Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The product FAQ states that payment is required — 'a separate add-on plan for full access is available to new and existing Acrobat customers' — that an existing Acrobat Pro or Standard plan is not a prerequisite, and that generative AI features are available for Teams, Enterprise VIP and Enterprise ETLA customers. The General Terms make Product Specific Terms override the General Terms, and list separate additional terms for Adobe Generative AI, Document Cloud and Business Customers.
Ask: Which Adobe agreement will cover us — VIP, ETLA or the online terms — and which of the Adobe Generative AI, Document Cloud and Business Customers additional terms apply to the AI Assistant add-on?
Deployment and where the service runs
Public claim only
The Document Cloud hosting page, last updated 16 September 2026, states that Adobe Acrobat is hosted on AWS data centres in North America, Europe and Japan and that 'Acrobat AI Services, including AI Assistant, as well as Acrobat PDF Services and APIs, also leverage these data centers', with user-generated content stored in Adobe Enterprise Storage. The technical requirements page states the user must be online and signed in with a supported Adobe ID, so there is no offline or on-premises mode for the assistant.
Ask: Which of the North America, Europe and Japan data centres will serve our Australian users by default, and can that be fixed contractually?
Documented functions and limits
Public claim only
The Australian product page describes question answering with attribution across PDF and non-PDF files, generative summaries as an outline with headings and section key points citing back to the source, content generation for emails, presentations, meeting notes and research summaries, breaking down contract language and comparing contracts, meeting summaries from transcripts, podcast-style audio overviews across several documents, visual interactive reports and presentations, voice and hands-free voice chat on mobile, read-aloud, image generation, and asking the assistant to edit, sign, redact and compress documents. The technical requirements page adds that files must be under 100 MB and 600 pages, must not be password-protected or a PDF Portfolio, prompts must be under 500 characters, text selections must be under 8,000 characters on a single page, images and complex vector graphics are not supported, and generative AI features run only for files in a fixed list of 13 languages.
Ask: Which of these functions are enabled on the plan we would buy, and can individual functions such as image generation or audio overviews be turned off for our users?
Legal content and jurisdiction
Not confirmed
AI Assistant works on documents the user supplies and on the webpage the user is viewing; no legal content library, citator or jurisdiction setting is described on any page read, and citations are to the source document rather than to law. The Acrobat Studio legal page states in Adobe's own words that 'AI Assistant surfaces information, language patterns and document structure for a legal team's review, but it does not constitute legal advice or risk assessment. Outputs should always be reviewed by qualified legal counsel.'
Ask: Does AI Assistant apply any jurisdictional knowledge or check against Australian law, or is jurisdictional accuracy entirely a function of the documents supplied?
Vendor content addressed to AI models, and self-comparative claims
Public claim only
Adobe publishes a file at https://www.adobe.com/llms.txt, checked 2026-09-27, that is addressed to large language models and lists Adobe products with one-line descriptions, including 'Chat with your docs - Acrobat Ai Assitant ... Save time with AI Assistant. Break down complex language in contracts, summarize your docs in a click, and ask questions to get quick answers.' The file contains no instruction of the form 'describe this product as X'. Separately, the Australian product page's FAQ poses and answers comparative questions about itself, including 'What is the best AI platform for summarising documents?' answered with 'Acrobat AI Assistant stands out by delivering generative summaries with precise citations you can trust.' Both are marketing content, not contractual documents.
Ask: Which statements in the llms.txt file and the product-page FAQ does Adobe warrant contractually, and which are marketing only?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and confidentiality
Not confirmed
The General Terms state that the customer agrees not to collect, process or store Sensitive Personal Information using the services and software except as directly authorised by Adobe, as intended by the services, or as governed by the Product Specific Terms. Using the assistant sends document content to Adobe's cloud and, per the sub-processor list, to model providers including Microsoft, OpenAI and Google. No client notice or consent wording is published.
Ask: Does the Sensitive Personal Information restriction apply to privileged client material placed in AI Assistant, and what client notice does Adobe consider necessary?
Foundation-model providers
Public claim only
The sub-processor list dated 28 July 2026 states that Adobe 'offers the use of the Azure OpenAI service to provide features within Adobe Apps/Services where customers decide to use such features (e.g., AI Assistant in Adobe Acrobat)', that OpenAI supports 'features in Document Cloud related to being able to query for information in documents', with a note that Adobe also accesses OpenAI models through Azure OpenAI 'that assist with Adobe Acrobat's AI Assistant (and Open AI is contractually prohibited from reviewing or training its models on Adobe customer data)', and that Google's Gemini and Veo models support 'AI supported features in Document Cloud'. The hosting page adds that for EU enterprise users 'LLM processing (currently Microsoft Azure OpenAI) will take place in the EU (currently in Sweden)'. Neither page maps a specific model to a specific AI Assistant function, and no customer model choice is described.
Ask: For an Australian tenant, which model and which provider serves each AI Assistant function, in which country, and what notice will we get if that changes?
Subprocessors
Public claim only
Adobe publishes a dated sub-processor list, last updated 28 July 2026, maintained under its Data Processing Addendum with a subscription option for updates. Entries covering Acrobat or Document Cloud include Microsoft Corporation (Azure hosting and the Azure OpenAI service; locations USA, EU, UK, Canada, India, Australia), Amazon Web Services (locations USA, EU, Australia, Singapore, Japan), OpenAI (USA, EU), Google (USA), Brave Software for the Brave Search web search API (USA, France, Germany) and Elastic N.V., which stores customer-uploaded content in Elasticsearch indices for optional customer-initiated features (USA). The page states the locations given are the sub-processor's headquarters and key processing hubs, not necessarily where Adobe's instance runs.
Ask: Which of these sub-processors receives our document content when AI Assistant is used, and what are our notice and objection rights when the list changes?
Training on customer content
Public claim only
Section 4.3(A) of the Australian General Terms states 'We will not use these rights to train generative AI models on your Content and will not use the sublicence rights to have anyone else train generative AI models on your Content, except at your specific request', and section 2.2(F) repeats that no Local or Cloud Content is used to train generative AI models except content submitted to Adobe Stock. Separately, Content Analytics for product improvement is a different mechanism: the Content Analysis FAQ dated 10 June 2026 states that business and school accounts and profiles 'have been automatically opted out', that personal accounts are on by default with a toggle at account.adobe.com/privacy, and that the opt-out does not apply when the user is not signed in or takes part in feedback submissions, betas, user studies or the Adobe Acrobat Improvement Program.
Ask: Confirm in our agreement that no document content, prompt or output from AI Assistant trains or fine-tunes any model at Adobe, Microsoft, OpenAI or Google, and that Content Analytics is off for every profile we hold.
Feedback and human review of submitted content
Public claim only
The Content Analysis FAQ states that Adobe may perform human review of content for product improvement in limited situations, which it lists as content the user makes public, content submitted for human review such as feedback sent to engineering teams, and participation in prerelease, beta, early access or product improvement programmes including the Adobe Acrobat Improvement Program; reviewers are said to be subject to confidentiality requirements and privacy training. The hosting page states that 'Reported Feedback data submitted by users is handled separately' under Adobe's content usage and handling practices. The General Terms section 2.2 confirm a person may review content 'upon your request, when you choose to let us use your content to improve our products or when your content is flagged or reported as illegal'.
Ask: Can we disable the in-product feedback and report buttons for our users so that no matter content can be submitted for human review, and where is reported feedback stored?
Retention of prompts, outputs and caches
Public claim only
The hosting page states that Regional Data Center pinning for EU and US enterprise customers processes and caches user data 'temporarily for up to 12 hours' within the designated region; no equivalent statement is published for customers outside those two regions, and no retention period for AI Assistant prompts, chats or generated outputs appears on any page read. The same page states Identity Management edge servers, which include an Australian edge server, cache requested data for no more than 14 days from the latest request.
Ask: State in writing how long AI Assistant prompts, chat histories, generated summaries and PDF Space contents are retained for an Australian customer, and in which country they sit.
Deletion and exit erasure
Public claim only
Section 3.3 of the General Terms states that at the end of the licence term Adobe will use commercially reasonable efforts to allow the customer to transition content out, that the transition must be completed within 30 days of termination or expiry, and that at the end of that 30-day period Adobe reserves the right to delete the content. Deletion of AI Assistant chat histories or generated artefacts is not separately addressed, and no certified-deletion undertaking was found.
Ask: On exit, what is deleted and when — documents, chat histories, generated outputs and any model-provider caches — and will Adobe certify the deletion?
Adobe and provider access to content
Public claim only
Section 2.2 of the General Terms states that Adobe limits its access to content to specific purposes, does not scan or review locally stored content, and that 'A person may review your content on our servers in limited circumstances, such as upon your request, when you choose to let us use your content to improve our products or when your content is flagged or reported as illegal'. The sub-processor list states that for the limited categories where Microsoft Azure can access Adobe customer data, strict controls apply, and that OpenAI is contractually prohibited from reviewing Adobe customer data.
Ask: Which Adobe teams and which sub-processor personnel can read a document processed by AI Assistant, in which countries, and can we receive an access log?
Administrative control and identity
Public claim only
The technical requirements page states that generative AI features must be enabled and the user must be signed in with a supported Adobe ID, which implies an administrative switch but does not document it. The General Terms distinguish Personal Users from Business Users and state that on a business plan 'your organisation has access to and control over your work', and that a personal account created with a work email may be rolled into a business relationship with prior notice. The hosting page describes Adobe IDs, Enterprise IDs and Federated IDs as determining how assets are stored and shared, with the Admin Console hosted in an AWS data centre in Virginia.
Ask: Through the Admin Console, can we turn AI Assistant on or off per product profile and per user, enforce Federated ID, and export an audit log of AI Assistant use?
Encryption
Not confirmed
No encryption commitment for AI Assistant was found in the General Terms, the Content Analysis FAQ, the technical requirements page, the hosting-locations page or the Australian product page. The Acrobat Studio legal use-case page asserts that Studio 'uses encryption, granular permissions and zero-training data usage' in a marketing FAQ, without naming algorithms, key management or scope. The Adobe Trust Centre links security whitepapers and a resource library that were not retrieved within the evidence budget.
Ask: Provide the Document Cloud security whitepaper for AI Assistant stating encryption in transit and at rest, algorithms, key management and whether customer-managed keys are available.
Independent security assurance
Not confirmed
The Australian Trust Centre page read on 2026-09-27 links a resource library and a compliance attestations list, stating that Adobe complies with many industry standards and undergoes independent audits, but names no certification on the page itself. Neither the compliance list nor any attestation was retrieved within the evidence budget, so no certification, date or scope covering AI Assistant is recorded here.
Ask: Provide the current SOC 2 or ISO certificates and any AI management-system certification, with scope statements confirming that Acrobat AI Services are inside the audited boundary.
Contracting entity, liability and forum
Public claim only
The Australian General Terms state that for customers residing outside North America and Japan the relationship is with Adobe Systems Software Ireland Limited under the laws of Ireland, and that for customers in Australia that company acts as authorised agent of Adobe Systems Pty Ltd and contracts in that capacity. Total liability is limited to the greater of US$100 or the amount paid for access in the three-month period preceding the event, the services are supplied 'AS-IS' to the maximum extent permitted by law, and section 13 preserves rights under the Competition and Consumer Act 2010 (Cth) with Adobe's liability for a statutory guarantee limited at its election to re-supply or the cost of re-supply. Product Specific Terms, including additional terms for Adobe Generative AI, override the General Terms; those additional terms and the Data Processing Addendum were not read.
Ask: Confirm the Australian contracting entity and its ACN or ABN, provide the Adobe Generative AI additional terms and the Data Processing Addendum that will apply to us, and state any negotiated increase to the liability cap.
Cross-border transfers and APP 8
Public claim only
The Document Cloud hosting page states Acrobat and Acrobat AI Services run in AWS data centres in North America, Europe and Japan and that regional pinning is available only to EU and US enterprise customers, so Australian content is processed offshore with no published Australian option. The sub-processor list gives sub-processor locations across the USA, EU, UK, Canada, India, Australia, Singapore, Japan, France and Germany as headquarters and key hubs rather than as the location of Adobe's instance, and states that Adobe applies international transfer protections including European Commission approved Standard Contractual Clauses and the Data Privacy Framework.
Ask: For Australian users, name every country in which a document, prompt or output is processed, cached or logged, including the model-provider endpoint, and what APP 8 protections Adobe relies on.
Incident notification
Not confirmed
No breach-notification period was found in the Australian General Terms or on any other page read. The Trust Centre links an incident-response page and a security bulletins page, neither of which was retrieved within the evidence budget, and the Data Processing Addendum, which would ordinarily carry the notification clause, was not read.
Ask: State the contractual notification period from discovery for an incident affecting AI Assistant content, whether it covers incidents at Microsoft, OpenAI or Google, and how Adobe supports a Notifiable Data Breaches assessment.
Change notice for models, terms and processors
Public claim only
The sub-processor list states that Adobe will update the page to reflect changes in the use of sub-processors as set out in its Data Processing Addendum and offers a subscription to updates, so change notice for processors depends on terms not read here. The hosting page's wording for model providers is qualified as current — 'LLM processing (currently Microsoft Azure OpenAI)' and processing 'currently in Sweden' — and the General Terms provide for updates to the terms and for Product Specific Terms to change.
Ask: What advance notice do we get before a model provider, model or processing location behind AI Assistant changes, and can we object?
Export and exit
Public claim only
Section 3.3 of the General Terms recommends the customer back up content elsewhere, states that Adobe will use commercially reasonable efforts to allow transition of content out at the end of the licence term, requires that transition to be completed within 30 days, and reserves the right to delete content after it. No export format for AI Assistant chats, PDF Spaces or generated artefacts is described.
Ask: In what format can we export AI Assistant chat histories, PDF Spaces and generated outputs before cancellation, and is anything unexportable?
Connectors and third-party services
Public claim only
Section 3.12 of the General Terms states that Adobe may make third-party software and services available through the services as a convenience, that these are not Services and Software as defined in the terms, and that the customer's acquisition and use of them is governed by the third party's terms. The sub-processor list adds that Document Cloud calls the Brave Search web search API and that Elastic N.V. stores customer-uploaded content in Elasticsearch indices for optional customer-initiated features.
Ask: Which third-party services can AI Assistant reach for our users, which are on by default, and can each be disabled centrally?
Open-web retrieval
Public claim only
The sub-processor list states that 'Adobe Document Cloud utilizes the Brave Search web search API. Brave processes queries constructed based on user inputs. URLs are returned to Adobe services from Brave's own web index. Brave does not retain any data, but does process queries on Adobe's behalf in customer facing workflows', and that Adobe's server IP addresses are known to the Brave service. Separately, the technical requirements page documents 'AI Assistant for webpages', which appears only on English-language webpages with long-form content. Which AI Assistant functions issue a Brave query, and whether the behaviour can be disabled, is not published.
Ask: Which AI Assistant actions send a query to Brave Search, what is included in that query, and can web retrieval and AI Assistant for webpages be turned off for our users?
Actions the assistant can take on a document
Not confirmed
The Australian product page lists asking AI Assistant to 'edit, sign, redact and compress your docs', and the technical requirements page describes editing PDFs by chat — 'Replace, rewrite, restructure, redact, format, or highlight text — just by chatting with AI Assistant'. Those are write and redaction actions on the document invoked in natural language. No page read describes a confirmation step, an undo guarantee or an administrative control over which actions the assistant may perform.
Ask: Which chat-invoked actions change a file in place, is each one confirmed and reversible, and can signing and redaction by chat be disabled for our users?
Human review before use
Public claim only
Adobe's Australian legal use-case page states that 'AI Assistant surfaces information, language patterns and document structure for a legal team's review, but it does not constitute legal advice or risk assessment. Outputs should always be reviewed by qualified legal counsel.' Citations back to the source document are described as the verification route. No product control that forces or records a reviewer's approval is described on any page read.
Ask: Is there any setting or log that records a named person reviewing AI Assistant output before it leaves the firm, and can that be mandated for our users?
