PERSUIT

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Persi is described by the vendor as the intelligence layer built into PERSUIT, and the pricing position is explicit: it is not bought separately and arrives with the platform. PERSUIT ran as a competitive RFP, AFA and e-billing platform for about a decade before Persi existed, and the underlying capabilities — request management, panel governance, invoice review, spend reporting — are workflow and data functions that stand without models. What the models add is real and central to how the product is now sold: matter triage, fee benchmarking, firm shortlisting, proposal evaluation and anomaly detection across six named workflow stages. That is the B band exactly, a model-driven core capability layered on a product that would still function without it. Pages read 1 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

The corpus is described with unusual precision and the output is never measured. PERSUIT states that Persi draws on more than $22 billion in proposal data across 4,800-plus firms, and the proof page dates that dataset to platform transactions as of February 2026, which is a stronger provenance statement than most vendors give. But no accuracy figure, no evaluation, no test set and no named failure mode was located for Persi’s own outputs on any page read on 1 September 2026. Persi’s illustrated answers cite counts of comparable matters and percentages against benchmark, and nothing published establishes that a user can open the underlying comparables to check them. The primary-authority and citator limbs of the higher bands do not apply, since the product reasons over commercial pricing data rather than case law. C: accuracy asserted without measurement.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A clear written division of labour with a visible approval point. The Persi page states that Persi does not replace the customer’s judgement and that the customer brings the judgement while Persi brings the infrastructure, and every one of the six illustrated workflows ends at a confirmation rather than an action — requests are drafted ready to review and send, a breaching invoice is put on hold pending review, exceptions are flagged for the customer. Constraint is customer-configured: engagement rules such as minimum competitive bids, spend thresholds, panel requirements and diversity obligations are applied to every matter, with a worked example of a $100,000 threshold triggering a competitive request to at least three panel firms. Held at B rather than A because no autonomy modes are published, nothing states what Persi may do without asking, and the control structure is shown through product illustrations rather than documentation a buyer could hold the vendor to.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

All four elements the band asks for are present. Named legal departments with named officers: Gabriel Harnier, General Counsel at SAP; Anne Robinson, Chief Legal Officer at IBM; Sabine Chalmers, General Counsel at BT Group; Leanne Geale, Group General Counsel at Nestlé; Ernst van de Weert, General Counsel at Heineken. A figure for what changed at a named customer: SAP reached its three-year savings target in nine months. Dated platform figures with the basis stated — 26% average savings per matter, 30% with competitive sourcing, 48% of the time the lowest bid wins, 79% of value awarded under an AFA — each with its denominator explained, footnoted as sourced from PERSUIT platform transactions as of February 2026, and carrying an explicit variance caveat that individual results differ by matter type, industry and process design. Publishing the limitation alongside the number is what makes the method assessable rather than decorative. The softness is that the per-customer testimonials are quotes without their own figures.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Confidentiality is asserted in general terms and the substance sits behind an NDA. The privacy policy commits to reasonable steps against misuse and unauthorised access, states that employees are prohibited from viewing customer data unless necessary to diagnose a problem, and describes SSL/TLS in transit and sign-in logging; the security page adds SSO and role-based access controls. Nothing addresses training on customer content, which is a live question here because Persi is marketed as trained on the aggregate proposal dataset that customers themselves generate, and no published term says whether a given customer’s proposals feed it. No retention or deletion position, no matter or tenant segregation, and no privilege or work product treatment was located. The documents that would answer these — subprocessor list, data flow diagrams, SOC 2 report — are enumerated on the security page as available in the Trust Center under NDA, so a buyer cannot read the commitments before entering an evaluation. C on the band’s second limb.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Nothing published on the advice line. No terms of service, customer agreement or disclaimer was located on 1 September 2026: the footer link labelled Privacy & Terms resolves to a privacy policy alone, and the home page, platform, Persi, security, integrations and proof pages carry no disclaimer of any kind. This matters less here than for a drafting product, because PERSUIT produces sourcing and pricing recommendations rather than legal work product, and the note records that as the reason the axis bites softly. It is not nothing, though: Persi is described as advising whether a matter should be insourced or sent out, recommending which firms to instruct, and evaluating which proposal represents best value, and those recommendations are consumed by in-house lawyers and by law firms. No position on the line between tooling and professional judgement is published anywhere, and ABA Formal Opinion 512 is not mentioned.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No governance position published for a system that allocates work between law firms. The home page, Persi page, platform pages, security page, integrations page, proof page and privacy policy were read on 1 September 2026; there is no responsible AI page, no named accountable owner, no pre-release testing regime, and no ISO 42001 or equivalent. The gap is sharper here than the grade alone conveys. Persi shortlists firms, scores firm performance with numeric value scores, and decides which firms are invited to compete for mandates worth six and seven figures, and the vendor itself lists diversity obligations among the engagement rules the system enforces. Nothing published addresses whether those recommendations have been tested for uneven treatment across firms, jurisdictions or matter types. Security certifications are a different subject under this band and are graded on Security Certifications instead.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

A generic privacy policy plus a security summary, with the operative detail withheld. What is published: SSL/TLS encryption in transit, employee access restricted to necessary diagnosis, sign-in logging, regular external security audits by contracted firms, business continuity and disaster recovery with tested contingency planning, role-based access control and full audit logging across platform activity. What is absent: any retention period, any deletion practice beyond GDPR erasure rights, and any incident or breach notification practice. The subprocessor list exists but the security page places it in the Trust Center under NDA, so under the three-tier rule it earns no credit. The privacy policy is also stale in a way a buyer should notice — it is dated October 2021 and still relies on the EU-US Privacy Shield Framework, invalidated by Schrems II in July 2020. C: the policy covers the product without addressing what happens to matter data, proposals and prompts after processing.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Nothing published on who bears the loss when a recommendation is wrong. No terms of service, master subscription agreement, customer agreement or service level agreement was located on 1 September 2026. The escalation ladder was run: the footer was checked across six rendering pages and its Privacy & Terms link resolves to a privacy policy carrying no liability, warranty or indemnity provision, and no separate terms page surfaced from the navigation. The Trust Center is the only route to contractual documentation and the security page states its contents are available under NDA, which is a gating decision by the vendor rather than a retrieval failure on this side, so it earns no credit. No indemnity, no cap, no carve-out, no warranty on output and no insurance position is readable before a buyer enters an evaluation.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

The most detailed integration disclosure located in this lane. Four connection routes are published — managed integrations, an RFP API, a reporting API and composable workflows — and each is documented at field level. Direction is stated explicitly with arrows: matter management system into PERSUIT for matter ID, reference data, legal team assignments, practice group and jurisdiction; PERSUIT out to the e-billing system on RFP conclusion, carrying PERSUIT ID, firm name, total budget, currency, matter owner, entity, category and department. Sample API fields are printed on the page, including request_id, participation_status, pricing_items, total_fee, average_rate, price_at_start and price_at_end. Configuration burden is addressed directly, with managed integrations stated to need zero custom development, and a public API documentation URL is published. The one weakness, named rather than hidden: the target systems are described by category rather than by product, so no specific matter management or e-billing partner is named, and the API documentation sits behind the application and was not opened.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The host is named and neither dimension a buyer needs is stated. The security page states the platform runs on Google Cloud with MongoDB and Qlik as data providers, which answers whose infrastructure but not where a given customer’s data sits. No tenancy model is published anywhere. No residency option is offered: the only location material is in the privacy policy, which says personal information may be stored outside Australia with cloud providers in the United States and that European personal data may be transferred to Australia and the US under standard data protection clauses. That is a transfer disclosure about personal information rather than a residency offering for platform data, and it comes from a policy dated October 2021. Processing location is not addressed as distinct from storage. C: cloud delivery is evident and neither the tenancy model nor a customer-selectable region is stated.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Real, current and unusually well itemised, one step short of accessible evidence. The security page states ISO/IEC 27001:2022 with the version named and describes it as independently audited rather than self-assessed, SOC 1 Type 2 attested, and CSA STAR certified. Third-party external assessments are published with dates and scores: SecurityScorecard A and UpGuard 865/950, both stated as independently assessed in January 2025. A SafeBase trust centre is named and publicly linked, and the page enumerates exactly what it holds — penetration test report, network diagram, data flow diagrams, SOC reports, subprocessor list, ISO certificate and Statement of Applicability, and OSPAR for financial services buyers. What holds this at B is the access flow and the missing attestation particulars: the SOC 2 report is stated to be available under NDA once access is granted, no auditor is named for any attestation, no coverage period is given, and the SOC 2 scope is not specified. No request was submitted.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Persi is described entirely through its training data and never through its models. The vendor states repeatedly that Persi is trained on more than $22 billion of outside counsel management data and contrasts it with generic AI, naming Claude and Copilot only as competitor categories rather than as anything sitting underneath its own product. No model, no model provider, no inference location and no change-notification commitment was located on any page read on 1 September 2026. Google Cloud, MongoDB and Qlik are named on the security page, but hosting and data infrastructure answer where software runs rather than whose model sees client content and cannot be spent on this axis. The subprocessor list that might resolve it is in the Trust Center under NDA. C: the vendor refers to proprietary intelligence without identifying what sits underneath.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information at any level. There is no pricing page: the navigation and footer were checked on 1 September 2026 across the home page, platform, Persi, security, integrations, proof and privacy pages, and none carries a pricing entry. No tier names, no packaging structure, no unit of charge and no figure are published. Every commercial route is a demo request, an industry briefing or a contact form, and the ROI calculator inverts the transaction by asking the buyer to supply its own outside counsel spend rather than disclosing what PERSUIT costs. D rather than C because C requires the shape to be visible with only the number withheld, and here neither the shape nor the number is published. Under the pricing-row rule there is no published structure, so no VendorPricing row was written.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is documented by role and by sector with real specificity. Five buyer pages are published — General Counsel and CLOs, legal operations, head of litigation, in-house attorney, and law firm partners and business development — which is notable because law firms are a distinct buyer here rather than an afterthought, sitting on the other side of the same transaction. Nine industry pages are published, from financial services and life sciences to energy and real estate. Matter coverage is named: multi-jurisdictional disputes, regulatory investigations, M&A and complex litigation. B rather than A because the limits are not stated and the vendor explicitly declines to state them, answering the objection that some matters are too complex with the claim that every matter type has been run through the platform and that complexity is the use case rather than an exception. Government legal departments are not addressed.