J

Jurimesh

Remove the models and nothing remains to sell. The agreement defines the Solution as a proprietary software platform that uses artificial intelligence to speed up legal due diligence. Customers upload legal and business documents, and the platform analyzes them and extracts insights, so AI is the definition of the product. Every published function is inference over an uploaded set. The platform recognizes and classifies documents against a request list, analyzes gaps in what the seller provided, runs more than a thousand authored legal checks across the data room, extracts risk provisions, and generates the due diligence report.

There is no document management layer underneath, by design. The product connects to the customer's existing data room rather than replacing it, so without the models what is left is a connector to someone else's repository.

Grounding is documented as a mechanism rather than claimed as a quality, and none of it is measured. The stated design checks every clause in the data room against risk guides written by experts and cites every finding back to its source. Findings are shown against the clause and schedule they rest on, and the company says its check library is written by named practitioners whose reports it publishes separately. For a diligence product, an authored rule set plus a citation to the source text is a substantive answer to fabrication.

No accuracy figure, evaluation, test set, error rate or failure mode statement appears anywhere, and there is no accuracy or benchmark page. The agreement runs the other way: article 3.5 disclaims any warranty that the Solution will perform without error and makes the customer responsible for verifying the accuracy and validity of all output. The published figures measure throughput, not accuracy.

Review is built into the artifact and the threshold at which the agents act alone is unstated. The oversight surfaces are real and specific: findings are cited to the clause so a reviewer can open the source, the workspace carries per-item review states with named reviewers and timestamps covering reviewed, waiting for review and modified, and the security page commits that every user action is recorded in full audit trails.

The agreement adds the obligation rather than leaving it implied, article 3.5 making verification of all output the customer's responsibility and article 4.1.3 requiring the customer to cease use immediately and notify Artificieel on observing any deficiency. What is missing is the machine's own account of itself. Nothing states what the agents do unattended, what routes a finding into review as against straight into the report, what happens when a check misfires, or whether generated text is marked as generated.

The product is marketed as handling the entire diligence process, which makes the unstated boundary the live question rather than an academic one.

Named customers with roles and firms, published figures, and no link between them. Three testimonials carry full attribution, each linked to its own customer story: Bas Mees, Partner M&A at Rutgers and Posch; Christopher Tournis Gamble, Managing Partner at WAD Capital; and Hans Kayaert, General Counsel at Aikido. Tournis Gamble's account is the most operational, describing work a legal team would take months over completed in a couple of hours.

The company's funding release adds Davy Gorselé, managing partner at Quorum. Eleven organizations appear as logos, including Andersen, Van Benthem and Keulen, Vriman, One Peterson, Around Partners, Vybros, 9Corporate and Lighthouse. The site also publishes sixty to eighty percent less manual review, attributed to customers generally, a first pass review of a data room in under twenty minutes, four thousand contracts screened and more than a thousand authored checks.

None of those figures is tied to a named firm or dated, and no method is published. The name Hans Kayaert also appears in the company's funding announcement as the representative of Syndicate One, the lead investor.

A published agreement that names professional secrecy and stops short of treating it. Article 10.2 records that Artificieel acknowledges Confidential Information may be covered by the customer's professional secrecy. Article 10.4 commits that the AI models are not trained on the customer's Confidential Information without explicit consent. Article 9.3 allows anonymized and aggregated data to be collected to improve the Solution only if it does not include or reference any User Content, unless the customer expressly authorizes that in writing.

Article 9.2 licenses User Content solely to provide the Solution, and the security page says documents, findings and data rooms never leave their tenant, alongside SSO and full audit trails. The data processing policy binds personnel to written confidentiality and limits access to those doing the work. Two gaps remain: professional secrecy is acknowledged but given no handling treatment, and no separation by matter inside a customer is described. The confidentiality obligation also expires three years after termination.

Nothing published addresses the advice line, on a product that produces the due diligence report a transaction is priced on. No statement says Jurimesh or Artificieel is not a law firm or that output is not legal advice. Nothing describes the professional judgment a lawyer must apply before a finding reaches a client, and no jurisdiction limit, supervision or competence language is published. The agreement, the natural home for such a clause, has none.

Article 3.5 requires the customer to verify accuracy and validity, which concerns correctness rather than advice, and articles 4.1.6 and 4.1.7 allocate responsibility for input and regulatory compliance without touching the question. The exposure is real: the product classifies contractual risk, flags uncapped indemnities and change of control triggers, and generates the report itself. Searched the home page, the security page, the terms and conditions, the data processing policy and the subprocessor page; the product and solutions pages were not opened and may say more.

No governance position is published. There is no responsible AI page, principles statement, accountable owner for model behavior, evaluation regime before release or AI management system such as ISO 42001, and nothing addresses uneven output. Two points sharpen the gap. The vendor is established in Belgium and sells into EU legal transactions, yet nothing published engages the EU AI Act. Its policy set otherwise cites the GDPR, the Belgian Privacy Law and the ePrivacy Directive by name.

And the product's main asset is an authored check library, which raises governance questions the site does not answer: who writes a check, how it is reviewed, and how a firm would know when one is wrong or out of date. ISO 27001 is an information security standard, not AI governance. Site navigation and footer inventoried 5 September 2026.

Most of the ground is covered with real specificity, and the technical annex sits behind a portal that was not opened. Retention and deletion are stated as periods. On termination live data is deleted within thirty business days and backups overwritten within a further ninety days, after a twenty day export window, and the processing annex keeps account and support data for one year after termination. Access is bounded: SSO, full audit trails of every user action, personnel under written confidentiality agreements, and access limited to those doing the work.

Incident practice is committed: notification without undue delay with the information the GDPR requires, and help with the customer's own reporting duty. A versioned subprocessor register is published. The readable pages give no encryption standard, key management or tenancy architecture, because Annex II of the data processing policy refers all technical and organizational measures to the trust center, which was not opened and may say more.

A real two sided position, published and readable before signing, short of any warranty on output. Article 8.5 commits Artificieel to indemnify, defend and hold the customer harmless for direct damages from its own breach of the agreement and from infringement of third party intellectual property in connection with the Solution. Article 8.2 sets a sequence of remedies rather than a bare cap: renewed performance first, then, where that is no longer possible or reasonable, compensation for direct damage limited to fees paid in the preceding twelve months.

The data processing policy mirrors this, with mutual indemnity for breach of the policy or privacy law and the same twelve month ceiling. Against that, article 3.4 provides the Solution as is, article 3.5 disclaims any warranty of error free performance, article 8.1 excludes indirect and consequential loss including data loss, and article 8.3 lists further exclusions. Nothing warrants that a finding is correct, no service credit exists and no insurance position is published.

Named connections into the systems where the work lives, with the purpose of each stated, short of documentation for implementers. Six counterparties are named on the home page as the product's premise: Ansarada, Virtual Vaults, HighQ and iDeals among virtual data rooms, and Google Drive and SharePoint for file storage, under a claim of direct integrations with every major VDR. The workflow is described: the platform reads the seller's data room, recognizes every document and maps it to the buyer's request list, and works alongside a firm's existing VDR rather than requiring migration.

For a diligence tool the data room is the integration that matters, and it is named. No field mapping, sync direction, trigger condition or permission model is described, no API or developer documentation is published, and nothing addresses document management, matter management or billing systems. The dedicated integrations page was not opened and may say more.

Residency is answered fully, and tenancy is asserted rather than described. The security page says all data is stored and processed only within the EU on infrastructure certified to ISO 27001. The data processing policy makes that contractual at article 7.1, and article 7.2 sets out the safeguards for any transfer outside the EEA: adequacy decisions, the 2021 standard contractual clauses with a transfer impact assessment, binding corporate rules and certification mechanisms.

The subprocessor register names the contracting entity and hosting location for each provider, showing that Google Cloud EMEA, Microsoft Ireland and AWS EMEA SARL all host in the EEA. On tenancy the site offers one sentence, that documents, findings and data rooms never leave the tenant they belong to. That asserts isolated tenants without describing the model, and no dedicated, single tenant or self hosted option is offered at any tier. The technical architecture sits in the trust center, which was not opened.

One named standard is claimed as achieved and a second as in progress, with no scope behind either. ISO 27001 is stated as certified on the home page, the security page and every page footer. The CTO's signed note repeats that the certification is maintained, and the company says regular third party audits and penetration tests validate its controls. SOC 2 is labeled as being implemented, so a buyer is told plainly which standard has been achieved and which has not.

A trust center at a published subdomain is linked from every page footer and from the data processing policy as the home of the technical and organizational measures, and a public status page sits alongside it. No certification body, certificate number, expiry, scope or statement of applicability is published, and no audit or penetration test summary is offered. The trust center was not opened, so its contents and whether access is self serve or gated were not established.

The model layer is the gap in an otherwise well disclosed record, and the detail elsewhere makes it visible. The vendor's funding release says the platform uses large language models, and the agreement defines the Solution as using artificial intelligence, but no model, version, provider or hosting arrangement for the model layer is named, and no commitment to notify customers of a change is published. The subprocessor register, versioned and dated 20 April 2026, lists eight processors with contracting entity, jurisdiction, nature of processing and safeguard for each: Google Cloud, Microsoft Azure, Amazon AWS, ConvertAPI, HubSpot, Slack, tl;dv and Sentry.

Those are cloud infrastructure and business tools. The only AI provider named in the document, Anthropic, appears as the processor inside tl;dv, the vendor's meeting recording tool, not as anything touching a customer's data room. The architecture is described, but whose model reads the deal is not.

The metering model is published in detail, and no figure appears anywhere. There is no pricing page and the only commercial route is a demo request, but the agreement sets out the unit and its arithmetic. The unit is a Transaction, covering the documents for one corporate transaction such as an acquisition, investment or restructuring, and consumed when the analysis completes. Each Transaction covers up to 1,500 documents, with another charged for each further block of 1,500 or part of one.

A document over fifty pages counts as one document per fifty pages, and a set under 150 documents is charged at half a Transaction. Use beyond the purchased allocation costs the Transaction price plus twenty five percent, and unused Transactions expire at the end of a term with no carry over or refund. Fees are in euro excluding VAT, invoices are due in thirty days, price changes need two months notice, and annual indexation follows a formula tied to the Agoria wage index. A buyer can model the shape of an invoice but cannot learn the rate.

Three buyer segments are defined by what each wants, and the practice boundary is never drawn. Law firms, private equity and corporate in house teams each have a dedicated page. Law firms are told diligence can move from a cost center to a profit center, private equity is offered a fast read on a target's risk, and corporate teams are offered diligence in house. Practice depth is narrow by design: transactional diligence for mergers, acquisitions, investments and restructurings.

Named customers are M&A practices and investment firms in Belgium and the Netherlands. Jurisdiction is absent, and on this product that matters. The value rests on more than a thousand authored legal checks, and nothing says which legal systems they are written for, whether a Belgian check applies to a Dutch or German target, or which languages document recognition supports. No firm or deal size band is given either.