Product and intended use
Define the configuration, people, information and tasks being assessed.
Product existence and what is being licensed
Public claim only
The product is carried on the vendor's own site, which settles the existence question Phase 2 left open: https://www.relativity.com/platform/relativity-clair, read 2026-09-27, is headed 'A conversational AI experience, built for lawyers', carries the status 'Now in Advanced Access', and appears as 'Relativity claiR — Conversational AI, built for lawyers' in the platform navigation and footer of every page read. It is presented as a tool inside Relativity aiR rather than a separate product: 'Relativity claiR gives legal practitioners a simple, intuitive way to engage with the full depth of their matter, inside the secure, governed AI platform where their most consequential legal data already lives.'
Ask: Is claiR available to us today under Advanced Access, on what terms, and what changes when it reaches general availability?
Release stage
Public claim only
Pre-release on the date checked. The vendor page carries 'Now in Advanced Access' twice and states that global law firms are among the first to work with claiR, 'with more organizations joining in the weeks ahead', with a 'More Coming Soon' marker and an email opt-in to 'Keep up to date on Relativity claiR as it develops'. Statements attributed on that page to partners at A&O Shearman, Foley & Lardner, K&L Gates and Skadden describe co-development and testing rather than production use. Trade press reporting the 12 August 2026 announcement recorded general availability as expected 'sometime early next year'. Nothing read gives a date.
Ask: What is the current general-availability date, what functionality is frozen between Advanced Access and general availability, and will Advanced Access participants' configurations carry across?
AI features in scope
Public claim only
The vendor page describes six functions: asking questions in plain language and getting 'answers grounded in your matter documents, supported by citations'; enriching data by creating 'custom data columns with AI to build insights, extract content, or classify documents'; searching without syntax by describing what is needed 'in everyday language'; running 'pre-built skills for specific legal tasks' or creating and refining new ones for future matters; drafting, to 'Generate memos, summaries, and other work product grounded in the facts and evidence in your data'; and saving and sharing work with the case team. Scope is described as the whole matter: 'Relativity claiR reasons across everything in your legal data project: millions of documents, deep metadata, and the connections between them.' The product is wholly an AI interface; there is no non-AI component to separate from it.
Ask: Which of these functions are live in Advanced Access today, and which are roadmap?
Deployment and where the data sits
Public claim only
claiR runs on data already held in Relativity aiR rather than in a separate AI environment: the vendor describes it as operating 'inside the secure, governed AI platform where their most consequential legal data already lives', and trade press quoted a statement attributed to Relativity that 'Nothing is exported or sampled, the answer comes from the record itself, right where the data lives.' The compliance page states 'Relativity aiR is built in the safety and security of the Azure cloud'. The vendor's navigation also carries a 'Server Policy' page, indicating a self-managed server product exists; that page was not read and whether claiR is available on it is unknown.
Ask: Is claiR available only on the cloud platform, and does any claiR processing occur outside our aiR instance — for example on a model endpoint in another region?
Jurisdiction and legal content
Public claim only
claiR carries no legal-content library: its corpus is described as the customer's own matter — documents, metadata and insights already captured in the project — and every published example of an answer is grounded in that matter with citations back to it. Nothing read claims coverage of Australian legislation, case law or rules of court, and nothing read addresses Australian discovery practice or production formats. The vendor publishes a separate AI Principles page, which was not read.
Ask: Does claiR ever draw on sources outside our matter, such as a legal-research corpus or model knowledge, when generating a memo?
Vendor content directing how AI describes the product
Not confirmed
A deliberate check was made on 2026-09-27 across a 40-URL site map of relativity.com and the four vendor pages read for this profile. No /llms.txt, /ai-info or /for-ai URL appeared in the map, and no 'Instructions for AI Assistants' heading or equivalent block appeared on the pages read. The vendor does publish an AI Principles page at https://www.relativity.com/artificial-intelligence, which was not read and which may or may not contain such content.
Ask: Does Relativity publish any page or embedded block directing how AI assistants should describe claiR or the aiR platform, and is the AI Principles page contractual or aspirational?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and self-service access to the whole matter
Not confirmed
The design point a firm must accept is the breadth and the self-service model together: claiR is described as reasoning across 'everything in your legal data project: millions of documents, deep metadata, and the connections between them', and is aimed at the lawyer directly so that 'The line of inquiry lives with the person closest to the facts'. On a matter holding another party's produced documents, or documents collected under a confidentiality regime or a court order, the question of which lawyer may put which question to the whole corpus becomes a permissions and undertakings question rather than a technical one. Nothing read describes matter-level or document-level restriction of claiR's reach, although the platform is separately said to include 'discrete permissions'.
Ask: Can claiR's reach be confined to a defined subset of a matter, so that documents subject to a confidentiality undertaking or a court order are excluded from what it reasons over?
Foundation-model provider
Not confirmed
No model, model family or foundation-model provider is named for claiR anywhere read on 2026-09-27, including on the vendor's own product page and both security pages. The only infrastructure statement is that 'Relativity aiR is built in the safety and security of the Azure cloud', which names the cloud, not the model. A trap was checked and avoided: relativity.com publishes a press release about collecting Claude Enterprise data through a Claude compliance API as an eDiscovery data source. That is a data-collection integration and says nothing about which models run claiR, so no model provider is recorded from it.
Ask: Which model, from which provider, under what contract and in which region, generates claiR answers and memos, and what notice will we get before it is changed?
Subprocessors
Not confirmed
No subprocessor list was found. The 40-URL site map showed no subprocessor page, and neither security page nor the privacy policy carries a register. The privacy policy addresses third parties only in general terms — 'We share your Personal Data with third parties in limited circumstances, including with service providers to enable them to perform services on our behalf. Service providers are not permitted to use your Personal Data for their own purposes' — and, critically, it excludes customer matter data from its scope entirely, so it is not evidence about who processes matter data. Microsoft Azure is the one named infrastructure provider.
Ask: Provide the subprocessor register applicable to claiR, naming each entity, its country and its function, including any model-hosting provider, and our notice and objection rights.
Training on customer content
Not confirmed
Nothing read states whether customer matter data, claiR prompts, answers or saved skills are used to train or improve any model. The vendor's product and security pages are silent on it; the privacy policy lists 'improving our software, websites and related services' among the purposes for the personal data it does cover, but expressly excludes matter data: 'Data uploaded by our customers into the software is not covered by this policy.' The AI Principles page, unread, may address it. The absence of a published statement on a pre-release generative product is the finding.
Ask: Will Relativity warrant that no matter data, prompt, generated answer, custom data column or saved skill from our environment is used to train, fine-tune, evaluate or improve any model, including by any model provider?
Feedback and quality monitoring
Not confirmed
Nothing read describes a feedback or rating control in claiR or what happens to what a user types into one. The one relevant fact about the programme is that Advanced Access is described by the vendor as a way to work with customers as the product develops, and the firms quoted describe it as co-development, which implies a feedback loop whose contents and destination are not published. Saved and refined skills are described as reusable 'for future matters' without saying whose future matters.
Ask: When we refine a skill or correct a claiR answer, where does that content go, is it confined to our environment, and can a refined skill ever be reused outside it?
Retention of prompts, answers and generated work product
Not confirmed
No retention period was found for claiR prompts, answers, citations, custom data columns, saved skills or generated memos. The only published retention statement is in the privacy policy, last updated 22 June 2022 — 'We only keep your Personal Data for as long as it is necessary for the legitimate business purpose for which it was collected, unless otherwise required or permitted by law' — and that policy states in terms that 'Data uploaded by our customers into the software is not covered by this policy and you should contact your software administrator if you have questions about how Relativity processes such data.' So the one published document on retention expressly does not reach the data a firm cares about.
Ask: State the retention period for claiR prompts, answers, citations, custom data columns, saved skills and generated memos, whether they sit inside the matter workspace, and whether we can set a shorter period.
Deletion and certified erasure
Not confirmed
Nothing read establishes what is deleted when a matter is closed or a subscription ends, in what period, or whether deletion is certified. The privacy policy offers individuals a right to request deletion of their personal data and says that when the grounds for processing end 'we take appropriate steps to delete, anonymize, or restrict your Personal Data', but that policy excludes customer matter data. If claiR artefacts live inside the matter workspace they may follow the workspace, and if they live elsewhere they may not; neither is stated.
Ask: On matter closure and on exit, what is deleted, over what period, does it include claiR prompts, answers and generated memos wherever they are stored, and will you certify the deletion in writing?
Vendor human access to content
Public claim only
The product-security page publishes a control aimed squarely at this: 'Customer Lockbox — Prevent administrators – including those from Relativity – from seeing your data unless you say so', and the Security Center feature list includes the ability to 'Perform real-time audits of Lockbox to enable and revoke access to individuals as needed'. That is a security page rather than a contractual document, no standing access-approval process or access log format is described, and nothing states whether Lockbox covers claiR prompts, generated answers and memos as well as the underlying documents.
Ask: Is Customer Lockbox available on our plan, does it cover claiR prompts, answers and generated work product as well as matter documents, and what audit record do we get of any Relativity access?
Access control, single sign-on and audit
Public claim only
The product-security page states that 'Our products support OpenID Connect and SAML2 protocols, two-factor authentication, and single sign-on', and that 'Relativity aiR includes discrete permissions to give you total control' through custom security settings per user. Security Center is described as included with Relativity aiR at no charge and as providing a dashboard covering two-factor-authentication enablement, a login map showing when and where users access data, inactive-user status and disablement, real-time Lockbox audits, and alerts for unusual events such as a change in login method. These are platform controls; nothing read states whether claiR use is itself a permissionable object or whether claiR activity appears in the audit trail.
Ask: Is access to claiR a discrete permission we can grant to named users only, and does the audit trail record each claiR question, the documents it cited and who asked it?
Encryption and customer-managed keys
Public claim only
The product-security page states 'By default, Relativity encrypts data at rest and in transit' and offers 'Customer-managed keys' which 'add an extra layer of protection, giving you total control over your environment's encryption key'. No algorithm, protocol version or key-management detail is published, the statement sits on a security page rather than in a contract, and nothing states whether customer-managed keys extend to claiR prompts, embeddings, generated answers and memos or only to stored documents.
Ask: Name the encryption algorithms and key management, confirm that customer-managed keys cover any index, embedding or prompt store used by claiR, and confirm encryption in transit to the model endpoint.
Independent security assurance
Public claim only
The compliance page publishes a list of certifications, read 2026-09-27: 'ISO/IEC 27001:2022 certification, ISO/IEC 27018:2019 certification, FedRAMP Class C Certified, HIPAA Compliance, IRAP Assessed at Protected, SOC 2 Type II Report, SOC 3 Report, Cloud Security Alliance's (CSA) CAIQ', with certificates available on request to securityquestions@relativity.com. The IRAP entry is the Australian-relevant one. Three limits matter: no certificate or report was seen, so none is verified here; the page states no scope, date, assessor or exceptions for any of them; and the FedRAMP authorisation is elsewhere on the same site attributed to Relativity aiR Government specifically, not to the commercial platform. Nothing states that claiR, a pre-release feature, is within the assessed scope of any of them. The page also claims 'multiple penetration tests a year from external organizations', SAST, DAST and SCA scanning, and a bug bounty. GDPR: the vendor's own page states "ear (ISV - independent software vendor) ## Learn more about compliance & privacy at Relativity [![GDPR & Other Privacy Laws ](https://relativity.com/sites/relativity/cache/file/2E31" (https://www.relativity.com/calder7-security/compliance-privacy/, checked 2026-10-10). HIPAA: the vendor's own page states "- ISO/IEC 27001:2022 certification - ISO/IEC 27018:2019 certification - FedRAMP Class C Certified - HIPAA Compliance - IRAP Assessed at Protected - SOC 2 Type II Report - SOC 3 Report -" (https://www.relativity.com/calder7-security/compliance-privacy/, checked 2026-10-10). IRAP: the vendor's own page states "2 certification - ISO/IEC 27018:2019 certification - FedRAMP Class C Certified - HIPAA Compliance - IRAP Assessed at Protected - SOC 2 Type II Report - SOC 3 Report - Cloud Security Al" (https://www.relativity.com/calder7-security/compliance-privacy/, checked 2026-10-10). SOC 2: the vendor's own page states "18:2019 certification - FedRAMP Class C Certified - HIPAA Compliance - IRAP Assessed at Protected - SOC 2 Type II Report - SOC 3 Report - Cloud Security Alliance’s (CSA) CAIQ [Request" (https://www.relativity.com/calder7-security/compliance-privacy/, checked 2026-10-10). Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.relativity.com/calder7-security/compliance-privacy/). the quote does not state this certification.
Ask: Provide the current SOC 2 Type II report, the ISO/IEC 27001:2022 and 27018:2019 certificates and the IRAP assessment letter, each with its scope statement, and state in writing whether claiR is inside those scopes today or only at general availability.
Contract, DPA, liability and forum
Not confirmed
No contractual document was read. The subscription agreement, any data processing addendum and any AI-specific schedule are not published on the pages read, and the site's Terms of Use link was not read because it governs use of the website rather than the platform. The only entity name published is the site copyright line, '© 2026 Relativity ODA LLC', which is not a statement about who contracts with an Australian customer, and no governing law, forum or liability position was found. The privacy policy is not a contract and expressly excludes matter data.
Ask: Provide the subscription agreement and data processing addendum that would cover claiR, name the entity that will contract with us in Australia with its ACN or ABN, and state the governing law, forum and liability cap.
Hosting region and cross-border processing
Not confirmed
No hosting region is published for matter data or for claiR processing. The compliance page states only that 'Relativity aiR is built in the safety and security of the Azure cloud', naming the platform and not a region. The privacy policy states that 'Your Personal Data may be processed by us in the United States, by our affiliates elsewhere in the world, and by third parties with whom we may share your Personal Data', with Standard Contractual Clauses where needed for transfers — but that document covers only the personal data Relativity collects about website visitors, event attendees, support contacts and job applicants, and expressly excludes data customers upload into the software. So the one published transfer statement does not reach matter data. The 'IRAP Assessed at Protected' entry indicates an Australian assessment but states no Australian region or residency commitment.
Ask: In which region is our matter data stored, in which region does claiR inference run, is an Australia-only option available for both, and does the IRAP assessment cover an Australian region of the platform including claiR?
Incident notification and history
Not confirmed
No incident-notification obligation, period or history was found on any page read on 2026-09-27. The security pages describe detection and prevention — around-the-clock scanning, simulated attacks, external penetration tests, a bug bounty, 'AI-driven threat detection and response' and Security Center alerts to the customer for unusual events — but say nothing about notifying a customer of a breach, the period from discovery, subprocessor incidents, or the Notifiable Data Breaches scheme. The privacy policy contains no breach-notification clause.
Ask: State the contractual notification period from discovery for our environment, whether it covers incidents at a subprocessor or model provider, and how you will support our assessment under the Notifiable Data Breaches scheme.
Change during and after a pre-release programme
Not confirmed
The product is explicitly in flux. It is offered through Advanced Access, described by the vendor as a programme in which features are refined with customers; the page carries 'More Coming Soon' and an opt-in to keep up to date 'as it develops'; pricing at general availability is stated only as an expectation; and the platform around it has been renamed from RelativityOne to Relativity aiR, with the vendor's navigation now reading 'RelativityOne is now Relativity aiR'. No notice period for a functional change, a model change or a default change was found on any page read, and a firm joining Advanced Access is accepting change on the vendor's timetable.
Ask: What notice will we get before a claiR feature, prompt behaviour or underlying model changes during Advanced Access, and will earlier answers and saved skills remain reproducible after such a change?
Export and exit
Not confirmed
Nothing read describes export of claiR output. Within the product, work can be kept and circulated internally — 'Save and share work with your case team' — and generated memos and summaries are described as work product, but no export format, no bulk export of question-and-answer history, no export of custom data columns or saved skills, and no exit window is published. Because generated memos may become part of a firm's own file, the absence matters more here than for a read-only tool.
Ask: On exit, in what format can we export claiR question-and-answer history with citations, generated memos, custom data columns and saved skills, and over what window?
Connectors and data leaving the platform
Public claim only
At platform level the vendor publishes three connector routes in its own navigation: Model Context Protocol integrations, described as a way to 'Seamlessly integrate external AI applications with Relativity aiR'; Gavel, to draft work product in Microsoft Word; and the Relativity App Hub for third-party applications. The vendor also publishes a separate integration that collects Claude Enterprise data into Relativity as an eDiscovery data source, which is data coming in rather than going out. Nothing read states whether any of these can read claiR output or the matter data claiR reasons over, or who in a firm can enable them.
Ask: Which connectors and App Hub applications can reach a matter that claiR is enabled on, who can enable them, and does the Model Context Protocol integration allow an external AI application to read matter content?
Open-web retrieval
Not confirmed
Nothing read states whether claiR makes any request outside the customer's matter. Every published description points inward — answers 'grounded in your matter documents', reasoning 'across everything in your legal data project', and a statement attributed to Relativity in trade press that 'Nothing is exported or sampled, the answer comes from the record itself, right where the data lives' — but none of those is a statement that no outbound retrieval occurs, and the vendor page does not address it. Absence of a statement is not a statement.
Ask: Does claiR make any outbound request to a search engine, a web index or any source outside our matter when answering a question or drafting a memo, and can that be disabled?
Actions the product takes on the matter
Public claim only
Two described functions write into the matter rather than only reading from it: creating 'custom data columns with AI to build insights, extract content, or classify documents', which adds AI-derived values against documents in the workspace, and saving and sharing work with the case team. Classification of documents by AI into a column is a durable artefact that other members of the team will see and may rely on. Nothing read says whether creating or populating such a column requires a confirmation step, who may do it, whether the values are marked as AI-generated, or whether the action is recorded in the audit trail.
Ask: When claiR creates or populates a custom data column that classifies documents, is a confirmation required, are the values labelled as AI-generated, and is the action audited?
Human review before reliance
Public claim only
The published control is citation rather than an enforced review step: answers 'come cited', are 'supported by citations', and generated memos are 'grounded in the facts and evidence in your data'. One law firm statement on the page describes the analysis as auditable. No setting is described that requires a lawyer to open a cited document before accepting an answer, records that they did, marks a generated memo as AI-generated, or restricts who may circulate one to the case team. Because the product is aimed at the lawyer directly rather than at a litigation-support intermediary, the review step is a matter of firm practice on the evidence read.
Ask: Can we require and evidence that a cited document was opened before a claiR answer is relied on or a generated memo is shared, and is every claiR memo marked as AI-generated in the workspace?
