---
title: "Contract Express (Thomson Reuters)"
url: "https://ailawframework.com/software/contract-express"
type: "software_profile"
site: "AI Law Framework"
id: "contract-express"
vendor: "Thomson Reuters"
category: "Legal-specific"
segment: "Document automation"
confidence: "low"
last_reviewed: "2026-10-10"
---

# Contract Express (Thomson Reuters)

> Document-automation engine for law firms, in-house legal departments and government: a guided questionnaire assembles documents from pre-approved language and business rules, with AI-assisted template authoring in the…

Canonical page: https://ailawframework.com/software/contract-express  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Contract Express as published on the Thomson Reuters Australia page, covering both published deployments - Cloud AI-enabled and On-Premise. CoCounsel, Practical Law and HighQ are separate subscriptions and need separate review.

Document-automation engine for law firms, in-house legal departments and government: a guided questionnaire assembles documents from pre-approved language and business rules, with AI-assisted template authoring in the cloud deployment.

## Capabilities

- Document automation
- Contract drafting
- Clause libraries and playbooks

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, On-premises |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | SOC 2 (the product's security profile, linked from the Thomson Reuters Trust Center, lists 'SOC 2 - 2 Documents'; the reports require an account, are subject to Thomson Reuters confidentiality provisions, and were not read, so the type, period and scope are unverified), ISO 27001 (the same product security profile lists 'ISO 27001 - 2 Documents'; certificate, certifying body and scope statement not read), ISO 9001 (the same product security profile lists 'ISO 9001 - 1 Document'; certificate and scope not read), CAIQ (a Cloud Security Alliance questionnaire is listed on the product security profile as 'CAIQ - 0 Documents') |
| Training on customer content | Unknown |
| Retention | No retention period is published for templates, questionnaire answers, assembled documents, repository data, audit history or AI prompts. The Thomson Reuters Privacy Statement (last updated 31 July 2026) says personal information is retained 'as required by our enterprise records retention schedule, which varies by Service, business function, country, record classes, and record types' and states no period; by its own terms that statement does not apply where Thomson Reuters acts as a processor for a customer, which is the position for documents a firm assembles. For the On-Premise deployment the vendor describes the software as 'hosted on your own servers' and 'Fully managed by your team', which leaves retention in the customer's hands. |
| Integrations | Microsoft Word, iSheets, Microsoft Excel (datasheet data download), Practical Law (additional subscription), CoCounsel (additional subscription), HighQ (additional subscription) |
| Legal content coverage | Contract Express is described as automating the organisation's own approved templates, clauses and business rules; no legal content set, jurisdiction list or update service is published as part of the product. The Australian page names Practical Law separately as the source of 'content starting points', which is a different subscription. |
| Pricing | No price is published. The Australian product page offers only 'Request a demo' and a contact form, and publishes no price, unit of charge or minimum for either deployment. Nothing published says whether the AI-assisted authoring that the page describes as 'built in' to the Cloud deployment carries a separate charge, and the features page notes that integrations with other Thomson Reuters products and services require an 'additional subscription'. Third-party resellers and directories quote figures for Contract Express; those are not vendor statements and are not recorded here. |
| Australian presence | Yes. CONTRACTING ENTITY NOT ESTABLISHED FOR THIS PRODUCT. No Australian contracting entity, ACN or ABN is published on the Australian product page, the Australian website terms of use or the Privacy Statement. The Australian modern slavery transparency statement linked in the site footer (for the financial year ending 31 December 2021, approved 3 May 2022) is made by two Australian entities, Thomson Reuters (Australia) Pty. Limited and Thomson Reuters (Professional) Australia Ltd., and states both are indirect wholly owned subsidiaries of Thomson Reuters Corporation, 'an Ontario corporation with shares listed on the Toronto Stock Exchange and New York Stock Exchange'; that statement carries no ACN or ABN and does not say which entity contracts for Contract Express. Australian presence is otherwise published: a Thomson Reuters Australia site carrying the Contract Express product page, and, in that site's navigation and footer and in a map of the site, Australian support, technical support, product training and contact-sales pages and a link to an Australian Thomson Reuters company page on LinkedIn (the linked LinkedIn page itself was not read). The only customer named on the Australian product page is a New Zealand law firm, so no Australian customer is recorded. |
| Website | https://www.thomsonreuters.com.au/en-au/products/contract-express.html |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product, deployment and what is licensed | Public claim only | Two deployments are published on the Australian page (checked 2026-09-27) and the AI differs between them. 'Cloud AI-enabled' is described as 'Cloud-hosted document automation with AI-assisted authoring built in'. 'On-Premise' is described as 'The same proven automation engine, hosted on your own servers so your data stays in-country. Fully managed by your team, using the authoring tools you already know, with no AI dependency required.' No price, unit of charge or plan table is published for either, and the page's only call to action is a demonstration request. | For an Australian subscription, which deployment are we buying, is AI-assisted authoring charged separately from the automation engine, and what is the price per author and per document user? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html) |
| What the product does and where the AI sits | Public claim only | The Australian page (checked 2026-09-27) describes document assembly rather than generative drafting: 'Instead of starting from a blank page, users answer a guided set of questions. Contract Express then automatically assembles the appropriate document using pre-approved language and business rules'. Every AI reference on that page is to template authoring - 'AI-assisted authoring puts template-building in the hands of legal' and 'A low-code, AI-assisted authoring tool that lets lawyers directly build and share customisable templates in minutes'. The global features page names two AI features: 'AI-powered authoring - Automatically create and logically arrange the questionnaire, quickly and easily provide initial markup, and allow additional "no-code" human markup using the proprietary authoring tool', and 'GenAI assistance - Our AI chat assistant provides guidance and resolution for your queries. Navigate directly to the relevant Author help articles or Knowledge Base content, including customer forum threads.' The same page describes an approval workflow with email notifications and a task tab, and a 'Searchable document repository' queried with 'our Boolean search box' with datasheet download to Microsoft Excel; neither is described as using AI. | Which steps call a language model - questionnaire generation and initial markup only, or also assembly, the repository search or the approval workflow - and what changes in an existing template if the authoring model is replaced? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Deployment options and processing locations | Public claim only | Cloud and on-premises are both published (checked 2026-09-27). For the cloud deployment no hosting country, region, data centre or Australian residency option is published on any page read, and none is inferred here from the product's Australian page or its .com.au address. The on-premises deployment is described as 'hosted on your own servers so your data stays in-country' and 'Fully managed by your team' with 'no AI dependency required' - a statement about the customer's own infrastructure, not a published Australian region offered by the vendor. The Privacy Statement says personal information 'may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States'. | For the Cloud AI-enabled deployment, name the country and region where our templates, questionnaire answers, assembled documents, repository index, logs and backups are stored, state whether an Australian region can be elected, and put it in the agreement. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| Jurisdictional content and Australian law | Public claim only | The product automates the organisation's own approved templates, clauses and business rules; the vendor names 'leases and licences, share purchase agreements, NDAs, employment contracts, facility agreements, and company formation agreements' as common examples (checked 2026-09-27). No Australian legal content, jurisdiction list, court or tribunal form set, or update service is published as part of Contract Express; the Australian page names Practical Law separately as the source of 'content starting points', which is a different subscription. | Does Contract Express ship any Australian precedent or clause content at all, or is every template ours to build and maintain - and if Practical Law content is used as a starting point, which subscription is required? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html) |
| Licence terms for the product | Not confirmed | No product licence or subscription terms for Contract Express were found published (checked 2026-09-27). The only licence wording on the Australian site is in the website terms of use, which grants 'a limited licence to access and make personal use of this site' and governs use of the website, not the software. A search-filtered map of the Australian site returned only a ProView content licence agreement for e-books as a product-terms page, which does not cover Contract Express. Unverified, not applied (2026-10-10): pricing claim Choose Contract Express if you run a large enterprise legal team inside the Thomson Reuters stack; most law firms pick Gavel Workflows for transparent (https://www.gavel.io/alternatives/contract-express-vs-gavel-workflows). not the vendor's domain. Unverified, not applied (2026-10-10): pricing claim Firms can automate their own templates or start with Gavel's attorney-reviewed legal template library. Pricing starts at $83 per month with a free trial (https://www.gavel.io/alternatives/contract-express-vs-gavel-workflows). not the vendor's domain. Unverified, not applied (2026-10-10): pricing claim - Pricing: Contract Express uses custom enterprise pricing; Gavel starts at $83/month. (https://www.gavel.io/alternatives/contract-express-vs-gavel-workflows). not the vendor's domain. | Send the licence terms for Contract Express, including author versus end-user licence counts, whether templates we build are our property, and what happens to our templates and assembled documents if we do not renew. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Australia - terms of use for this website](https://www.thomsonreuters.com.au/en-au/terms-of-use.html) |
| Integration with the systems a firm already uses | Public claim only | The global features page (checked 2026-09-27) states 'Contract Express integrates with other systems, training tools, and standardized processes for document creation, including our other products and services (additional subscription required). Seamless integration with Microsoft Word and iSheets helps you accomplish more in your existing systems', and describes datasheet download into Microsoft Excel. The Australian page names Practical Law, CoCounsel and HighQ as the products it extends into. No document-management integration is named for Contract Express on the pages read; the Australian AI campaign page names iManage and NetDocuments as integration partners for Thomson Reuters AI products generally, not for Contract Express. | Which document-management systems does Contract Express itself integrate with for Australian customers, and is a connector to our DMS supported or a professional-services build? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features); [Thomson Reuters Australia AI campaign page ('Professional-grade AI'), including the ISO/IEC 42001 statement for Westlaw and CoCounsel](https://www.thomsonreuters.com.au/en-au/c/ai-lawyers-trust.html) |
| Support, training and the help assistant | Public claim only | Australian support, technical support and product training pages are published, and the Australian page offers a demonstration request and a contact-a-representative link (checked 2026-09-27). The global features page publishes a United States telephone number, a Contract Express support section, and the 'GenAI assistance' chat assistant, described as providing 'guidance and resolution for your queries' and navigating to 'the relevant Author help articles or Knowledge Base content, including customer forum threads'. No service levels, support hours, Australian support coverage or response targets are published on the pages read. | What are the support hours, response targets and escalation path for an Australian customer, is support delivered from Australia, and is the help assistant's chat log retained or reviewed? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| The published performance figures and what backs them | Public claim only | The Australian page carries four figures or claims with no stated method, sample, period or source (checked 2026-09-27): 'the AI-enabled document automation engine trusted by 650+ law firms and leading organisations worldwide'; '82% time saved vs. manual drafting'; 'Capable of 100+ page documents assembled correctly, first time'; and a customer video and quotation. Separately, the Australian AI campaign page's figures ('2.6x', '85%') are footnoted as 'Time savings data from Thomson Reuters customer surveys and U.S. usage data, 2024' and are about Thomson Reuters AI solutions generally, not Contract Express. No benchmark, error rate or accuracy measurement for the AI-assisted authoring is published. | For the 82% time saved and the '100+ page documents assembled correctly, first time' claims, what was measured, over what sample and period, and is any of it measured on Australian templates? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Australia AI campaign page ('Professional-grade AI'), including the ISO/IEC 42001 statement for Westlaw and CoCounsel](https://www.thomsonreuters.com.au/en-au/c/ai-lawyers-trust.html) |
| Tasks the vendor publishes the product for | Public claim only | The published use is repeat-form document production from the organisation's own approved language: 'law firms, corporate legal departments, and government agencies' converting 'approved templates, clauses, and legal expertise into documents that can be generated quickly and consistently, without drafting from scratch' (checked 2026-09-27). Named document types are leases and licences, share purchase agreements, NDAs, employment contracts, facility agreements and company formation agreements. AI-assisted drafting and review of a counterparty's document are attributed on the same page to a different product, CoCounsel. This catalogue records what the vendor publishes; whether the product suits a named task is a judgement the firm makes on its own evidence. | Which of our document types are in scope for the first deployment, how many templates does that involve, and what authoring effort per template do you estimate with and without AI-assisted authoring? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. Search-filtered maps of thomsonreuters.com.au (two runs, 33 and 36 URLs) and of legal.thomsonreuters.com (42 URLs) returned no /ai-info, /llms.txt or /for-ai page, and none of the pages read for this profile - the Australian product page, the global features page, the Privacy Statement, the website terms of use, the Trust Center, the product security profile, the Australian AI solutions page or the Australian AI campaign page - carries a heading or block addressing AI models, assistants or crawlers, or instructing them how to describe the product. Both sites are large and the maps were search-filtered, so they do not exhaust either site. | Do you publish any page or embedded block that tells AI assistants or crawlers how to describe Contract Express, and if so where is it? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features); [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center) |
| Client authority to put matter material into the product | Not confirmed | No matter-exclusion control, client-notification template or engagement-letter guidance for Contract Express was found on the Australian page, the global features page, the website terms of use or the Privacy Statement (all read 2026-09-27). Client and transaction detail enters the product through the questionnaire and is held in the searchable document repository together with the assembled documents, and self-service is described as extending to 'junior teams' and to 'the business', so client material is handled by people outside the responsible lawyer's immediate team. | Can we exclude named clients or matters from the cloud repository and from AI-assisted authoring, and what wording do you recommend for Australian engagement letters and client consents covering questionnaire data and assembled documents? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Which model performs the AI-assisted authoring | Not confirmed | No model, model version or model provider is named for AI-powered authoring or for the GenAI assistance chat assistant on the Australian page, the global features page, the Privacy Statement or the product security profile (all read 2026-09-27). The Australian AI solutions page makes a claim about Thomson Reuters AI solutions generally - 'Highest standards of data security and privacy, and where no third-party large language models (LLMs) can access customer data' - and does not name Contract Express anywhere other than in the site navigation, so it is not read across to this product. | Name the model and provider behind AI-powered authoring and behind the GenAI assistance assistant, the version in use, the region each runs in, and whether the 'no third-party LLM can access customer data' statement applies to Contract Express in our agreement. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features); [AI solutions for legal professionals - Thomson Reuters Australia, including the CoCounsel IRAP statement](https://www.thomsonreuters.com.au/en-au/legal/ai-solutions.html) |
| Sub-processors and who else handles the data | Not confirmed | No sub-processor list for Contract Express, and none for Thomson Reuters products generally, was found published (checked 2026-09-27). The Trust Center publishes no sub-processor register; it directs customers to per-product security profiles whose artefacts require an account. The Privacy Statement says personal information is shared with 'Affiliates within the Thomson Reuters group of companies' and with 'Third-party service providers and partners that support our business, such as our content and other partners, vendors and subcontractors, analytics providers, advertising and marketing agencies, credit agencies, and other third parties we engage', naming none of them. | Give us the sub-processor register for the Cloud AI-enabled deployment - including the cloud host, the model host and any support or analytics provider - with each one's country and your notice period before a sub-processor changes. | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement); [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center) |
| Whether our templates, answers and documents train or improve models | Not confirmed | Nothing product-specific was found (checked 2026-09-27). The Privacy Statement lists among the personal information it collects 'the content of your queries on our Services, such as artificial intelligence prompts', and lists among its purposes 'To operate, improve, or personalize our Services' and 'Develop new products, services, content, and other offerings' on a legitimate-interests basis; but that statement says expressly it does 'not apply where we act as a processor or service provider to another controller, such as our customers', which is the position for documents a firm assembles. Its artificial-intelligence section says only that some Services 'may use artificial intelligence, machine learning, automation, analytics, or similar technologies to provide, improve, personalize, secure, or support our Services' and that additional information is provided 'Where required by law or applicable product and/or service documentation'. | Warrant in our agreement that our templates, precedents, questionnaire answers and assembled documents are not used to train, fine-tune, evaluate or improve any Thomson Reuters or third-party model, including embeddings and evaluation sets, and identify the document that carries that warranty. | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| What happens to corrections and feedback | Not confirmed | No statement was found on what happens to an author's corrections to AI-generated questionnaires or markup, or to ratings given to the GenAI assistance assistant (checked 2026-09-27). The Privacy Statement's 'User contributions & user content' category includes 'feedback you provide to us and the content of communications between you and us', and its purposes include operating and improving the Services and developing new offerings; it draws no distinction between a support ticket and a correction made inside the authoring tool. | If an author corrects the AI-generated questionnaire or markup, is that correction retained beyond our tenancy, used to improve the authoring model, or visible to other customers - and can we switch that off? | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| How long content is kept | Not confirmed | No retention period is published for templates, questionnaire answers, assembled documents, repository data, audit history or AI prompts (checked 2026-09-27). The Privacy Statement says only that personal information is retained 'as required by our enterprise records retention schedule, which varies by Service, business function, country, record classes, and record types' and gives no period, and by its own terms it does not govern content processed for a customer. For the On-Premise deployment the software is described as running on the customer's own servers and 'Fully managed by your team'. | State the retention period for each data class in the Cloud AI-enabled deployment - templates, questionnaire answers, assembled documents, repository index, prompts and audit logs - and how long backups persist after deletion. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| Deletion on request and on exit | Not confirmed | No deletion mechanism, timeframe or certification for customer content was found (checked 2026-09-27). The Privacy Statement offers data-subject rights, including deletion, through a Data Subject Rights Portal, but adds that 'These rights are not absolute and may be subject to exceptions. We are only required to honor these rights where applicable under local law and to the extent we act as a controller of the data' - which excludes content processed on a customer's behalf. | On written request and on termination, what is deleted from the Cloud AI-enabled deployment, within how many days, does it include backups and the repository index, and will you certify deletion in writing? | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| Thomson Reuters personnel access to our documents | Not confirmed | Nothing published states who at Thomson Reuters can read a customer's templates, questionnaire answers or assembled documents, under what approval, or whether such access is logged (checked 2026-09-27). The Trust Center describes a 'SECURE' framework built on six pillars including 'Secure workplace' and 'Secure products' without operational detail, and directs customers to the per-product security profile; the Contract Express profile lists a 'Thomson Reuters - Contract Express - Security Summary.pdf' which requires an account and is subject to Thomson Reuters confidentiality provisions, and was not read. | Who at Thomson Reuters and at any sub-processor can access our tenancy content, under what approval and logging, can we require Australian-based support access only, and will you supply the access logs on request? | [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center); [Contract Express security profile (published profile linked from the Thomson Reuters Trust Center)](https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35) |
| Identity, roles and the approval workflow | Not confirmed | The only access-related mechanism published is functional rather than identity-based: a 'Customizable approval workflow' with 'notifications and status alerts automatically sent via email and outstanding approvals accessible from the task tab', and self-service document creation extended to non-lawyer users (checked 2026-09-27). No single sign-on, multi-factor authentication, SCIM provisioning, role model or permission matrix is published for Contract Express on any page read. | Does the Cloud AI-enabled deployment support SSO and SCIM with our identity provider and enforce MFA, and what roles separate template authors, document generators and approvers? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Encryption and key management | Not confirmed | No encryption statement for Contract Express was found (checked 2026-09-27). The Trust Center speaks at framework level - 'Establish baseline practices and standards to maintain secure networks, systems, and hosting environments' and 'Deliver secure-by-design products that protect processes and customer data' - and points to the per-product security profile, whose documents require an account and an accepted confidentiality provision. The Privacy Statement says Thomson Reuters works 'to implement technical and organizational measures designed to protect the security of personal information' and that 'no method of transmission over the Internet or electronic storage is 100% secure'. | State encryption in transit and at rest for the Cloud AI-enabled deployment, who holds the keys, whether customer-managed keys are available, and whether prompts sent to the authoring model are encrypted end to end. | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement); [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center); [Contract Express security profile (published profile linked from the Thomson Reuters Trust Center)](https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35) |
| Certifications and independent assessment | Public claim only | The Thomson Reuters Trust Center links a per-product security profile for Contract Express, and that profile (read 2026-09-27) lists 'Audits and Certifications (3)': SOC 2 with 2 documents, ISO 9001 with 1 document and ISO 27001 with 2 documents, plus a CAIQ questionnaire with 0 documents and three additional documents. Every artefact is gated: the profile states that access to and use of any document 'is subject to the Thomson Reuters Confidentiality Provision ("NDA")' and that documents are viewable once logged into an account, so no certificate, scope statement or report period was read. ISO/IEC 42001 is not listed on the Contract Express profile. Separately the Trust Center publishes corporate ISO 42001, ISO 27001, ISO 9001, ISO 14001 and ISO 20000-1 certificate PDFs, whose scope was not read, and the Australian AI campaign page states ISO/IEC 42001:2023 was achieved 'for Westlaw and CoCounsel'. The Australian AI solutions page states CoCounsel (Australia) was IRAP assessed on 22 June 2026 against PROTECTED controls; Contract Express is not named in either statement. Unverified, not applied (2026-10-10): security claim GDPR (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim HIPAA (https://drata.com/learn/iso-27001/vs-soc-2). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 42001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim SOC 2 (https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35). not the vendor's domain. | Send the SOC 2 Type II report and ISO 27001 certificate with Contract Express and its hosting infrastructure named in scope, confirm whether ISO/IEC 42001 covers the AI-assisted authoring, and say whether any IRAP assessment covers Contract Express. | [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center); [Contract Express security profile (published profile linked from the Thomson Reuters Trust Center)](https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35); [AI solutions for legal professionals - Thomson Reuters Australia, including the CoCounsel IRAP statement](https://www.thomsonreuters.com.au/en-au/legal/ai-solutions.html); [Thomson Reuters Australia AI campaign page ('Professional-grade AI'), including the ISO/IEC 42001 statement for Westlaw and CoCounsel](https://www.thomsonreuters.com.au/en-au/c/ai-lawyers-trust.html) |
| Contract, data processing terms and governing law | Not confirmed | No subscription agreement, master terms, product terms or data processing addendum for Contract Express is published (checked 2026-09-27). The only contract document on the Australian site is a website terms of use, which by its own words applies to 'All use of Thomson Reuters World Wide Web pages located within www.thomsonreuters.com.au', states 'We may amend the Terms at any time by posting the amended terms on this site', provides the site 'on an "as is" and "as available" basis' with 'no representations or warranties of any kind', and contains no governing law, forum, liability or data-processing provision for a software subscription. A search-filtered map of the Australian site returned no other product terms besides a ProView content licence agreement for e-books. | Send the Contract Express subscription agreement and data processing addendum, naming the contracting Thomson Reuters entity and its ACN or ABN, the governing law and forum, the liability cap, and how liability is allocated if a business rule or AI-generated template produces a wrong clause. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Australia - terms of use for this website](https://www.thomsonreuters.com.au/en-au/terms-of-use.html); [Modern Slavery Act Thomson Reuters Transparency Statement (Australia), financial year 2021](https://www.thomsonreuters.com.au/content/dam/ewp-m/documents/australia/en/pdf/fact-sheets/msa-tr-transparency-statement-australia.pdf) |
| Where the data goes, and whether inference runs in Australia | Not confirmed | No processing location is published for the cloud deployment and no statement says whether model inference for AI-assisted authoring runs in Australia (checked 2026-09-27); neither is inferred here. The Privacy Statement says personal information 'may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States', asks the reader to 'acknowledge the risk that we may transfer your personal information to countries that may provide less protection than your home country's privacy laws', and states Thomson Reuters 'may not be able to prevent government authorities in some countries from accessing your personal information'. The On-Premise deployment is described as keeping data in-country on the customer's own servers. | List every country in which Contract Express questionnaire data, templates, assembled documents, logs, backups and support access are processed, and state whether authoring-model inference runs in Australia or is sent offshore. | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) |
| Incident notification | Not confirmed | No incident-notification commitment, timeframe or contact was found for Contract Express (checked 2026-09-27). The Trust Center names a framework pillar, 'Secure response - Rapidly detect and mitigate risks to Thomson Reuters estate', with no customer notification undertaking, and the Privacy Statement contains no breach-notification provision. Nothing published addresses the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). | What is your contractual notification period and channel for a security incident affecting our tenancy, and how will you support our own assessment and notification obligations under the Australian Notifiable Data Breaches scheme? | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement); [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center) |
| Notice of changes to terms, features and models | Not confirmed | No commitment to notify customers before a change to the product, the AI features or the model behind them was found (checked 2026-09-27). Both published documents reserve unilateral change: the website terms of use say 'We may amend the Terms at any time by posting the amended terms on this site', and the Privacy Statement says 'We reserve the right to update it at any time for any reason. We will notify you of changes to our Privacy Statement by updating the "last updated" date and posting the updated Privacy Statement on this page' and that customers 'should check our Services frequently'. The Australian AI campaign page describes 'automatic access to new capabilities as they become available' for Thomson Reuters AI products. | How much notice will we get before the authoring model, its provider or its hosting region changes, and will you agree to notice and a right to object for changes that affect processing location or model provider? | [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement); [Thomson Reuters Australia - terms of use for this website](https://www.thomsonreuters.com.au/en-au/terms-of-use.html); [Thomson Reuters Australia AI campaign page ('Professional-grade AI'), including the ISO/IEC 42001 statement for Westlaw and CoCounsel](https://www.thomsonreuters.com.au/en-au/c/ai-lawyers-trust.html) |
| Getting our templates and documents out | Not confirmed | No export, transition or post-termination provision is published (checked 2026-09-27). Two published mechanisms bear on it without amounting to an exit right: assembled documents are produced as Microsoft Word files, and the searchable repository allows datasheet data to be downloaded 'into Microsoft Excel'. Nothing published says whether automated templates, questionnaire definitions, business rules, questionnaire answers or audit history can be exported in a reusable form, and nothing addresses migration between the Cloud and On-Premise deployments. | On exit, in what format can we export every automated template, business rule, questionnaire answer set, assembled document and audit record, and can a cloud tenancy be migrated to the On-Premise deployment? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Connectors and what they can reach | Public claim only | Published connections are Microsoft Word, iSheets, download into Microsoft Excel, and 'our other products and services (additional subscription required)' - the Australian page naming Practical Law, CoCounsel and HighQ (checked 2026-09-27). No permission model, scope limit or administrative control over connectors is published, and no document-management connector is named for Contract Express on the pages read. | For each connector, what data leaves Contract Express and what can the connector read back, who may enable one, and can we restrict connectors to named systems? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Whether the product reaches the public internet | Not confirmed | Nothing on the pages read says that Contract Express queries the public web (checked 2026-09-27). The two published search-like features are internal on their face: the 'Searchable document repository' is queried with 'our Boolean search box' over the customer's own documents, and the GenAI assistance assistant is described as navigating to 'the relevant Author help articles or Knowledge Base content, including customer forum threads', which is vendor help content. No document confirms whether either feature, or the authoring model, calls an external index or the open internet. | Does any Contract Express feature, including the authoring model and the GenAI assistance assistant, call an external search index or the public internet, and can that be disabled for our tenancy? | [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| What the AI is allowed to do without a person | Not confirmed | On the published description the AI produces a draft that a person then edits: AI-powered authoring 'Automatically create and logically arrange the questionnaire, quickly and easily provide initial markup, and allow additional "no-code" human markup', and document issue is gated by the 'Customizable approval workflow' with notifications and a task tab (checked 2026-09-27). Two settings a firm must decide are not addressed by anything published: whether AI-assisted authoring can be turned off inside the Cloud deployment - the vendor's answer to no AI is a different deployment, On-Premise, 'with no AI dependency required' - and whether the approval workflow can be made mandatory rather than configurable, since it is described as customisable. | Can AI-powered authoring and the GenAI assistance assistant be disabled per tenancy or per user in the Cloud deployment, and can the approval workflow be locked so a document cannot be issued without a named approver? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |
| Where a person must check the output | Public claim only | The published workflow places a person at two points: the author reviews and extends AI-generated questionnaires and markup with 'additional "no-code" human markup', and the approval workflow routes documents for approval before issue (checked 2026-09-27). No reviewer guidance, accuracy statement, error rate or obligation to verify is published, and the vendor's claim that the engine is 'Capable of 100+ page documents assembled correctly, first time' carries no stated method or sample. Because assembly runs on business rules rather than a model, an error is a rule or template error that can repeat silently across every document generated from that template. | What review guidance do you publish for authors accepting AI-generated questionnaires and markup, how are template and rule errors detected before they propagate, and who is accountable if an assembled document contains the wrong clause? | [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html); [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) |

## Notes

CONFIDENCE IS LOW AND THE REASON IS THE PUBLISHED RECORD, NOT THE EFFORT: 16 of the 20 critical controls ended not_verified because Thomson Reuters publishes no subscription agreement, product terms, data processing addendum, sub-processor list, hosting-region statement or encryption statement for Contract Express anywhere that could be read without an account. What is published for this product is a marketing page, a features page, a global privacy statement that by its own terms does not govern content processed for a customer, a website terms of use that covers the website only, and a per-product security profile whose every artefact is gated. Four firecrawl operations were available and four were spent: one search for Contract Express binding documents (which returned only third-party pages - a reseller pricing page and Australian software directories - none of which is used here as a vendor fact), one scrape of the product security profile linked from the Trust Center, one search-filtered map of legal.thomsonreuters.com, and one scrape of the global Contract Express features page. Six further documents were read free from the project cache: the Australian product page, the Australian website terms of use, the Thomson Reuters Privacy Statement, the Trust Center, the Australian AI solutions page and the Australian AI campaign page. DOCUMENTS NOT REACHED, AND WHERE THEY ARE: (1) 'Thomson Reuters - Contract Express - Security Summary.pdf', 'thomson-reuters-security-principles.pdf' and 'thomson-reuters-resilience-security-statement.pdf', together with the SOC 2, ISO 27001 and ISO 9001 artefacts, all sit on the Contract Express security profile at https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35 behind an account and an accepted Thomson Reuters confidentiality provision - the profile page itself was read, the documents behind it were not, so hosting region, encryption and personnel access remain unverified; (2) the corporate ISO certificate PDFs linked from the Trust Center were not opened, so their scope is unknown and none is recorded as covering Contract Express; (3) no subscription agreement, product terms or data processing addendum for Contract Express was found published anywhere, which is itself the finding recorded under 'contract'. NOT ESTABLISHED: the Australian contracting entity and its ACN or ABN (two Australian Thomson Reuters entities are named in the Australian modern slavery transparency statement, neither tied to this product and neither carrying an ACN); the cloud hosting region and whether Australian data residency can be elected; whether authoring-model inference runs in Australia; the model and provider behind AI-powered authoring and the GenAI assistance assistant; training, retention and deletion terms for customer content; sub-processors; and the price of either deployment. CARRIED FORWARD AND EXTENDED FROM THE EARLIER CAPABILITY PASS: that pass recorded one AI function, template authoring. The global features page read here names a second, a 'GenAI assistance' chat assistant over Author help articles, Knowledge Base content and customer forum threads, and also describes a Boolean-searchable document repository and an approval workflow, neither described as using AI. Capabilities are unchanged from that pass. Assurance is the one place where the earlier pass's 'no assurance certifications established' has moved: the product security profile lists SOC 2, ISO 27001 and ISO 9001 documents, though every artefact is gated. Two statements must not be read across to this product and are recorded where they belong: the ISO/IEC 42001:2023 statement on the Australian AI campaign page names Westlaw and CoCounsel, and the IRAP assessment on 22 June 2026 at PROTECTED named on the Australian AI solutions page is for CoCounsel (Australia). Contract Express appears on that page only in the site navigation. The Australian modern slavery transparency statement was read from the project cache rather than fetched in this pass, and is cited at the URL the Australian site footer publishes for it. Recheck 2026-10-10: 8 claims left unverified and not applied. Confidence stayed low on 2026-10-10. The proposed medium was not applied: no security or hosting quote from the vendor's own domain was accepted.

## Sources

- [Contract Express - Thomson Reuters Australia product page, including the two published deployments and the FAQ](https://www.thomsonreuters.com.au/en-au/products/contract-express.html) (checked 2026-09-27)
- [Contract Express features - Thomson Reuters (global site): generative AI tools, automation, integration and document repository](https://legal.thomsonreuters.com/en/products/contract-express/features) (checked 2026-09-27)
- [Thomson Reuters Privacy Statement, last updated 31 July 2026](https://www.thomsonreuters.com/en/privacy-statement) (checked 2026-09-27)
- [Thomson Reuters Australia - terms of use for this website](https://www.thomsonreuters.com.au/en-au/terms-of-use.html) (checked 2026-09-27)
- [Thomson Reuters Trust Center - product security profiles, SECURE framework and corporate certificates](https://www.thomsonreuters.com/en/trust-center) (checked 2026-09-27)
- [Contract Express security profile (published profile linked from the Thomson Reuters Trust Center)](https://public-profile.whistic.com/d97f9da2-5150-4583-83e2-410979881e35) (checked 2026-09-27)
- [Modern Slavery Act Thomson Reuters Transparency Statement (Australia), financial year 2021](https://www.thomsonreuters.com.au/content/dam/ewp-m/documents/australia/en/pdf/fact-sheets/msa-tr-transparency-statement-australia.pdf) (checked 2026-09-27)
- [AI solutions for legal professionals - Thomson Reuters Australia, including the CoCounsel IRAP statement](https://www.thomsonreuters.com.au/en-au/legal/ai-solutions.html) (checked 2026-09-27)
- [Thomson Reuters Australia AI campaign page ('Professional-grade AI'), including the ISO/IEC 42001 statement for Westlaw and CoCounsel](https://www.thomsonreuters.com.au/en-au/c/ai-lawyers-trust.html) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.