L

LawX

Machine learning is a real layer across a conventional system, not the thing being sold underneath it. The buyer licenses a practice operating system: matter creation, deed preparation, execution and XNP export, invoicing, a dashboard with task priorities, structured case file export, and interfaces to the commercial register and Microsoft 365. Without the models, a working notarial practice management system remains.

The AI layer is specific: checks for incomplete entries, wording suggestions in context, a land register assistant that reads extracts, communication help, automated execution preparation, matter suggestions and adaptive template use. The company brands the whole product as an AI supported operating system.

Accuracy is asserted without measurement and hallucination is not addressed anywhere. The published claims are outcome claims: automated checks mean matters run reliably from the outset, error sources are minimized, excellence becomes the standard rather than the exception. None carries a figure, a test set, a method or a date. What does exist is structural grounding rather than described grounding: outputs are built from the firm's own templates and from data read out of the commercial register and the land register through named interfaces, so a drafted deed starts from official register content and a stored precedent rather than from model recall.

That is a real architectural constraint and it is why this does not sit at the floor. Nothing published describes what happens when the model is wrong, no accuracy evaluation is linked, and the words hallucination and error rate appear nowhere on any surface read.

A written commitment that the professional approves, with a review point visible in the product. The automation section of the pricing page is headed with the principle: Sie geben frei, you release it. The product illustration shows the assistant proposing a matter update and then asking the user to confirm it before applying it, so approval is a described step, not an aspiration. Routine processes run in the background so the professional can concentrate on the legal substance.

Not published: any threshold at which the system defers or escalates, which steps run unattended and which need approval, and what happens after an error reaches a deed or an execution filing.

Logos stand in for evidence on the pages read. About seventeen unlabeled marks appear on the home and pricing pages under a heading about experienced practitioners accompanying the product, with no sign of which are customers, advisers or media. The claim that the product is proven in notarial practice names no office. One third party marker is published: LawX appears on the Federal Chamber of Notaries listing of software houses for IT in the notarial office, a professional body's register, not a vendor claim.

The company says it maintains an exchange with the federal and regional chambers and contributes to specialist committees. No named customer, figure, matter volume or date appears on any page read. A customer page exists in the navigation and was not opened; it may say more.

Professional secrecy is addressed directly, in German terms. The security page commits to professional confidentiality undertakings as soon as mandate data is processed, which carries the notary's and lawyer's duty of secrecy onto the vendor's staff. Processing is described as compliant with data protection law and professional law throughout. Separation is documented at feature level, with role based rights, logging of access, client structure and support for several locations.

Accounts are hosted in German data centers, with TLS 1.2 or higher in transit and AES-256 at rest. Three things are missing: nothing says whether customer or mandate data is used to train models, no retention or deletion position for mandate data exists, and no model provider is named, so what any provider may retain is unstated. The privacy policy covers website use and the sales process only, and leaves processing under the customer relationship to a contract that is not published.

A real published position on professional responsibility, short of a statement on the advice line. Compliance with professional law is stated as a design principle, with the security page headed on it and processing described as compliant with the GDPR and professional law. The company says it maintains a close exchange with the Federal Chamber of Notaries and regional notary chambers and contributes to specialist committees, and it links the chamber's register of notarial software.

Routine processes run in the background so the professional concentrates on the legal substance, and the approval principle leaves the release decision with the office. Nothing says the product does not give legal advice, nothing addresses the line between a prepared draft and a professional's own judgment, and no jurisdiction limit is stated, although the product is built around German notarial and court procedure.

No governance position is published for the product. There is no responsible AI statement, governance framework, named owner accountable for model behavior, evaluation or testing regime for output quality, published result, or anything on bias. Two published items sit close to the subject and neither answers it. The privacy policy says no automated decision making or profiling under Article 22 GDPR takes place, but limits that to the website and to contract initiation and performance, not the product's processing of mandate data.

The EU AI Act appears only in a partner's training course on AI Act compliance, a service sold alongside the product, not a statement of the vendor's own governance. A data protection officer is named, which is a data protection role, not an AI one.

Substantive published policy covers most of the ground, and mandate data is the missing half. Customer accounts are hosted in German data centers certified to ISO 27001 with a BSI C5 attestation. Data is protected with TLS 1.2 or higher in transit and AES-256 at rest, with role based rights, logging of access, access control and login logs, and regular audits and tests described as ongoing. A data protection officer and the supervisory authority are named.

The privacy policy names every processor for the website and sales process: Framer, Microsoft Deutschland, Attio, Intercom, Mailchimp, Luma, Typeform, Posthog, Google Ireland, Calendly and TeamViewer. It addresses transfers outside the EU under the Data Privacy Framework and Article 46, and states the remaining FISA risk plainly. Nothing covers mandate data after processing: no retention period, deletion commitment, incident or breach notice practice, or named processor for the AI.

The privacy policy says it covers website use and steps before a contract, and that the customer relationship is governed by a contract that is not published.

Nothing is published on who bears the loss when the system is wrong. There are no general terms and conditions, no customer agreement, no master subscription terms and no service level document anywhere on the site. The navigation carries Product, Solutions, Customers, Pricing, Security and a company menu; the footer carries an imprint, a privacy policy, careers and support. The imprint is the disclosure German law requires of any commercial website and says nothing about the contract.

No indemnity, no liability cap, no warranty, no uptime commitment and no insurance position is published, and the privacy policy is the only legal instrument published, expressly scoped to the website and the sales process. A buyer evaluating a system that prepares deeds and executes filings has nothing to read on allocation of loss before entering a sales conversation.

The integrations are named, specific to the jurisdiction's actual infrastructure, and described in terms of what moves. Into the office: Microsoft 365 with Outlook and Word named, with drafts and letters prepared directly in Word, and email integration that assigns incoming mail automatically to the correct matter. Into the official systems that notarial work runs on: a commercial register interface, a land register assistant that reads extracts intelligently, and export to XNP, the electronic notarial filing standard, including into the deposit register for escrow.

Outward: structured export of case files, so a customer can leave with its data. Through named partners: a DATEV interface for accounting and electronic invoicing, transparency register extracts and sanctions screening in the money laundering workflow, and escrow account opening with transactions flowing back into the LawX file. Onboarding covers data migration explicitly, and the product is documented as able to run in parallel with an incumbent system rather than requiring replacement, which is the practical question an implementer asks first.

Residency is published precisely, and tenancy is not addressed. The security page says the customer's account is hosted in German data centers certified to ISO 27001 with a BSI C5 attestation, and describes the arrangement as compliant with data protection law and professional law. That names a country, a certification regime for the facility and a German federal attestation standard. Nothing states whether the platform is single or multi tenant, no dedicated or private option appears at the single price, and nothing separates where mandate data is stored from where model inference happens; no model provider is named. Support for several locations is published, but it describes the customer's own offices, not the deployment model.

LawX holds no independent attestation of its own and says so plainly. The security page states that its processes and systems are oriented to ISO 27001 standards and that certification is currently in preparation. An orientation is the company's own assessment: no certifying body, no scope, no observation period and no date, and nothing a buyer can check against a register without asking. The ISO 27001 certification and the BSI C5 attestation named on the same page belong to the data centers hosting the accounts, not to LawX, and the page is careful about that distinction, so they are covered under deployment instead.

Regular audits and tests are described without naming an auditor, a standard or a cadence. There is no trust center, no report is offered at any access tier including on request, and no penetration testing is mentioned.

Nothing is published about the model supply chain a customer inherits. No model is named, no model provider is identified, no location is given for inference, and no commitment to notify customers when any of it changes is published. The one detailed processor list the company publishes, in the privacy policy, covers the website and the sales process and names Framer, Microsoft Deutschland, Attio, Intercom, Mailchimp, Luma, Typeform, Posthog, Google Ireland, Calendly and TeamViewer; none of those is presented as processing mandate data and the list is expressly scoped away from the customer relationship.

So a buyer can establish in detail who handles a demo request and nothing at all about what reads a deed. The gap is conspicuous on a product whose security page otherwise engages professional secrecy directly.

One published figure, one unit, one term, and the whole feature set listed against it. The price is 159 euro per license per month on annual payment, a single tier with no enterprise band held back. What the license includes is listed in five groups: core processes, from matter creation with register data capture through deed preparation, execution and XNP export, invoicing, dashboard and structured case file export; communication and documents, including email integration, AI communication help, file and party management, the commercial register interface and the land register assistant; security and compliance; technical integration with Microsoft 365; and automation and AI.

Onboarding, data migration and customer service are included in the license under LawX Care. Every purchase route ends in booking a demo.

Coverage is described with substance in two dimensions, and the boundary is soft. Two buyer segments are named, and their relationship is stated: the product is proven in notarial practice and is now being offered to law firms, with a separate page for firms offering early access and introductory terms. Within the office, the professionals, staff and IT specialists each have their own material. Practice coverage shows in the workflows: property purchase deeds, land and commercial register work, execution and deposit, escrow accounts and money laundering checks.

No firm size or matter volume is stated, in house and government use are not mentioned, and nothing says which areas of practice fall outside the system. The solutions and customer pages were not opened and may say more.