Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, deployment and what is licensed
Public claim only
Two deployments are published on the Australian page (checked 2026-09-27) and the AI differs between them. 'Cloud AI-enabled' is described as 'Cloud-hosted document automation with AI-assisted authoring built in'. 'On-Premise' is described as 'The same proven automation engine, hosted on your own servers so your data stays in-country. Fully managed by your team, using the authoring tools you already know, with no AI dependency required.' No price, unit of charge or plan table is published for either, and the page's only call to action is a demonstration request.
Ask: For an Australian subscription, which deployment are we buying, is AI-assisted authoring charged separately from the automation engine, and what is the price per author and per document user?
What the product does and where the AI sits
Public claim only
The Australian page (checked 2026-09-27) describes document assembly rather than generative drafting: 'Instead of starting from a blank page, users answer a guided set of questions. Contract Express then automatically assembles the appropriate document using pre-approved language and business rules'. Every AI reference on that page is to template authoring - 'AI-assisted authoring puts template-building in the hands of legal' and 'A low-code, AI-assisted authoring tool that lets lawyers directly build and share customisable templates in minutes'. The global features page names two AI features: 'AI-powered authoring - Automatically create and logically arrange the questionnaire, quickly and easily provide initial markup, and allow additional "no-code" human markup using the proprietary authoring tool', and 'GenAI assistance - Our AI chat assistant provides guidance and resolution for your queries. Navigate directly to the relevant Author help articles or Knowledge Base content, including customer forum threads.' The same page describes an approval workflow with email notifications and a task tab, and a 'Searchable document repository' queried with 'our Boolean search box' with datasheet download to Microsoft Excel; neither is described as using AI.
Ask: Which steps call a language model - questionnaire generation and initial markup only, or also assembly, the repository search or the approval workflow - and what changes in an existing template if the authoring model is replaced?
Deployment options and processing locations
Public claim only
Cloud and on-premises are both published (checked 2026-09-27). For the cloud deployment no hosting country, region, data centre or Australian residency option is published on any page read, and none is inferred here from the product's Australian page or its .com.au address. The on-premises deployment is described as 'hosted on your own servers so your data stays in-country' and 'Fully managed by your team' with 'no AI dependency required' - a statement about the customer's own infrastructure, not a published Australian region offered by the vendor. The Privacy Statement says personal information 'may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States'.
Ask: For the Cloud AI-enabled deployment, name the country and region where our templates, questionnaire answers, assembled documents, repository index, logs and backups are stored, state whether an Australian region can be elected, and put it in the agreement.
Jurisdictional content and Australian law
Public claim only
The product automates the organisation's own approved templates, clauses and business rules; the vendor names 'leases and licences, share purchase agreements, NDAs, employment contracts, facility agreements, and company formation agreements' as common examples (checked 2026-09-27). No Australian legal content, jurisdiction list, court or tribunal form set, or update service is published as part of Contract Express; the Australian page names Practical Law separately as the source of 'content starting points', which is a different subscription.
Ask: Does Contract Express ship any Australian precedent or clause content at all, or is every template ours to build and maintain - and if Practical Law content is used as a starting point, which subscription is required?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. Search-filtered maps of thomsonreuters.com.au (two runs, 33 and 36 URLs) and of legal.thomsonreuters.com (42 URLs) returned no /ai-info, /llms.txt or /for-ai page, and none of the pages read for this profile - the Australian product page, the global features page, the Privacy Statement, the website terms of use, the Trust Center, the product security profile, the Australian AI solutions page or the Australian AI campaign page - carries a heading or block addressing AI models, assistants or crawlers, or instructing them how to describe the product. Both sites are large and the maps were search-filtered, so they do not exhaust either site.
Ask: Do you publish any page or embedded block that tells AI assistants or crawlers how to describe Contract Express, and if so where is it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority to put matter material into the product
Not confirmed
No matter-exclusion control, client-notification template or engagement-letter guidance for Contract Express was found on the Australian page, the global features page, the website terms of use or the Privacy Statement (all read 2026-09-27). Client and transaction detail enters the product through the questionnaire and is held in the searchable document repository together with the assembled documents, and self-service is described as extending to 'junior teams' and to 'the business', so client material is handled by people outside the responsible lawyer's immediate team.
Ask: Can we exclude named clients or matters from the cloud repository and from AI-assisted authoring, and what wording do you recommend for Australian engagement letters and client consents covering questionnaire data and assembled documents?
Which model performs the AI-assisted authoring
Not confirmed
No model, model version or model provider is named for AI-powered authoring or for the GenAI assistance chat assistant on the Australian page, the global features page, the Privacy Statement or the product security profile (all read 2026-09-27). The Australian AI solutions page makes a claim about Thomson Reuters AI solutions generally - 'Highest standards of data security and privacy, and where no third-party large language models (LLMs) can access customer data' - and does not name Contract Express anywhere other than in the site navigation, so it is not read across to this product.
Ask: Name the model and provider behind AI-powered authoring and behind the GenAI assistance assistant, the version in use, the region each runs in, and whether the 'no third-party LLM can access customer data' statement applies to Contract Express in our agreement.
Sub-processors and who else handles the data
Not confirmed
No sub-processor list for Contract Express, and none for Thomson Reuters products generally, was found published (checked 2026-09-27). The Trust Center publishes no sub-processor register; it directs customers to per-product security profiles whose artefacts require an account. The Privacy Statement says personal information is shared with 'Affiliates within the Thomson Reuters group of companies' and with 'Third-party service providers and partners that support our business, such as our content and other partners, vendors and subcontractors, analytics providers, advertising and marketing agencies, credit agencies, and other third parties we engage', naming none of them.
Ask: Give us the sub-processor register for the Cloud AI-enabled deployment - including the cloud host, the model host and any support or analytics provider - with each one's country and your notice period before a sub-processor changes.
Whether our templates, answers and documents train or improve models
Not confirmed
Nothing product-specific was found (checked 2026-09-27). The Privacy Statement lists among the personal information it collects 'the content of your queries on our Services, such as artificial intelligence prompts', and lists among its purposes 'To operate, improve, or personalize our Services' and 'Develop new products, services, content, and other offerings' on a legitimate-interests basis; but that statement says expressly it does 'not apply where we act as a processor or service provider to another controller, such as our customers', which is the position for documents a firm assembles. Its artificial-intelligence section says only that some Services 'may use artificial intelligence, machine learning, automation, analytics, or similar technologies to provide, improve, personalize, secure, or support our Services' and that additional information is provided 'Where required by law or applicable product and/or service documentation'.
Ask: Warrant in our agreement that our templates, precedents, questionnaire answers and assembled documents are not used to train, fine-tune, evaluate or improve any Thomson Reuters or third-party model, including embeddings and evaluation sets, and identify the document that carries that warranty.
What happens to corrections and feedback
Not confirmed
No statement was found on what happens to an author's corrections to AI-generated questionnaires or markup, or to ratings given to the GenAI assistance assistant (checked 2026-09-27). The Privacy Statement's 'User contributions & user content' category includes 'feedback you provide to us and the content of communications between you and us', and its purposes include operating and improving the Services and developing new offerings; it draws no distinction between a support ticket and a correction made inside the authoring tool.
Ask: If an author corrects the AI-generated questionnaire or markup, is that correction retained beyond our tenancy, used to improve the authoring model, or visible to other customers - and can we switch that off?
How long content is kept
Not confirmed
No retention period is published for templates, questionnaire answers, assembled documents, repository data, audit history or AI prompts (checked 2026-09-27). The Privacy Statement says only that personal information is retained 'as required by our enterprise records retention schedule, which varies by Service, business function, country, record classes, and record types' and gives no period, and by its own terms it does not govern content processed for a customer. For the On-Premise deployment the software is described as running on the customer's own servers and 'Fully managed by your team'.
Ask: State the retention period for each data class in the Cloud AI-enabled deployment - templates, questionnaire answers, assembled documents, repository index, prompts and audit logs - and how long backups persist after deletion.
Deletion on request and on exit
Not confirmed
No deletion mechanism, timeframe or certification for customer content was found (checked 2026-09-27). The Privacy Statement offers data-subject rights, including deletion, through a Data Subject Rights Portal, but adds that 'These rights are not absolute and may be subject to exceptions. We are only required to honor these rights where applicable under local law and to the extent we act as a controller of the data' - which excludes content processed on a customer's behalf.
Ask: On written request and on termination, what is deleted from the Cloud AI-enabled deployment, within how many days, does it include backups and the repository index, and will you certify deletion in writing?
Thomson Reuters personnel access to our documents
Not confirmed
Nothing published states who at Thomson Reuters can read a customer's templates, questionnaire answers or assembled documents, under what approval, or whether such access is logged (checked 2026-09-27). The Trust Center describes a 'SECURE' framework built on six pillars including 'Secure workplace' and 'Secure products' without operational detail, and directs customers to the per-product security profile; the Contract Express profile lists a 'Thomson Reuters - Contract Express - Security Summary.pdf' which requires an account and is subject to Thomson Reuters confidentiality provisions, and was not read.
Ask: Who at Thomson Reuters and at any sub-processor can access our tenancy content, under what approval and logging, can we require Australian-based support access only, and will you supply the access logs on request?
Identity, roles and the approval workflow
Not confirmed
The only access-related mechanism published is functional rather than identity-based: a 'Customizable approval workflow' with 'notifications and status alerts automatically sent via email and outstanding approvals accessible from the task tab', and self-service document creation extended to non-lawyer users (checked 2026-09-27). No single sign-on, multi-factor authentication, SCIM provisioning, role model or permission matrix is published for Contract Express on any page read.
Ask: Does the Cloud AI-enabled deployment support SSO and SCIM with our identity provider and enforce MFA, and what roles separate template authors, document generators and approvers?
Encryption and key management
Not confirmed
No encryption statement for Contract Express was found (checked 2026-09-27). The Trust Center speaks at framework level - 'Establish baseline practices and standards to maintain secure networks, systems, and hosting environments' and 'Deliver secure-by-design products that protect processes and customer data' - and points to the per-product security profile, whose documents require an account and an accepted confidentiality provision. The Privacy Statement says Thomson Reuters works 'to implement technical and organizational measures designed to protect the security of personal information' and that 'no method of transmission over the Internet or electronic storage is 100% secure'.
Ask: State encryption in transit and at rest for the Cloud AI-enabled deployment, who holds the keys, whether customer-managed keys are available, and whether prompts sent to the authoring model are encrypted end to end.
Certifications and independent assessment
Public claim only
The Thomson Reuters Trust Center links a per-product security profile for Contract Express, and that profile (read 2026-09-27) lists 'Audits and Certifications (3)': SOC 2 with 2 documents, ISO 9001 with 1 document and ISO 27001 with 2 documents, plus a CAIQ questionnaire with 0 documents and three additional documents. Every artefact is gated: the profile states that access to and use of any document 'is subject to the Thomson Reuters Confidentiality Provision ("NDA")' and that documents are viewable once logged into an account, so no certificate, scope statement or report period was read. ISO/IEC 42001 is not listed on the Contract Express profile. Separately the Trust Center publishes corporate ISO 42001, ISO 27001, ISO 9001, ISO 14001 and ISO 20000-1 certificate PDFs, whose scope was not read, and the Australian AI campaign page states ISO/IEC 42001:2023 was achieved 'for Westlaw and CoCounsel'. The Australian AI solutions page states CoCounsel (Australia) was IRAP assessed on 22 June 2026 against PROTECTED controls; Contract Express is not named in either statement. Unverified, not applied (2026-10-10): security claim GDPR (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim HIPAA (https://drata.com/learn/iso-27001/vs-soc-2). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 42001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim SOC 2 (https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35). not the vendor's domain.
Ask: Send the SOC 2 Type II report and ISO 27001 certificate with Contract Express and its hosting infrastructure named in scope, confirm whether ISO/IEC 42001 covers the AI-assisted authoring, and say whether any IRAP assessment covers Contract Express.
Contract, data processing terms and governing law
Not confirmed
No subscription agreement, master terms, product terms or data processing addendum for Contract Express is published (checked 2026-09-27). The only contract document on the Australian site is a website terms of use, which by its own words applies to 'All use of Thomson Reuters World Wide Web pages located within www.thomsonreuters.com.au', states 'We may amend the Terms at any time by posting the amended terms on this site', provides the site 'on an "as is" and "as available" basis' with 'no representations or warranties of any kind', and contains no governing law, forum, liability or data-processing provision for a software subscription. A search-filtered map of the Australian site returned no other product terms besides a ProView content licence agreement for e-books.
Ask: Send the Contract Express subscription agreement and data processing addendum, naming the contracting Thomson Reuters entity and its ACN or ABN, the governing law and forum, the liability cap, and how liability is allocated if a business rule or AI-generated template produces a wrong clause.
Where the data goes, and whether inference runs in Australia
Not confirmed
No processing location is published for the cloud deployment and no statement says whether model inference for AI-assisted authoring runs in Australia (checked 2026-09-27); neither is inferred here. The Privacy Statement says personal information 'may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States', asks the reader to 'acknowledge the risk that we may transfer your personal information to countries that may provide less protection than your home country's privacy laws', and states Thomson Reuters 'may not be able to prevent government authorities in some countries from accessing your personal information'. The On-Premise deployment is described as keeping data in-country on the customer's own servers.
Ask: List every country in which Contract Express questionnaire data, templates, assembled documents, logs, backups and support access are processed, and state whether authoring-model inference runs in Australia or is sent offshore.
Incident notification
Not confirmed
No incident-notification commitment, timeframe or contact was found for Contract Express (checked 2026-09-27). The Trust Center names a framework pillar, 'Secure response - Rapidly detect and mitigate risks to Thomson Reuters estate', with no customer notification undertaking, and the Privacy Statement contains no breach-notification provision. Nothing published addresses the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
Ask: What is your contractual notification period and channel for a security incident affecting our tenancy, and how will you support our own assessment and notification obligations under the Australian Notifiable Data Breaches scheme?
Notice of changes to terms, features and models
Not confirmed
No commitment to notify customers before a change to the product, the AI features or the model behind them was found (checked 2026-09-27). Both published documents reserve unilateral change: the website terms of use say 'We may amend the Terms at any time by posting the amended terms on this site', and the Privacy Statement says 'We reserve the right to update it at any time for any reason. We will notify you of changes to our Privacy Statement by updating the "last updated" date and posting the updated Privacy Statement on this page' and that customers 'should check our Services frequently'. The Australian AI campaign page describes 'automatic access to new capabilities as they become available' for Thomson Reuters AI products.
Ask: How much notice will we get before the authoring model, its provider or its hosting region changes, and will you agree to notice and a right to object for changes that affect processing location or model provider?
Getting our templates and documents out
Not confirmed
No export, transition or post-termination provision is published (checked 2026-09-27). Two published mechanisms bear on it without amounting to an exit right: assembled documents are produced as Microsoft Word files, and the searchable repository allows datasheet data to be downloaded 'into Microsoft Excel'. Nothing published says whether automated templates, questionnaire definitions, business rules, questionnaire answers or audit history can be exported in a reusable form, and nothing addresses migration between the Cloud and On-Premise deployments.
Ask: On exit, in what format can we export every automated template, business rule, questionnaire answer set, assembled document and audit record, and can a cloud tenancy be migrated to the On-Premise deployment?
Connectors and what they can reach
Public claim only
Published connections are Microsoft Word, iSheets, download into Microsoft Excel, and 'our other products and services (additional subscription required)' - the Australian page naming Practical Law, CoCounsel and HighQ (checked 2026-09-27). No permission model, scope limit or administrative control over connectors is published, and no document-management connector is named for Contract Express on the pages read.
Ask: For each connector, what data leaves Contract Express and what can the connector read back, who may enable one, and can we restrict connectors to named systems?
Whether the product reaches the public internet
Not confirmed
Nothing on the pages read says that Contract Express queries the public web (checked 2026-09-27). The two published search-like features are internal on their face: the 'Searchable document repository' is queried with 'our Boolean search box' over the customer's own documents, and the GenAI assistance assistant is described as navigating to 'the relevant Author help articles or Knowledge Base content, including customer forum threads', which is vendor help content. No document confirms whether either feature, or the authoring model, calls an external index or the open internet.
Ask: Does any Contract Express feature, including the authoring model and the GenAI assistance assistant, call an external search index or the public internet, and can that be disabled for our tenancy?
What the AI is allowed to do without a person
Not confirmed
On the published description the AI produces a draft that a person then edits: AI-powered authoring 'Automatically create and logically arrange the questionnaire, quickly and easily provide initial markup, and allow additional "no-code" human markup', and document issue is gated by the 'Customizable approval workflow' with notifications and a task tab (checked 2026-09-27). Two settings a firm must decide are not addressed by anything published: whether AI-assisted authoring can be turned off inside the Cloud deployment - the vendor's answer to no AI is a different deployment, On-Premise, 'with no AI dependency required' - and whether the approval workflow can be made mandatory rather than configurable, since it is described as customisable.
Ask: Can AI-powered authoring and the GenAI assistance assistant be disabled per tenancy or per user in the Cloud deployment, and can the approval workflow be locked so a document cannot be issued without a named approver?
Where a person must check the output
Public claim only
The published workflow places a person at two points: the author reviews and extends AI-generated questionnaires and markup with 'additional "no-code" human markup', and the approval workflow routes documents for approval before issue (checked 2026-09-27). No reviewer guidance, accuracy statement, error rate or obligation to verify is published, and the vendor's claim that the engine is 'Capable of 100+ page documents assembled correctly, first time' carries no stated method or sample. Because assembly runs on business rules rather than a model, an error is a rule or template error that can repeat silently across every document generated from that template.
Ask: What review guidance do you publish for authors accepting AI-generated questionnaires and markup, how are template and rule errors detected before they propagate, and who is accountable if an assembled document contains the wrong clause?
