L

Legl

Risk Agents is one of three items under Platform on Legl's site, alongside the Governance Layer and Integrations, and sits above the six solution modules rather than inside one of them. The agents are described as working across the client lifecycle. They research and structure screening matches, triage ongoing monitoring alerts, read bank statements for source of funds, analyze trust deeds for trustees, settlors and beneficiaries, fill in risk assessments automatically, and run remediation loops back to the client.

Screening and monitoring run continuously using the agents. Much of the platform does not depend on the AI. Client payments and reconciliation, digital onboarding workflows, company registry retrieval, electronic signature, dashboards and reporting all predate the agents and work without them. The file a firm needs for an SRA or MLR audit comes from the workflow and the audit trail rather than from the model. The AI removes manual effort from a compliance process that would still run without it.

Screening matches are returned with a recommendation, a confidence level and the supporting evidence, so the reviewer sees what the model relied on rather than a bare conclusion. The underlying sources are named suppliers a firm can identify. In source of funds, the AI reads bank statements and surfaces income, large single payments, balance trends and higher risk activity. A mathematical validation step confirms the figures are consistent before they reach the reviewer, an arithmetic check on the model's output.

No accuracy figure, false positive or false negative rate, test set, evaluation or named failure mode is published, for a product whose core function is deciding whether a flagged record really is the firm's client. Legl's Terms of Use state that it makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided with the services, while the product returns confidence levels and validated figures. The product does not cite legal authority.

Screening, ongoing monitoring and remediation run continuously, and clients are screened again daily. The agents gather and parse documents, research and structure data, read bank statements, analyze trust deeds, and run remediation loops directly with the firm's client. The governance layer turns the firm's own risk policies into Risk Rules the agents enforce, and administrators set screening firm wide, choosing categories, PEP seniority levels, source jurisdictions, search breadth and matching sensitivity.

Matches come with a recommendation, a confidence level and the supporting evidence. The compliance dashboard gives a view across the firm with downloadable reports, decisions and overrides are recorded with their reasoning, confirmed false positives can be whitelisted, and a weekly summary reaches the MLRO. Legl states that agents flag discrepancies and nonconformity for human attention and that the decision stays with the reviewer.

High risk factors escalate automatically by email to the MLRO or nominated reviewers, alerts can be assigned to a named reviewer, and reassessment dates are set by risk level. Agents gather, research and structure; people decide.

Named firms include Lewis Silkin, Michelmores, Stephens Scown, Taylor Rose, Cripps, gunnercooke, Tollers, Wilkes, Blacks, Higgs, Woodstock, Wolferstans, Hall Brown Family Law, Harold Benjamin, Burnett and Reid, Robertsons, Sharmans and Laytons ETL. Testimonials carry full names and job titles. They include Helen Strachan, Practice Director and MLRO at Burnett and Reid; Shivani Patel, Compliance Supervisor at gunnercooke; and Guy Hurst, Compliance Manager at Wilkes.

Will Taylor, CFO and COO at Hall Brown, Natasha Boyland of Woodstock and Simon Bagshaw of Tollers are also quoted. Customers state two figures. At gunnercooke, half of due diligence requests were completed within 24 hours of being sent. At Sharmans, three risk assessments took about twenty minutes against roughly an hour for one under the previous system. Both sit in testimonials with no method, sample, baseline date or independent basis, and only the Sharmans figure compares before and after.

The adoption count differs between pages: Legl's marketing site says more than 600 law firms, while its trust center description says more than 400, including 40 of the top 200.

The only agreement on Legl's site is the Terms of Use, which by its own first clause governs the individual submitting a payment or completing a workflow, not the law firm. The subprocessor policy refers throughout to the Legl Services Agreement and takes its undefined terms from it, but that agreement is not published, so the confidentiality obligations, data handling terms and security commitments that would bind Legl to the firm cannot be read.

The biometric commitment is specific. Neither Legl nor the firm ever receives the biometric identifier generated from the client's images; the provider holds it only until Legl says it is no longer needed; and Legl states it does not use, disclose or retain biometric information for any other commercial purpose. Data is destroyed on the firm's request or when processing is no longer needed, and contractual safeguards bind all sixteen subprocessors, including confidentiality for their personnel and prompt breach notification.

Privilege and work product are not mentioned. The product holds client identity and source of funds material rather than matter files.

Legl's Terms of Use state that nothing in the Legl Services, or in emails Legl sends on the law firm's behalf, is or should be construed as legal advice. They state separately that the individual's use of the service does not determine whether they are a client of the firm, with contractual arrangements to be made directly. Both are directed at the firm's client, which fits a platform that communicates with clients under the firm's brand, and the second makes clear where the retainer sits.

The product is built around the firm's own regulatory obligations, with MLRO dashboards, defensible records of how each client was assessed and why, and reporting ready for audit. Nothing addresses professional responsibility in the firm's use of the AI: no conduct rule or regulator is named, nothing covers supervision obligations when an agent acts, and nothing states what a firm must still do itself to meet its duties. A due diligence platform produces no legal work product.

No AI policy, responsible AI or ethics statement, governance framework, or bias or fairness discussion is published on the Risk Agents page, the KYC, KYB and AML page, the pricing page, the Terms of Use, the subprocessor policy, the trust center entry page or the site footer. No ISO 42001 or NIST AI RMF alignment, named internal owner for AI decisions, model evaluation or testing description, or AI provision in any published agreement appears there either.

Legl markets its agents as auditable and sells a governance layer to firms, applied to the customer's risk policy rather than to Legl's own models. The platform also runs biometric identity verification and AI risk scoring on individuals whose onboarding depends on the result, and nothing published addresses fairness, error rates across populations, testing, or what recourse an individual has when a check goes against them. The ISO/IEC 27001 certification covers information security, not AI governance.

The subprocessor policy describes a commercially reasonable selection process evaluating security, privacy and confidentiality practices. Subprocessors must meet obligations equivalent to Legl's own: processing only on documented controller instructions, using personnel bound to confidentiality, training staff, maintaining technical and organizational measures, promptly reporting any breach, and cooperating with controller, data subject and regulator requests.

Biometric handling is specific and restrictive, and destruction follows the firm's request or the end of the processing need. No published page states how client documents, bank statements or trust deeds are handled once an agent has read them, or whether anything is retained. Nothing says whether client content is kept apart from model operations, or what happens to material a remediation loop collects. No commitment specific to AI is published.

The one improvement right in the published Terms covers deidentified device and system telemetry, not client content. The Legl Services Agreement, where data use terms would sit, is named but not published.

The subprocessor policy twice names the Legl Services Agreement as the instrument governing the client relationship. That agreement is not published; Legl's legal footer carries only the Terms of Use, website terms, privacy policy and a trust center link, so what warranty, cap, indemnity, service level or remedy a firm would have cannot be read before purchase. The published Terms of Use exclude liability. Use is as is and as available, at the user's sole risk.

Legl makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided with the services, and excludes all other conditions, guarantees and implied or statutory warranties. It accepts no liability for loss or damage from use of the services and disclaims responsibility for any third party service provider. As a data processor, it states, it is not liable to the individual for acts or omissions on their personal data.

The only indemnities run from the user to Legl. No cap figure, uptime commitment, service credit, cure period or right to terminate for degraded service is published.

Ten named systems appear on Legl's product pages, all practice systems rather than general business tools. They are iManage and NetDocuments for document management; Clio Manage and Clio Operate, the latter named as Sharedo; Elite 3E for finance and practice management; Litera Foundation 365, named as Peppermint; Unity Practice Management, named as NebuLAW; Quill; Proclaim, named as DPS; and Partner for Windows. The former names help a UK firm that knows several of these products by the older brand.

The set spans the two major document management systems, a major international finance platform and four practice systems specific to the UK. The product pages do not describe the depth of each connection: nothing states whether the integration writes back, what triggers a sync, whether an API is public, or what a firm must build.

Neither tenancy nor data location is stated. The subprocessor policy names the infrastructure suppliers, Amazon Web Services EMEA, Heroku, Microsoft Ireland Operations and Snowflake, and the corporate entities named are European. That identifies who hosts, not where the data sits. No data center location, region, residency option or residency commitment is published, and an Irish or Luxembourg contracting entity says nothing about storage location.

Nothing states whether the service is single tenant, pooled or configurable, and no separation model is described beyond screening configuration changes applying firm wide. The nearest thing to a residency term is in the consumer Terms of Use, which bar the individual from using the services outside the United Kingdom where that would require Legl or its providers to store data in that jurisdiction without prior written consent.

That restricts the user rather than committing the vendor. Legl runs a separate Australian site, with no second region described. No self hosted or private deployment option is published.

Legl publishes its ISO/IEC 27001 certificate number, 0174467, in the footer of every page, a number that can be taken to the certification body. It is listed under its registered name, The Justice Platform Ltd, on the UK government's Digital Verification Services register, which the Office for Digital Identities and Attributes maintains, and is a certified Identity Service Provider against the Digital Identity and Attributes Trust Framework.

A government register entry can be checked entirely independently of the vendor. A trust center sits at a subdomain on Vanta's European instance, linked from the site footer as Security. No certification body or auditor is named, no validity window is given, no certificate document is published on the main site, and no SOC 2 report for Legl itself is published. Certifications named for subprocessors and payment partners belong to those companies.

The subprocessor policy names sixteen suppliers as at 3 June 2025, each with its processing activity. It describes due diligence and contractual safeguards, notice of changes by email or in the customer's own environment, and a ten day objection window. A dated update log explains why Mitek Systems and Dun and Bradstreet were added in July 2024. No model or model provider appears in it. The list covers cloud and data infrastructure (Amazon Web Services, Heroku, Microsoft Ireland, Snowflake and Fivetran), identity and data suppliers (ComplyAdvantage, Equifax, Entrust Identity, Mitek, Creditsafe, Dun and Bradstreet and TrueLayer), and tooling (Datadog, Sentry, HelloSign and an email provider).

None is a foundation model provider, and no page names a model, version or family, or states that the models are built in house. The agents read bank statements and analyze trust deeds, and nothing published says whose model processes a client's financial documents. The cloud providers show where the software runs, not which model runs on it.

The charging model is published and no price is. Pricing is modular: the firm chooses the modules it needs and pays only for what it uses. Billing is monthly and described as predictable, there are no implementation fees, and there is no long term lock in. A named customer contrasts this with competitors requiring fixed contracts of up to 36 months and usage forecasts. ROI reporting and insights on cost savings are offered as part of the product.

No price per module, check, seat or firm, volume band, minimum, term length or currency is published. The page carries no plan table, and the only route to a number is booking a demo. The page is titled transparent, value based pricing, and its meta description promises a transparent pricing structure with no surprises.

Every solution page addresses law firms, the named customers are all law firms, and the roles quoted are legal compliance roles. Customers range from national and international names such as Lewis Silkin and Michelmores, through regional practices including Stephens Scown, Cripps, Tollers and Wilkes, to gunnercooke with its alternative structure, Burnett and Reid in Scotland, and specialist family practices including Hall Brown.

The trust center description claims forty of the top two hundred. The product addresses one workflow, client onboarding and anti money laundering diligence with payments attached, and applies it the same way whatever the matter. No breakdown by practice area or matter type, and no configuration for particular areas, is published beyond risk assessment templates a firm builds to its own policy. The regulatory frame rests on the SRA, the Money Laundering Regulations, HM Land Registry expectations, the DVS register and the Digital Identity and Attributes Trust Framework. A separate Australian site is the only other market.