Relativity

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are the engine of a core capability layered on a platform that would function without them. RelativityOne is an end to end ediscovery system covering legal hold, preservation, collection, processing, review, production and analytics, and it has sold for two decades. The aiR suite of five generative products sits on top of that and drives substantial capability rather than peripheral features, which is why this is not a C. Worth recording precisely because it distinguishes this record from the AI native vendors: technology assisted review has existed in this platform for years, so the generative layer is the newest of several model based capabilities rather than the first, and third party analysis characterises the aiR features as evolutionary within that lineage. Sixth B on this axis.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real and documented through an explainability mechanism, short of published measurement. The vendor states that aiR for Review surfaces impactful content backed by transparent rationale and that aiR for Privilege explains every decision, so each output carries a stated basis a reviewer can inspect against the document rather than a bare classification. The suite is described as designed to be transparent, reviewable and defensible, with safeguards derived from published AI Principles. That is a documented verification surface tied to specific documents. Searched the aiR product pages, the artificial intelligence overview, the corporate data solutions pages and the learning centre on 29 Aug 2026 and located no accuracy figure, no precision or recall number, no hallucination rate, no test set, no published evaluation methodology and no independent benchmark participation. A partner published case study describes predictions as highly accurate, which is a customer's characterisation rather than a measurement and was not treated as evidence.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A real published commitment with documented review surfaces and an explicit control philosophy, short of published thresholds. The vendor's AI Principles state the aim of technology that is clear, fair and gives customers the utmost control, and the aiR suite is described as transparent, reviewable and defensible. The review surface is concrete: every decision carries a rationale, and aiR for Privilege predictions are positioned to guide counsel's second pass review rather than to replace it. The vendor also invests in operator competence in a way no other record here does, running a certification programme covering generative AI and individual aiR products, with published guidance on building, testing and trusting prompts. Third party analysis states the product does not make autonomous privilege designations and that a human reviewer still makes every privilege call, which corroborates the position without being vendor material. Not located as of 29 Aug 2026: a published threshold at which a document routes to a human, and what the vendor commits to when an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Named customers and a specific, checkable adoption figure, short of vendor published outcome numbers. Adoption is quantified precisely rather than vaguely: 192 of the Am Law 200 firms and more than 110 legal service provider partners use RelativityOne, which is a figure a reader can test against the published Am Law list. Named organisations are published as aiR success stories including Alvarez and Marsal, Cimplifi and Gilbert and Tobin, with Alvarez and Marsal stated to have used aiR for Review, aiR for Privilege and aiR for Case Strategy on a single complex matter. Quantified results exist but sit in partner published material rather than vendor material: a Relativity Gold Partner published a case study covering 30,000 documents analysed with aiR for Privilege and 610 hours saved in privilege review, with auto generated log descriptions replacing a manual process. That is a named scope, a named figure and a described method, and it is recorded here as partner published rather than treated as the vendor's own evidence.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive published commitments including one control no other record on this index discloses, short of the training and retention limbs. The distinctive element is specific and consequential: the vendor states it has opted out of the abuse and harmful content monitoring offered by Microsoft, so that no unauthorised users have access to raw inputs or outputs. Abuse monitoring is the standard route by which provider staff may review customer prompts, and opting out of it is the single most concrete confidentiality decision disclosed anywhere in this pull. Alongside it: a privileged access management solution and a classification schema dictating how confidential data is handled, and a vendor risk management team reviewing Azure's security and privacy posture at least annually to validate controls are operating effectively. Two gaps hold this off an A. No statement on whether customer content may be used to train models was located, either at the vendor or provider layer. No retention or deletion terms were located. Both matter for a platform holding entire document universes for live matters.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The audience is professional and the position is unstated. Users are law firms, corporate legal departments, government and regulatory response teams, and legal service providers, with no consumer surface located, and the product is a review and investigation platform rather than an advice tool, so the advice line question arises less sharply than for a research or drafting product. Searched the aiR product pages, the artificial intelligence overview, the data solutions pages and the learning centre on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties as professional obligations, and no jurisdiction limits. Worth recording as adjacent rather than as credit: the vendor runs a substantial user certification programme, which addresses operator competence as a commercial and training matter rather than as the professional duty it also is.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

A published governance framework with real substance, short of testing results, a named owner and any bias disclosure. Relativity AI Principles are published as a standing document and the vendor states they guide everyday decision making toward technology that is clear, fair and gives customers the utmost control, with aiR safeguards described as inspired by them. The vendor states directly that it recognises the value AI can create along with its risks and commits to processes that are thoughtful, disciplined and trusted, which is an acknowledgement of risk rather than an unqualified capability claim. Governance is also operationalised through vendor risk management, with an annual in depth review of the underlying platform provider's security and privacy posture. Not located as of 29 Aug 2026: an AI management certification such as ISO 42001, published pre release testing results, a named accountable owner for model governance, and anything on uneven output across matter types, parties or populations. The word fair appears in the principles without any published work behind it, which is the gap this axis exists to mark.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously graded C because access control appeared to be the only well covered element. That reading came from marketing surfaces without reaching the dedicated trust site, and understated the published controls. Now located and published: customer managed encryption keys, so a customer can hold its own key material; Customer Lockbox, a default on control restricting the vendor's own system administrators from accessing customer workspaces unless the customer explicitly grants it, which is a strong and specific limit on vendor side access; client domains providing data separation between clients; Security Center, a monitoring application shipped to customers; SIEM integration giving customers access to their own security logs; and round the clock monitoring by the named in house security team, Calder7. Previously recorded and still standing: privileged access management, a classification schema for confidential data, the opt out from Microsoft abuse and harmful content monitoring, and annual vendor risk review of Azure. That is a substantive published policy covering most of what this axis asks. Not located as of 29 Aug 2026: a stated retention period or deletion control for customer data, prompts or aiR outputs, and a named subprocessor list. Those two absences are what hold this at B rather than A.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Searched the aiR product pages, the artificial intelligence overview, the corporate and data solutions pages and the learning centre on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer agreement or master terms was located on the surfaces reached. Recorded as a pure absence on those surfaces. The shape is worth naming for this vendor specifically: aiR for Privilege exists to reduce the risk of inadvertent production of privileged material, which is among the most consequential errors in litigation, and nothing published addresses who bears the loss if a privileged document is produced on the strength of an AI prediction. Rebuttable with one link.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real integrations exist, are named individually, and target the systems evidence actually lives in. Named as out of the box integrations for collections: Microsoft, Google, Slack and Box, with in place preservation from what the vendor calls the top productivity platforms, which is the integration that matters most for defensible legal hold. A published .NET Platform API for RelativityOne is documented through the learning programme, and the platform is explicitly built for shared working across internal teams, outside counsel and service providers, with more than 110 legal service provider partners in the ecosystem. Not located as of 29 Aug 2026: a consolidated integrations index page, per integration documentation of what moves in which direction and what an administrator configures, and legal document management connectors such as iManage or NetDocuments.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The hosting platform is named and residency is not addressed. RelativityOne is stated to be built on Microsoft Azure, and the vendor adds a substantive point about that choice, that it is the same platform chosen by global regulators, alongside an annual vendor risk review of Azure's security and privacy posture. Naming the hosting provider and evidencing ongoing oversight of it is more than several records here manage. Searched the aiR pages, the artificial intelligence overview, the data solutions pages and the learning centre on 29 Aug 2026 and located no named regions, no customer selectable residency, no tenancy model, and no statement of where processing happens as distinct from where data is stored. For a platform serving 192 of the Am Law 200 across international matters, published residency options would be expected and none was located on the surfaces reached.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously graded C on the finding that the vendor claimed several industry certifications without naming any. That was wrong. It came from reading product and solutions marketing pages without reaching the dedicated trust site at relativity.com/trust and its compliance and privacy page, where the certifications are named individually and with versions. Published there: ISO/IEC 27001:2022 certification, ISO/IEC 27018:2019 certification, FedRAMP Moderate ATO, HIPAA compliance, IRAP assessed at Protected, a SOC 2 Type II report, a SOC 3 report, and a Cloud Security Alliance CAIQ, alongside a published request route for compliance certificates. Naming ISO 27001 at the 2022 revision and 27018 at 2019 is precise, and the set is unusually broad, spanning the US federal authorisation, the Australian government assessment at Protected level, a healthcare framework and a standardised cloud control questionnaire. A SOC 3 report is a public summary report, which is a materially more open disclosure than SOC 2 alone. The vendor also names its in house security team, Calder7, publishes a Security Center monitoring application to customers, and offers SIEM integration giving a customer access to their own security logs. Short only of a published coverage period, report date and named auditing firm, none of which was located as of 29 Aug 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The provider is identified, where the models run is stated, and the terms binding the relationship are described, short of naming the models themselves. Microsoft Azure is named as the platform the product is built on, and the vendor's disclosure about opting out of Microsoft's abuse and harmful content monitoring identifies Microsoft as the party that would otherwise have had access to raw inputs and outputs, which locates the generative processing in the Microsoft stack more precisely than most vendors manage. The relationship is governed rather than assumed: a vendor risk management team performs an in depth review of Azure's security and privacy posture at least annually to validate controls are operating effectively. Not located as of 29 Aug 2026: which specific models serve which aiR product, any subprocessor list beyond the platform provider, and any commitment to notify customers when the model supply chain changes.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

A real commercial term is published without a rate, and the term itself is unusual enough to record. The vendor states that aiR for Review and aiR for Privilege are included in the standard pricing and packaging for RelativityOne, so a buyer learns that two of the five generative products carry no separate charge, which is a meaningful commercial fact and one almost no vendor on this index discloses about its AI features. Flexible pricing models are referenced without being enumerated. Searched the aiR pages, the data solutions pages and the corporate pages on 29 Aug 2026 and located no rate, no unit of charge, no tier structure, and no published packaging for the remaining aiR products, aiR for Case Strategy, aiR for Data Breach Response and aiR Assist. Recorded at C on the strength of the published inclusion statement.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Segment and practice coverage is described with substance and quantified where it can be. Segments named: law firms with a stated 192 of the Am Law 200, corporations, government, and more than 110 legal service provider partners, with the platform explicitly designed as shared working space across internal teams, outside counsel and providers. Practice coverage is enumerated by product rather than claimed broadly, five aiR products each with a distinct purpose spanning document review, privilege, case strategy, data breach response and assistance, plus legal hold, preservation, collection, processing, production and analytics. Regulatory response is named down to the agency: EPA, DOJ, FDA, SEC and third party subpoenas. Not located as of 29 Aug 2026: firm size segmentation below the Am Law tier, jurisdictional or language coverage, and any statement of what the platform is not built for.