Legal-specific · Compliance and privacy · Low confidence
Nomos AI, Inc. (dba Norm Ai) · Norm Technology agent platform as marketed in 2026, distinct from the affiliated firm Norm Law. Site Terms and Privacy (23 January 2024) are website/User Terms; a product DPA was not found on the pages reviewed.
US ‘agentic law’ platform that encodes legal rules into AI agents, with a supervisory verification layer; affiliated law firm Norm Law is a separate practice entity.
Opens a private software assessment of Norm Ai for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | United States |
| Australian region | Unknown |
| Training on customer content | Unknown |
| Retention summary | Privacy (23 Jan 2024) has a Data Security and Retention section for Site/Services personal data; no numbered matter-data schedule was extracted in this pass. |
| Pricing summary | No public price list. Home describes institutional customers and fundraising, not seats. |
| Legal content coverage | Encoded law for agents and a supervisory verification layer. Not described as a licensed Australian primary-law corpus. Affiliated Norm Law is a law firm, not the software licence. |
| Australian presence | No — 7 World Trade Center, New York. New York law and JAMS arbitration. No Australian office or corpus described. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Nomos AI, Inc. dba Norm Ai, 7 World Trade Center, 39th Floor, New York. Home: Norm Law (affiliated firm), Norm Technology (agents), Supervisory AI (verification). Do not conflate the software licence with legal services from Norm Law.
Ask: Are we buying Norm Technology software, engaging Norm Law, or both — and which entity signs?
Not confirmed
Site/Services hosted; Terms say use from other regions transfers data to the practices described in the Privacy Policy. Cloud region is not named on the home, privacy or terms pages reviewed.
Ask: Where is production hosted, and is an Australian region available?
Public claim only
Home: embedding of law into AI agents; automation of legal and compliance tasks; Supervisory AI as a verification layer for every agent. Legal AGI Lab announced April 2026 as R&D.
Ask: Which agents and which encoded regimes are in our SKU?
Public claim only
Timeline is US (Delaware sandbox proposal July 2026; US forum 2025). No Australian statute-encoding claim on the home page.
Ask: Which jurisdictions’ rules are actually encoded for our use?
Record the practical work needed to introduce and maintain the software.
Public claim only
Site Terms: New York law; JAMS arbitration in New York; 30-day arbitration opt-out to the WTC address. User Terms (separate) govern Services. No public price list.
Ask: Provide the User Terms/MSA and fees; can we negotiate Australian law/forum?
Not confirmed
No named DMS/SSO connectors on the home, privacy or terms pages reviewed.
Ask: Which systems will agents read or write to?
Public claim only
Privacy: contact@norm.ai. Terms give the WTC address. No published severity SLA.
Ask: What are support hours and the security contact?
Compare complete work at the required quality, including checking and correction.
Not confirmed
No Vals AI or Stanford RegLab legal-output score found. Supervisory AI is a vendor layer, not an independent audit.
Ask: May we trial encoded agents on our compliance use-cases with a scored error log?
Public claim only
Fit is encoding rules into agents with a verification layer. Unsuitable as an Australian research corpus. Using Norm Law is a legal-services engagement, not this software record.
Ask: Will a lawyer remain accountable for every agent output before it is acted on?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Privacy is a Site/Services personal-data notice. No Australian client-consent template. Agents that act on client matters need a separate authority analysis.
Ask: What client data do agents ingest, and what disclosure do you recommend?
Not confirmed
No OpenAI/Anthropic/Google name on the home, privacy or terms pages reviewed. Series C coverage on the home page mentions Khosla as an OpenAI investor; that is not a product-provider statement.
Ask: Name every model provider and region on our tenant.
Not confirmed
Privacy: service providers (hosting, technology, communications, analytics), advertising and business partners. No dated named list.
Ask: Provide the current named list with locations.
Not confirmed
Privacy lists product development, testing, research and internal analytics as purposes for Site/Services personal data. No clause stating customer matter content is not used to train models.
Ask: Confirm in a DPA that customer content is not used to train Norm Ai or third-party models.
Public claim only
Privacy: improving the Site and Services, testing, research, internal analytics, product development; advertising partners.
Ask: Can prompts or encoded-matter text appear in analytics or ads?
Not confirmed
Privacy has a Data Security and Retention heading. A numbered matter-data schedule was not extracted in this T3 pass.
Ask: State default retention for prompts, agent traces and encoded work product.
Public claim only
Privacy describes California deletion/access rights for Personal Data. Product-tenant certified deletion is not numbered.
Ask: Will you delete production, backups and provider logs within 30 days of exit and certify?
Not confirmed
Staff access to customer agent traces is not described on the pages reviewed.
Ask: When may Norm Ai staff read our agent runs, and is access logged?
Not confirmed
SSO/MFA/RBAC for the product were not described on the home, privacy or terms pages reviewed.
Ask: Is SSO/MFA available, and how are agent permissions scoped?
Not confirmed
Privacy refers to data security generally. TLS/at-rest algorithms are not stated on the pages reviewed.
Ask: Confirm encryption in transit and at rest, and key custody.
Not confirmed
No SOC 2, ISO 27001 or ISO 42001 certification claim was found on the home, privacy or terms pages reviewed.
Ask: Do you hold SOC 2 or ISO 27001 covering Norm Technology, and will you share the report?
Public claim only
Site Terms (NY/JAMS) plus a separate User Terms document for Services. No public DPA URL. Privacy effective 23 January 2024 — older than 2026 product timeline.
Ask: Provide current User Terms and DPA before any matter data is processed.
Public claim only
New York company. Privacy shares with service providers and partners. No SCCs extracted from the privacy page in this pass.
Ask: List every country of storage and inference for APP 8.
Not confirmed
Privacy mentions security-incident investigation among legal purposes. No 72-hour customer-notification SLA found.
Ask: Commit in writing to notify us within 72 hours of a confirmed incident.
Public claim only
Privacy may change with notice on the website and/or email; continued use is acceptance. Terms similarly complete-agreement language.
Ask: Will material processor or agent-capability changes get 30 days’ written notice?
Not confirmed
Export/deletion on termination is not numbered in the Site Terms extract.
Ask: What export exists for encoded rules and agent logs, and when are they purged?
Not confirmed
No named connectors on pages reviewed. Agents that invoke tools would be a residual disclosure.
Ask: List every tool an agent may call on our tenant.
Not confirmed
Open-web browsing was not stated.
Ask: Can agents browse the open web with our data, and can we disable it?
Public claim only
Supervisory AI is described as the verification layer for every AI agent. Default unattended actions are not contractually listed in the Site Terms extract.
Ask: Which agent actions require a human approve-step by default?
Public claim only
Supervisory AI is a product claim. Site Terms do not require a human lawyer to accept each output before action.
Ask: Is there a mandatory human-accept step before an agent files, sends or pays?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI compliance and privacy tools Australia
