4 of 29 legal AI vendors put a full promise not to train on client data in their contract.
We read the published terms, data agreements and trust pages of 29 legal AI vendors. Most say they don't train on client data. 13 put it in the contract, and only 4 without a carve-out.
- 29
- legal AI vendors
- 226
- published documents, each read twice
- 8
- kinds of legal AI, from research to e-discovery
Key findings
- Only 4 of 29 legal AI vendors put a full promise not to train on customers' data in their contract: Harvey, Legora, MyCase and Ironclad.
- 9 more promise it in the contract, but only for part of it, such as large language models only (LexisNexis), general models only (Clio) or generative AI models unless agreed otherwise in writing (Thomson Reuters).
- 12 make the promise only on web pages that aren't part of the contract. 4 of those promises cover only the outside AI companies a vendor uses, not the vendor itself.
- 4 vendors' terms let them train on customers' data or use it to improve their own models: Alexi, Darrow, EvenUp and Luminance. Hebbia's lets it train models used only by that customer.
- At 5 vendors, a marketing or security page promises more than the contract does.
- 22 of the 29 vendors' terms let an order form or a separate agreement change them, so what a firm signs can say more, or less.
- The big AI model developers go further. On 19 of 25 of their paid business plans and APIs, not training by default is in the contract.
Most legal AI vendors don't put it in the contract.
Where each of 29 legal AI vendors says it won't train on customers' data, read from its published documents.
- In the contract, for all customer data
- 14%
- In the contract, for part of it
- 31%
- Only on a web page
- 41%
- No promise
- 14%
fulkersonadvisors.com
Vendor by vendor.
What each legal AI vendor's published documents say about training on customers' data, and where they say it. Each name links to the clause.
- AlexiLegal researchTrains by default, no opt-outOn a web page only, global models only
- Bloomberg LawLegal researchDoesn't sayNo promise
- ClioPractice managementDoesn't train by defaultIn the contract, general LLMs only
- DarrowLitigationTrains by default, no opt-outNo promise
- DefinelyDraftingDoesn't sayNo promise
- DISCOE-discoveryDoesn't train by defaultOn a web page only
- DraftWiseDraftingDoesn't train by defaultOn a web page only, public models only
- EvePersonal injuryDoesn't train by defaultOn a web page only, shared models only
- EvenUpPersonal injuryTrains by default, no opt-outOn a web page, for its outside AI companies only
- EverlawE-discoveryDoesn't train by defaultIn the contract, general-use generative models only
- FilevinePractice managementDoesn't sayOn a web page, for its outside AI companies only
- HarveyLegal AI platformDoesn't train by defaultIn the contract
- HebbiaLegal AI platformTrains models used only by that customerIn the contract, may train models used only by that customer
- iManageLegal AI platformDoesn't train by defaultIn the contract, not for other customers' benefit
- IroncladContractsDoesn't train by defaultIn the contract
- IvoContractsDoesn't train by defaultOn a web page only
- LegoraLegal AI platformDoesn't train by defaultIn the contract
- LexisNexisLegal researchDoesn't train by defaultIn the contract, large language models only
- LiteraContractsDoesn't train by defaultIn the contract, generative and foundation models only
- LuminanceContractsTrains by default, no opt-outNo promise
- MyCase (8am)Practice managementDoesn't train by defaultIn the contract
- NetDocumentsLegal AI platformDoesn't sayOn a web page, for its outside AI companies only
- PaxtonLegal researchDoesn't train by defaultIn the contract, personal data and general models only
- RelativityE-discoveryDoesn't train by defaultOn a web page only, generative AI models only
- SmokeballPractice managementDoesn't train by defaultOn a web page only
- SpellbookDraftingDoesn't train by defaultIn the contract, not for other customers' benefit
- SupioPersonal injuryDoesn't train by defaultOn a web page only
- Thomson ReutersLegal researchDoesn't train by defaultIn the contract, generative AI models, unless agreed otherwise in writing
- vLexLegal researchDoesn't sayOn a web page, for its outside AI companies only
fulkersonadvisors.com
Where the website promises more than the contract.
At 5 legal AI vendors, a marketing or security page says more than the binding terms do.
- AlexiThe web page says“Your prompts, documents, and workflow data never train global models or mix with other firms.”The contract says“otherwise Process Customer Property to: (i) improve and enhance the Alexi Solution and Alexi’s other offerings”
- DISCOThe web page says“We never train on or retain your client’s data.”The contract says“license to use, process, host, store, display, reproduce, modify, create derivative works of, and distribute Customer Content during the course of Customer’s use of the AI Services for purposes of providing and improving the AI Services.”
- EverlawThe web page says“usage of Everlaw’s generative AI technology ensures that data submitted and responses received are only used to fulfill the users’ requests within Everlaw”The contract says“license to use the Case Materials to provide the Service to Customer and Authorized Users and to support, manage, and improve the Service”
- HebbiaThe web page says“Your documents, prompts, and outputs are never used to train Hebbia's models or any model provider we work with.”The contract says“Hebbia may use the Customer Materials to improve machine learning models that are solely for use by Customer”
- LexisNexisThe web page says“We never use customer data to train AI models and maintain robust data retention and deletion policies.”The contract says“will not be used by LN to train any large language model(s)”
The big model developers go further.
On 19 of 25 paid business plans and APIs from 11 AI model developers, among them OpenAI, Anthropic, Google and Microsoft, not training on customers' data by default is in the contract. Plan by plan.
Know what your AI vendors can do with client data.
We build AI systems for law firms and read the vendor terms that come with them. Bring yours to a thirty-minute call.
How we did it
We read the published documents that govern business customers of 29 legal AI vendors: terms of service, enterprise and AI terms, data processing agreements, privacy notices, trust and help pages and subprocessor lists, 226 documents in all, on October 12, 2026. The vendors are those listed in at least two 2026 sources, among them Legaltech Hub, Stanford CodeX's TechIndex and the ILTA technology survey.
An AI model (Jev, from TypeSafe) marked every passage about training, opting out, feedback, retention and changes to the terms, then answered each question for each vendor and plan, pointing to the passage behind each answer. A second AI reader read the same documents in full without seeing those answers. The two agreed on the default and on where the promise sits for 24 of 29 vendors. Every difference was settled by reading the clause, with a written reason, and every quote in the data was checked word for word against its document.
A promise counts as in the contract only when a binding document (terms, an enterprise or AI agreement or a data processing agreement) says the vendor won't train on customers' data. A promise that covers only the outside AI companies a vendor uses doesn't count as the vendor's own. Where documents disagree, the binding one decides.
These are published terms. Large customers often sign their own agreements, and 22 of the 29 vendors' terms let an order form or a separate agreement change them. Clio's terms and data agreement didn't load for our reader and were read by hand in a browser. The same reading of the AI model developers' 42 plans is a separate study.
Cite this study
Fulkerson Advisors (2026). Do legal AI vendors train on client data? The published terms of 29 legal AI vendors. https://www.fulkersonadvisors.com/research/ai-vendors-training-on-client-data
Free to use with a link to this page. The data is in the CSV.
Questions
Do legal AI vendors train on client data?
Most say they don't, but few put it fully in the contract. Only 4 of 29 legal AI vendors promise in their contract not to train on customers' data, with no carve-out: Harvey, Legora, MyCase and Ironclad. 4 vendors' terms let them use customers' data to train or improve their own models.
Does Harvey train on client data?
Harvey's platform agreement says it will not train any AI models on customer content or data, and that its subprocessors won't either. It is one of 4 legal AI vendors with a full promise in the contract.
Does CoCounsel train on my data?
Thomson Reuters' terms say it won't train generative AI models or large language models on customer data, "unless agreed separately in writing". Separate terms for its Document Intelligence product let it train on customer data.
Is "no training" something a law firm has to negotiate?
Often, yes. Only 4 of 29 legal AI vendors put a full no-training promise in their published contract, and 22 let an order form or a separate agreement change their terms. A firm that wants the promise should get it in what it signs.
Do the big AI model developers train on business data?
Mostly not by default. On 19 of 25 paid business plans and APIs from 11 model developers, the contract says they don't train on customers' data by default. Every consumer plan we read trains by default.