are stated with the model providers by name. Data sits in a segregated database instance, encrypted AES-256 at rest and TLS in transit, and the customer can delete it at any time. Enterprise plans carry SSO, MFA, directory sync, domain verification, authentication audit logs and log streams. A data processing agreement is published openly. The one element not located as of 29 Aug 2026 is a stated incident and breach notification practice on the public pages, which the published DPA may well cover.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Liability is addressed through published terms of service that a buyer can read before signing, which is more than most of this market, but what was located is the standard shape: the terms and the data processing agreement are public and cover the relationship. No indemnity running to the customer for third party claims arising from output, no warranty on output, no stated cap figure and no insurance position was located as of 29 Aug 2026 on the terms, the security FAQ or the trust center. Recorded at C rather than D because the governing documents are published rather than reachable only through a sales process.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real integrations, documented, short of implementer level depth on each. Named and specific: a Microsoft Word add in with contract agents, playbooks and Easy Edit; a Slack connector included with the seat; Agent Connectors covering more than 20 business applications including Gmail, Outlook, Slack, Drive and HubSpot, each connected per user with per action approval; and a REST API with published documentation reaching tools including Ironclad, Jira and Zapier. The orientation is toward the business systems an in house team lives in rather than firm document management, which fits the segment. Not located as of 29 Aug 2026: integration with legal specific document management such as iManage or NetDocuments, and per connector documentation of what syncs in which direction.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery is implied and neither the tenancy model nor the region is stated. The vendor does publish that customer data sits in a segregated database instance, which speaks to isolation rather than to location, and states GDPR compliance and hundreds of global customers across Brazil, Israel, Japan, the United Kingdom and Australia. Searched the site, the security and privacy FAQ, the trust center and the published DPA references on 29 Aug 2026 and located no list of available regions, no residency option, and no statement of where processing happens as distinct from where data is stored.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real and stated with an open access route, short of accessible evidence. SOC 2 Type II and SOC 3 are both stated as certified, GDPR compliance is claimed, badges link to a security and privacy FAQ page rather than sitting as decorative images, and a trust center is published at a stable URL. Under the three tier test this is materially better than absent. What holds it off an A is that the vendor states documentation is provided on request for procurement, and no coverage period, audit scope or named auditor was located as of 29 Aug 2026. Note the noun is used correctly for SOC 3, which is a public report by design, so publishing it openly would be a straightforward upgrade.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The strongest supply chain disclosure in the index so far. The vendor answers the question directly in a published FAQ, names OpenAI and Anthropic as providers, points to a full subprocessor list published at a stable URL with no gate, states that no provider trains on customer data, and states that zero data retention agreements are in place with the named providers. The architecture is disclosed at a level most vendors do not attempt: a multi model retrieval approach calling five different models. What is not published is which model serves which task, where they run, and a commitment to notify customers before the list changes, but the subprocessor list is the mechanism by which such changes would surface.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

Real pricing published for part of the range with team and enterprise tiers withheld, and the self serve path is genuinely complete rather than a gesture. The pricing page publishes $500 per user per month for the Individual plan with monthly and annual billing, itemises what the seat includes, and offers a buy now path that completes without a sales conversation, alongside a 14 day free trial. The vendor states in its own FAQ that individual pricing is standard and not negotiable. Team is On Request and Enterprise is custom. What holds this off an A: no figure for team or enterprise, US case law is an add on for individual seats with no price published, API usage is billed in credits with no rate published, and professional services for playbook buildouts and custom integrations are offered with no implementation cost stated.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Who the product is for is documented precisely, and the limits are stated in the vendor's own words rather than inferred. Segment is in house legal teams at corporations, from solo and fractional general counsel through public companies, with named industries spanning retail, SaaS, technology, fintech, healthcare, restaurants, grocery, manufacturing and private equity, and named customers including Hitachi, Logitech, News Corp, Nextdoor, Skims, Zscaler, Vercel and TIME. Practice coverage is enumerated by work type: commercial contracts, MSAs, DPAs, NDAs, privacy, board minutes, policies, OEM and supply agreements. The boundary is published explicitly: the vendor states it is best for generalist in house lawyers and that if a practice is specialised, other platforms may be better and it will recommend them. Law firm practice is out of scope by design.