Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Three AI features are described: AI-powered Q&A embedded in search results, which the vendor says steps in when a curated editorial answer is not available; AI-generated summaries from any CCH iKnowConnect document view including the 360-degree view; and an AI assistant launched from anywhere in the platform with conversation context, suggested follow-ups and persistent chat history. They launched in September 2025, are enabled by default, and an administrator can opt the organisation out permanently or temporarily by contacting support.
Ask: Which AI features are enabled on our tenancy today, and confirm in writing that an opt-out leaves the underlying research platform and its editorial answers fully usable.
How the AI works
Public claim only
The vendor states: 'CCH iKnowConnect AI is an AI-powered tax and legal research assistant that uses Retrieval-Augmented Generation (RAG) to deliver accurate, jurisdiction-specific answers grounded in trusted content from your subscription.' It retrieves chunks from documents and generates answers with citations and footnotes, and the vendor says 'All content is securely hosted within CCH iKnowConnect - the AI does not access or rely on external sources.' Announced but not released: fresh news integration, hover-to-view snippets, pre-, post- and predictive filtering, chart visualisations, an additional-info section, multi-format content consumption, an AU/NZ-only depreciation rate finder, and a Research Pinboard marked 'Subscription required' that would allow document upload.
Ask: Which of the announced enhancements are contracted for our tenancy and on what dates, and will each ship with its own opt-out?
Jurisdiction handling
Public claim only
The vendor states responses are tailored to jurisdiction automatically from subscription settings and the region being viewed, and that a jurisdiction can also be specified directly in a prompt. The corpus is the organisation's subscribed CCH iKnowConnect content plus freemium primary materials. Excluded content includes bills, archive material, news older than six months and ATO edited private advice before 2020.
Ask: Demonstrate how the AI behaves when a question spans Commonwealth and state law, and how a user can tell which jurisdiction's material an answer drew on.
Vendor content addressed to AI systems
Not confirmed
Checked on 2026-09-27: the AI FAQ, the AI product page, the AI principles page, the global Privacy & Cookie Notice and the Australian terms portal page were read in full and none contains a block addressed to AI models, assistants or crawlers, or instructions on how the product should be described. A product-scoped URL map of wolterskluwer.com/en-au returned 36 URLs with no /llms.txt, /ai-info or /for-ai path. The map was narrow relative to the size of the site, so this is a negative from a partial view rather than a whole-site check.
Ask: Does Wolters Kluwer publish any page, file or block directed at AI models, assistants or crawlers about how its products should be described, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
What may be entered, and redaction
Not confirmed
One FAQ answer on data privacy makes two statements that pull in opposite directions, and as published the second sentence is garbled: 'Protected data detection and redaction capabilities automatically remove sensitive information. However, are prohibitied not to include personal or confidential data when interacting with the AI.' Read together, the vendor both claims automatic removal of sensitive information and prohibits users from entering personal or confidential data. Nothing in the pages read states what happens if a user does enter client-identifying material, or whether the prohibition is contractual.
Ask: Which governs our use: the prohibition on entering personal or confidential data, or the automatic redaction capability, and what happens to a prompt in which a fee earner enters client-identifying matter facts?
Foundation model provider
Public claim only
The FAQ answers the question directly: 'What models power CCH iKnowConnect AI? The tool is currently powered by OpenAI's Chat GPT. We continuously evaluate model performance and effectiveness.' No model name or version is given, no contracting route to OpenAI is described (direct or through a cloud provider), and no customer model choice is offered. The FAQ also states AI models 'are periodically upgraded with the latest NLP advancements'.
Ask: Name the model and version in production for our tenancy, the entity that contracts with OpenAI and the region in which the model endpoint runs, and the notice we get before either changes.
Subprocessors
Not confirmed
No subprocessor list was found for the platform or the AI features. OpenAI is named as the current model provider in the FAQ. The global Privacy & Cookie Notice (version 1.5, effective June 2026) describes categories of recipients only: other Wolters Kluwer affiliates or subsidiaries, service providers for managing or hosting services and underpinning technology, business partners and advertisers, subscribing or accrediting organisations, parties to business transfers, auditors and governmental authorities. No entity names, countries or data types are given.
Ask: Provide the current dated subprocessor register for CCH iKnowConnect and its AI features, with entity, country, purpose and data types, and our notice and objection rights.
Training on customer content
Public claim only
The FAQ states 'Customer data is not used to train AI models' and, on prompts: 'No. Your interactions are used solely to generate responses and improve the experience. They are not used to train or fine-tune the underlying AI models.' The product page states 'your prompts are never used for training, eliminating risk of leakage or misuse.' The phrase 'improve the experience' is not defined. None of these statements was found in a subscription agreement or DPA, because the Australian subscription terms were not reached.
Ask: Point to the clause in our Australian agreement that prohibits training and fine-tuning on our prompts and content, including by OpenAI, and define what 'improve the experience' permits.
Feedback and quality monitoring
Public claim only
The vendor states client feedback is incorporated through a like/dislike feedback loop, that 'Flagged responses are reviewed by subject matter experts, who may create gold-standard answers to feed back into the retreival validation process', and that targeted surveys provide broader insights. A flagged response therefore reaches Wolters Kluwer subject matter experts. Nothing states whether the prompt and surrounding conversation travel with the flag, or whether an organisation can disable the feedback control.
Ask: When a user flags a response, exactly what is sent to your subject matter experts, how long is it kept, and can we disable the feedback control for our tenancy?
Retention of prompts and chat history
Public claim only
The FAQ states: 'Conversation history is saved to your account and persists across sessions, allowing you to revisit and build on previous queries. You have full control over your history and can delete individual queries at any time.' History is not available to anonymous users. No retention period, backup retention or index retention is published. The global privacy notice states only that personal information is processed for as long as necessary and in accordance with internal data retention policies.
Ask: State the default and configurable retention for chat history, prompts, generated answers, logs and backups on the Australian platform, and whether we can set a shorter period.
Deletion
Public claim only
The only deletion control published for the AI features is user-level: a user can delete individual queries from their conversation history at any time. No organisation-level purge, no deletion timeframe, no backup-expiry statement and no certified-erasure commitment was found. The global privacy notice describes a right to erasure for personal information, subject to legal and contractual exceptions, exercised through an inquiry form.
Ask: On termination or on request, what is deleted from chat history, logs and backups, in what period, and will you certify deletion in writing including at OpenAI?
Vendor access to content
Public claim only
The global privacy notice states access to personal information by employees, business partners, service providers and third-party service providers is limited to a need-to-know basis, with appropriate technical and organisational measures. The FAQ establishes one specific access path: responses flagged through the like/dislike loop are reviewed by Wolters Kluwer subject matter experts. Which roles can read unflagged chat history, and from which countries, is not stated.
Ask: Which roles and which countries can read our users' chat history and prompts, under what approval, and can we obtain the access log?
Access control and administration
Not confirmed
The only administrative control described for the AI features is an organisation-level opt-out, permanent or temporary, arranged by contacting support; the FAQ notes that existing customers could opt out by 31 August 2025 and that opting out or back in is still handled by email to customer support. Chat history is tied to an account and is unavailable to anonymous users. Single sign-on, multi-factor authentication, role-based control of individual AI features and per-user enablement are not addressed on any page read.
Ask: Confirm whether single sign-on and enforced multi-factor authentication are available on our plan, and whether AI features can be enabled or disabled per user or per practice group rather than only for the whole organisation.
Encryption
Public claim only
The product page states the AI operates 'in a closed, encrypted environment aligned with NIST and SOC 2 Trust Principles'. 'Aligned with' is the vendor's own wording and is not a certification claim. No algorithm, protocol version, at-rest detail or key-management arrangement is named, and customer-managed keys are not mentioned. The global privacy notice describes appropriate technical and organisational measures in general terms.
Ask: State the encryption in transit and at rest for prompts, chat history and the retrieval index, the key-management arrangement, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The FAQ states: 'Yes, the SOC 2 Type 2 audit report is available to customers and prospects, provided a non-disclosure agreement (NDA) is in place.' No auditor, report period, scope or exception list is published, and the FAQ does not say whether the report covers the AI features. The vendor also states that before launch its AI products 'undergo security, privacy, technical, and legal assessments to confirm compliance with Wolters Kluwer polices', and publishes five AI Principles covering privacy and security, transparency and explainability, governance and accountability, fairness, and a human focus. No ISO/IEC 27001, ISO/IEC 42001 or IRAP claim was found.
Ask: Provide the current SOC 2 Type 2 report under NDA and confirm in writing whether CCH iKnowConnect AI is inside its scope, with the report period, exceptions and any bridge letter.
Contract, entity and forum
Not confirmed
The Australian subscription terms were not reached. The terms portal page at https://www.wolterskluwer.com/en-au/solutions/tax-and-legal/terms-conditions was read on 2026-09-27; it is an index that links country-specific terms and states only 'Browse terms and conditions for all Wolters Kluwer product subscriptions in one convenient location.' The Australian document sits one level below at /terms-conditions/australia and was not fetched within the four-operation budget. The pages read name no Australian contracting entity, ABN or ACN, no governing law, no liability cap and no AI-specific schedule; the global privacy notice names Wolters Kluwer N.V. in the Netherlands as controller for corporate web pages, under a controller-to-controller or joint-controller arrangement with affiliates.
Ask: Confirm the Australian contracting entity and its ABN or ACN, provide the Australian subscription terms and any DPA, and identify the clause that covers the AI features, liability and governing law.
Hosting region and cross-border transfers
Public claim only
No hosting region, Australian data-residency option or statement about where model inference runs appears on the product page, the AI FAQ or any other page read; searches of those pages for hosting, region, residency and cloud-provider terms returned nothing beyond 'All content is securely hosted within CCH iKnowConnect'. The global privacy notice states that when personal information is shared internally or with third parties in other countries, 'we have appropriate safeguards in place... including as applicable the EU Model clauses or other transfer safeguard', and that the group consists of many companies worldwide. It names no country and makes no Australian Privacy Principle 8 statement.
Ask: In which countries are our content, prompts, chat history and backups stored, in which region does model inference run, and is an Australia-only option available?
Incident notification
Not confirmed
No breach-notification period, notification commitment or incident history was found in the global Privacy & Cookie Notice, the AI FAQ, the product page or the AI principles page. The privacy notice states that Wolters Kluwer cannot guarantee that information will be absolutely safe from intrusion and points individuals to a contact form and to their local data protection authority for complaints.
Ask: State the contractual notification period from discovery for our Australian subscription, including incidents at OpenAI or a hosting provider, and any material incident in the last 24 months affecting the platform or its AI features.
Change notice for models and terms
Public claim only
The FAQ states the model position is current rather than fixed: 'The tool is currently powered by OpenAI's Chat GPT. We continuously evaluate model performance and effectiveness', and that 'AI models are periodically upgraded with the latest NLP advancements' while prompts are continuously refined. The AI features were turned on by default at the September 2025 launch, with an opt-out deadline of 31 August 2025 for existing customers. The privacy notice says it may be updated and that a new date will be added, and is at version 1.5 effective June 2026. No notice period for a model change, a new subprocessor or a new AI feature was found.
Ask: What written notice will we receive before the underlying model, a subprocessor or the default enablement of a new AI feature changes, and can we require our tenancy to stay on a named configuration?
Export and exit
Not confirmed
No export of chat history, prompts or generated answers is described on any page read, and no exit or data-return provision was reached because the Australian subscription terms were not fetched. The only user-side control is deletion of individual queries. The global privacy notice describes a right to data portability for personal information processed by automated means, where technically feasible, on request.
Ask: On exit, what can we export of chat history and saved research, in what format, and what is deleted and when?
Connectors and document upload
Public claim only
Today the answer is narrow: the FAQ states 'Summarisation is currently limited to CCH iKnowConnect content only', that uploading a user's own documents is not supported, and that external linked files such as PDF, Excel, Word and Smart Charts and external websites are excluded from AI responses. No Word, Outlook or document-management connector is described. That position is announced to change: the FAQ lists a Research Pinboard, marked 'Subscription required', where 'You can upload documents, pin answers and key content' and interact conversationally with them, and multi-format content consumption covering Smart Charts, PDFs, spreadsheets and Word documents in the corpus. The vendor states that if document upload is introduced, organisations will have the option to opt out.
Ask: When the Research Pinboard and document upload ship, what will the data-handling position be for uploaded client documents, and will upload be off by default for our tenancy?
Open-web access
Public claim only
The FAQ states: 'All content is securely hosted within CCH iKnowConnect - the AI does not access or rely on external sources', and lists external websites among content excluded from AI responses. The vendor contrasts this with general-purpose tools trained on the open internet. No retrieval toggle, web-search plug-in or browsing mode is described.
Ask: Confirm in writing that no AI feature issues an outbound web request at query time, including for link resolution or citation checking.
Agent actions
Not confirmed
Nothing on the AI FAQ, the product page or the AI principles page describes any AI feature taking an action: the three released features return answers, summaries and chat responses inside the platform. No agentic workflow, no outbound email or document writing, and no autonomous multi-step execution is described, and no statement rules it out either. Announced enhancements are about retrieval, filtering, presentation and an upload-capable Pinboard rather than actions.
Ask: Does any current or planned CCH iKnowConnect AI feature take an action outside returning content to the user, and if so what confirmation step applies?
Human review before use
Public claim only
The FAQ is explicit: 'Do users need to verify AI-generated responses? Yes. While the AI provides citations and footnotes, users should always verify sources and consult referenced materials before making decisions.' On hallucination it states: 'By using RAG, the AI retrieves real documents and generates answers based on them. This reduces the risk of fabricated or inaccurate information. Citations are included for transparency.' The reduction is not quantified. No product control forces a named reviewer before an answer is used or shared.
Ask: What in-product control, if any, records that a user has opened the cited source before relying on an AI answer, and can that be made mandatory for our firm?
