TrustArc

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Artificial intelligence is present and peripheral by the vendor's own construction. The Terms of Use for AI Features state that use of any AI-enabled feature is strictly optional, that no customer data is processed by AI technologies unless the customer uses such a feature, and that the customer may discontinue them at any time; Table 1 lists the features as assistants, lookups, autofill, similarity search, bulk record creation, translations and summaries layered onto PrivacyCentral, Data Mapping, Assessment Manager, Cookie Consent Manager, Trust Center and Nymity Research, each of which functions as a privacy management, assessment or research product without them. Arc Intelligence reached general availability in December 2025 on a platform in operation for decades. This is the legacy-platform case the brief asks the axis to discriminate, and it does. AI Terms, legal centre index and product navigation read 6 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is disclaimed without measurement, and grounding is to a subscription corpus the reader cannot open. The AI Terms state that TrustArc takes measures designed to ensure accuracy but is not responsible for the quality, accuracy or effectiveness of AI-generated output and that every output must be reviewed, with a subject-matter expert if needed, before use; the NymityAI research chatbot answers over the Nymity library of regulatory summaries and templates, which is licensed content rather than primary law a reader can verify without a subscription. No accuracy figure, test set, evaluation or description of how answers cite their sources is published on the surfaces read. AI Terms, product navigation and trust centre privacy notice read 6 September 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A written commitment to human oversight with real review surfaces, short of the full control structure. AI Terms section 2.1 requires the customer to review and validate AI outputs and not rely on them for decision-making without human oversight, section 1.1 requires notice before any AI technology processes customer data and makes every AI feature optional and revocable on request, and the features themselves are assistive, with suggestions, lookups, autofill and an evidence analyser that a user accepts into an assessment or record. What is not published is any threshold at which the system acts without a person, any description of what executes automatically, or a stated route back after an output is wrong beyond the customer's own review. AI Terms and product navigation read 6 September 2026.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

A named customer without figures, and figures without a named customer. A published case study names the New England Journal of Medicine and its data protection officer, Sean McInnis, describing a migration of a cookie consent tool and the support received, with no measured outcome; a second case study attributes figures to an unnamed Fortune 500 consumer products company: time to compliance cut by up to fifteen per cent, privacy programme operating expenses reduced by sixteen to thirty per cent, and more than three quarters of privacy processes automated, with no method stated. Nothing joins a named customer to a figure, and the AI features are not the subject of either study. Two case study PDFs read 6 September 2026; the customers index was not opened.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive published commitments on training use, third-party providers and deletion, short of the full picture on segregation and privilege. No training: AI Terms section 1.1(b), incorporated into the customer agreement, states that customer data will not be used for AI model training, model improvement or any similar purpose, and 1.1(d) that the third-party AI technologies are explicitly opted out of LLM training and used solely to generate responses for authenticated users within the TrustArc environment. Third-party providers: Table 1 names them feature by feature. Retention and deletion: the subscription agreement gives a thirty-day retrieval window after termination followed by deletion, and the AI Terms commit to ceasing AI processing promptly on request. Not located: any statement on segregation between customers or matters, since the technical and organisational measures document was not opened, and any treatment of privilege or work product. AI Terms, subscription agreement fragments and trust centre privacy notice read 6 September 2026.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

A real position on tooling versus expertise, short of a drawn advice line and jurisdiction limits. AI Terms section 1.2(b) requires the customer to review all AI output before use, suggesting consultation with an internal or external subject-matter expert, and section 2.1 bars relying on outputs for decision-making without human oversight; the buyer is stated as privacy and compliance teams. The Nymity library publishes legal summaries and the research chatbot answers from them, and no located surface states whether those outputs are or are not legal advice; the subscription agreement, which a third-party summary describes as stating that use of the solutions does not guarantee compliance, could not be fetched in full because the site blocks automated retrieval, so that line is not credited. No jurisdiction limit is named. AI Terms and subscription agreement fragments read 6 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Published AI-use commitments without a governance mechanism, testing regime or accountable owner. The AI Terms are substantive on data use, provider transparency, opt-out and change notice, but they say nothing about who inside TrustArc is accountable for the AI features, what is tested before a feature ships, or what has been found about uneven output; no responsible AI page, ISO 42001 or equivalent certification, or model evaluation is published on the surfaces read. The Assessment Manager product sells AI risk assessment to customers, which is governance of the customer's AI rather than TrustArc's own. AI Terms, product navigation and trust centre read 6 September 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Substantive published policy covering most of the ground, with access control not read. Retention: the subscription agreement retains customer data for thirty days after termination for retrieval, then permits deletion except for legally required copies; the trust centre privacy notice retains personal information only as long as necessary and places data about individuals named in customer assessments under customer control. Deletion: the AI Terms commit to ceasing AI processing on request. Sub-processors: a public disclosure lists each with location, purpose and transfer mechanism, with emailed notice thirty days before any addition and a subscription to receive it, plus a separate affiliate list. Incident practice: AI Terms section 1.3 commits to prompt notice of any security incident involving AI-related processing under the agreement or DPA. Access control: the technical and organisational measures document and DPA of February 2024 exist in the legal centre and were not opened; the trust centre security page states TLS 1.2 in transit and AES-256 at rest with intrusion detection and logging. Surfaces read 6 September 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

A real published position on liability, short of the full picture because the subscription agreement could not be read end to end. Recovered through the search index from the subscription agreement: section 8.1 gives a TrustArc defence and indemnity for third-party claims stated to be its entire liability and the customer's exclusive remedy for such claims, with exclusions for modifications, combinations and non-compliant use; section 8.2 has the customer indemnify TrustArc for customer data and other matters; section 7.2 warrants core functionality against documentation, no material decrease during the term, malicious-code measures and diligent services. The end-user terms for partner channels cap either party's liability at fees paid for the applicable solution in the preceding twelve months. AI Terms section 2.1 provides the AI features with the same warranties and exclusions as the solutions and section 1.2(b) disclaims responsibility for the quality and accuracy of AI output. The agreement's own cap, consequential-loss exclusions and carve-outs were not readable because the site returned bot detection on fetch on 6 September 2026; that is a limit on this reading and the agreement is the rebuttal route.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Integrations are referred to without documentation an implementer could use on the surfaces read. The subscription agreement contemplates customer-enabled Third-Party Applications with data exchange on the customer's behalf, and the Trust Center product page describes pushing documents from content systems, notifying Slack and creating ServiceNow tasks through TrustArc Integrations. No integrations page or documentation was opened, no practice, document or matter system is named in the material read, and nothing describes what syncs or in which direction for the privacy applications. Subscription agreement fragments and Trust Center product page read 6 September 2026; the integrations surface is the rebuttal route.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery is stated with partial residency detail and the tenancy model is not addressed. The sub-processor disclosure gives a location for each processor, including Microsoft in Washington and Canada Central for logging and messaging and Mailgun in Texas for research alerts, and the AI Terms place one feature, Ask Arc, on Anthropic in the United States or Bedrock in the EU, which is a region choice stated for that feature alone; the trust centre security page names an enterprise-grade cloud hosting provider without naming it. Nothing states whether customers share infrastructure or where the platform's primary data store sits, and no residency option is described for the platform as a whole. Sub-processor disclosure, AI Terms and trust centre security page read 6 September 2026.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real and stated on a trust centre that renders, short of a report reachable without asking. The trust centre security page states an annual assessment by a qualified external third-party auditor against the AICPA SOC 2 Type II standard, alongside TLS 1.2 in transit, AES-256 at rest, intrusion detection, logging and incident response plans; the trust centre carries privacy, security, availability and legal sections. No auditor is named, no coverage period is stated, and the report itself sits behind the trust centre's permissions, which the vendor's own Trust Center product page describes as keeping SOC 2 reports behind confidentiality requirements; no request was submitted. No ISO certification is stated on the surfaces read. Trust centre security page and Trust Center product page read 6 September 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The most granular provider disclosure in the pull, held off A because the models themselves are not named. Table 1 of the AI Terms maps every AI-enabled feature to its AI technology and third-party provider: the Azure AI Platform from Microsoft for the Nymity research chatbot and lookups, the OpenAI API for autofill, similarity search, bulk record creation, evidence analysis, summaries and cookie research, the Gemini API from Google Cloud for translations and assisted upload, and for Ask Arc either Anthropic in the United States and Bedrock from Amazon in the EU or the OpenAI API, depending on which of the two versions of the table the page renders. Section 2.2(b) commits to thirty days' notice and a right to object before any modification that materially and adversely affects the customer, including changes to provider relationships, and section 1.1(d) states the providers are opted out of LLM training. The page carries two versions of Table 1 with different entries for Ask Arc, which is recorded as an inconsistency a buyer will see. The technology column names platforms and APIs rather than models. AI Terms read 6 September 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information was located on any surface read, at any level. The legal centre lists agreements and policies with no pricing document, the subscription agreement refers fees to the order, the AI Terms refer to usage limits such as daily query caps without a charge, and the supplier's pre-screen recorded no pricing page. The home page navigation was read only in excerpt, so the existence of a pricing page was not established by inventory, and this row is rebuttable on that page if one exists. Legal centre index, AI Terms, subscription agreement fragments and end-user terms fragments read 6 September 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Segment and coverage described with substance; the boundaries are left open. The buyer is stated as privacy, legal, security and compliance teams in enterprises, with the Nymity library covering privacy regulations, legal summaries and operational templates globally and product navigation naming the EU AI Act, India's data protection law and the EU-US Data Privacy Framework among covered regimes; case studies span healthcare and publishing and consumer products, and the TRUSTe assurance programmes serve a separate certification market. What is not stated is where the product stops: no jurisdiction or regulation is named as unsupported and no law firm use is described. Product navigation, case studies and AI Terms read 6 September 2026.