Onspring

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The clearest case on the index of AI as an addition rather than a foundation, and the vendor says so itself. Onspring is a no code GRC platform that existed and sold for years before any AI shipped. Onspring AI launched October 2025 as an optional add on module that customers enable and configure, extended July 2026 into agentic operation. The vendor's own framing is that customers have total control over when and how it is used, which is a sound commercial position and also an admission that the product works without it. Removing the model layer removes an efficiency layer over data entry, documentation drafting, duplicate detection and record linking, and leaves the entire platform standing. Graded below Everlaw and Relativity at B, where the model layer is bundled into the core product rather than licensed separately. The AI is real, shipped, documented and dated, which is why this is C and not lower. The brief flagged this vendor to check the AI bar and it clears it comfortably; centrality is a different question from existence.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Nothing published. Onspring AI generates and revises long form content, creates records from prompts, completes text predictively, and reads and summarises uploaded documents such as SOC 2 reports to populate fields. Every one of those is a generation task where a wrong output lands in a compliance record, and none carries a published grounding claim, source citation behaviour, accuracy figure, precision or recall measure for duplicate detection or field extraction, hallucination rate, evaluation, or statement of what the assistant does when it has no answer. Searched the Onspring AI announcements of October 2025 and July 2026, the regulatory change management product page, the security page, the platform pages and the corporate counsel solution page on 29 Aug 2026. The gap is sharper here than the grade alone conveys: the assistant is documented as able to answer from every record and application in a customer's GRC program, and nothing states how those answers are grounded in the underlying records.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The strongest autonomy disclosure located in this category, and the only one on the index where the boundary is a configurable customer artifact rather than a vendor assurance. The July 2026 release is explicit that administrators define the rules that prompt agent action, that automation operates within the boundaries set by the system administrator, and that the design intent is a governed assistant that keeps users in control. The module is opt in and configurable to organisational standards, and an internal AI governance council is named as the oversight body. That gives a buyer three separate levers a compliance function can actually evidence to an examiner: whether the module is on, what rules trigger action, and who governs it. Held at B because none of the mechanics are published. No rule syntax, no scope limits, no statement of what an agent may never do, no escalation or human confirmation behaviour, and no description of what the audit trail captures when an agent rather than a person acts. Better positioned than Regology and Norm Ai, both of which describe oversight without a customer set boundary.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Customers are named, which most of this category does not do. American Family Insurance for IT risk and GRC program management, Warner Bros. Discovery for GRC management, Memorial Hermann Health System for audit, and Northgate Resorts with a stated saving of 200 compliance hours from a single integration. The vendor also publishes an annual GRC Benchmarking Report carrying survey findings, including that 70 percent of GRC practitioners see simplifying repeatable administrative work as the largest AI opportunity, which is industry research rather than product evidence but is dated and attributable. Held at B rather than A because the named customers are described at use case level without published outcome methodology, the 200 hours figure carries no baseline or period, and none of the named accounts is a legal department, so the evidence supports the GRC product rather than the corporate counsel solution this index is grading it for.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

General confidentiality is claimed and evidenced; legal specific confidentiality is not addressed at all. The vendor publishes a SOC 2 Type II attestation covering security, availability and confidentiality, and states that information privacy, security and risk management policies are documented with defined roles, responsibilities, policies and procedures protecting stored data. That is a real confidentiality position for a platform generally. What does not exist: any treatment of legal privilege or attorney work product, any statement about the confidentiality of matter records held in the Corporate Counsel solution, and any acknowledgement that a legal department's records on the platform differ in kind from an IT risk register. Checked the security page, the corporate counsel solution page, the platform pages and the AI announcements on 29 Aug 2026. This matters more than usual here because the same platform holds both the legal department's matters and the business units those matters concern.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Not addressed. The Corporate Counsel solution holds legal opinions, legal research and a clause library whose clauses are automatically selected by contract type, and Onspring AI can generate and revise long form field content across the platform. Generated or auto selected contract language reaching a business user without a lawyer in the path is the shape this axis exists to examine, and nothing addresses it. No statement that output is not legal advice, no positioning on the role of the reviewing lawyer, no professional responsibility material of any kind. Checked the corporate counsel solution page, the AI announcements, the platform pages and the resource material on 29 Aug 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

A governance body is named and nothing it produces is published. Onspring AI is stated to operate under the oversight of the company's AI governance council, and the module is configurable by customers against their own organisational standards and compliance requirements. Naming an internal governance body at all puts this ahead of most of the roster, where governance disclosure covers security rather than model behaviour. What is missing is everything the council would produce: no AI policy, no model evaluation, no bias testing or fairness assessment, no accuracy monitoring, no drift or regression statement, no model card, no ISO 42001, and no description of what the council reviews or when. A named committee with no published output is a claim rather than evidence, which is the definition of this band. Checked the October 2025 and July 2026 announcements, the security page and the platform pages on 29 Aug 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Platform stewardship is evidenced and AI specific stewardship is not. The SOC 2 Type II attestation covers security, availability and confidentiality, documented privacy, security and risk management policies are stated, and SecurityScorecard is cited as awarding a 100 out of 100 score. Nothing addresses what happens to customer content once it passes into the AI layer: no statement on whether customer records, policies or uploaded documents are used to train or improve any model, no retention position for prompts or generated output, and no description of how data flows to the model provider and back. That last gap is notable because the provider is named, so the vendor has already disclosed the harder fact and stopped short of the easier one. Checked the security page, both AI announcements and the platform pages on 29 Aug 2026. Security certification is graded separately and is not double counted here.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No published position. Nothing was located on liability for AI output, indemnity, warranty, service levels, or remedy where a generated field value, an auto populated record or an agent action is wrong. The agentic release makes this a live question rather than a theoretical one, since an agent acting on administrator defined rules can write to compliance records that an examiner later reads. The vendor's answer to that risk is architectural, in the form of administrator boundaries and opt in configuration, rather than contractual, and no contractual position is public. Checked the July 2026 agentic announcement, the October 2025 launch announcement, the security page, the platform pages and the site footer on 29 Aug 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Integrations are named rather than gestured at, and an open API is documented as the extension path. Named: DocuSign, Microsoft 365, Google Drive and Slack, with the vendor stating that further systems connect through the Onspring API. A published customer account credits a single integration with saving 200 compliance hours, which is integration evidence rather than an integration list. Held at B, and the reason matters for a legal index: not one named integration is a legal practice system. No iManage, no NetDocuments, no SharePoint matter workspace, no e-billing or matter management connector, and nothing that would let the Corporate Counsel solution sit inside a legal department's existing document estate. The integrations are the business software a GRC platform needs. Compare Regology at B for naming ServiceNow, Archer and Hyperproof, which is the same shape: real named integrations aimed at the adjacent stack rather than the legal one.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Nothing located from the vendor. Third party software directories describe the platform as cloud deployment supporting Windows and macOS with no mobile application, and that is directory material rather than vendor disclosure, so it is recorded here as context and not credited. From Onspring's own pages, located nothing on hosting provider, region, data residency commitment, single tenant or dedicated instance options, or where customer data is processed and stored. Checked the security page, the platform pages, the corporate counsel solution page and the site footer on 29 Aug 2026. Research limitation stated rather than hidden: the security page was reached through search result content rather than a full page render, so a residency statement lower on that page would not have been seen. Flagged as a correction candidate on that basis.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

A named attestation with its scope stated and its currency addressed, published on the vendor's own security page. Onspring states an annual SOC 2 Type II attestation prepared in accordance with AICPA standards, and names the trust services criteria covered as security, availability and confidentiality. Naming which criteria are in scope is the detail most vendors omit and it is the difference between a claim and a checkable one, since a SOC 2 covering security alone is a materially narrower report. Annual renewal addresses currency. Also cited: a SecurityScorecard rating of 100 out of 100, which is an external scanner score rather than an audit and is treated as supporting rather than load bearing. Held at B on three gaps: the auditing firm is not named, the examination period is not stated, and no trust centre or self serve request route for the report was located, so under the three tier test the artifact itself is sales gated. Consistent with Regology at B, which names its auditor but not its currency; Onspring names its currency and scope but not its auditor.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The best model supply chain disclosure located in this pull, and the first record to name its provider outright. Onspring states in dated public announcements that Onspring AI is powered by Anthropic's Claude family of generative AI models, repeated across the October 2025 launch and the July 2026 agentic release and carried in independent trade coverage of both. Naming the provider is the single fact a regulated buyer's own supervisor is most likely to ask for, and it is the fact almost every vendor on this index withholds. Held at B rather than A because the disclosure stops at the family name. No specific model or version is identified, no subprocessor list exists, nothing states whether the provider is engaged through an enterprise agreement or what contractual terms govern data sent to it, no data flow description is published, and no statement addresses what happens if the provider is changed. A buyer knows who, and nothing else.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

The pricing structure is discoverable and no figure is. Subscription pricing is structured by number of users and by modules selected, with annual and multi year licensing options, additional modules incurring incremental cost, and implementation services included with the GRC Suite under some licensing models. Onspring AI is separately licensed as an add on. Knowing that price scales on seats and modules, and that the AI costs extra, tells a buyer how the bill will grow, which is more than most of this roster discloses. Held at C because no price, range or entry point is published at any level, every route is a quote request, and the vendor's own licensing model is described by third parties as complex, which is a signal in itself. Source basis recorded as Third Party Estimated rather than Vendor Published: the structural detail comes from an independent review platform's product summary, not from an Onspring pricing page, and no vendor pricing page was located on 29 Aug 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is broad across compliance domains and thin across legal ones. Governance frameworks are named at ISO, NIST and CMMC, and the platform spans risk, audit, vendor and third party risk, IT risk, policy, ESG, and business continuity, with named deployments across insurance, media and healthcare. Legal coverage is a single Corporate Counsel solution positioned within business operations, describing matter tracking, requests, opinions, research, a clause library and cost tracking. That is one in house legal use case, not practice coverage: nothing addresses practice areas, jurisdictions, matter types beyond the generic, or any distinction between a legal department's work and the adjacent compliance work the platform was built for. Held at C because the legal offering is real and documented but shallow relative to the platform around it, and because the corporate counsel material carries no visible recent update while the GRC and AI material is refreshed continuously.