LawVu

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are the engine of a core capability layered on a platform that would function without them. LawVu sold as a legal workspace for a decade before the AI layer: matters, contracts, intake, spend, reporting and a document repository are workflow and record keeping capabilities that operate with no model behind them, and the vendor's own capability navigation lists them separately from its AI. What the models drive is substantial rather than peripheral, which is why this is not a C: LawVu Intelligence spans an assistant, a self service agentic workflow builder, AI powered intake triage and a drafting and review toolbox in Microsoft Word. The June 2026 LegalOS launch reframes the whole platform around the AI layer, but the underlying workspace predates it. Seventh B on this axis, consistent with the other enterprise workflow platforms on this index.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is asserted without measurement and the grounding method is described only at feature level. The strongest published element is architectural rather than evidential: LawVu Draft works from the customer's own clauses, precedents and playbooks, so drafting output is anchored to material the customer supplied and can check, and the trust centre carries a section headed Reliance which on its face addresses reliance on output. Searched the trust centre index, the AI governance page, the platform pages and the Microsoft connector documentation on 29 Aug 2026 and located no accuracy figure, no hallucination rate, no test set, no evaluation methodology and no independent benchmark participation. The Reliance page and the AI security and privacy FAQ were not retrieved in this pass and are the two documents most likely to move this row.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A real control structure, published as a product capability rather than as a policy statement. Agentic workflows are built by the customer through a self service workflow builder, so what an agent is permitted to do in a given workflow is defined by the legal team rather than by the vendor, which is a more concrete allocation of authority than a human in the loop assurance. AI powered intake triage routes work rather than deciding it. The trust centre publishes a dedicated Reliance section, which is an unusual thing for a vendor to name and on its face addresses how far output may be relied on. Not located as of 29 Aug 2026: any threshold at which an agent stops or escalates, what the vendor commits to when an output is wrong, and the contents of the Reliance section itself, which was not retrieved in this pass.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Named customers with published stories, short of figures and method. Three customer stories are featured with the organisation named: Property Finder on accelerating legal operations, Dentsu on uniting legal teams across more than 40 markets, and Sizzling Platter on scaling legal operations. A full customer stories index is published and is filterable by region across Asia-Pacific, North America, the United Kingdom, Europe and the United Arab Emirates, which lets a prospect find a reference in their own market rather than taking a global claim on trust. Independent review presence exists on G2. Searched the customer stories index, the platform pages and the resources library on 29 Aug 2026 and located no quantified outcome tied to a named customer, no dated case study and no assessable method. Named organisations without figures is the B band.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

A substantial compliance framework is published without the specific limbs this axis tests being reached. Established: an information security management system designed against ISO 27001, SOC 2, SOC 1 and HIPAA, ISO 27001 certified since April 2019 with annual internal and external audits, a statement of applicability available in the security pack, a risk treatment standard applying ISO 27001 controls against a confidentiality, integrity and availability matrix with senior management review, and a stated practice of quantifying risk and implementing controls before any external party is granted access to sensitive data. The vendor also publishes a dedicated AI security and privacy FAQ and states AI data governance sits within the scope of its security and privacy compliance programme. What was not reached in this pass, and what holds this at C: that FAQ itself, which is where a training position, retention terms and any segregation model would sit. No statement on whether customer content may be used to train models was located, no retention or deletion terms, and no segregation model. This row is rebuttable in one step by retrieving the AI security and privacy FAQ.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The audience is corporate and the product is deliberately extended beyond lawyers, with no position on the boundary published. The buyer is the in house legal team, with dedicated pages for general counsel and chief legal officers, legal operations, IT teams and teams with no existing legal technology. But LawVu Assistant is positioned explicitly as the AI legal assistant for legal and the business, and intake is sold as self service triaging, so business users interact with AI generated legal output by design. Searched the trust centre, the platform and solutions pages and the resources library on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits despite customers across five named regions.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

A published governance framework with real structure, short of certification, testing results and bias disclosure. The trust centre carries a dedicated AI Governance section and a separate AI Principles page, described as guidelines the vendor developed for its own use and development of AI tools, so the principles are a standing artifact rather than a marketing line. Governance is placed inside an existing assurance regime rather than alongside it: AI privacy and data governance is stated as provided within the scope of the security and privacy compliance programme, which is ISO 27001 certified with annual external audit, and a dedicated AI security and privacy FAQ is published. Not located as of 29 Aug 2026: an AI management certification such as ISO 42001, a named owner of model governance, published pre release testing results, and any disclosure about uneven output across matter types, parties or populations. The AI Principles page content was not retrieved in this pass.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Substantive published policy covering most of the ground, with the assurance regime documented at an unusual level of process detail. Published: ISO 27001 certification held since April 2019 and maintained through annual internal and external audits with the statement of applicability available; SOC 1 first audited February 2021 with the full report in the security pack; SOC 2 described as regularly refreshed and covering security, availability and confidentiality; HIPAA named among the frameworks the management system is designed against; a risk assessment standard using a confidentiality, integrity and availability matrix with treatment requiring ISO 27001 controls, senior management review of residual risk, and reassessment triggered after any major change; and a stated requirement that risks from external parties are quantified and controls implemented before access is granted. A public system status page is published. Not located as of 29 Aug 2026: a stated retention period or deletion control, a named subprocessor list, and an incident or breach notification practice.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Searched the trust centre index, the compliance and AI governance pages, the website terms, the mobile app terms and the platform pages on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer master agreement was located as published on the property. Recorded as a pure absence on the surfaces reached. Noted as the one place where this vendor's otherwise well organised trust centre has nothing: it publishes separate sections for security, privacy, compliance, reliance, AI governance and AI principles, and none of them addresses who bears the loss when an output is wrong. Rebuttable with one link.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

The strongest integration position in this category and among the better ones on the index, documented by a third party as well as by the vendor. LawVu Draft is embedded natively in Microsoft Word rather than connected alongside it. A Microsoft Power Platform connector is published in Microsoft's own connector catalogue covering Copilot Studio, Logic Apps, Power Apps and Power Automate, with prerequisites, publisher, support contact and regional availability documented including the specific regions excluded, which is implementer level documentation maintained by the platform owner rather than by the vendor. The vendor additionally ships an MCP server, publishes a dedicated integrations page and operates a developer centre at its own subdomain, so a customer can build against the platform directly rather than waiting for a connector. Spend management includes outside counsel collaboration, so the integration extends to parties outside the customer. Short of nothing material on this axis; no legal document management connector such as iManage or NetDocuments was located, which matters less here because the buyer is an in house team using the platform as its own repository.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery and the hosting platform are stated and residency is not addressed. The vendor states its AI operates within its existing Microsoft Azure ecosystem, which identifies the platform, and it serves customers across five named regions being Asia-Pacific, North America, the United Kingdom, Europe and the United Arab Emirates. Searched the trust centre index, the security and compliance pages and the Microsoft connector documentation on 29 Aug 2026 and located no named Azure regions for customer data, no customer selectable residency, no tenancy model, and no statement of where processing happens as distinct from where data is stored. Serving customers in five regions is a market statement rather than a residency position and was not treated as one. For a New Zealand headquartered vendor selling into the United Kingdom, Europe and the Gulf, published residency options would be expected.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real, dated and accompanied by scope evidence, short of auditor identification and an open report route. ISO 27001 certification has been held since April 2019 and is maintained through annual internal and external audits, and critically the statement of applicability is available alongside the certificate, which tells a reviewer which controls the certification actually covers rather than only that it exists. SOC 1 was first audited in February 2021 with the full report available, and SOC 2 is described as regularly refreshed covering security, availability and confidentiality. HIPAA is named among the frameworks the management system is designed against. A structured trust centre is published with separate Security, Privacy, Compliance, Reliance, AI Governance and AI Principles sections and a public system status page. Access runs through a requestable security pack described as containing everything needed to start a security assessment, which is a self serve request flow rather than a sales gate. Short of an A because no auditing firm is named for any certification, no SOC 2 type designation or coverage period was located, and no certificate is published without the request step.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The hosting environment is identified and the models are not. The vendor states its AI capability is provided within its existing Microsoft Azure ecosystem, which locates the processing environment and is more than several records here disclose. Searched the trust centre index, the AI governance page, the platform pages and the Microsoft connector documentation on 29 Aug 2026 and located no named model or model provider, no statement of which models serve which capability, no subprocessor list, and no commitment to notify customers when the supply chain changes. The AI security and privacy FAQ was not retrieved in this pass and is where such disclosure would sit if it exists.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

A plans page is published in the primary navigation, which is materially different from the demo only pattern that dominates this index, and the vendor separately publishes a return on investment calculator among its buyer resources. That a prospect is offered a plans page at all indicates some packaging is disclosed. What was not established in this pass is what that page contains: it was not retrieved, so no rate, unit of charge or tier structure is confirmed, and the record does not assume any. Recorded at C on the strength of a published plans entry point rather than higher, and flagged as rebuttable in one step by retrieving the plans page. Checked the trust centre, the platform pages and the resources library on 29 Aug 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Who the product serves is documented precisely across three dimensions, each with its own published pages. Eight industries are named individually: healthcare, higher education, software and technology, financial services, government, energy, manufacturing and insurance. Four buyer roles carry dedicated pages: general counsel and chief legal officers, legal operations, information technology teams, and teams with no existing legal technology, the last being an explicit statement about maturity level rather than sector. Geographic coverage is enumerated by region with customer references filterable in each: Asia-Pacific, North America, the United Kingdom, Europe and the United Arab Emirates. Functional scope is stated at capability level across intake, matters, contracts, spend, reporting and documents, with contract lifecycle and spend management described as addable modules rather than bundled, so a buyer learns what is core and what is optional. The self limit is clear and consistent: this is an in house legal function platform, and nothing on the property claims law firm practice management or litigation capability.