M

Miramis

The models are the engine of a core capability layered on a product that would still function without them as a contract workflow system. PLAI reviews redlines against the playbook, extracts metadata into the repository, answers portfolio questions and generates dashboards, and the vendor describes it as built into every workflow rather than bolted on. Remove it and templates, self-serve drafting with CRM data, approval routing on a Delegation of Authority, native eIDAS e-signing, the repository and renewal alerts remain, which is a working CLM; terms section 2.1.1 describes the service as an AI contract lifecycle management platform and the definitions treat Miramis AI as a feature of it. The AI-native label is the vendor's positioning; the structure is a CLM with a model layer.

Accuracy is acknowledged as imperfect and nothing is measured. Terms section 5.2.1 says that, given the probabilistic nature of the technology, output may be inaccurate, incomplete or misrepresent people, places or facts. Section 5.2.2 disclaims any warranty on the accuracy or correctness of output, and the acceptable use policy requires the customer to review outputs before use. No accuracy figure, test set or evaluation is published.

Citation checking against primary law does not apply: PLAI grounds its review in the customer's own playbook, templates and Delegation of Authority, not in primary law. What would matter for a contract agent, some measure of how often its redline assessments are wrong, is not published.

What runs alone, what constrains it, and how legal checks it are all published. Modes: business teams in sales, HR and procurement handle contracts autonomously within guardrails legal defines, drafting from pre-approved templates and negotiating in-platform, while PLAI reviews each incoming redline and states what can be accepted, what must change and what needs escalation; metadata extraction and approval routing run automatically.

Constraints: legal sets the rules once, which templates, which terms are non-negotiable and who approves what, and the Delegation of Authority determines approvers and signatories on every contract. Review surface: flagged redlines with suggested alternative wording, automated approval routing before signature, and a complete audit trail on every action. Route back: anything outside the playbook escalates to legal, and the acceptable use policy and terms section 2.3.2 prohibit using the AI as the sole basis for any decision affecting legal rights without prior human review.

A named customer with a figure, short of a date or method. BabyBjörn's general counsel, David Grünbaum, is quoted that the company improved efficiency six times by streamlining legal flows with Miramis and that each department now handles its own standardized legal tasks; no date, baseline or method accompanies the figure. Further general counsels or heads of legal are named with attributed quotes and no figures: Strömma, Svea Solar, Cambio, Eton, Treyd, PortmanDentex, Secret Escapes and Almedia.

The home page's own figures, cycle time falling from 21 days to three to five, are unattributed, and its animated counters for time from draft to execution, hours saved and cost saving render without values. The customer stories page was not opened.

Four of five questions are answered in the published agreement, and privilege is not. Training: terms section 6.2.5 says no customer data will be used, directly or indirectly, to train any foundational AI model, with foundational carried as a qualifier. Separation: role based permissions down to document level and SSO are stated on the help center and home page, and section 6.1 defines customer data as confidential information.

Retention and deletion: DPA section 16 requires destruction or return on termination and destruction within twelve months in any case. Model providers: section 6.2.4 says input goes to and output comes from third party LLM providers under their terms, section 8.3 treats them as subprocessors, and Schedule 1 names OpenAI and Google Cloud Vertex AI with EU or EEA residency. Nothing addresses privilege or work product handling, although the users include a legal team negotiating for the company.

A real position on advice versus tooling is published. Terms section 5.2.2 says Miramis provides self serve technology, is not a law firm or a substitute for a lawyer, and gives no legal advice. Section 2.3.2 bars using the services in any way that would constitute or substitute for legal advice, the practice of law or automated decisions about people. The acceptable use policy of 11 February 2026 repeats both and requires human review before any decision affecting legal rights.

That matters because the product is sold for business users to handle contracts without legal expertise, and the terms say so plainly. Two things are missing. Nothing addresses how the product supports a supervising lawyer's duties beyond its guardrails. No jurisdiction limit is named, apart from the caveat in section 2.5.2 that local law may impose electronic signature requirements the platform does not meet.

There are statements on responsible use without a mechanism, a testing regime or an accountable owner. The acceptable use policy carries AI usage rules and requires human review before decisions that affect rights. Terms section 5.2.1 acknowledges the limits of probabilistic output and says Miramis continually strives to improve accuracy, reliability and safety. No governance framework, ISO 42001 or similar certification, description of testing before release, or statement about uneven output across contract types or business teams is published, and the site has no AI principles page.

Retention, deletion, access control, sub-processors and incident practice are all published, current and specific enough to hold the vendor to, in the terms and the DPA appended to them. Retention and deletion: DPA section 16 requires destruction or return of personal data on termination and destruction within twelve months regardless; terms section 2.3.4 requires reasonable prior notice before Miramis deletes customer data for breach.

Access control: Schedule 2 lists access-level controls, access logging, VPC, two-factor authentication and password management, and the home page and help center add SSO and document-level role permissions. Sub-processors: Schedule 1 lists nine by name, service and data residency, all EU or EEA, including AWS, Azure, OpenAI, Google Cloud Vertex AI, Signicat, Idura, Auth0 and Twilio SendGrid, with a 30-day objection window on additions under DPA section 7.

Incident practice: DPA section 5.1 commits to written breach notice within eight hours of discovery with the circumstances, categories, consequences, measures and a contact. The help center adds that data sent through the AI integrations is not stored at the provider. Terms of service version 2.2 of 18 February 2026 and its DPA read in full 6 September 2026.

What the vendor stands behind is published and specific, including that on wrong output it stands behind nothing, which a buyer can read before signing. Terms section 5.4 gives a vendor indemnity against third-party IP infringement claims arising from use of the services, with its exclusions listed in 5.4.2 and the remedies in 5.4.3 including a refund of prepaid fees on termination. Section 5.3 caps each party's liability at fees paid in the preceding twelve months, excludes indirect loss, and carves out fraud, willful misconduct and gross negligence; section 5.3.4 sets a twelve-month claims window.

Section 5.1.1 warrants that the services conform to specification and are performed professionally, with the remedy in 5.1.2. Section 5.2.2 then states that Miramis bears no legal responsibility and gives no warranty for the accuracy, correctness or fitness of output, and section 5.5 has the customer indemnify Miramis for claims arising from input and use of output. DPA section 13.3 adds an indemnity for processing against instructions.

No insurance is stated. The allocation is complete and the terms are the self-serve agreement; order forms prevail on conflict.

Real integrations, documented, with depth described for some. Salesforce and HubSpot are described as pulling deal data directly into contract drafts, the Word add-in as keeping redlines synced with the platform, and DocuSign as a supported alternative to native e-signing; Teams, Slack, SharePoint and Google Drive are named on the home page without a description of what moves. A WebAPI is offered for custom connections and public developer documentation exists, still hosted at the pocketlaw-api domain, and a May 2026 release named Miramis Connect exposes the platform to external AI agents.

The integrations page and the developer documentation were not opened, so what a firm must configure is not recorded. No document management or matter management system is named.

Residency and processing location are stated and the tenancy model is not. DPA Schedule 1 gives EU or EEA data residency for every sub-processor including both model providers, DPA section 12 states processing is primarily within the EU or EEA with adequacy, standard contractual clauses or equivalent safeguards for anything outside, and the help center states EU data residency is available. That places both storage and model processing in the region.

Nothing states whether customers share infrastructure or receive a dedicated tenant, no region outside the EU is offered, and nothing describes what changes between plans.

Certification is real, stated and warranted in the contract, without accessible evidence. Terms section 6.2.6 says Miramis is ISO 27001 and SOC 2 Type II certified and shall maintain the certification or an equivalent throughout the term. The home page and help center repeat both and add regular penetration testing. No auditor, coverage period, scope or route to the report is published, and there is no trust center. The Security page and Security Policy listed on the site were not opened and may say more. The control detail in DPA Schedule 2 is a list of headings rather than a description.

Providers, location and change notice are published; the models are identified only as a family. DPA Schedule 1 names OpenAI and Google Cloud Vertex AI as the AI sub-processors with EU or EEA residency, terms section 8.3 deems the model provider a sub-processor, and DPA section 7 requires written details and a 30-day objection window before any sub-processor is added. The definition of Miramis AI names OpenAI's GPT models as an example, which is a model family rather than a named model, and nothing states which model runs which function. The provider list does not name the models themselves.

The unit and structure are stated in the agreement without a figure, and the pricing page could not be retrieved. Terms section 2.2.3 licenses per individual user. Section 4.1 sets twelve month initial and renewal terms with 90 days' notice to terminate, section 3.1.2 gives 120 days' notice of price changes, and section 3.2 sets 30 day invoice terms and 20 percent late interest. Section 4.4 provides for free trial accounts, and section 3.1.1 refers to standard subscription plans offered from time to time.

A pricing page at /pricing appears in the navigation and footer, but it could not be retrieved and may say more. A third party review says published pricing was withdrawn at the February 2026 rebrand, and aggregator listings carry older tiers; neither is treated as evidence.

Segment and work type are described with substance; the boundaries are partly stated. The buyer is enterprise in-house legal, with solutions pages for legal, sales, HR, procurement, finance and IT, industries named as banking and financial services, manufacturing, retail and technology, and a mid-market to enterprise positioning in the vendor's own comparison pages. Coverage is European by design: Swedish and UK entities, eIDAS e-signing with BankID and MitID, EU residency, and a DORA clause for regulated customers.

Limits stated: e-signature validity may not meet enhanced local requirements and some documents cannot be signed electronically. Not stated: any practice area or contract type the platform does not handle, and any position on use outside Europe.