iManage is a cloud document and email management platform for law firms, corporate legal departments, financial services, accounting and government. It is built around iManage Work, with add on products for sharing, information barriers, security, records, conflicts and knowledge search. Its AI is sold as separate products on top of a standard cloud subscription and runs only on the cloudimanage.com endpoint. AI Enrichment classifies documents and extracts data points at scale.
Ask iManage takes a plain language question, retrieves material from the firm's own repository and returns an answer with citations the user can open. It also extracts clauses, compares redlines, summarizes documents and applies a firm's contract playbook. iManage states that by default neither it nor its third party model providers train on customer data, including AI inputs and outputs. The published Cloud Services Agreement includes the security exhibit and data protection agreement, and commits to notice before compelled disclosure. iManage LLC contracts from Chicago, and iManage EMEA Limited, registered in England and Wales, contracts for Europe, the Middle East and Africa. Customer data is stored in the region named in the order.
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Vendors in the same categories as iManage whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a platform that stands entirely without them, and the vendor draws the line itself. The FAQ on the AI page states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be purchased as additional products, and that iManage AI is available only on the cloudimanage.com endpoint, with customers still being moved there.
The platform underneath is a document and email management system with security, governance, records, conflicts, knowledge search, transaction management and workflow products, sold for decades and bought for that. AI Enrichment classifies and extracts at scale and Ask iManage answers questions from the repository; remove both and the DMS is unchanged.
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is real and the retrieval method is described, but no accuracy figure is published. The vendor sets out Ask iManage as a three step process. It interprets intent and context from a plain language prompt rather than keywords, identifies the most relevant material within iManage Work, and generates an answer anchored with citations so users can verify the sources. The product page states that answers are backed by citations to the firm's own work and that documents never leave the platform.
It also claims that outputs are grounded rather than hallucinated because the system draws only from real documents. Nothing published measures how often that holds: no accuracy figure, test set or evaluation of any kind is published. The hallucination claim rests on a described architecture, not on measurement. The product cites the firm's own files, not reported authority, so checks on case citations do not apply.
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Oversight rests on review surfaces, not on a published control structure. What exists is real. Every answer carries citations the user can open to verify the source, all AI interactions stay inside the governed platform with native enforcement of permissions and information barriers, and the vendor describes the result as explainable and auditable in regulated settings. Not published is what the system does without a lawyer, any threshold at which it stops, or what happens after an output is wrong.
The May 2026 playbook analysis release describes the feature applying a firm's positions automatically to every contract review, without saying where review sits in that loop.
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
There is real deployment evidence, split between a measured deployment of the platform and unmeasured statements about the AI. The strongest item is the vendor's release of 12 June 2025. Rio Tinto's legal function replaced a SharePoint based system with iManage Work 10, Threat Manager and Share. It covered more than 200 users across Australia, Singapore, the United Kingdom and North America, and 4.5 million documents were migrated.
User engagement reached 80 percent within four months of going live, with half the department classified as active users. A named Digital Transformation Lead is quoted. That is named, dated and quantified, but it measures the document management deployment, and the same release records Ask iManage as something the customer is exploring, not running. For the AI itself the evidence is attributed and unmeasured: the Director of Information Technology at Jones Walker LLP on the January 2026 release, a manager at Rio Tinto in trade press, and a Senior Associate at Simpson Grierson describing a trial. No figure attaches to an AI outcome, and no method is published for the 80 percent.
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Published commitments cover most of the ground, and privilege is not addressed. Customer Data is the customer's Confidential Information under section 6.1 and must be safeguarded in perpetuity under 6.3(c)(ii), longer than the five years the agreement gives other confidential information. The customer remains sole owner under 5.2. The AI page states that by default neither iManage nor its third party model providers use customer data to train or retrain models, that data is encrypted and that iManage does not have access to the underlying content.
Segregation is documented: Security Policy Manager is sold as a product for information barriers, and the January 2026 release states that AI interactions carry native enforcement of permissions, information barriers and security policies. Retention and deletion are set out in the DPA, and Exhibit B records that each customer's data is logically separated. Privilege and work product are not addressed on any surface located. The training promise is prefaced "by default", with an opt in whose scope is not published.
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No position on the advice line is published, for a product that answers legal questions from a firm's documents, extracts clauses, compares redlines and applies contract playbooks. The Cloud Services Agreement was read in full. It addresses acceptable use, warranties, indemnities and liability and says nothing about advice, competence or supervision; its warranty disclaimer at 8.5 does not say what the product is and is not.
The AI and Ask iManage pages carry no disclaimer. The website terms of service govern the website, not the product. The audience is clear: the agreement confines use to Authorized Users for the customer's internal business operations, every segment page addresses law firms, corporate legal, compliance and other professional functions, and there is no consumer surface. A product level acceptable use or AI policy, if one sits behind the trust center, may say more.
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Principles are published without a mechanism a buyer could audit. The AI page states that the platform approach lets organizational data be used securely, responsibly and ethically, whether by iManage or a third party. The vendor publishes an ESG report and a diversity statement, and trade coverage records the appointment of a Vice President of AI Engineering in 2026. Nothing located names who inside iManage is accountable for AI governance, describes what is tested before an AI capability ships, or discloses any finding about uneven output across matter types or populations.
No governance standard such as ISO 42001 is published. The trust center, hosted on Vanta, returns page metadata with no body on this channel; it could not be read and may say more.
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention, deletion, access control, subprocessors and incident practice are all published in the agreement. The DPA commits to notifying the customer of a Security Incident without undue delay and in any event within 48 hours, and to helping with the customer's own notification duties. The customer can access, extract and delete Customer Data at any time during the term. After expiry the vendor keeps it for 90 days so the customer can extract it, then disables the account and deletes within 30 days.
Backups are never held beyond 90 days. Exhibit B sets out AES-256 encryption at rest, least privilege access and logical separation of each customer's data. It also commits to annual independent assessment against ISO 27001 and ISO 27017, annual third party penetration testing and Tier 3 or better data centers. The vendor keeps a subprocessor list and gives 60 days' notice before a new one touches customer data. Customers have 30 days to object, with termination and a pro rata refund if the objection is not resolved. The subprocessor list refuses automated access and was read through search results.
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
What the vendor stands behind is published and specific. Section 9.1 gives a defense and indemnity against third party claims that the Services infringe intellectual property rights, with three named exclusions. Section 9.4 sets out the remedies: procuring the right, modifying or replacing the service, or terminating with a refund of the prepaid balance. Section 10.2 caps each party at the greater of twelve months' fees or fifty thousand US dollars.
Section 10.1 excludes consequential loss for both parties, and 10.3 lifts both the exclusion and the cap for fraud, for the indemnities, for negligence causing death or personal injury and for willful misconduct. Section 8.3 warrants performance by qualified personnel to industry standards, that the Cloud Services are free of harmful code, and that they will perform substantially in accordance with the documentation.
Exhibit A adds a 99.9 percent availability commitment with service credits, and a right to terminate where availability falls below 99.0 percent in three months of any six. No insurance is stated, and nothing addresses liability for a wrong AI output specifically.
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations are named and their boundary is described, short of an implementer's account of what moves in which direction. The vendor publishes a Microsoft partnership page and describes a plugin connecting Microsoft 365 with iManage while keeping the repository as the single source of truth, sells a Model Context Protocol connection as an open standard that lets AI and legal technology tools reach iManage content without custom connectors, and states in the January 2026 release that the same underlying AI services expose content to third party applications through MCP with permissions and information barriers enforced and content never leaving the platform.
Access software (ndOffice equivalents, mobility clients) is defined in the agreement, and the Rio Tinto release describes API integration between iManage and that customer's own digital legal hub with iManage as the core content layer. The agreement is candid that third party products and any data transfer to them are between the customer and that provider, with no iManage warranty. Integration depth is not published; the MCP product page and partner directory were not read and may say more.
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The deployment model is stated clearly, with partial residency detail and a plain answer on where processing happens. Region is a defined term in the SLA, availability is measured per region with service credits, and DPA 12.4 states that all Customer Data is stored in the geographic region set out in the applicable Order. The same clause discloses that iManage may provide the Services from other regions, naming the United States, the United Kingdom, Canada, Australia and India, so iManage personnel there may have access to Customer Data.
DPA 12.1 warns that this applies even where the customer has agreed to hosting in the EEA or the United Kingdom. Transfers out of the EEA and UK run on the 2021 Standard Contractual Clauses with the UK Addendum, incorporated in Schedule 1. Exhibit B describes tenancy as logical separation of each customer's data. The list of regions a buyer can choose is not published on the surfaces read; it sits behind the Order and on the Cloud page, which was not read. iManage AI runs only on the cloudimanage.com endpoint.
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is contractually committed, and the evidence is available only on request. Exhibit B binds iManage to security practices at least as protective as ISO 27001 and ISO 27017 or equivalent standards, assessed annually by an independent third party, to annual independent penetration testing, and to a business continuity plan compliant with ISO 22301. On request, no more than once a calendar year and subject to the agreement's confidentiality terms, iManage will make available its ISO 27001 certification and SOC 2 or SOC 3 reports.
A customer may also commission its own audit once a year, at its own cost, through an accredited firm on twenty days' notice. No auditor, certificate number, audit period or report date is published. The trust center at compliance.imanage.com, hosted on Vanta, returns page metadata with no body on this channel, so whether anything there is self serve could not be established; it may say more.
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The architecture is described and change notice is contractual; the model providers are never named. AI processing stays on the iManage platform, with content not moved outside it, and the AI is available only on the cloudimanage.com endpoint. The subprocessor list names Microsoft Corporation (Azure). The DPA commits to 60 days' notice before any new subprocessor touches customer data, with an objection right and a termination remedy.
What is absent is whose models run. The AI page refers throughout to "our third-party model providers" without naming one, and no model is named anywhere. Naming Azure shows where processing happens, not whose model it is. The Microsoft relationship is described in product terms, a Copilot plugin and AI Services feeding Copilot, which is a different fact from the provider of the models behind Ask iManage. That gap is the one a client's AI clause asks about.
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The shape of the charge is visible and the number is not. Every path on the site ends at Book a Demo, and no price, band or unit figure appears on any page read. The AI FAQ states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be bought as additional products. The product catalog splits the platform into named modules a buyer can map to a quote. The agreement adds the mechanics.
Fees are set in the Order in a named currency, orders cannot be canceled and payments are not refundable, and each order renews automatically for one year terms unless either party gives 30 days' notice. Late payment accrues 1.5 percent per month, disputed fees must be raised within 30 days, and service credits are a percentage of one twelfth of the annual subscription fee. Section 3.2 confirms the license is per user by prohibiting multiple users from sharing a per user feature. Fees may also be set by a Partner rather than by iManage, which matters for a buyer purchasing through a reseller.
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment coverage is described with substance, and the boundaries are left open. The site has separate pages for global, midsize and small law firms and for financial services, accounting, government, media and entertainment and other knowledge workers. Department pages cover corporate legal, compliance, finance, human resources and knowledge management, and the customer evidence spans a US law firm and a global corporate legal department.
Practice coverage is described through the work the AI does, not by practice area. It answers questions across the repository, extracts clauses, compares redlines, summarizes, structures results into tables by attributes such as judges and jurisdictions, and applies a corporate legal team's contract playbook, with transaction work covered by Closing Folders. Nothing published states what is not supported: no practice area, jurisdiction or language is named as out of scope.
The one limit the vendor states is technical: AI capabilities exist only on the cloudimanage.com endpoint, and customers are still being migrated there.
The public pages on file for iManage, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
Primary Law Corpus Provenance, Good Law Verification, Refusal and Uncertainty Behavior and 1 more
Read Sep 7, 2026
Client Data in Training, Prompt and Output Retention
Read Sep 7, 2026
Third Party Request and Subpoena Notice, Outside Counsel Guideline Readiness
Read Sep 7, 2026
Ethical Walls and Matter Segregation, Bar Guidance Alignment
Read Sep 7, 2026
Fabricated Citation Record
Read Sep 7, 2026
Court Disclosure Support
Read Sep 7, 2026
iManage released a ChatGPT plugin as part of OpenAI's Astra for Law launch. A lawyer can draft a document such as a negotiation brief in ChatGPT and save it straight to the matter file in iManage.
A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Can material a lawyer puts into this product be used to train a model?
A public policy or trust page states no training on customer content, with no matching term located in the published agreement.
A product page states no training, and the published agreement has no matching term. The AI page answers the question for both iManage and its model providers and extends the promise to AI inputs and outputs, adding that data in the cloud is encrypted and that iManage does not have access to the underlying content. Two qualifiers come with it. The sentence is prefaced "by default". The same answer discloses that customers may opt in to certain services that let iManage collect limited insights for the sole purpose of improving those services, described as optional and disclosed at the time of use.
Nothing published says what an insight is or whether it can reach document content. The Cloud Services Agreement and its Data Protection Agreement were read in full and never name training. Processing is confined to Documented Instructions and to incidental business operations: delivering functionality, fixing problems and providing support. A separate undertaking bars deriving information from customer data for advertising or similar commercial purposes and selling personal data. The agreement is silent on training either way. Agreement, DPA and AI page read 7 September 2026.
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Retention is acknowledged and no period is published for what a lawyer types. The vendor states that data processed by iManage AI stays on the platform under the same governance as everything else, which answers where it goes and not for how long. The document regime around it is precise: under the Data Protection Agreement the customer can access, extract and delete Customer Data at any time during the term, iManage keeps it for 90 days after the subscription ends so the customer can extract it, then disables the account and deletes within 30 days, with backups never retained beyond 90 days, and the platform sells Records Manager and Disposition Manager for the customer's own retention policies.
None of that is stated to apply to Ask iManage prompts and generated answers specifically, and no zero retention option is offered anywhere located. Reading the repository regime across to prompts would be an inference. AI page, agreement and DPA read 7 September 2026.
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Retrieval enforces the source system access model at query time, per user, and the vendor documents it.
Retrieval enforces the firm's own access model at query time, and the vendor documents it, since iManage is itself the source system. The January 2026 Ask iManage release states that all AI interactions stay inside the governed platform with native enforcement of permissions, information barriers and security policies, and that content is not moved outside the environment. The same applies to third party tools reaching content through the Model Context Protocol.
Security Policy Manager is sold as a product for building those barriers with multi level security, and the product page describes the assistant as aware of permissions and respecting access and metadata. What is not published is the enforcement point: whether a barrier is applied before the search runs or filters results afterwards, which decides whether an agent can infer that walled content exists. Release text of January 2026, Ask iManage page and Security Policy Manager page read 7 September 2026.
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
The agreement commits to notice where lawfully permitted and adds a protocol for law enforcement requests. Section 6.4 obliges the receiving party, before disclosing compelled confidential information, to notify the disclosing party in writing so it can oppose the disclosure or seek a protective order, and to give reasonable assistance, with any disclosure limited to the portion legally required. Under section 6.5, iManage will not disclose to law enforcement unless required by law and will try to redirect the agency to the customer.
If compelled, it will notify the customer and provide a copy of the demand, assess the legitimacy of the request including the sender's identity, seek clarification of scope and oppose blanket requests. It will not give any agency unfettered access, the platform encryption keys or the ability to break the encryption, or access where iManage knows the data is to be used for purposes other than those stated. No transparency report or request statistics were located. Agreement read in full 7 September 2026.
Where does the law in this product come from, and does the vendor have the right to use it?
Sources are identified without stating the license or rights basis.
The source behind the answers is identified, and no license basis is stated because none is the vendor's to give. Ask iManage answers from the firm's own repository and cites back to it, and the vendor stresses that it uses the firm's actual documents and never leaves iManage Work. No external collection of law, filings or public material was located anywhere in the product, and no third party content source is named.
The rights basis for the material the AI reads sits in the agreement, not in a license: section 8.4 has the customer warrant that it has the necessary rights and consents in the Customer Data, and section 5.2 leaves ownership with the customer. Questions about licensed legal content do not arise for a product whose source is the buyer's own filing system. Ask iManage page and agreement read 7 September 2026.
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No located public material addresses whether authority is checked for subsequent history. The assistant answers from the firm's own documents and emails and cites to them. Nothing read describes a citator, a treatment signal or a prompt to verify legal authority, and the product does not claim to retrieve reported cases. A firm using Ask iManage to find a precedent in its own files would still rely on a separate research tool for good law status. Ask iManage page, AI page and January 2026 release coverage checked 7 September 2026.
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No located public material describes what the product does when it cannot ground an answer. The published three step method covers interpreting the question, retrieving the most relevant material and generating a cited answer, and stops there. The product page claims grounded outputs rather than hallucinations because the system draws only from real documents, which is a claim about the source material, not a described path for declining to answer.
No confidence score, no state for having no answer, and no evaluation showing either was located. Ask iManage page, AI page and release coverage checked 7 September 2026.
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
No court order, opinion or disciplinary record naming iManage or Ask iManage was located as of 7 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on both names together with a general search of the sanctions coverage; the decisions that name products built for legal work name other vendors. This is a statement about the public record, not a finding about the product. Exposure is structurally low for an assistant that answers from a firm's own repository and cites to documents the firm already holds rather than generating legal authority.
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Public materials refer to professional responsibility in general terms without naming guidance.
Professional obligations are engaged in general terms, and no AI guidance is named. The vendor frames the AI around explainable and auditable outcomes in regulated settings, information barriers and conflicts management. It states that its platform approach lets organizational data be used securely, responsibly and ethically, and its essay series addresses how law firms should approach AI adoption. None of it names an ABA formal opinion, a state bar opinion, a regulator's AI guidance or a court's standing order.
The professional responsibility material that does exist is about confidentiality and conflicts, which is covered under ethical walls and confidentiality. AI page, Ask iManage page, essay listings and January 2026 release coverage checked 7 September 2026.
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure, and the product sits inside a fee relationship between a lawyer and a client where those savings would change the bill.
The product sits inside law firms' fee relationships with their clients and the published position on the bill is a savings claim. The AI is sold on accelerated productivity, reduced manual effort and time reclaimed for work of greater value, and the January 2026 release describes attorneys reaching an answer instead of wading through search results; the platform is sold to law firms that bill clients for the work it speeds up.
Nothing located addresses how AI assisted work is recorded against a matter, whether compressed time is disclosed to the client, or what a firm should say when research that took hours now takes minutes. The vendor sells products adjacent to time recording and a conflicts and intake product, and neither is presented as answering the fee question. Ask iManage page, AI page and release coverage checked 7 September 2026.
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
A current subprocessor list is published with contractual change notice, and the model provider is not named. A firm can forward a maintained subprocessor page naming Microsoft Corporation (Azure), with an email subscription for change notices. It can also forward the Data Protection Agreement, published in full as Exhibit C to the public Cloud Services Agreement with the 2021 Standard Contractual Clauses and the UK Addendum in its schedule, and a security exhibit setting out the controls.
The DPA commits to 60 days' notice before a new subprocessor touches customer data, a 30 day objection right and a termination remedy if the objection is not cured. What a client's AI clause turns on is missing: the AI page refers to "our third-party model providers" and never names them. Naming Azure states where processing runs, not whose model reads the documents, so a firm can show its contracting position and cannot answer the model question. Agreement, DPA and subprocessor list (read through search results) read 7 September 2026.
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Elements of a record exist without an export built for disclosure. Each answer is anchored with citations so a user can verify the sources it rests on, the vendor describes AI outcomes as explainable and auditable in regulated settings, and the platform sells Threat Manager for monitoring user activity and audit reporting across the repository. Between them a firm can show which documents an answer drew on and who accessed what.
What is not published is an export for each document covering the model used, the retrieval performed and the human verification applied, and no disclosure template or guidance for a court's standing order on AI use was located. January 2026 release coverage, Ask iManage page and product catalog checked 7 September 2026.
Every grade and every signal on this index is drawn from public sources and dated. If a record is wrong, out of date, or missing an artifact the index did not locate, send the source and it will be reviewed and the record redated. Vendors are welcome to submit documentation. Nothing on this index is for sale, including a listing, a placement, or a grade.