Product and intended use
Define the configuration, people, information and tasks being assessed.
Subscription plans, usage limits and credits
Public claim only
User Agreement clause 14.2 (as at 8 September 2026) states there are different subscription plans, 'each with its own conditions, usage limits, and features', and that a user reaching a plan usage limit 'may purchase additional credits to continue accessing the Service', with the detail held in the Manage Your Subscription section of the product. Clause 14.1 states 'You agree that your subscription is for personal use only.' No plan names, inclusions or figures appear on any page read; they sit behind the subscriber area at app.miai.law/billing, which was not opened.
Ask: Which plan tiers exist, what usage limit applies to each, what a credit buys, and will you licence the platform to the firm as an entity rather than on the personal-use basis in clause 14.1?
Deployment and hosting
Public claim only
Delivered as a web subscription with the subscriber area at app.miai.law; no desktop, add-in, mobile or self-hosted option appears in anything read. The home-page FAQ, checked 2026-09-27, states 'Customer account information, uploaded documents, research outputs and AI processing workloads are stored and processed entirely within Australia' and that 'MiAI utilises infrastructure hosted in Australian cloud regions'. No page read names the cloud provider hosting that Australian infrastructure. Logos including HPE, Google, NVIDIA and AWS appear on the home page under the heading 'Our Current Global Partners' with no text describing any relationship.
Ask: Which cloud provider and which Australian region host the production platform and the inference workload, and can you evidence that in the subscription documents rather than the FAQ?
Published feature set
Public claim only
The home page, checked 2026-09-27, publishes: case research in a 'Lite Mode' and a Deep mode; legislation research including interpretation and point-in-time analysis; case summarisation separating majority, concurring and dissenting judgments and ratio from obiter with judicial and paragraph references; 'Contract Intelligence' for review of agreements; and three checking tools, LawCheck ('audit legal documents for correctness, authority, and reasoning integrity'), AppealCheck and PleadingCheck. It also states 'Every query becomes part of your complete audit trail, searchable by date, document type, or jurisdiction.' These are product-page descriptions, not tested behaviour.
Ask: Which of these functions are included at the plan we would buy, and which are separately priced or part of the Bespoke Solutions line?
Jurisdictional coverage and its stated limits
Public claim only
The home page states coverage of 'Federal, State, and Territory laws' and that the platform retrieves from its own structured database of cases and legislation rather than from a language model's memory. The User Agreement narrows this in two places a firm should read together: clause 5.7 states case law research 'relies solely on judicial precedent' and that the service 'does not confirm whether the cited legislation is still current, amended, or repealed', and clause 3.1 names a risk of 'infection' defined as 'where legal concepts from a different jurisdiction is inserted into the AI's interpretation of Australian law'.
Ask: Given clause 5.7, does the platform flag when legislation cited in a retrieved judgment may have been amended or repealed, and what is the update cycle for the case and legislation database?
Vendor content directing how AI systems describe the product
Not confirmed
Checked 2026-09-27 for a page or block telling AI models, assistants or crawlers how to describe the product. The home page was read in full, including the feature sections, the security and compliance section and the whole FAQ set, and contains no block addressed to AI models or crawlers. https://miai.law/llms.txt returns the site's not-found page ('It looks like nothing was found at this location.'), and no /ai-info or /for-ai page appears in the site navigation or footer. This negative is not exhaustive: a firecrawl map of miai.law returned only three indexed links, so the site is poorly indexed and pages outside the navigation may exist.
Ask: Do you publish any file or page that tells AI systems, assistants or crawlers how to describe MiAI Law, and if so where is it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Professional responsibility, privilege and client authority
Public claim only
The User Agreement disclaims the relationships a firm might assume. Clause 5.2 states use of the service 'does not create a solicitor-client relationship or any other professional relationship. No duty of care or legal responsibility is assumed for the content generated by the AI, and your use of the system does not give rise to any confidential or privileged client communications.' Clause 5.1 states the content is for general informational and research purposes and is not a substitute for the professional judgment of a qualified Australian lawyer. Nothing read addresses whether a firm needs client consent before uploading client material.
Ask: What does clause 5.2 mean for legal professional privilege in documents we upload, and will you confirm in writing that uploading client material to the platform does not waive privilege?
Foundation-model providers
Not confirmed
Three vendor documents describe the models differently. The home-page FAQ states 'We use Microsoft Azure OpenAI language models (LLMs) in inference-only mode.' Privacy Policy clause 1.2, which the Terms incorporate at clause 1.1, names no provider: 'We use third-party large language models (LLMs) in inference-only mode. Your data is not used to train those models... For example, if we use OpenAI's API, their policy is not to use API data for training.' Terms clause 2.1 says the service 'uses off-the-shelf large language models (LLMs), together with our proprietary legal architecture, algorithms and relevance reranking systems'. So the marketing FAQ names one named provider and deployment while the binding documents leave the provider open and give a different provider path as a conditional example. The distinction matters because the two paths sit in different regions.
Ask: Name every model provider and model deployment used at inference, state whether it is Azure OpenAI in an Australian region or the OpenAI API, and commit to notifying us before any change.
Subprocessors
Not confirmed
No subprocessor list, and no page naming any hosting, infrastructure or support provider, was found anywhere on the site or in the documents read. The binding documents describe categories of recipient only: Terms clause 13.2 states 'We may disclose that information to third parties that help us deliver the Service (including technology suppliers, communication suppliers and our business partners) or as required by law', and that personal information may be disclosed 'to recipients that are located outside of Australia, including India'. Privacy Policy clauses 6.1 and 6.2 say the same, with Australian Privacy Principle 8 protections asserted. The absence of a named list is itself the finding.
Ask: Provide a subprocessor list naming each recipient, its function and the country it processes in, and identify specifically which recipients are located in India and what data they receive.
Training on customer content
Public claim only
Privacy Policy clause 1.2, which the Terms incorporate at clause 1.1, states 'We do not train any AI models at Miai Law Pty Ltd or Miai Law SEZC. We use third-party large language models (LLMs) in inference-only mode. Your data is not used to train those models, and we do not retain it for that purpose.' The home-page FAQ states the same and adds 'we also do not use your data for any training purposes.' Nothing read states whether that commitment is contracted down to the model provider, and Privacy Policy clause 3.1 separately permits use of collected data for 'Enhancing the accuracy and relevance of the AI-generated responses', which is not defined.
Ask: Is the no-training commitment flowed down in your contract with the model provider, does it cover prompts and generated outputs as well as uploaded documents, and will you warrant it to us?
Service improvement, aggregation and feedback
Public claim only
Privacy Policy clause 3 permits use of collected data 'to improve our services', listing at 3.1 'Enhancing the accuracy and relevance of the AI-generated responses', at 3.2 analysis of usage patterns, and at 3.7 'To develop new features and services'. Clause 4 permits aggregation: the vendor 'may aggregate your information and use the aggregated information to analyse the effectiveness of our Services', may 'analyse the general behaviour and characteristics of users', and may share, publish or make generally available aggregated information such as general user statistics. This sits alongside the clause 1.2 statement that no models are trained, and no opt-out is offered for either use.
Ask: By what mechanism are AI-generated responses made more accurate under clause 3.1 if no model is trained, does that mechanism touch our prompts or uploaded documents, and can we opt out of clauses 3.1 and 4?
Retention of uploaded documents, prompts and outputs
Not confirmed
The marketing FAQ and the published policies do not say the same thing. The home-page FAQ states 'Uploaded source documents are automatically deleted 30 days after upload in accordance with MiAI's data management policies.' No such period appears in either published policy: Privacy Policy clause 9 and Data Protection Policy clause 3 both say only that data is retained 'only for as long as necessary to fulfill the purposes outlined in these terms and conditions, unless a longer retention period is required or permitted by law', that data may also be retained 'for legitimate business interests', and that where deletion is not possible, for example in backup archives, the information is isolated from further processing 'until deletion is possible'. No retention period is published for prompts, research outputs or the audit trail.
Ask: Is the 30-day automatic deletion of uploaded documents a contractual commitment, which document records it, and what are the retention periods for prompts, generated outputs, the audit trail and backups?
Deletion on request and on exit
Public claim only
Privacy Policy clause 8 and Data Protection Policy clause 2 give a right to access, correct or delete personal data held by the vendor, exercised by writing to support@miai.law, and both add 'We reserve our right to limit our facilitating such requests to that which is required by applicable law.' Neither document states a timeframe for deletion, offers certified erasure, or addresses deletion of uploaded documents, prompts, outputs or the audit trail as distinct from personal information. The Terms deal with cancellation at clauses 15 and 16 but contain no provision for deletion or return of customer data on termination.
Ask: On termination, what happens to our uploaded documents, prompts, outputs and audit trail, within what period will they be deleted, and will you certify erasure including from backups?
Vendor and provider personnel access to content
Public claim only
The home-page FAQ, checked 2026-09-27, states 'Access to customer information is strictly limited on a least-privilege basis' and that 'Only authorised personnel with a legitimate business need may access customer information, and only where necessary for platform support, security operations, or legal compliance purposes. All access is governed by role-based access controls and monitored through audit logging.' A separate FAQ answer states subscriber data 'will be segregated from the data of other subscribers in your personal server'. These statements sit on a product page; no equivalent clause appears in the Terms, Privacy Policy or Data Protection Policy, and nothing read states whether the model provider has human reviewers able to read prompts or completions.
Ask: Will you put the least-privilege and audit-logging commitments into our agreement, report access to our content on request, and confirm whether the model provider's personnel can read our prompts or outputs?
Identity and access controls available to the firm
Public claim only
Terms clause 5.6 commits to 'appropriate technical and organisational safeguards—including encryption at rest and in transit, firewalls, secure access controls, and continuous security monitoring', in compliance with Australian Privacy Principle 11, and Privacy Policy clause 7 repeats it. Terms clause 9.2 places responsibility for account confidentiality and for all activity under the account on the user, with an obligation to notify the vendor immediately of unauthorised use. Nothing read mentions single sign-on, multi-factor authentication, IP restriction, session controls or firm-level administrator roles, and no administrator documentation was found.
Ask: Is single sign-on or enforced multi-factor authentication available, and can a firm administrator provision users, set permissions and review the audit trail across the firm's accounts?
Encryption and key management
Public claim only
Terms clause 5.6 states encryption at rest and in transit; Privacy Policy clause 7 states the vendor 'actively encrypts all data and the transmission of that encrypted data both at rest and in transit, and employs additional safeguards such as firewalls, secure access controls, and regular security monitoring'; Data Protection Policy clause 1 states the same encryption position. The home-page FAQ adds that encryption uses 'industry-standard encryption technologies'. All three documents also state that absolute security cannot be guaranteed. No algorithm, key length, key management arrangement or customer-managed key option appears in anything read.
Ask: Which encryption standards are used at rest and in transit, who holds and rotates the keys, and is a customer-managed key option available?
Independent assurance
Public claim only
The home-page FAQ, checked 2026-09-27, answers 'Is MiAI Law ISO 27001 certified?' with 'Yes. MiAI Law is certified to ISO/IEC 27001:2022, the internationally recognised standard for information security management systems (ISMS)', and adds that the vendor 'conducts regular internal audits, risk assessments and management reviews'. A page heading states 'Independently audited and certified to the international standard for information security management.' The certificate itself, the certifying body, the certificate number and the scope statement were not published on any page read, and no SOC 2, IRAP, ISO/IEC 42001 or penetration-test report is mentioned anywhere on the site.
Ask: Provide the ISO/IEC 27001:2022 certificate, certifying body, certificate number and scope statement, and confirm the certified scope covers the production platform and the Australian hosting environment.
Contracting entity, liability and forum
Public claim only
The Australian contracting entity is MiAI Law Pty Ltd, ACN 678 734 766, ABN 55 678 734 766, recorded on the Australian Business Register as an Australian Private Company with ABN and GST registration active from 1 July 2024 and main business location NSW 2000, record extracted 27 September 2026. The User Agreement is dated 'As at 8 September 2026'; clause 17.1 applies the law of New South Wales; clauses 12.1 to 12.3 set a path of informal negotiation, then mediation before a mediator agreed or appointed by the New South Wales Bar Association, then arbitration under ACICA Rules seated in Sydney. Clause 6.3 caps aggregate liability at the fees paid in the 12 months preceding the event, subject to clause 6.1 preserving non-excludable Australian Consumer Law rights, and clause 7 requires the customer to indemnify the vendor. Clauses 10.1 and 10.2 name a second entity, MiAI Law SEZC, as co-owner of the intellectual property; nothing read states where that entity is incorporated or what role it plays in the service.
Ask: Will you contract with the firm as an entity on negotiated terms, raise the clause 6.3 liability cap, and explain the role of MiAI Law SEZC, including whether it holds or can access customer data?
Cross-border transfers and Australian residency
Not confirmed
The residency claim and the binding documents have to be read together. The home-page FAQ states 'MiAI offers full Australian data residency' and that 'Customer account information, uploaded documents, research outputs and AI processing workloads are stored and processed entirely within Australia', using 'infrastructure hosted in Australian cloud regions'. The binding documents contain an offshore disclosure clause: Terms clause 13.2 and Privacy Policy clause 6.2 both state 'We may disclose your personal information to recipients that are located outside of Australia, including India', subject to the recipient agreeing to handle it equivalently to the Australian Privacy Principles. Nothing read reconciles the two, or states which data categories the residency statement covers and which the India clause covers. The residency statement sits on a product FAQ; no terms, data processing agreement or trust-centre document supports it.
Ask: Does the Australian residency commitment cover uploaded documents, prompts, outputs and the inference workload, will you warrant it contractually, and exactly what personal information is disclosed to recipients in India, to whom and for what purpose?
Incident notification
Not confirmed
No breach or incident notification clause was found in the User Agreement, the Privacy Policy or the Data Protection Policy, and no notification timeframe or contact path for a security incident is published. The obligation runs the other way at Terms clause 9.2, which requires the user to notify the vendor immediately of unauthorised account use or a breach of security. Privacy Policy clause 10 covers privacy complaints with a 28-day response commitment and names the Office of the Australian Information Commissioner. No incident history or status page was found on the site.
Ask: What is your contractual commitment to notify us of a security incident affecting our data, within what timeframe, and have you had a notifiable data breach since launch?
Change notice for terms, policies and the service
Public claim only
The three change clauses give different notice. Terms clause 8.1 states changes to the Terms 'will be brought to your notice for your acceptance', that continued use after notice constitutes acceptance, and that a user who does not agree may terminate without penalty within 30 days of receiving notice. Terms clause 3.3 states 'We may, from time to time and without notice, change or update the Service at our discretion.' Privacy Policy clause 11 and Data Protection Policy clause 4 both state that policy changes are 'effective immediately upon posting' and that continued use indicates acceptance. Terms clause 14.3 gives at least 30 days' notice before modifying or cancelling a subscription plan where the user would be significantly impacted, and clause 14.7 gives at least 15 days' notice of a price adjustment tied to additional features.
Ask: Will you give advance written notice of material changes to the service, the model provider and the privacy and data-protection policies, rather than relying on change without notice under clause 3.3 and effective-on-posting policy updates?
Exit, export and continuity
Public claim only
Terms clause 15.1 states the subscription renews automatically at the end of each period, that cancellation takes effect at the end of the current plan period, and that the user must cancel before renewal to avoid the next period's fee. Clause 16.1 states payments are non-refundable with no credit for partially used limits, except as required by the Australian Consumer Law, and that access continues to the end of a paid period. Nothing in the Terms or either policy provides for export of prompts, saved research, generated outputs or the audit trail, in any format, on exit or during the subscription, and no continuity or escrow arrangement is published.
Ask: In what format can we export our research history, generated outputs and audit trail before cancelling, and for how long after cancellation does that remain available?
Third-party agents and automated access
Public claim only
Terms clause 9.3 governs this in unusual detail. Clause 9.3.1 states the user must not permit 'any third-party artificial intelligence system, browser-enabled agent, autonomous or semi-autonomous agent, software robot, scraper or other automated tool (excluding any agent or integration provided by MiAI Law, such as Jewel Co-Pilot)' to access the service through the account. Clause 9.3.2 states that if it does, prompts, research questions, uploaded documents, client or matter information, outputs, usage data, metadata and inferences 'may be transmitted to, processed, stored or retained by the third-party provider, including outside Australia', and clause 9.3.3 that such processing sits outside the data-residency, security, privacy and governance controls applicable to the service. Clause 9.3.6 reserves the right to restrict, block or suspend such access, and clause 9.1.6 separately prohibits scraping and systematic analysis of outputs.
Ask: Does clause 9.3.1 prohibit our own approved AI assistants and automation from accessing the platform on our lawyers' behalf, and what is the approved route for connecting it to our document or practice-management system?
Open-web retrieval
Not confirmed
No page read states whether the service retrieves from the open web at query time. The home-page FAQ describes retrieval in the opposite direction: the platform 'retrieves from its own structured database of cases and legislation, then reasons from those primary sources', and states it does not rely on a language model's memory. Terms clause 4 notes only that the service may contain links to third-party websites provided for convenience. Whether any open-web or third-party search occurs as part of answering, and whether it can be disabled, is unstated.
Ask: Does any part of the service retrieve from the open web or from third-party sources at query time, and if so which, and can that be turned off for our account?
Agent actions and confirmation
Not confirmed
Nothing read describes the service taking actions outside its own interface: the published functions are research, summarisation and document checking, and the outputs described are answers, citations and audit reports. The one unexplained item is Terms clause 9.3.1, which names 'Jewel Co-Pilot' as an example of 'any agent or integration provided by MiAI Law' while excluding it from the prohibition on third-party agents; no page read says what it is, what it can do, or whether it acts autonomously. No confirmation, approval or action-logging design is published.
Ask: Does Jewel Co-Pilot, or any other part of the service, take actions outside the platform interface such as sending, filing or writing to other systems, and is per-action human confirmation required?
Human review before reliance
Public claim only
The User Agreement requires it in terms. Clause 5.5 states 'Always exercise independent professional judgment when using AI outputs. All conclusions, interpretations, or risk assessments provided by the AI must be evaluated and confirmed by a qualified legal practitioner before being acted upon. The AI is a support tool, not a decision-maker, and cannot replace the expert judgment and responsibilities of human lawyers.' Clause 3.1 records a risk of 'errors, inaccuracies, "hallucinations"... and "infection"' and states the user should independently verify any information obtained. Clause 5.3 states summaries may not capture all relevant facts or nuances and directs the user to consult the full original sources, and clause 5.7 requires independent verification of the current status of all legislation mentioned.
Ask: What in-product support exists for the verification clauses 5.5 and 5.7 require, for example flagging that cited legislation may be out of date, and can a firm require a recorded verification step before an output is exported?
