Product and intended use
Define the configuration, people, information and tasks being assessed.
Australian configuration versus other editions
Public claim only
The AU product page describes CoCounsel as integrating with Westlaw Advantage Australia, Practical Law Australia, HighQ and Microsoft 365. Outlook security FAQ is written for CoCounsel Core v2 and names OpenAI GPT and Google Gemini. US/global CoCounsel Legal pages must not be treated as the AU contract.
Ask: Which CoCounsel edition, Westlaw/Practical Law collections and add-ins are on our order form, and do Outlook/Word use the same AU Core processing path?
Australian hosting
Public claim only
AU FAQ: all customer prompts, content and output are currently stored and processed in Australia. That is a vendor statement about the current Core configuration, not a signed data-map covering add-ins, telemetry, backups, failover or support.
Ask: In the agreement, confirm AU storage and inference and list every exception for support, telemetry, backups, failover and Microsoft Graph transfers.
Skills and connected products
Public claim only
AU page: legal research intelligence grounded in Westlaw and Practical Law; Microsoft Word, Outlook, Teams, SharePoint and iManage logos; HighQ. Related product: Westlaw Precision Australia generative research. Exact skill list on the contracted SKU is not published as a schedule.
Ask: List enabled skills (research, drafting, timelines, comparison, deposition) and which are generally available in Australia.
Australian legal content
Public claim only
Westlaw Precision Australia describes generative research over Australia's legal database, including Commonwealth Law Reports, authorised reports of the High Court, Federal Court, Fair Work Commission and state superior courts, and The Laws of Australia across every Australian jurisdiction. Currency and KeyCite-equivalent behaviour must be confirmed for AI answers.
Ask: Which collections and jurisdictions are in our licence, and how does CoCounsel show currency and negative treatment on each citation?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority
Not confirmed
No public matter-exclusion or client-facing disclosure template was found. Output ownership is claimed for the customer subject to TR terms. The firm still needs client authority to put matter data into a third-party processor.
Ask: Can we exclude named clients or matters, and what wording do you recommend for Australian engagement letters?
Model providers
Public claim only
AU FAQ refers to OpenAI GPT and zero-retention APIs under the Thomson Reuters identity. Outlook Core v2 FAQ names OpenAI GPT and Google Gemini and says content is not stored by those providers. Do not treat that as a complete, current, AU-specific model register.
Ask: Provide the current model and endpoint register for our AU Core and Outlook add-in, including region and ZDR contract scope.
Subprocessors
Not confirmed
No dated CoCounsel-specific public subprocessor list with Australian locations was found. Model providers are named in FAQs. Change-notice and objection rights were not inspected in a DPA.
Ask: Provide the current subprocessor schedule for CoCounsel Australia, locations, notice period and objection rights.
Training
Public claim only
AU FAQ: Thomson Reuters does not use content or prompts to train or enhance CoCounsel or any third-party LLMs; the AI partner is contractually prohibited from training; abuse-monitoring is turned off where applicable. Outlook FAQ table: User Content, Prompts and AI Outputs are not used to train or to improve the product; Usage Information is used to improve the product but not to train. These are FAQ statements, not the signed DPA extract.
Ask: Point to the signed clause covering prompts, outputs, uploads and embeddings for our AU edition, including Outlook Graph transfers.
Usage data
Public claim only
AU FAQ and Outlook FAQ: de-identified usage metrics are analysed for account health, capacity and roadmap. 'De-identified' is not defined in the FAQ. Feedback ratings are not separately described.
Ask: Define de-identified usage data, whether prompt text can appear in it, and whether feedback ratings train anything.
Retention
Public claim only
Retention is configurable at organisation level with a client manager; users can delete their own content and prompts. LLM providers: zero-retention APIs. Default period, backups and add-in copies in Graph/CoCounsel are not stated.
Ask: State the default retention we will be set to, backup lag, and retention of Outlook/Word transfers.
Deletion
Public claim only
Users can delete content and prompts in-product; organisation deletion follows the customer's schedule. Exit deletion, certification and subprocessor purge were not in the FAQ.
Ask: On termination, what is deleted from TR and subprocessors, within how many days, and will you certify including backups?
Human access at model providers
Public claim only
AU FAQ: systemic controls turn off third parties' abuse-monitoring so there is no human access to customer data at those providers. TR staff access for support is not described. Outlook FAQ: sensitive-data use cases may be escalated to a Model Ethics Committee internally.
Ask: Who at Thomson Reuters can read our prompts, is that logged, and is abuse-monitoring off for every AU endpoint we use?
Identity and access
Not confirmed
Outlook add-in uses Entra-managed Graph consent. SAML/SSO, SCIM and MFA for the CoCounsel web app were not documented on the AU product page reviewed.
Ask: Confirm SSO/MFA/SCIM on our tier and how leavers lose Graph and CoCounsel access.
Encryption
Public claim only
AU FAQ: TLS 1.2 in transit and AES-256 at rest. Key management and BYOK were not described.
Ask: Does AES-256 cover embeddings, logs and backups, and is customer-managed key available?
Assurance
Public claim only
AU page: ISO/IEC 42001:2023 certification; IRAP assessed 22 June 2026 against PROTECTED classification-level controls for CoCounsel (Australia). Outlook FAQ: penetration testing in 2025 for the add-in. SOC 2 for the CoCounsel AU system was not stated on that page. Reports were not inspected.
Ask: Provide the IRAP letter of completion, ISO 42001 certificate scope, SOC 2 if held, and the 2025 pen-test summary for AU CoCounsel and Outlook.
Contract and DPA
Not confirmed
AU FAQ says outputs are owned by the customer subject to applicable law and Thomson Reuters terms. The master terms, DPA, liability cap and law/forum for the AU subscription were not inspected in this pass.
Ask: Provide the AU DPA, liability caps, governing law and output-ownership clause that will apply to our order.
Cross-border disclosure
Public claim only
AU FAQ asserts storage and processing of prompts, content and output in Australia. Outlook uses Microsoft Graph, which may involve Microsoft 365 processing under the customer's M365 tenancy (often Australia for AU firms, but not proven here). Model-provider region is not named beyond ZDR APIs.
Ask: List every country for inference, Graph, support and telemetry on our AU Core and Outlook configuration.
Incidents
Not confirmed
No public CoCounsel-specific breach-notification timeline was found on the AU product page.
Ask: What contractual notice period applies from discovery, and where is the last 24-month incident summary?
Product and model changes
Not confirmed
No contractual model-change notice was found. Skills and models can change under a research-publisher subscription.
Ask: What notice do we get before model, skill or processing-location changes, and can we decline a change?
Exit
Not confirmed
In-product deletion of content and prompts is described. Export formats, post-termination window and certified deletion were not.
Ask: How do we export prompts, outputs and audit logs, and what is deleted on exit including Graph-transferred mail?
Connectors
Public claim only
iManage, SharePoint, HighQ and Microsoft 365 are shown. Connector permission models were not documented beyond Outlook Graph.
Ask: For each connector, what is copied into CoCounsel, are DMS ACLs live, and can we disconnect without residual copies?
Open web
Public claim only
AU FAQ: prompting guardrails confine GenAI outputs to vetted Thomson Reuters databases and not the open internet. That does not prove every skill or add-in is closed-corpus.
Ask: Confirm no skill in our licence sends prompts to the open web, including Outlook and any agent features.
Actions on connected systems
Public claim only
Outlook add-in interacts with mailbox content via Graph after consent. Autonomous send/share without a person is not described. A full action catalogue was not published.
Ask: Which actions can CoCounsel take in Outlook, Word, iManage or Teams without a click, and how do we disable them?
Human review
Public claim only
Westlaw Precision AU: validate AI-generated summaries with in-line links to original sources. CoCounsel is described as surfacing sources and reasoning. Lawyer verification remains the firm's duty; TR's nightly tests are not a substitute.
Ask: Show Australian sample outputs with pinpoint citations and unsupported-answer behaviour for our tasks.
