Legal-specific · Document management and knowledge · Medium confidence
iManage AI Enrichment (called AI Services in the vendor's own FAQ)
iManage LLC · iManage AI Enrichment on the cloudimanage.com endpoint, purchased as an additional product. Ask iManage, Mailbox Assistant, the MCP Server, Security Policy Manager and on-premises iManage Work need separate review.
Platform service that classifies documents and extracts agreement metadata at filing and across an existing iManage library, so the values can be used for search and by other AI tools.
Opens a private software assessment of iManage AI Enrichment (called AI Services in the vendor's own FAQ) for one task, with this profile’s questions to hand.
Knowledge searchDocument classification
Published facts
Deployment
SaaS
Hosting regions
Australia, United States, United Kingdom, European Union / EEA, Singapore, Canada
Australian region
Yes
Assurance
SOC 2 (a 2026 Type 2 SOC 2+ report and an August 2026 bridge letter are listed on the compliance portal; access on request), ISO/IEC 27001:2022, ISO 27701, ISO 27017, ISO 27018, ISO 22301, CSA STAR Level 2, EU-US Data Privacy Framework, UK Extension and Swiss-US Data Privacy Framework (the privacy notice states the self-certification does not apply to processing in Australia or India), Per-product penetration-test executive summaries listed on the compliance portal (Ask iManage 2026, MCP, iManage Work 2026, Threat Manager 2026); none listed for AI Enrichment
Training on customer content
No
Retention summary
The terms of service say that where iManage uses AI Services it 'will process and store your inputs and outputs solely for the purpose of providing the Services'; no period is stated. The privacy notice retains personal information only as long as reasonably necessary and allows anonymised information to be used indefinitely for research or statistical purposes. No retention period for enrichment metadata, classification runs or AI logs was found, and the Cloud Services Agreement that governs customers is not published.
Integrations
iManage Work, Microsoft 365, Microsoft Teams, Microsoft Outlook, Microsoft SharePoint, iManage Security Policy Manager, Ask iManage, iManage MCP Server, Third-party AI tools named by the vendor as consumers of the metadata (Harvey, Microsoft Copilot)
Pricing summary
No public price. The vendor's AI FAQ states that 'Mailbox Assistant, AI Services, and Ask iManage will not be included in a standard cloud subscription and will need to be purchased as additional products', and that iManage AI is available only on the cloudimanage.com endpoint.
Australian presence
Yes — The published subprocessor list names NEXTDC Limited as a data-centre provider in Australia for multiple iManage Cloud Services (data storage only), and lists iManage LLC, 71 South Wacker Drive, Chicago, with the annotation 'Including Australian branch office' and processing location 'Australia & United States'. The privacy notice says iManage has a presence in Australia and that its Data Privacy Framework self-certification 'does not apply to processing in Australia or India'. The AI Enrichment FAQ names Australia as one of the regions the service is available in. No Australian-incorporated contracting entity and no ACN or ABN were found: the terms of service say that outside Europe, the Middle East and Africa 'your agreement is with iManage LLC, a Delaware limited liability company', and that for customers 'the governing agreement will be the Cloud Services Agreement', which is not published.
Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, plan and endpoint
Public claim only
The vendor's AI FAQ states 'iManage AI is only available on the cloudimanage.com endpoint' and that AI Services, Ask iManage and Mailbox Assistant 'will not be included in a standard cloud subscription and will need to be purchased as additional products' (read 2026-09-27). The product page names the service AI Enrichment; the FAQ and the Copilot answer call the same document classification and extraction service AI Services.
Ask: Is our tenant on cloudimanage.com, and is AI Enrichment a separate line item on our order form with its own term and price?
The product FAQ states 'AI Enrichment is available in United States, United Kingdom, EU, Singapore, Canada, and Australia' and that it 'is currently available in the English language, with plans to expand'. Availability only on the cloudimanage.com endpoint means no on-premises path for this service. The published subprocessor list separately names NEXTDC Limited as an Australian data-centre provider for multiple iManage Cloud Services, data storage only (all read 2026-09-27).
Ask: Confirm in writing that our AI Enrichment processing and the metadata it writes stay in the Australian region, including backups and any queueing or telemetry.
The vendor states the service classifies documents and extracts metadata at the point of filing 'using natural language processing (nlp) and Large Language Model (LLM)', 'Supports 60+ agreement subclasses, including NDA, MSA, and more', 'Extracts 6 structured entity types from agreements' including parties, jurisdiction and governing law, applies retroactively across an existing library, and 'Updates automatically when documents are edited, versioned, or restored'. Administrators can see enrichment fields per library through the Control Center and override an individual document's classification (read 2026-09-27).
Ask: List the 60-plus subclasses and the six entity types exactly, and show what the service writes to a document record on a first run and on a re-run.
The service is described as extracting jurisdiction and governing law as metadata from agreements, not as interpreting law, and the FAQ states it is 'currently available in the English language'. No Australian-specific taxonomy, precedent set or legal content is claimed. No Australian customer is named on the pages read; the named customer stories include a New Zealand firm (checked 2026-09-27).
Ask: How does classification perform on Australian state-based agreement types and on documents governing multiple jurisdictions, and is any Australian taxonomy supported?
Vendor content directing how AI describes the product
Not confirmed
No block or page directing how AI models, assistants or crawlers should describe the product was found on the two vendor pages read (the AI Enrichment product page and the platform AI page, both 2026-09-27). An earlier check in this project of https://imanage.com/llms.txt and of /ai-info returned 404, and the site map returned no such path.
Ask: Does iManage publish any file or page instructing AI models how to describe iManage or AI Enrichment, and if so where?
Record the practical work needed to introduce and maintain the software.
Licence and which agreement applies
Public claim only
The published terms of service state: 'Where you are an iManage Customer, please note the governing agreement will be the Cloud Services Agreement. Where you are not an iManage Customer, these terms of service ... cover your use and access to our services, client software and websites.' The Cloud Services Agreement is not published, so the customer-facing licence terms for AI Enrichment were not read. The terms of service limit iManage's liability under those terms to 1,000 US dollars (read 2026-09-27).
Ask: Provide the Cloud Services Agreement and any AI Services schedule that will apply to us, with the order of precedence against the online terms of service.
The vendor states the extracted metadata 'Raises the metadata floor for Ask iManage and other AI tools' and names Harvey and Microsoft Copilot as tools whose results depend on the underlying data. Output is surfaced 'through surfaced metadata in the Work Web properties panel. No separate UI or context switching.' The FAQ adds that the AI layer sits on top of existing storage and integrations including Microsoft 365, Teams, Outlook and SharePoint (read 2026-09-27).
Ask: Which downstream tools will read enrichment fields in our tenant by default, and can we restrict an enrichment field to iManage-only consumers?
The compliance portal publishes compliance@imanage.com as the contact, a 'Request access' flow for documents, a 'Subscribe to updates' option and a dated updates feed. The subprocessor list shows customer support and operational services delivered by iManage entities in Canada, the United Kingdom, Spain, India, Singapore and the United States, alongside iManage LLC with an Australian branch office. Zendesk is listed for support tickets, processed in the United States (read 2026-09-27).
Ask: For an Australian tenant, which support entity handles our tickets, in which country, and what is the escalation path for an AI Enrichment fault?
Compare complete work at the required quality, including checking and correction.
Published quality evidence
Not confirmed
The published figures are counts of coverage, not measures of accuracy: 60-plus agreement subclasses and six entity types. No precision, recall, error rate or independent evaluation is published for classification or extraction, and the compliance portal lists penetration-test summaries for Ask iManage, MCP, Work and Threat Manager but none for AI Enrichment (checked 2026-09-27).
Ask: Provide measured accuracy per entity type and per agreement subclass, with the test corpus, and the penetration-test summary covering AI Enrichment.
The vendor states administrators can 'override an incorrect classification' and that the service 'Offers a per-document override feature for flexibility and control', with 'visibility of enrichment fields per library via the Control Center'. Nothing states how a user can tell a machine-written field from a human-entered one, or how confident the service was (read 2026-09-27).
Ask: In the Work properties panel, how does a lawyer see that a value was machine-extracted, and is any confidence score exposed or exportable?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
The service reads every document in the library, including client matter documents, and writes metadata against them. The vendor states it 'automatically inherits your existing security permissions, ethical walls, and retention policies' and that processing happens inside the customer's environment. Nothing addresses client notice or consent for automated reading of client documents, and the firm's professional obligations are not mentioned on the pages read (checked 2026-09-27).
Ask: What client notice does iManage consider appropriate before enrichment runs retroactively over existing client matters, and can nominated matters or clients be excluded entirely?
The product page states 'AI Enrichment is a purpose-built model that runs inside your environment, with documents processed within your region', and the FAQ says it uses natural language processing and a Large Language Model with 'no model training' required. The platform FAQ refers to 'our third-party model providers' without naming any. The published subprocessor list of 17 entries names no model-inference provider at all: it lists data centres, iManage support entities, Microsoft 365, MongoDB Atlas, MixPanel, Twilio, Zendesk, Beamer, MessageBird and Forethought (all read 2026-09-27). The vendor therefore acknowledges third-party model providers exist while the published list names none.
Ask: Name every model and third-party model provider used by AI Enrichment for an Australian tenant, and explain why they do not appear on the published subprocessor list.
The compliance portal publishes a subprocessor list of 17 entries with purpose and location, read 2026-09-27. Data centres: NEXTDC Limited (Australia), Centersquare (United States), Digital Realty UK, and AWS for Closing Folders only (Australia, Canada, EU, UK, United States). Support and operational entities: iManage LLC (Australia and United States, including an Australian branch office), iManage Canada Technologies ULC, iManage EMEA Limited, NetRight entities in Singapore, Spain and India. Application services: Microsoft 365 and MongoDB Atlas at 'Customer Selected Region'; MixPanel (EU), Twilio Segment (US and EU), Zendesk, Beamer, Forethought and MessageBird in the United States. No model-inference provider appears.
Ask: Which of these 17 subprocessors touch AI Enrichment for an Australian tenant, and what is our notice and objection right when the list changes?
The platform FAQ states: 'By default, neither iManage nor our third-party model providers use any customer data in the iManage Cloud - including inputs or outputs from AI services - to train or retrain AI models', adding that 'In some cases, customers may voluntarily choose to opt in to certain services that allow iManage to collect limited insights for the sole purpose of improving those services.' The product page states 'No data ever leaves to train a shared model.' Separately the published privacy notice says iManage processes 'publicly available documents to improve our services, including to train our machine learning models'. The FAQ statements sit on a marketing page; the customer-facing Cloud Services Agreement was not read (all checked 2026-09-27).
Ask: Which signed document prohibits training on our content, what opt-in services exist, and how would we know if someone in the firm opted in?
The terms of service state that 'iManage may use usage information derived from the use of the Services (this does not include Your Content) to benchmark, develop and improve our services in locations globally', and that 'Where required, we will provide separate notice and request your consent before accessing this information'. The same section grants iManage a worldwide royalty-free licence to use Your Content to the extent necessary to provide the Services, protect them 'and to improve iManage products and services'. MixPanel and Twilio Segment are listed as analytics subprocessors (read 2026-09-27).
Ask: How does the 'improve iManage products and services' limb of the content licence operate for enrichment output, and can it be struck out of our agreement?
Retention of inputs, outputs and enrichment metadata
Public claim only
The terms of service state: 'Where iManage uses AI Services, iManage will process and store your inputs and outputs solely for the purpose of providing the Services.' No period is given. The privacy notice retains personal information 'for as long as reasonably necessary to fulfil the purposes for which we collected it' and allows indefinite use of anonymised information for research or statistical purposes. The product page says the service respects 'inherited retention policies' (all read 2026-09-27).
Ask: State the retention period for enrichment inputs, outputs, run logs and any intermediate index, and confirm they follow the matter's own retention policy.
Nothing found states how enrichment metadata is deleted, whether classification can be reversed library-wide, or what happens to extracted values when the underlying document is destroyed under a retention policy. The privacy notice gives individuals a right to erasure of personal information, subject to exceptions; that right addresses personal information rather than document metadata (checked 2026-09-27).
Ask: If we turn AI Enrichment off, can the metadata it wrote be removed from every document record, and will you certify that in writing?
The terms of service state 'iManage does not routinely have access to Your Content', and the platform FAQ states 'All data uploaded to the iManage Cloud is encrypted, and iManage does not have access to the underlying content.' The published subprocessor list nonetheless shows customer support and operational services for all iManage Cloud Services delivered from Canada, the United Kingdom, Spain, India, Singapore, the United States and Australia. The privacy notice says access to personal information is restricted to employees who need it (all read 2026-09-27).
Ask: Reconcile 'does not have access to the underlying content' with support entities in seven countries: under what approval can a support engineer read a document, and is that logged for us?
The vendor states the service 'Inherits existing security permissions and ethical walls from your current environment', inherits iManage Security Policy Manager policies, and 'Provides visibility of enrichment fields per library via the Control Center' with a per-document override. The compliance portal lists an FAQ entry headed 'Who has administrative access to the iManage Cloud, and how is this access controlled?' whose answer was collapsed on the page and not extracted (checked 2026-09-27).
Ask: Confirm that enrichment fields respect ethical walls at read time, and show the audit record of every enrichment run and override in our tenant.
The platform FAQ states 'All data uploaded to the iManage Cloud is encrypted'. No algorithm, protocol version, key-management model or customer-managed key option is published on the pages read; the compliance portal lists an Information Security Policy Manual and a Cloud Services Responsibility Matrix behind a request-access flow (checked 2026-09-27).
Ask: State encryption in transit and at rest for AI Enrichment processing and for the metadata store, including key custody and whether customer-managed keys are available.
The compliance portal displays SOC 2, ISO/IEC 27001:2022, ISO 27701, ISO 27017, ISO 27018, ISO 22301, CSA STAR Level 2 and the EU-US, UK Extension and Swiss-US Data Privacy Frameworks, and lists a 2026 Type 2 SOC 2+ report, an August 2026 SOC 2 bridge letter, a Statement of Applicability, CAIQ and SIG questionnaires and per-product penetration-test executive summaries. Documents require a request-access approval. Penetration-test summaries are listed for Ask iManage 2026, MCP, iManage Work 2026 and Threat Manager 2026; none is listed for AI Enrichment. No IRAP assessment is listed on the portal page read (2026-09-27).
Ask: Is AI Enrichment inside the SOC 2 and ISO 27001 scope, has it been penetration tested, and is any IRAP assessment held for the Australian iManage Cloud?
The terms of service state that for customers 'the governing agreement will be the Cloud Services Agreement', and that outside Europe, the Middle East and Africa 'your agreement is with iManage LLC, a Delaware limited liability company'. Under those terms liability is limited to 1,000 US dollars, the law is that of Illinois, judicial proceedings go to courts in Cook County, Illinois, and US residents are bound to arbitration with a 30-day opt-out. No Australian contracting entity, ACN or ABN was found; the subprocessor list records iManage LLC as 'Including Australian branch office' (all read 2026-09-27).
Ask: Which entity will sign our Cloud Services Agreement, does it have an ACN or ABN, what law and forum apply for an Australian customer, and what is the negotiated liability cap?
The product FAQ states 'All processing happens inside your iManage environment and within your region ... Nothing is sent to an external service, and there is no cross-region data transfer.' The published subprocessor list nonetheless locates support and operational services in Canada, the United Kingdom, Spain, India, Singapore and the United States, with Microsoft 365 and MongoDB Atlas at 'Customer Selected Region' and analytics in the EU and United States. The privacy notice says personal information 'will be primarily processed in the United States, the UK, and the EEA', relies on adequacy decisions or Standard Contractual Clauses, and states the Data Privacy Framework self-certification 'does not apply to processing in Australia or India' (all read 2026-09-27).
Ask: For an Australian tenant, confirm contractually that document content and enrichment output never leave Australia, and list every country from which support can access them.
The compliance portal runs a dated updates feed with a subscribe option. Entries read on 2026-09-27 include a 3 June 2026 statement that iManage has 'identified no exposure to the reported attack vectors' associated with the publicised AI-driven threat it calls Claude Mythos, and a 10 December 2025 statement that no product is vulnerable to React2Shell (CVE-2025-55182). The same updates describe regular penetration testing and a private bug bounty programme. No contractual notification period and no customer-affecting incident history were found.
Ask: State the contractual notification period from discovery for an incident affecting AI Enrichment, and confirm cooperation with the Notifiable Data Breaches scheme.
The compliance portal offers a 'Subscribe to updates' function and publishes dated updates and a subprocessor list. The terms of service contain a Modifications section and a Beta Services section under which alpha, beta, preview and early-access features 'may not be as reliable as our other services' and feedback may be collected. No advance-notice commitment was found for a change of model, of model provider, or of subprocessor (checked 2026-09-27).
Ask: How much written notice will we receive before the model behind AI Enrichment changes or a subprocessor is added, and can we object or pause enrichment?
The terms of service say iManage will give reasonable advance notice before terminating access and 'give you the opportunity to export Your Content from our Services', and that on discontinuation of a service it will give 'reasonable prior notice so that you can export Your Content from our systems'. No export format, window or assistance is specified, and whether enrichment metadata is included in an export is not stated. The customer-facing Cloud Services Agreement was not read (checked 2026-09-27).
Ask: On exit, does the export include enrichment fields as structured metadata, in what format, and within what period?
The terms of service state that when a customer uses third-party services 'you understand that by using our Services you are directing them to make Third-Party Services available to you', that those services may require content to be stored with the third party, and 'You agree to assume all risk and liability arising from the use of these Third-Party Services'. The platform FAQ says the AI platform lets organisations use iManage AI, Microsoft Copilot or third-party tools, and a separate MCP Server product is marketed for connecting content to external AI tools (read 2026-09-27).
Ask: Which connectors and MCP clients will be enabled in our tenant, what enrichment metadata do they receive, and confirm they are off unless we enable them in writing.
The service is described as operating on documents in the customer's own library, with 'no cross-region data transfer' and nothing 'sent to an external service'. No open-web retrieval, browsing or external lookup is described, and no toggle is published; the pages read do not state the position either way for the model that performs classification (checked 2026-09-27).
Ask: Does any part of AI Enrichment make an outbound network call beyond our tenant, and can that be blocked at tenant level?
The service writes without being asked: the vendor states it 'Applies data automatically at filing, no setup or training needed', 'Enriches your entire existing DMS, not just new files' and 'Runs continuously as documents are edited or versioned'. The controls described are administrative rather than per-action: visibility of enrichment fields per library and a per-document override after the fact. No confirmation step before a value is written is described (read 2026-09-27).
Ask: Can enrichment run in a review-only mode where values are proposed and not written, and can it be scoped to nominated libraries before a firm-wide run?
The only human controls described are the per-document classification override and per-library visibility of enrichment fields through the Control Center; the vendor states the service runs 'automatically in the background' with 'no taxonomy customization, and no configuration required from your team'. No mandatory review before an extracted value is relied on, or before downstream tools consume it, is described (read 2026-09-27).
Ask: Before an enrichment field can be used in a search, a report or by a third-party AI tool, what control lets us require human sign-off?
