Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The vendor's dedicated product page (read 2026-09-27) describes Dragon Legal Anywhere as cloud-hosted speech recognition for legal work, with a specialised legal vocabulary, custom voice commands and auto-texts, central administration through the Nuance Management Center, and Dragon Anywhere Mobile included at no additional cost. Sibling products in the same range are Dragon Professional Anywhere, Dragon Anywhere Mobile, Dragon Professional v16, Dragon Legal v16 and Dragon Law Enforcement v16, each with its own page. No plan tiers or module options for Dragon Legal Anywhere are published.
Ask: Which Dragon Legal Anywhere entitlement will our firm hold, does it include Dragon Anywhere Mobile and the Nuance Management Center for every user, and are there plan tiers that differ on data handling?
Product lifecycle and end of sale
Not confirmed
The vendor's own pages, read 2026-09-27, carry Dragon Legal Anywhere as a current product in the Dragon range with no end-of-sale or end-of-support notice, and a search result shows a vendor support article titled "Dragon Professional Anywhere / Dragon Legal Anywhere client 2026.1 Release Notes" published 2026-04-01 and updated 2026-04-30. An Australian reseller publishes a "Dragon Legal Anywhere Discontinuation Notice" giving 30 December 2026 for purchase or renewal and 30 December 2027 for product support, and describing the product as a transition rather than a long-term platform. The two sources differ in that the reseller states dates the vendor does not publish anywhere read.
Ask: Confirm in writing the end-of-sale and end-of-support dates for Dragon Legal Anywhere in Australia and New Zealand, the migration path offered, and what happens to cloud user profiles, custom vocabulary and auto-texts at end of support.
What the product does
Public claim only
The product page (read 2026-09-27) states the product recognises dictated speech in compatible Windows applications, carries a legal vocabulary with automatic formatting of legal citations, supports custom voice commands that insert standard clauses and automate multi-step workflows by voice, shares customisations across teams, provides Anchor Dictation Focus so text lands in a chosen document while the cursor is elsewhere, and supports thin-client and virtualised environments. An Australian reseller adds that each authorised user has a personalised cloud profile holding legal vocabulary, custom words, auto-texts, voice commands and preferences. No summarisation, drafting or document-generation feature is described for this product on any page read.
Ask: Does Dragon Legal Anywhere perform any generative function (summarising, drafting, reformulating dictated text), or only speech-to-text recognition and command execution?
Deployment and where recognition runs
Public claim only
The product page (read 2026-09-27) states the service is deployed server-side via Microsoft Azure, that cloud solutions "run on geographically dispersed, active-active, data centers hosted on Microsoft Azure, a HITRUST CSF certified hosting infrastructure", and quotes 99.5% uptime. No Azure region, country or data-residency option is named on any vendor page read, so where recognition runs is not established. A Windows client is installed on the device and connects to the server component; thin-client and Citrix deployments are supported.
Ask: In which Azure region or regions does Dragon Legal Anywhere recognition run for an Australian tenant, where are cloud user profiles and vocabulary stored, and is an Australia-only configuration available?
Jurisdiction of the legal vocabulary
Public claim only
The product page (read 2026-09-27) states the legal vocabulary was "Trained using millions of words from legal documents" and enables automatic formatting of legal citations, but names no jurisdiction and no citation style. No Australian-specific vocabulary, citation format or court terminology is described on any vendor page read; an Australian reseller states the legal vocabulary covers terminology used in correspondence, advices, file notes and briefs, without naming a jurisdiction either.
Ask: Which jurisdictions' legal vocabulary and citation formats are built in, is Australian citation formatting (for example AGLC or medium-neutral citations) supported, and can we load Australian court and statute terminology as custom words?
Vendor content directing how AI describes the product
Not confirmed
No page or block telling AI models, assistants or crawlers how to describe the product was found on the four vendor pages read on 2026-09-27 (the product page, the Dragon range overview, the privacy policies page and the legal notices page) or on the Australia and New Zealand regional home page. No /llms.txt, /ai-info or /for-ai URL appeared in the site map made in the earlier research pass, and no such URL was fetched, so the absence of such content elsewhere on dragon.nuance.com is not established.
Ask: Does Nuance or Microsoft publish any page or embedded block instructing AI assistants or crawlers how to describe Dragon products, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Dictating a client matter sends the spoken words of a privileged communication to a cloud recognition service, and the Nuance Privacy Statement (updated 14 March 2025) states that when a person uses Nuance voice recognition technology "we may capture your voice and the words that you speak into the product" and that snippets of voice data may be manually reviewed and transcribed by employees or vendors. No vendor page read addresses legal professional privilege, client consent, or the position of a firm dictating a client's confidential information. The privacy statement places responsibility for obtaining consents on the customer where the vendor processes on a third party's behalf.
Ask: What notice or consent does our firm need for dictating privileged client matter content, and can we contractually exclude our dictation audio and text from any human review or quality sampling?
Recognition engine and model providers
Public claim only
The product page (read 2026-09-27) states the product uses "a next-generation speech engine powered by Nuance Deep Learning technology", calls the product "AI-powered speech recognition", refers to "Conversational AI", and states the cloud service always runs the latest speech recognition engine. No model name, model version or third-party foundation-model provider is named on any page read; Microsoft Azure is named as the hosting infrastructure, not as a model provider. The Nuance Privacy Statement describes the vendor's automated methods as including artificial intelligence, again without naming a model.
Ask: Name the recognition model or models used by Dragon Legal Anywhere for Australian English, the entity that operates them, whether any third-party model is called, and the notice we receive before the engine is changed.
Subprocessors
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states that personal data, including Product Personal Data, may be shared with affiliates and subsidiaries, co-development partners, resellers, suppliers, distributors and "vendors acting on our behalf", and gives as an express example "vendors who conduct transcription in connection with our products and services". Site-usage data (excluding Product Personal Data) is shared with analytics and search providers, and Google Analytics is named. No dated subprocessor register naming entities, countries or purposes is published anywhere on the pages read, so the categories are published but the list is not.
Ask: Provide the current dated subprocessor register for Dragon Legal Anywhere, including any transcription or quality-review vendors, the country each operates from, and our notice and objection rights when one changes.
Training on customer content
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states: "To build, train, and improve the accuracy of our automated methods of processing (including AI), we manually review some of the predictions and inferences produced by the automated methods against the underlying data from which the predictions and inferences were made. Snippets of your voice data, may be manually reviewed and transcribed into text for Nuance's product operation, tuning, maintenance, and enhancement." It states that before review the vendor takes steps such as de-identifying the data where possible and requiring non-disclosure agreements with vendors and their employees, and separately that aggregated non-identifying data is used to operate, analyse, improve and develop the products. No opt-out from this use, and no enterprise carve-out, appears on any page read.
Ask: Can our firm obtain a written commitment that no dictation audio or recognised text from our tenant is used for model training, tuning or enhancement, and that no snippet is reviewed or transcribed by a person?
Feedback, corrections and usage telemetry
Public claim only
The site legal notice (read 2026-09-27) states that any material or communication transmitted or posted to the site is treated as non-confidential and non-proprietary and that the vendor and its designees are free to copy, disclose, distribute, incorporate and otherwise use it for any commercial or non-commercial purpose; that clause is about the website, not the product. The Nuance Privacy Statement states the vendor collects usage data showing registration, installation and use of software, generally on an aggregate and non-identifying basis except for IP address and unique device identifiers, and retains non-identifiable aggregate information for research and product development. No control over in-product correction data (the words a user corrects after misrecognition) is described on any page read.
Ask: When a user corrects a misrecognised word, where does that correction go, is it used beyond that user's own profile, and can correction and usage telemetry be turned off for our tenant?
Retention of audio, text and user profiles
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) retains personal data while the person remains an active customer or user and for three years afterwards, or otherwise as required for business operations or by law, and notes that different retention may be necessary under contractual terms with the data controller. Biometric data is destroyed when the initial purpose is satisfied or within three years of last interaction, whichever is first, and non-identifiable aggregate information may be kept beyond those periods for research and product development. No specific retention period is published for dictation audio, recognised text, reviewed voice snippets or a firm's cloud user profiles.
Ask: State the retention period for dictation audio, recognised text, reviewed snippets and cloud user profiles for our tenant, and whether we can set a shorter period or require that audio is not stored at all.
Deletion and certified erasure
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states that a person wishing to access, correct or delete Product Personal Data should use the privacy webform, that the vendor generally processes Product Personal Data on behalf of its healthcare, enterprise and corporate customers and may redirect the request to that customer, that it will make reasonable efforts to delete within a reasonable timeframe, and that it may refuse a request where entitled to under applicable law. No deletion timeframe, no certificate of deletion and no deletion commitment covering copies held by transcription or review vendors appears on any page read.
Ask: On termination, what is deleted from the cloud service and from any review or transcription vendor, within what period, and will you certify deletion in writing?
Human access to dictation content
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states that processing of data within the products includes both automated and manual (human) methods, that snippets of voice data may be manually reviewed and transcribed into text by an employee or vendor for product operation, tuning, maintenance and enhancement, and that before such review the vendor takes steps such as de-identifying the data where possible, requiring non-disclosure agreements with relevant vendors and their employees, and requiring that they meet stated privacy standards. It separately names "vendors who conduct transcription in connection with our products and services" among the parties with whom data may be shared. No approval workflow, access log available to the customer, or country restriction on reviewers is published.
Ask: Who can listen to or read our dictation content, in which countries, under what approval, and can we obtain an access log and exclude our tenant from sampling?
Access control and administration
Public claim only
The product page (read 2026-09-27) states the Nuance Management Center allows central tracking of employee usage, redistribution of licences and management or sharing of customisations including custom words, commands and auto-texts across users. The site legal notice states each copy must be activated before use, and the privacy statement notes that where a password is issued the user is responsible for keeping it confidential and refers generally to "Appropriate access right limitations" in its GDPR controls section. No single sign-on, SCIM provisioning, multi-factor authentication requirement or exportable audit log is described on any page read.
Ask: Does Dragon Legal Anywhere support single sign-on, SCIM provisioning and enforced multi-factor authentication, and can we export an audit log of who dictated what and when?
Encryption in transit and at rest
Public claim only
The product page (read 2026-09-27) states "The client connects to a server component that is installed using 256-bit encryption. Data is encrypted in transit and at rest", and that the product "employs secure encryption methods throughout the workflow". The Nuance Privacy Statement lists "State-of-the-art technical and security measures, including data encryption at rest and in transit" among its GDPR controls and states payment transactions are encrypted to current PCI-DSS standards. No cipher suite, TLS version, key-management description or customer-managed key option is published on any page read.
Ask: Confirm the encryption algorithms and TLS versions used for dictation audio in transit and for stored profiles and audio at rest, who holds the keys, and whether customer-managed keys are available.
Independent security assurance
Not confirmed
No SOC 2, ISO 27001, IRAP or penetration-test report is claimed for Dragon Legal Anywhere on any vendor page read. The product page attributes a certification to the hosting layer only, describing data centres "hosted on Microsoft Azure, a HITRUST CSF certified hosting infrastructure", which is a statement about the infrastructure provider rather than about this product, and the range overview page says Dragon solutions are "audited to support gold-standard industry security protocols" without naming a standard, an auditor or a report. HIPAA support is claimed for the sibling Windows client (Dragon Professional Anywhere), not for this product. No trust centre was found on the pages read.
Ask: Provide the current independent security assurance report covering the Dragon Legal Anywhere cloud service itself, with scope, auditor, exceptions and date, and state whether any Australian assurance (for example an IRAP assessment) exists.
Contract, DPA, liability and forum
Not confirmed
No customer licence agreement, subscription terms or master services agreement for Dragon Legal Anywhere was found on any vendor page read. The page linked as "Legal" in the footer is a website notice covering use of the site and downloaded materials, published by Nuance Communications, Inc. and carrying copyright 2002-2023; it disclaims all warranties for site documents and excludes special, incidental, indirect and consequential damages, but it is not the product contract and states no governing law or forum for a product licence. The Nuance Privacy Statement refers to "GDPR-compliant data protection agreements with all customers for whom Nuance Processes Personal Data" and links a document at https://dragon.nuance.com/shared/company-policies/terms-and-conditions_%20Nuance.docx, which was not fetched.
Ask: Provide the executed Australian licence agreement and data processing agreement for Dragon Legal Anywhere, naming the contracting entity and its ACN or ABN, the governing law and forum, the liability cap, and whether we contract with the vendor or the reseller.
Cross-border transfers
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states the vendor operates in many countries and may transfer personal data across international borders to other affiliates, its parent corporation, or companies performing support functions, including to jurisdictions not covered by an adequacy decision and that may not provide the same level of protection, relying on appropriate agreements and standard contractual clauses where required. It adds that "Where required by applicable law, we will only share, transfer or store your personal data outside of your jurisdiction with your prior consent", and records certification to the EU-US, UK extension and Swiss-US Data Privacy Frameworks. It names no country for the storage or processing of dictation data, does not mention Australia, the Privacy Act 1988, the Australian Privacy Principles or APP 8, and no Australian data-residency option is published.
Ask: List every country in which dictation audio, recognised text, cloud profiles, backups, support access and quality review occur for an Australian tenant, and state whether Australia-only storage and recognition can be contracted for.
Incident notification
Not confirmed
No breach or incident notification commitment was found on any vendor page read. The Nuance Privacy Statement (updated 14 March 2025) describes security measures and states that information is stored on secure servers, and refers to detecting security incidents as a business purpose under the California disclosures, but it sets no notification period, names no notification recipient, and does not mention the Australian Notifiable Data Breaches scheme or the OAIC. The site legal notice contains no incident term. No incident history is published on any page read.
Ask: What is the contractual notification period from discovery of a security incident affecting our dictation data, who is notified, and have there been any material incidents affecting the Dragon cloud services in the last 24 months?
Change notice for the engine, terms and processors
Public claim only
The Nuance Privacy Statement (updated 14 March 2025) states it may be updated from time to time by publishing an updated version with a new date, that material changes will be published, and that material changes apply only to personal data collected after the revised statement takes effect. The site legal notice states product information is subject to change without notice and that the vendor may make changes to the products described at any time without notice. The product page states the cloud service ensures users always have the most recent updates and the same software version, so the recognition engine can change without a customer-facing notice, and no notice period for an engine or subprocessor change is published.
Ask: What advance written notice will we receive before the recognition engine, hosting region or a transcription or review vendor changes, and can we object or defer?
Export and exit
Not confirmed
No export or exit terms for Dragon Legal Anywhere were found on any vendor page read. The Nuance Privacy Statement gives data-portability rights to European, United Kingdom and Swiss residents and states that a user with their own account may delete data they submitted through the account help system, but says nothing about a firm exporting its cloud user profiles, custom vocabulary, auto-texts or voice commands. An Australian reseller states that custom Dragon words, auto-texts and commands "may not transfer automatically" when moving to another product, which is a third-party statement about migration difficulty, not a vendor exit term.
Ask: On termination or at end of support, in what format can we export every user's vocabulary, custom words, auto-texts and voice commands, and what is deleted from the cloud service and when?
Connectors and third-party components
Not confirmed
The product page (read 2026-09-27) describes the client inserting text into whatever compatible Windows application has focus, and Anchor Dictation Focus directing text into a chosen document while the cursor sits elsewhere, so the component that decides where dictated text lands is the client on the endpoint rather than a configured connector. No API, marketplace or third-party connector is described for this product on any page read. The Nuance Privacy Statement states that third-party products employing Nuance voice recognition technology also send captured voice and spoken words to the vendor.
Ask: Which applications is the client permitted to write into, can we restrict it to an approved list, and does any third-party add-in or connector send our dictation content anywhere else?
Open-web retrieval
Not confirmed
No open-web search, browsing or retrieval capability is described for Dragon Legal Anywhere on any page read; the product is described as recognising speech and inserting text, and Anchor Dictation Focus is described in the context of a user referring to a web page themselves rather than the product retrieving one. The vendor publishes no statement confirming that the product does not reach the open web, so the absence of the capability is inferred from silence rather than established.
Ask: Confirm in writing that Dragon Legal Anywhere makes no outbound request other than to the recognition service, and that it does not retrieve or transmit content from web pages open on the user's screen.
Voice commands that take action
Not confirmed
The product page (read 2026-09-27) states users can create custom voice commands to insert standard clauses into documents and "step-by-step commands to automate multi-part workflows by voice", and that customisations can be shared across legal teams. Those commands execute on the user's spoken phrase, and no confirmation step, command-approval workflow or administrator restriction on what a shared command may do is described on any page read. The Nuance Management Center is described as managing and sharing commands, without stating who may author or approve them.
Ask: Can an administrator restrict which voice commands exist, require approval before a shared command is distributed, and require confirmation before a command inserts a clause or performs a multi-step action?
Human review before use
Not confirmed
No human-review or verification obligation, warning or control is published for Dragon Legal Anywhere on any vendor page read; recognised text is inserted directly into the document as the user speaks, and the pages read contain no statement that output should be checked before use. The site legal notice disclaims accuracy for documents published on the site but says nothing about product output. No professional-use or verification clause of the kind found in some vendors' AI terms appears anywhere read.
Ask: Does any contractual term or product control require or support verification of recognised text before it is filed or sent, and what does the vendor say about responsibility for a misrecognised word in a court document?
