Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The Australian pages describe HighQ as a platform for document and matter management, collaboration, workflow automation and analytics, with modules for corporate teams (contract lifecycle management, legal intake and triage, document automation) and for firms (client portals, matter management, knowledge management). AI appears in two named places on the AI Hub page: the AI Hub integration layer and what the vendor calls 'the native AI engine on HighQ'. Neither page states whether either is included in a subscription or charged separately (both read 2026-09-27).
Ask: For our Australian order form, is the AI Hub enabled and is the native AI engine included in the subscription, or are they separately licensed line items?
Deployment model and hosting
Public claim only
HighQ is described as a cloud platform. The product FAQ answers the hosting question with: 'We are moving the platform to Microsoft Azure cloud in data centers around the world. You decide where to store your data, and it stays there.' No region list is published, Australia is not named, and no on-premises or private-cloud option appears on the pages read (checked 2026-09-27).
Ask: Which Azure regions can a HighQ site be provisioned in for an Australian customer, is an Australian region among them, and does the answer cover backups, search indexes and the native AI engine?
AI features in scope
Public claim only
The AI Hub page sets out a four-step integration path: '1. HighQ syncs via the AI Hub with your third-party AI engine, sending out documents for analysis 2. Your AI engine of choice examines the document, extracting the desired data 3. The resulting data is then pulled back into the AI Hub 4. Now, using HighQ iSheets and automation, you can quickly create data visualisations, workflows, risk evaluations, and more.' Separately it states 'The AI engine on HighQ analyzes documents securely stored in the platform and extracts key data by determining document classification, language, currency, governing law, and more.' The four headline platform functions on the product page are described without reference to AI (both read 2026-09-27).
Ask: Demonstrate both paths on our data: which fields the native engine extracts, and exactly what leaves the platform when the AI Hub sends a document to an external engine.
Jurisdiction and legal content
Public claim only
HighQ is sold to Australian firms and corporate legal teams and carries no cited primary-law library; the native engine is described as determining document classification, language, currency and governing law as metadata rather than advising on law. The Australian product page states the platform has been IRAP assessed against PROTECTED classification level controls, which the linked post describes as the framework the Australian Government applies to sensitive workloads (read 2026-09-27).
Ask: Confirm in writing that neither the native engine nor the AI Hub produces legal advice or citations, and what the 'governing law' field means when the document is silent.
Vendor content directing how AI describes the product
Not confirmed
No block or page directing how AI models, assistants or crawlers should describe HighQ was found on the two Australian pages read (product page and AI Hub page, both 2026-09-27). An earlier check in this project of https://www.thomsonreuters.com.au/llms.txt, https://www.thomsonreuters.com/llms.txt and /en-au/ai-info.html returned 404, and the Australian site map returned no /ai-info or /for-ai path.
Ask: Does Thomson Reuters publish any file or page instructing AI models how to describe HighQ, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
The AI Hub sends client documents out of HighQ to a third-party AI engine chosen by the customer. Nothing on the pages read addresses client consent, confidentiality or professional-obligation allocation for that transfer, and no AI-specific clause was found in any Thomson Reuters document read (checked 2026-09-27).
Ask: What client notice or consent does Thomson Reuters consider necessary before the AI Hub sends client documents to an external engine, and who bears that obligation under our agreement?
Foundation-model providers
Not confirmed
No model, model family or provider is named for the native AI engine on either Australian page. On the AI Hub path the model is the customer's own: 'Your AI engine of choice examines the document'. The trust centre lists an 'AI Regulatory Disclosures' profile and an AI Governance and Security Program white paper but names no model provider for HighQ (checked 2026-09-27). Statements made on the Thomson Reuters Australian CoCounsel pages about named AI partners are about CoCounsel and have not been carried across.
Ask: Name every model and model provider used by the HighQ native AI engine, the legal entity and country of each inference endpoint, and the notice we receive before a model changes.
Subprocessors
Not confirmed
No subprocessor register for HighQ was found. The trust centre publishes certificates, questionnaires, a Data Security Addendum and a Global Customer Data Processing Addendum but no subprocessor list, and product artefacts require an account. The global privacy statement describes categories only: 'Third-party service providers and partners that support our business, such as our content and other partners, vendors and subcontractors, analytics providers, advertising and marketing agencies, credit agencies' (checked 2026-09-27).
Ask: Provide the dated subprocessor register for HighQ and the AI Hub, with entity, country, purpose and our notice and objection rights.
Training on customer content
Not confirmed
Nothing on the pages read states whether documents in a HighQ site, or the metadata the native engine extracts from them, are used to train or improve any model. The AI Hub page and product page are silent, the website terms of use do not address it, and the global privacy statement addresses personal information rather than customer content (checked 2026-09-27).
Ask: Confirm in the agreement that HighQ content, native-engine extractions and AI Hub traffic are never used to train or tune any Thomson Reuters or third-party model.
Feedback and quality monitoring
Not confirmed
No in-product rating, correction or feedback mechanism for the native AI engine is described on the pages read, and no statement was found about how corrections to extracted fields are used (checked 2026-09-27).
Ask: If a user corrects an extracted field, where does that correction go, and is it used to improve the engine for other customers?
Retention of documents, prompts and extracted data
Not confirmed
No retention period is published for HighQ documents, AI Hub traffic or native-engine output. The global privacy statement says personal information is retained 'as required by our enterprise records retention schedule, which varies by Service, business function, country, record classes, and record types', and that anonymised information may be used indefinitely; that document governs personal information Thomson Reuters holds, not customer matter content (read 2026-09-27).
Ask: State the default and configurable retention for documents, extracted metadata, AI Hub request and response logs, and backups, for an Australian HighQ site.
Deletion and certified erasure
Not confirmed
The global privacy statement gives individuals a right to request deletion of their personal information and publishes counts of deletion requests received. No commitment was found about deleting HighQ customer content, extracted metadata or AI Hub logs, and no certified-deletion undertaking appears on the pages read (checked 2026-09-27).
Ask: On termination, what is deleted from HighQ and from any AI Hub path, within what period, and will you certify deletion in writing?
Vendor access to content
Not confirmed
The global privacy statement says Thomson Reuters restricts access to personal information to employees who need it and trains staff on confidentiality. No statement was found about which Thomson Reuters staff or contractors can read documents in a customer's HighQ site, from which countries, or under what approval (checked 2026-09-27).
Ask: Who at Thomson Reuters can access documents in our HighQ site, from which countries, under what ticketed approval, and can we see those access logs?
Access control and audit
Public claim only
The product page describes the platform as letting a firm 'securely access, organise, share, track, audit and maintain version control for all your legal documents and matters in one centralised platform', and describes secure collaborative workspaces for clients and third parties. No detail on single sign-on, SCIM, mandatory multi-factor authentication or the audit-log export was found on the pages read (checked 2026-09-27).
Ask: Confirm SSO and SCIM support, enforced MFA, and whether the audit log records AI Hub sends and native-engine runs per document.
Encryption in transit and at rest
Not confirmed
No encryption statement for HighQ was found on the pages read. The trust centre describes an information security management framework and offers a HighQ security profile and security questionnaires (SIG, CAIQ) behind an account, without publishing algorithms, key management or customer-managed key options (checked 2026-09-27).
Ask: State encryption in transit and at rest for HighQ documents, AI Hub traffic and backups, the key-management model, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The trust centre lists Thomson Reuters corporate certificates as downloadable PDFs: ISO/IEC 42001, ISO/IEC 27001, ISO 9001, ISO 14001 and ISO 20000-1, plus an AI Regulatory Disclosures profile; product-specific SOC reports, bridge letters, attestations and questionnaires sit behind a per-product security profile that requires an account, including one for HighQ. Separately the Australian product page states HighQ 'has been IRAP assessed on 18 May 2026 against PROTECTED classification level controls', and the linked Thomson Reuters Australia post says the assessment was completed in May 2026 against the September 2025 Information Security Manual (all read 2026-09-27). IRAP: the vendor's own page states "reporting built on metadata gathered in the platform to inform business decisions. HighQ has been IRAP assessed on 18 May 2026 against PROTECTED classification level controls, provid" (https://www.thomsonreuters.com.au/en-au/products/highq.html, checked 2026-10-10). Unverified, not applied (2026-10-10): security claim GDPR (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 42001 (https://www.thomsonreuters.com/en/trust-center). not the vendor's domain. Unverified, not applied (2026-10-10): security claim SOC 2 (https://public-profile.whistic.com/f97698b2-e055-4e12-9d36-675e4fa4185c). not the vendor's domain.
Ask: Provide the IRAP assessment report and the current SOC 2 report for HighQ, with scope, exceptions and whether the AI Hub and native engine are inside that scope.
Contract, entity, DPA and forum
Not confirmed
No Australian contracting entity, ACN or ABN was found: the Australian terms-of-use page is a website terms page naming only 'Thomson Reuters', and refers to filings with the Canadian securities regulatory authorities and the US Securities and Exchange Commission. The trust centre publishes a Thomson Reuters Data Security Addendum (November 2023) and a Global Customer Data Processing Addendum as PDFs; neither was opened within this pass, so nothing is recorded here about their content (checked 2026-09-27).
Ask: Name the Thomson Reuters entity that will contract with us for HighQ and its ACN or ABN, the governing law and forum, and whether the Global Customer DPA and Data Security Addendum attach to that agreement.
Cross-border transfers and APP 8
Not confirmed
The product FAQ puts the storage location in the customer's hands — 'You decide where to store your data, and it stays there' — while naming no regions and not naming Australia. The global privacy statement says personal information 'may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States', and acknowledges it 'may not be able to prevent government authorities in some countries from accessing your personal information'. Where inference for the native engine runs is not stated anywhere read (checked 2026-09-27).
Ask: List every country where HighQ content is stored, backed up, supported and processed for the native AI engine, and confirm in the agreement whether Australia-only storage and Australia-only inference are available.
Incident notification and history
Not confirmed
The trust centre publishes a vulnerability disclosure programme run on HackerOne. No breach-notification commitment, notification period or incident history for HighQ was found on the pages read, and the website terms of use do not address it (checked 2026-09-27).
Ask: State the contractual notification period from discovery for a HighQ incident, cooperation with the Notifiable Data Breaches scheme, and any material incidents in the last 24 months.
Change notice for models, terms and processors
Not confirmed
The website terms of use state 'We may amend the Terms at any time by posting the amended terms on this site.' No change-notice commitment was found for the HighQ subscription, for the native AI engine's underlying model, or for subprocessors, and no subprocessor change feed exists on the pages read (checked 2026-09-27).
Ask: What written notice will we receive before the native AI engine's model, the supported AI Hub engines, or a subprocessor changes, and can we object?
Export and exit
Not confirmed
No export format, export window or exit assistance is described for HighQ on any page read, and the website terms of use do not address customer data export. Extracted data is described as living in HighQ iSheets, with no statement about exporting it (checked 2026-09-27).
Ask: What formats can we export documents, matter records, iSheet data and extracted metadata in on exit, over what period, and at what cost?
Connectors and third-party AI engines
Public claim only
The AI Hub is itself a connector: the vendor states it 'integrates with leading AI providers' and 'syncs via the AI Hub with your third-party AI engine, sending out documents for analysis'. No engine is named, no list of supported connectors is published, and nothing states who contracts with the external engine or on what terms (read 2026-09-27).
Ask: For each AI Hub connector, who holds the contract with that engine, what data is sent, and does it run under our agreement with Thomson Reuters or our own agreement with that vendor?
Open-web search
Not confirmed
Neither Australian page describes open-web retrieval or browsing by the native AI engine or by the AI Hub; both describe processing of documents stored in the platform or sent to a nominated engine. No toggle or statement about web access was found (checked 2026-09-27).
Ask: Does the native AI engine or any AI Hub integration retrieve anything from the open web, and can that be disabled for our site?
Autonomous actions and confirmation
Not confirmed
The described flow ends with data being written into iSheets and used by automation to build 'data visualisations, workflows, risk evaluations, and more'. Whether that automation can act without a person confirming, and what confirmation controls exist, is not described on the pages read (checked 2026-09-27).
Ask: Which HighQ automations can run on AI-extracted values without a person confirming, and can we require confirmation for each?
Human review before use
Not confirmed
No human-review requirement, reviewer role or override control for AI-extracted values is described on the pages read. The pages describe classification and extraction happening automatically on documents stored in the platform, without stating a review step (checked 2026-09-27).
Ask: What product control forces a named person to accept or reject an extracted field before it is used in a workflow or reported to a client?
