L

LexCheck

Remove the models and nothing remains to sell. The vendor states the systems are built on large language models, and the two capabilities that constitute the product both depend on them: automatic capture of a customer's preferred positions from an uploaded template into a working playbook, and evaluation of an incoming contract against those positions to surface deviations and propose redlines. There is no repository, workflow, approval or signature product underneath that would still function if the models were removed; the self-serve platform exists to review and edit the playbook the models generated.

Two named products ship: LexCheck Insights, described as AI-powered contract review software that evaluates every contract and catches deviations in seconds, and LexCheck Copilot. The vendor describes its playbooks as LLM-powered and trained on the most common provisions and ready to use across virtually every contract type. Checked 8 September 2026.

Accuracy is asserted repeatedly and measured nowhere, which is the C band's first limb exactly. The claims located are comparative and unquantified: the vendor states its system's AI is highly accurate and that this lowers risk more than human review, and its blog states that accuracy exceeds attorney counterparts while cutting review time by more than ninety per cent. No accuracy figure attributable to a test is published, no test set is described, no method is set out, and no third-party validation is referenced.

Failure modes are named nowhere on the estate: nothing states what the system does with contract language outside the playbook, with unusual provisions, or where a position is ambiguous. What does exist, and what keeps this off the floor, is a described rationale surface: the vendor states that insights are transparent and explain why particular contract language is potentially problematic and requires attention, so a reviewer sees a reason attached to each flagged passage rather than an unexplained mark.

R15 governs the limbs that do not bite. This product cites no legal authority, retrieves no cases and has no citator, so the primary-authority, citation-status and no-support limbs are inapplicable rather than failed, and grounding is read against the customer's own playbook positions. B is unavailable because the rationale surface is asserted rather than described: no retrieval or matching method is published, so a buyer cannot tell what the explanation is derived from. Checked 8 September 2026.

Oversight is asserted and one real control is described, but nothing addresses oversight of the output, which is where this axis bites. What is published: the customer reviews and finalises the drafted playbook in a self-serve platform before use, can add fallback positions and adjust language, and the vendor frames this as maintaining control and being able to edit the playbook at any time. That is a genuine described control, but it governs the standard rather than the result.

Nothing published states whether a lawyer must review the redlines the system proposes, at what point the system acts alone, what happens when it is wrong, or what route a flagged contract takes back to human judgement. No human-in-the-loop commitment appears on any surface, and no such provision appears in the Terms of Service, which were read in full. Two of the vendor's own statements pull against each other and R37 rule 2 governs the treatment: the platform is presented as keeping the customer in control, while the technology page states the AI is highly accurate and lowers risk more than human review, and the marketing states the tools are easy enough for anyone to use so reviews can be completed without the need for external support.

The conflict is not graded as such; what it reveals is that the threshold at which the system's output is relied on without legal review is unstated, and that is the limb missing. B requires a written commitment that the models work alongside a supervising lawyer, and no such commitment is published. Checked 8 September 2026.

Real deployment evidence with named customers, short of attributed measurement, which is the B band. Two case studies are published with the customer named and a quotation attributed: NetApp, on contract review, and RSM, whose quoted reviewer calls it the best technology implementation they have witnessed for value and ease of use. A further customer strip names Autodesk, Bio-Rad, DigiCert and NetApp. That is named production use rather than logos alone.

What holds it off A is that the figures and the names are never joined. The headline outcome claims are aggregate and unattributed: more than a seventy-five per cent increase in speed to close, contracts signed in as little as one day rather than weeks, and more than a fifty per cent reduction in legal costs per contract review. None is tied to a named customer, dated, or supported by a stated basis or method, so a reader cannot assess how any of them was derived or over what population.

Under the R25 triage the two case study pages were named but not opened, because the grade rests on the named customers and attributed quotations visible on the home page rather than on the contents of those pages; had the grade turned on a figure inside them they would have been load-bearing and read. Checked 8 September 2026.

Substantive commitments a buyer can read before signing, held at B by two absent limbs, one of which R33 makes mandatory. Published and readable: the customer exclusively owns all right, title and interest in Client Data irrespective of whether it is stored or processed in the platform, with assignment of any interest the vendor might be deemed to hold; Client Data is expressly within the definition of the customer's Confidential Information; confidentiality obligations run during the term and thereafter with no expiry; disclosure is restricted to personnel with a need to know; data is stored and processed in the United States with ninety days' notice of any change in processing location; the security page states customer data is only used to provide the service and that the vendor does not look into an account without permission; and encryption is AES-256 at rest and TLS 1.2 or greater in transit.

Two limbs are missing. Privilege and work product are not addressed anywhere, expressly or by implication, which under R33 is dispositive on its own. And the position on training use is silent across all three published instruments, so a buyer cannot establish whether contract text reaches a model, while no model provider is named anywhere so what any such provider may retain is equally unestablishable. Segregation between users or matters is also unaddressed, which matters given law firms are a named buyer segment. Checked 8 September 2026.

Nothing published addresses the advice line for a product that proposes contract language, and the product is expressly sold to people who are not lawyers. The Terms of Service were read in full and contain no statement that the service is not legal advice, no requirement or expectation of lawyer review, and no provision addressing competence or supervision. The privacy policy and the security and technology pages contain nothing on the point either.

The intended audience is not ambiguous, which removes the other route to C: the vendor names legal departments, sales departments and procurement departments among those it serves, and states that its tools are easy for anyone to use so a team can complete reviews efficiently without the need for external support. That is marketing addressed to non-lawyers describing the product as a substitute for outside legal help, with no accompanying statement about what the product is and is not.

One provision was tested and does not reach this axis: clause 11.3 disclaims warranties including accuracy of results, but a warranty disclaimer allocates risk for defective performance and says nothing about whether output constitutes legal advice or who should review it. Under the no-double-spend rule it is graded on AI Liability and Recourse, where it answers the question directly. The grade records what is locatable on the date. Checked 8 September 2026.

No governance position is published for a system whose output is proposed contract language. Nothing identifies who inside the vendor is accountable for AI governance, no pre-release testing or evaluation regime is described, no results are disclosed, and nothing addresses uneven output across contract types, counterparties, drafting conventions or jurisdictions. There is no responsible AI page, no principles statement, no model card, no AI policy, no certification such as ISO 42001, and no third-party assessment referenced.

The C band was tested and does not fit: C describes principles published without a mechanism, and here no principles are published at all. Two items were considered and rejected as belonging to other axes under the no-double-spend rule. The operational security policies described on the security page govern IT assets, disaster recovery and access control and are validated under SOC 2 guidance, which is security governance rather than AI governance and is spent on Security Certifications and on AI Safety.

And the accuracy assertions on the technology page are marketing claims about performance, not a testing regime, and are spent on Citation Accuracy. The absence is notable in context, since the vendor's own material makes a comparative claim that its AI is more accurate than human review while publishing nothing that would let anyone test or govern that claim. Checked 8 September 2026.

Substantive published policy covering nearly the whole of the A band, short of it on the single limb the B band names. Published and specific: incident practice is unusually strong, with the Data Processing Addendum committing to written notice without undue delay and in no event longer than twenty-four hours of becoming aware of a Security Incident, including the details the customer needs for its own notification obligations, alongside documented detection and response procedures; the Terms add a broadly defined Security Event, a notification and cooperation obligation, and a customer or regulator right to audit books, systems and log files following an incident.

Deletion is specific: all copies of Customer Personal Data including archival copies destroyed within ninety days of termination, return within thirty days on request, secure physical destruction of media, and a Certificate of Deletion supplied within thirty days on request. Access control, encryption at rest and in transit, regular penetration and vulnerability testing, backups with a stated twenty-four hour recovery time and recovery point objective, and an annual audit right exercisable for any reason are all published.

The B band's named shortfall is exactly what is absent: no subprocessor list is published. The DPA makes one available on reasonable request with thirty days' notice and an objection right before any new third party is engaged, which is a strong change-control mechanism but is not a published list. Retention of contract content is also addressed only as prescribed intervals, naming no interval. Checked 8 September 2026.

All four elements the A band names are published and specific, including the one most vendors in this lane omit entirely. Indemnity scope, at clause 9.1, is broader than the usual intellectual property carve: the vendor indemnifies against losses arising from any Security Event, from any failure to comply with the confidentiality and data security article, and from third-party claims that the platform infringes intellectual property rights, with the vendor controlling defence at its own cost and a licence, replacement or refund path at 9.4.

Caps, at clause 10.1, are the charges paid in the preceding twelve months. Carve-outs are specific in both directions: 9.3 excludes unauthorised combination and customer-supplied designs, while 10.3 makes liability entirely uncapped for Security Events, confidentiality and data security failures, indemnification obligations, fraud, wilful misconduct, gross negligence and service level credits. Insurance is a full article rather than a mention: the vendor must maintain primary coverage of at least one million dollars with A-rated carriers, name the customer as an additional insured with equally broad coverage, furnish certificates on request, give thirty days' notice of cancellation or material alteration, and waive subrogation, with the stated intent that the vendor's insurance rather than the customer's responds.

Affirmative warranties at 11.1 include that the platform will perform the functions described in the Documentation with a repair-or-replace obligation. A service level of 99.9 per cent availability carries a defined credit and a termination right after three consecutive failures. One limit is named rather than buried, because it is the adverse half of the picture: clause 11.3 disclaims accuracy of results, so the warranty runs to conformity with the Documentation rather than to the correctness of any individual redline, and nothing is invocable for a wrong output as such.

Under R65 that is disclosure of an adverse allocation, credited rather than penalised, and it is stated here so a reader weighs the wording rather than the grade. Checked 8 September 2026.

An integration into the contract stack is claimed and no system is named, which is the C band's substance. The vendor states the platform is built to seamlessly integrate with the customer's contract lifecycle management solution and to optimise the negotiation phase of the lifecycle, but names no CLM platform anywhere on the estate, publishes no integration page, no partner list, no connector documentation and no API reference.

Nothing describes what would sync, in which direction, or what an implementer would configure. Microsoft Word is the one named system, and the product does deliver into it, described as keeping work in one place and working in the customer's usual word processing software; the privacy policy separately refers to plug-ins exchanging information with LexCheck. That is a named surface without a description of what actually moves between it and the platform, and the primary workflow described elsewhere is web-based, with the user signing into the platform and uploading a contract.

B was tested and declined: it requires real integrations that are documented, and what is published here is one delivery surface asserted without description alongside a category-level integration claim with nothing behind it. A third-party source names two channel partnerships; that is an aggregator listing, excluded outright as evidence, and is recorded only so a later reader knows it was seen and refused rather than missed. Checked 8 September 2026.

Residency is published to a level almost nothing else in this lane reaches, and the distinction the A band asks for is drawn expressly. Regions are named in the agreement rather than gestured at: clause 1.6 identifies the primary data centres as located in Northern Virginia and the secondary in Oregon, and provides that the platform and Client Data may only be hosted at those data centres or others the customer approves.

Clause 8.6 addresses processing separately from storage, stating that the platform and services are provided from the United States and that Client Data will be stored and processed in the United States, requiring at least ninety days' advance notice before any change in processing location, and giving the customer a right to terminate without penalty with a pro-rata refund if data is stored in a foreign jurisdiction it has not approved in writing.

The Data Processing Addendum reinforces it, committing the vendor to inform the customer in writing of all countries where data is processed or stored and to obtain consent, and recording the United States as the only such country as of the effective date. Hosting is on Amazon Web Services. The tier limb does not bite and is named rather than counted either way under R15: a single cloud deployment model is offered, with no on-premise, private cloud or region-choice variation to describe.

One genuine gap is recorded and is the reason this call is flagged: the tenancy model is stated nowhere, so a buyer cannot establish whether the deployment is single or multi-tenant or how separation is achieved. Checked 8 September 2026.

A real named certification without scope or date and with no route to the report that avoids a sales conversation, which is the B band precisely. The vendor states it has achieved and maintains SOC 2 Type II accreditation and that its operational security policies are regularly reviewed and validated per its SOC 2 guidance. What is not published: the auditor is not named, no audit period or report date is given, and the scope of the assessment is not described.

Access is sales gated and therefore earns no credit under R5, the page directing a reader to contact their Account Executive to obtain the most recent Type II report. A second badge sits under the same Certifications heading and is not a certification: GDPR compliance is described as best practices maintaining strict compliance, which is a self-assertion with no attestation, auditor or scope behind it, and it is recorded as such rather than counted.

The security page itself is substantive and self-published rather than a hosted portal, setting out hosting, encryption, data usage, recovery objectives, ownership, operational policies, retention and penetration testing, which is what keeps this above the C band's bare badges. A is unavailable because nothing there carries reports, dates or the standards actually covered, and no self-serve route to evidence exists. Checked 8 September 2026.

The vendor refers to the models generically and identifies nothing underneath them, which is the C band in its own words. What is published is that the systems are built on large language models, that these are ideal for handling large sets of data, and that the playbooks are LLM-powered and trained on the most common provisions. No model is named, no model provider is named, no architecture is described, and nothing states whether the models are the vendor's own or a third party's. The Terms of Service and the Data Processing Addendum were both read in full and neither identifies an artificial intelligence subprocessor; the DPA's third-party mechanism is generic and its list is available only on request.

Amazon Web Services is named as the hosting environment and as a subcontractor in the support exclusions, and under R29 test 1 naming a cloud host says where a model runs rather than whose model it is, so that fact is spent on infrastructure and does not reach this axis. D was tested and does not fit, because the vendor does publish that large language models sit behind the product; what it withholds is which. Change notification is not reached: with nothing named, notification would be a fourth limb of an A this record cannot approach. Checked 8 September 2026.

No pricing information is published at any level, including the unit of charge. There is no pricing page on the estate, no rate, no band, no tier name, no feature split, no minimum term, no seat minimum and no free or trial tier with stated terms. Every purchase path resolves to a demo or contact request, and the agreement confirms the shape: fees are set entirely in an Order Form executed between the parties, with clause 2.3 leaving the Unit of Measure to be specified per order as named users, concurrent users, devices, locations or transactions.

That clause describes what an order may contain rather than telling a buyer what this vendor charges for, so it does not lift the axis. C was tested and does not fit, because C describes pricing gated behind a demo while tier names and feature splits are published, and no tier or feature split is published here at all. Two commercial terms were located and are recorded rather than used to lift the grade, because they govern how a price may change rather than what the product costs: clause 5.3 caps any renewal increase at the lesser of two per cent of the prior year's charges or the rise in the vendor's list prices, which is a genuinely protective term rarely published in this lane, and clause 5.4 sets thirty-day payment with a one per cent monthly late fee and a good-faith dispute process.

Clause 5.6 records that a satisfactory credit check is required before a subscription starts. No VendorPricing row is written, per the R10 discipline that a page inviting only a sales conversation is an absence. Checked 8 September 2026.

Who the product serves is set out as an explicit list rather than implied, with the boundaries left open. Seven segments are named: legal departments, sales departments, procurement departments, global enterprises, high-growth businesses, private equity firms and law firms. The named customers corroborate breadth across segments rather than clustering in one, spanning technology, professional services and life sciences.

Buyer framing is differentiated in the material, with the platform positioned for teams reviewing recurring commercial agreements at volume and for non-specialist users applying positions the legal team has set. What is left open is the coverage boundary. Contract type is addressed only by the claim that the playbooks are ready to use on virtually every contract type, which is a breadth assertion with no supporting enumeration, no list of supported agreement types, and no statement of where the product works less well.

Practice areas are not addressed as a dimension at all, coverage being organised by buyer function rather than by practice. Government use is nowhere described. A requires the limits to be stated and they are not; C was tested and does not fit, because coverage here is not a bare claim to serve everyone but a specific and differentiated segment list. Checked 8 September 2026.