P

Plexus

AI runs through a contract, matter and approvals platform that also works without it. With AI features on, each new contract gets an automatic review when its first version is uploaded. The review holds an executive summary, a risk summary covering legal, commercial and operational risk, and a clause table. The table compares the draft with the customer's precedents, or with general drafting principles where none are loaded.

Summaries sit in each document's Key Facts tab, and intake autofill reads an uploaded contract for party names, dates, values and jurisdictions. Marketing Wizard is where the model carries the work, rating each marketing asset high, medium or low risk against more than 230 Australian laws, codes and regulations. Its November 2025 launch said compliant content is approved automatically, and the product page says only high risk items reach legal.

Intake forms, templates, approval routing, signing, the repository and Insights reporting all run with AI switched off. AI features arrived in 2023, six years after the platform launched in March 2017.

Grounding differs by feature. Contract review compares a draft with precedents the customer uploads, and its Confirmed Clauses list shows what matched the customer's standard. Since March 2026 Plexus Counsel shows the name of the Knowledge material behind an answer, and Marketing Wizard recommendations carry citation links to the Australian legislation behind them. Where no Knowledge is loaded, features fall back to the broader model, and document summaries and Draft Advice always use it.

No accuracy measure accompanies contract review, summaries, redlines or Marketing Wizard. The one figure comes from Plexus's own testing of intake autofill, which it says fills about 75 percent of custom questions from the document. The AI Security Fact Sheet names hallucination and lists the mitigations: grounding in the customer's documents, prompt guardrails, tags on all AI generated content and review by a person. The Counsel help article warns that answers may include details that seem relevant but are not in the document.

Most AI output waits for a person. Redline suggestions arrive as cards showing the current wording, the proposed wording and the reason, stay visible only to the user, and apply as tracked changes once accepted. AI comments follow the same rule, and since August 2026 redlining asks the user to confirm details it is unsure of, such as an address, rather than filling them in. Draft Advice, offered to select organizations, is generated when a matter is raised and stays visible only to the legal team until a lawyer posts it.

A warning appears when it is posted unedited, and once posted it is emailed to the matter's stakeholders. AI filled intake answers are marked, and users are told to check each one because answers can trigger delegation of authority rules. Playbooks are reviewed by their creator before publishing and can route a question to a named person in legal. Two features act without a person. Contract review runs automatically on the first version of each new contract, and Marketing Wizard's launch materials describe compliant content being approved automatically, while its help article routes submissions to a legal stakeholder for approval. How a risk rating is set, and what happens to a medium risk item, is undescribed.

Named customers report figures. ENGIE Australia's head of legal and general counsel describe a 90 percent cut in contract execution time, a 50 percent year on year rise in executed volume and workflows finishing in 4.5 hours on average. That covers more than 320 users across 13 business units. Caidya's chief legal officer describes growth from 125 users to about 1,500 across more than 40 regions. Since October 2023 the team has handled more than 15,000 documents and more than 700 legal requests, answered in under two days on average.

Lion's marketing team reports campaign approvals up to 90 percent faster and trade promotion permit costs up to 50 percent lower, across about 1,000 promotions since 2017. Shorter customer cards cite Noumi, with NDAs executed in 1.5 hours, LocalEyes, with promotion approvals seven times faster, and PMG, with approved terms in 24 hours. The case studies carry no dates or method, and Caidya's region count reads 41 in its case study and 43 on the customers page. Plexus says more than 200 legal teams use it, and its about page says more than 250 companies.

Customer data stays out of shared models by policy. The security page, the AI page and the AI Security Fact Sheet say customer data never trains public or shared AI models. The Counsel help article says it never trains or improves the model for anyone else. Each customer sits in its own databases and vector stores, which Plexus describes as zero data crossover between tenants. Staff reach customer data only with the customer's approval or under authorization from senior management and security.

The Subscription Terms bind both parties to hold each other's confidential information in trust and use it only for the agreement, and their data processing addendum limits processing of personal data to the customer's instructions. Neither contract mentions AI training. Inside an account, permission sets grant review and view rights per document type and organization unit, and legal teams can leave comments on matters that only legal can see.

The Draft Advice article says OpenAI did not keep the data or use it for training. Privilege and work product go unmentioned.

The advice line is drawn in the contract and in the product. The Subscription Terms state that the platform is not intended to constitute, or be a substitute for, legal advice, and make the customer solely responsible for the documents and results it generates. The AI Security Fact Sheet calls output general guidance rather than final legal advice and says anything with legal or commercial consequences should be reviewed by someone competent to judge it.

Marketing Wizard results say they are not legal advice and do not replace a full legal review, and the tool is intended for the Australian market only. Draft Advice warns that AI may produce incorrect, non compliant, non standard or incomplete content. Plexus also practices law. Under its Subscription Terms Promotion Wizard counts as legal advice, covered by Plexus's professional insurance as a law firm. Marketing Wizard work from customers without an in house legal team goes to the Plexus legal team.

Plexus Counsel is marketed as a digital lawyer. How the product supports a customer lawyer's competence and supervision duties is unaddressed.

No AI governance framework sits behind the product. There is no responsible AI page, no named owner for model behavior, no description of testing before release, no results on output quality and no ISO/IEC 42001 certification. The AI Security Fact Sheet says AI supports rather than replaces human decisions and that all AI generated content is tagged, and the AI page says every AI output is auditable. The rest of the security material covers ISO 27001, SOC 2, encryption and tenant isolation, which govern information security rather than model behavior.

Whether review quality differs by contract type, jurisdiction or language is unaddressed. Marketing Wizard is built only for Australian law, while Plexus serves enterprises across Australia, New Zealand and Singapore alongside global consumer brands.

Data handling is set out across the security pages and the Subscription Terms. Data is encrypted with TLS 1.2 or later in transit and AES 256 at rest, encrypted backups allow recovery to any point in the previous seven days, and uploads are scanned for viruses and malware. Independent security firms run penetration tests, and staff reach customer data only with the customer's approval or under authorization from senior management and security.

The data processing addendum in the Subscription Terms commits each party to report a personal data breach without undue delay. It deletes personal data at the end of the agreement and promises notice before a new subprocessor is engaged. Its Annex III names 19 subprocessors, including Amazon Web Services, Heroku, Google Cloud, DocuSign, Auth0 and OpenAI, without purposes or locations. Retention periods for documents, prompts and outputs are unstated, and files uploaded to a Counsel thread stay available for the life of the thread.

The older data security page, last reviewed July 2023, still cites ISO 27001:2013, and the privacy policy carries no breach notice of its own.

Two documents set the terms, and both cap and disclaim. The Subscription Terms, which Plexus says it does not amend, cap total liability at the fees paid in the 12 months before a claim. They exclude lost profits, lost data and indirect loss, exclude implied warranties, and make the customer solely responsible for documents and results the platform generates. The Legal Gateway Terms of Use, which carry no date, set the same 12 month cap with remedies at Plexus's election and leave reliance on generated material at the user's own risk.

Their warranty exclusion is subject to warranties implied by the Competition and Consumer Act 2010. Neither document carries an indemnity from Plexus. The AI Security Fact Sheet points to an intellectual property indemnity that OpenAI gives under its enterprise terms. Promotion Wizard output sits under Plexus's professional insurance as a law firm, while the software carries no insurance or service level commitment. Victorian law governs for customers in Australia, New Zealand and Asia Pacific.

Word and Outlook are the main connections. The Word add in, released in December 2025, creates documents from templates, saves them as contract records and uploads new versions. Since July 2026 it also runs AI review and redlining inside Word for users with a Microsoft 365 business license. The Outlook add in, also released in December 2025, turns emails into contracts or matters, attaches conversations and sends documents for signature, keeping documents and contract data in sync.

Plexus announced both on Microsoft's marketplace in February 2026. Word Online editing has run since 2023, and a Gmail add in raises matters. Signing runs through an embedded DocuSign integration or a customer's own DocuSign Part 11 account for organizations under FDA rules. Single sign on works with Entra ID, ADFS, Okta, Google and SAML, across up to 1,000 domains. There is no public API yet. Plexus's roadmap, dated July 2026, targeted a documented platform API for September 2026 and a Legal MCP server for Claude, Copilot or ChatGPT for October 2026, and the release notes through September 2026 show neither.

Plexus runs as a multi tenant service on AWS, with each customer in its own databases and vector stores. Personal information is stored on servers in Australia, and the privacy policy says data may also sit in the United Kingdom and the United States. Since August 2026 AI contract review runs on Amazon Bedrock in Australia, which Plexus ties to data residency and sovereignty requirements. The Counsel launch in November 2025 described Australian infrastructure with residency controls for customers that need them.

The other AI features call OpenAI's enterprise API, and where that processing happens is unstated. Region choice is not a product setting, and there is no single tenant or private deployment. The contract management page gives implementation times of one to two weeks, and two to three weeks on average to full deployment.

Plexus states ISO 27001:2022 certification on its security page and in its information security policy, last reviewed March 2024. Its AI page and AI Security Fact Sheet add SOC 2 Type 2 compliance, which the security page leaves out. No auditor, certificate number, scope or date appears with either. A security portal holds the disaster recovery report, the ISO 27001 certificate, a penetration test attestation letter and network security, risk management and secure development policies.

Access comes through a request form, and verification takes up to three business days. The portal's document list has no SOC 2 report. Penetration tests come from independent security firms Plexus does not name. The older data security page, last reviewed July 2023, cites the 2013 edition of ISO 27001.

OpenAI is the named provider. The security page, the AI page and the AI Security Fact Sheet describe OpenAI's enterprise GPT models behind Plexus AI, and the Subscription Terms list OpenAI among the subprocessors. Since August 2026 AI contract review runs on Amazon Bedrock in Australia, with the model there unnamed. The Draft Advice article, dated August 2026, still refers to OpenAI's GPT 3 API, and Marketing Wizard's launch post describes a proprietary AI engine.

No model version is mapped to a feature. A change of provider carries notice, since the data processing addendum promises notice before a new subprocessor and its transfer clauses set one month's warning. A change of model within a provider carries none. The Draft Advice article says data sent to OpenAI was not kept or used for training.

Prices are quoted on request. The help center defines the unit of charge as the Professional User license, charged per person who meets the definition. The Subscription Terms set fees by the number of Professional Users and Workflows in the order form and bill overage pro rata. Fees rise by 7 percent plus CPI on each anniversary, and contracts renew automatically for 12 month periods. A free trial with no payment card includes Approve and eSign, document storage, legal requests, Marketing Wizard and Plexus Counsel, with no stated length.

There are no tiers, feature splits or implementation fees on the open pages. Promotion compliance is sold at 50 percent below traditional legal review with a guaranteed 24 hour turnaround. Random Draw, the trade promotion draw service, asks for sign in only at payment and caps prizes at $200,000.

Plexus serves in house legal teams in larger companies, with marketing, sales, procurement and operations staff using it to request legal help, approve marketing and run promotions. Its case studies come from energy, consumer goods, clinical research and lending, and its pages show consumer brands such as Nike, Woolworths and Nestlé. Plexus describes its enterprise base as spanning Australia, New Zealand and Singapore.

The Subscription Terms contract through Plexus Gateway for Australia, New Zealand and Asia Pacific and through Legal Gateway International for the rest of the world. Marketing Wizard covers Australian advertising law only, and customers without an in house legal team can send marketing reviews to Plexus's own lawyers. Law firms are not a target segment, and no team size or contract type is ruled out.