LawX
LawX is a German practice operating system for notaries' offices and law firms that runs a matter from opening to invoicing in one place. It creates the matter and pulls party details from official registers, prepares deeds and drafts from the firm's own templates directly in Word, reads land register extracts, handles execution and export to XNP, raises the invoice, and gives the office a dashboard with task prioritisation and a structured export of the case file. Email is integrated with automatic assignment to the right matter, and there are interfaces to the commercial register and Microsoft 365. The AI sits across those steps rather than in a separate assistant: it checks entries for gaps, suggests wording in context, proposes next steps on a matter, adapts template use, and prepares execution, with the published principle that the professional approves before anything happens. A partner network adds accounting with a DATEV interface, an AI telephone assistant, automated anti-money-laundering checks covering beneficial owners and sanctions lists, notary escrow accounts, and AI training for firms. The product is priced openly at 159 euro per licence per month on annual payment, with onboarding, data migration and support included. LawX hosts customer accounts in ISO 27001 certified German data centres holding a BSI C5 attestation, enters professional confidentiality undertakings once mandate data is processed, and says its own ISO 27001 certification is in preparation. It maintains an exchange with the Federal Chamber of Notaries and regional chambers and appears on the chamber's register of notarial software. Proven first in notarial practice, it is now being offered to law firms. LawX GmbH is based in Berlin and raised a 7.5 million euro seed round led by Motive Partners in May 2026.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The machine learning is a real layer across a conventional system rather than the thing being sold underneath it. What the buyer licenses is a practice operating system: matter creation, deed preparation, execution and XNP export, invoicing, a dashboard with task prioritisation, structured case file export, and interfaces to the commercial register and Microsoft 365. Strip the models out and a working notarial practice management system remains. The AI layer is genuine and specific rather than decorative, covering AI-based checking of incomplete entries, context-sensitive wording suggestions, a land register assistant that reads extracts, communication assistance, automated execution preparation, intelligent matter suggestions and adaptive template use, and the company brands the whole product as an AI-supported operating system. That branding is not what the band measures. Checked 4 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is asserted without measurement and hallucination is not addressed anywhere. The published claims are outcome claims: automated checks mean matters run reliably from the outset, error sources are minimised, excellence becomes the standard rather than the exception. None carries a figure, a test set, a method or a date. What does exist is structural grounding rather than described grounding: outputs are built from the firm's own templates and from data read out of the commercial register and the land register through named interfaces, so a drafted deed starts from official register content and a stored precedent rather than from model recall. That is a real architectural constraint and it is why this does not sit at the floor. Nothing published describes what happens when the model is wrong, no accuracy evaluation is linked, and the words hallucination and error rate appear nowhere on any surface read.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
A written commitment that the professional approves, with a review point visible in the product. The automation section of the pricing page is headed with the principle directly: Sie geben frei, you release it. The product illustration carries the same shape, showing the assistant proposing a matter update and then asking the user to confirm it is correct before applying it, so the approval step is a described interaction rather than an aspiration. The positioning reinforces it, with routine processes running in the background so the professional concentrates on the legal substance and has more time for substantive review. What is absent is the rest of the control structure: no threshold is published at which the system defers or escalates, nothing states which steps run unattended against which require approval, and nothing addresses what happens after an error reaches a deed or an execution filing.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Logos stand in for evidence on the surfaces read. Roughly seventeen unlabelled marks appear on the home and pricing pages under a heading describing experienced practitioners accompanying the product, with no indication of which are customers, which are advisers and which are media. The claim that the product is proven in notarial practice is made without a named office behind it. One genuinely third-party marker is published and is worth recording: LawX appears on the Federal Chamber of Notaries listing of software houses for IT use in the notarial office, which is a professional body's register rather than a vendor claim, and the company states it maintains an exchange with the chamber and regional chambers and contributes to specialist committees. No named customer, no figure, no matter volume and no date appears on any surface read. A dedicated customer page exists in the navigation and was not opened in this pass; it is the cheapest available upgrade on this record.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The professional secrecy limb is met directly and in the German idiom, which is what this axis exists to find. The security page commits to concluding professional confidentiality undertakings as soon as mandate data is processed, which is the obligation that carries the notary's and lawyer's duty of secrecy onto the vendor's staff rather than a generic confidentiality clause. Processing is described as compliant with both data protection law and professional law throughout. Segregation is documented at feature level with role-based rights management and logging of access, alongside client structure and multi-location capability. Residency is specific, with accounts hosted in German data centres. Encryption is stated at TLS 1.2 or higher in transit and AES-256 at rest. Three limbs are missing entirely and hold this at B: nothing anywhere states whether customer or mandate data is used to train models, no retention or deletion position for mandate data exists, and no model provider is identified, so what any underlying provider may retain is unstated. The published privacy policy covers website use and the pre-contractual sales process only, and expressly defers processing under the customer relationship to a contract that is not published.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
A real published position on professional responsibility, short of the full treatment. Compliance with professional law is stated as a design principle rather than a footnote, with the security page headed on the point and data processing described as compliant with both the GDPR and professional law. The company publishes an active relationship with the profession's regulator, stating that it maintains a close exchange with the Federal Chamber of Notaries and regional notary chambers and contributes expertise to specialist committees, and it links the chamber's own register of notarial software. The professional's role is addressed rather than assumed: routine processes run in the background so the professional concentrates on the legal substance, and the approval principle places the release decision with the office. What is missing from the top band is an express statement of what the output is and is not. Nothing says the product does not give legal advice, nothing addresses the boundary between a prepared draft and a professional's own judgement, and no jurisdiction limit is stated, although the whole product is built around German notarial and court procedure.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
No governance position is published for the product. There is no responsible AI statement, no governance framework, no named owner accountable for model behaviour, no evaluation or testing regime for output quality, no published results and nothing at all on bias. Two published items sit close to the subject and neither answers it. The privacy policy states that no automated decision-making or profiling within the meaning of Article 22 GDPR takes place, but scopes that expressly to operation of the website and to contract initiation and performance rather than to the product's processing of mandate data. And the EU AI Act appears only through a partner's training offering, which sells firms a course on meeting AI Act compliance requirements, so it is a service sold alongside the product rather than a statement of the vendor's own governance. A data protection officer is named, which is a data protection role and not an AI one. Searched the home page, product, pricing, security and privacy pages on 4 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy across most of the ground, with the matter-data half missing. What is published is specific: hosting of customer accounts in ISO 27001 certified German data centres holding a BSI C5 attestation, TLS 1.2 or higher in transit and AES-256 at rest, role-based rights management with logging of access, access control and login logs, and regular audits and tests described as an ongoing process rather than an event. Governance of personal data is properly staffed, with a named data protection officer and a stated supervisory authority. The privacy policy publishes a full named processor list for the website and sales process, covering Framer, Microsoft Deutschland, Attio, Intercom, Mailchimp, Luma, Typeform, Posthog, Google Ireland, Calendly and TeamViewer, with third-country transfers addressed under the Data Privacy Framework and Article 46 safeguards and an unusually frank statement of the residual FISA risk. What is absent is everything covering mandate data after processing: no retention period, no deletion commitment, no incident or breach notification practice, and no processor named for the AI itself. The privacy policy states in terms that it covers website use and pre-contractual measures, with the customer relationship governed by a contract that is not published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Nothing is published on who bears the loss when the system is wrong. There are no general terms and conditions, no customer agreement, no master subscription terms and no service level document anywhere on the site. The navigation carries Product, Solutions, Customers, Pricing, Security and a company menu; the footer carries an imprint, a privacy policy, careers and support. The imprint is the disclosure German law requires of any commercial website and says nothing about the contract. No indemnity, no liability cap, no warranty, no uptime commitment and no insurance position was located, and the privacy policy is the only legal instrument published, expressly scoped to the website and the sales process. A buyer evaluating a system that prepares deeds and executes filings has nothing to read on allocation of loss before entering a sales conversation. Searched the home page, product, solutions, pricing, security, privacy and imprint links and the full footer on 4 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The integrations are named, specific to the jurisdiction's actual infrastructure, and described in terms of what moves. Into the office: Microsoft 365 with Outlook and Word named, with drafts and letters prepared directly in Word, and email integration that assigns incoming mail automatically to the correct matter. Into the official systems that notarial work runs on: a commercial register interface, a land register assistant that reads extracts intelligently, and export to XNP, the electronic notarial filing standard, including into the deposit register for escrow. Outward: structured export of case files, so a customer can leave with its data. Through named partners: a DATEV interface for accounting and e-invoicing, transparency register extracts and sanctions screening in the anti-money-laundering workflow, and escrow account opening with transactions flowing back into the LawX file. Onboarding covers data migration explicitly, and the product is documented as able to run in parallel with an incumbent system rather than requiring replacement, which is the practical question an implementer asks first.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Residency is published precisely and tenancy is not addressed. The security page states that the customer's account is hosted in ISO 27001 certified data centres in Germany holding a BSI C5 attestation, and describes the arrangement as compliant with both data protection law and professional law. That is a specific country, a named certification regime for the facility and a named German federal attestation standard, which is a good deal more than a region label. What is absent is the tenancy limb and the processing limb. Nothing states whether the platform is single or multi-tenant, no dedicated or private option appears at the single published price tier, and nothing distinguishes where mandate data is stored from where model inference happens, which matters because no model provider is identified anywhere. Multi-location capability is published but describes the customer's own offices rather than the deployment model.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
LawX holds no independent attestation of its own and says so plainly, which is honest and does not change what is located. The security page states that its processes and systems are oriented to ISO 27001 standards and that certification is currently in preparation. An orientation is a self-assessment: no certifying body, no scope, no observation period and no date, and nothing a buyer can check against a register without asking. The ISO 27001 certification and the BSI C5 attestation named on the same page belong to the data centres hosting the accounts, not to LawX, and the page is careful about that distinction, so they credit to the host and are recorded on the deployment axis instead. Regular audits and tests are described without naming an auditor, a standard or a cadence. There is no trust centre, no report is offered at any access tier including on request, and no penetration testing is mentioned. Checked home page, security page, pricing page, privacy policy and footer on 4 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Nothing is published about the model supply chain a customer inherits. No model is named, no model provider is identified, no location is given for inference, and no commitment to notify customers when any of it changes was located. The one detailed processor list the company publishes, in the privacy policy, covers the website and the sales process and names Framer, Microsoft Deutschland, Attio, Intercom, Mailchimp, Luma, Typeform, Posthog, Google Ireland, Calendly and TeamViewer; none of those is presented as processing mandate data and the list is expressly scoped away from the customer relationship. So a buyer can establish in detail who handles a demo request and nothing at all about what reads a deed. The gap is conspicuous on a product whose security page otherwise engages professional secrecy directly. Searched the home page, product, pricing, security and privacy pages on 4 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
One published figure, one unit, one term, and the whole feature set itemised against it. The price is 159 euro per licence per month on annual payment, presented as a single tier with no packaging to decode and no enterprise band withheld. What the licence includes is listed in detail rather than gestured at, across five groups: core processes covering matter creation with register data capture, deed preparation and drafting, execution and XNP export, invoicing, dashboard and task prioritisation and structured case file export; communication and documents covering email integration with automatic assignment, AI communication assistance, file and party management, the commercial register interface and the land register assistant; security and compliance; technical integration covering Microsoft 365; and automation and AI. Implementation is addressed rather than left open, with onboarding, data migration and customer service published as included in the licence under LawX Care. The only thing a buyer cannot do is purchase without contact, since every route resolves to booking a demo, which the band does not require.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is described with substance in two dimensions and the boundary is soft. Two buyer segments are named and their relationship is stated honestly rather than blurred: the product is proven in notarial practice and is now being offered to law firms, with a separate landing page for firms offering early access and introductory terms, which tells a buyer plainly which segment is mature. Within the office, three roles are addressed separately with their own material, covering the professionals themselves, staff, and IT specialists. Practice coverage is evidenced concretely through the workflows rather than claimed, spanning property purchase deeds, land register and commercial register work, execution and deposit, escrow accounts and anti-money-laundering checks, which is the substance of German notarial practice. What is missing is the edge: no firm size is addressed, no matter volume is stated, in-house and government use are not mentioned, and nothing says which areas of practice fall outside the system. The solutions and customer pages were not opened in this pass.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No located term or policy addresses the question either way.
No located term or policy addresses the question either way. LawX publishes no general terms and conditions, no customer agreement and no data processing agreement; the footer carries an imprint and a privacy policy and nothing else. The privacy policy states at its opening that it covers use of the website and the initiation of a contract, and that further processing under the customer relationship is explained when the contract is concluded, so it never reaches mandate data. Nothing on the security page, the product page or the pricing page states whether client or mandate content is used to train or improve models. The absence sits against a security page that does engage professional secrecy directly, which makes it a gap in an otherwise deliberate disclosure rather than general silence. Searched the home page, product, pricing, security, privacy and imprint on 4 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
No located public material states how long prompts and outputs are retained.
No located public material states how long mandate data, prompts or generated drafts are retained. The privacy policy does publish retention periods in detail, but only for the categories it governs: server log files deleted after at most seven days, contact data held while the sales process is active, applicant data deleted after six months or two years in a talent pool, and commercial and tax retention obligations of two to ten years with limitation periods running to thirty. All of that concerns website visitors and prospects. For the product itself the policy defers expressly to the customer contract, which is not published, and no deletion commitment or end-of-subscription position appears anywhere. The one adjacent product feature is a structured export of case files, which addresses getting data out rather than how long it stays.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
LawX maintains and describes its own permission model rather than inheriting one. The security page publishes role-based rights management with logging of access, under the heading that the system is for authorised people only, and the pricing page repeats it as rights management by role plus access control and login logs. Client structure and multi-location capability are published as product features, which is the mechanism by which a firm with several offices keeps files separated. So the model is LawX's own, documented at feature level, and the office administers its own roles, which is the alignment burden this value describes. What is not published is how the roles map to a wall in practice, and nothing addresses separation between individual matters within a single office, which is the form the question takes for a notary acting for multiple parties.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.
The privacy policy addresses compelled disclosure and commits to no notice. Section nine provides that data is passed on where LawX is legally obliged to do so under Article 6(1)(c) GDPR, in particular where required by official requests, court orders and legal proceedings for the pursuit or enforcement of rights, and separately lists public authorities receiving data under statutory provisions. No commitment to inform the customer before or after such a disclosure appears, and no discretion over notice is reserved either. Two limits on the clause are recorded because they matter here: it governs the personal data the privacy policy covers, being website and sales process data, and the policy expressly defers processing under the customer relationship to an unpublished contract, so nothing published addresses compelled disclosure of mandate data itself. No transparency report was located.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No located public material identifies a corpus behind the product's output. The product works on the firm's own material and on official register data reached through interfaces, drafting from the office's existing templates and reading land register extracts and commercial register entries. Those registers are named as data sources the product connects to, which is an integration fact rather than an identification of a training or retrieval corpus, and nothing states what any underlying model was trained on, under what licence, or with what update cadence. No database, publisher or legal collection is named on any surface read. Searched the home page, product, pricing, security and privacy pages on 4 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Nothing on any located surface addresses whether authority is checked for subsequent history. The product does not retrieve or present case law: it runs the operational lifecycle of a matter, drafting deeds from the office's templates and register data, handling execution and export, and raising invoices. The question does not bite on this product class and the honest value is the absence rather than a penalty. Searched the home page, product, pricing and security pages on 4 September 2026.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No located public material describes what the product does when it cannot ground an output. One published feature sits near the question and answers a different one: AI-based checking of incomplete entries, which flags gaps in the data the office has supplied rather than uncertainty in what the model has produced. That is an input completeness check. Nothing describes an abstention path, a no-answer state, or any confidence or grounding signal surfaced to the professional before they approve. The published approval principle places a human at the release point, which is a control on the output rather than a description of the system's own behaviour when it is unsure. Searched the home page, product, pricing and security pages on 4 September 2026.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
The AI Hallucination Cases database maintained by Damien Charlotin was searched on 4 September 2026 on both the product name LawX and the corporate name LawX GmbH. No court order, opinion or disciplinary record naming the product was located. The database covers Germany among its jurisdictions. This records the state of the public record on that date and is not a finding about the product.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Public materials engage with at least one named ethics opinion.
The vendor names the profession's regulator and describes an active relationship with it. The security page states that LawX maintains a close exchange with the Federal Chamber of Notaries and with regional notary chambers, that it contributes expertise to specialist committees, and it links the chamber's own published listing of software houses for IT use in the notarial office, where LawX appears. Compliance with professional law is stated as a design constraint across the security and pricing pages, and professional confidentiality undertakings are committed once mandate data is processed. What is not published is a mapping: no individual rule, chamber guideline or opinion is cited, and nothing sets out how specific product behaviours meet specific professional obligations, which is what separates this from the top value.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
No located public material addresses billing, fee or disclosure treatment.
No located public material addresses billing or disclosure of AI-assisted work. The product raises invoices as a core function and the pitch is built on efficiency, with routine work automated so the office can handle more matters despite a shortage of qualified staff, but nothing quantifies a saving and nothing addresses what happens to a fee when the work takes less time. The question has a particular shape in this market and is untouched: German notarial fees are fixed by statute rather than billed by the hour, so the compression this signal was written for does not translate directly, and nothing published engages either that point or the position for the law firm segment the company is now entering. No per-matter record of AI-assisted work is described.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No located public material supports a client side disclosure obligation.
No located public material supports a client-side disclosure obligation for the product. A full and current processor list is published in the privacy policy, naming Framer, Microsoft Deutschland, Attio, Intercom, Mailchimp, Luma, Typeform, Posthog, Google Ireland, Calendly and TeamViewer, with Article 28 obligations, third-country transfers addressed under the Data Privacy Framework and Article 46, and a frank statement of residual United States surveillance risk. That is a genuinely good disclosure and it covers the wrong thing: the policy scopes itself to the website and the pre-contractual sales process, so none of those processors is presented as handling mandate data. No model provider is identified anywhere, no subprocessor register for the product exists, and no data processing agreement or forwardable client-facing pack is published at any access tier.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a record are produced and nothing covers the AI itself. Access logging is published twice, as logging of access under role-based rights management and as access control with login logs, so the office has a trail of who did what. Structured export of case files is a published feature, and export to XNP places documents into the official electronic notarial record, which is a formal filing route rather than an internal report. Register-derived content is traceable to the register it came from through the named interfaces. What is absent is the model dimension entirely: nothing states that the system records which outputs were AI-generated, no model is identified against an output, no record of what a professional reviewed or amended before approval is described as exportable, and no disclosure guidance for a court, chamber or supervisory authority was located.