Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
This profile covers the product Workday publishes on its Australia/New Zealand site as 'Workday Contract Intelligence, powered by Evisort AI' (page read 2026-09-27). The page sits under Workday Procurement, and the Procurement menu lists Contract Intelligence and Contract Lifecycle Management as two separate products. Workday's product login menu lists 'Evisort' at clients.evisort.com as a product login of its own alongside Workday Adaptive Planning, Workday Peakon and Workday Extend. No plan, edition or module list, and no statement of what the subscription includes, was published on the page.
Ask: Is Contract Intelligence licensed separately from Workday Contract Lifecycle Management and from the wider Workday subscription, and is it delivered in the Workday tenant or in the Evisort application at clients.evisort.com?
Deployment model and hosting location
Not confirmed
The product is delivered as a hosted service - the page describes syncing contracts 'across all your repositories such as Box, SharePoint, and Salesforce' and delivering data 'via API and productised integrations' - but no page read states where it is hosted. The Trust at Workday page is a hub of links (security, privacy, compliance, ESG, responsible AI, corporate integrity) and names no data centre, region or residency option. Workday's security page, privacy statement and customer terms are named on the legal index and were not opened within this product's evidence budget. Unverified, not applied (2026-10-10): hosting claim australianRegion (https://slashdot.org/software/comparison/Workday-CLM-vs-elsai-Contract-Intelligence/). not the vendor's domain.
Ask: In which data centre region is Contract Intelligence hosted for an Australian customer, is an Australian or at least an APAC region available, and where does the AI inference run?
AI features in scope
Public claim only
The Australia/New Zealand page (read 2026-09-27) states the product 'gives you total visibility into the agreements that fuel your organisation' and lists key capabilities including AI and OCR, '“Ask AI” across all contracts', 'Custom AI models', 'Advanced search and customisable dashboards', 'Seamless integrations', 'ISO-certified responsible AI' and 'Advanced administration'. In its own words on function: 'Ask questions about your contracts in natural language and get clear, reasoned answers with links to sources'; 'Quickly extract common contract terms and easily create custom AI models to track any term of interest'; 'Interactive, always-current dashboards and reports are easily configurable'; and 'Deliver structured contract data to other enterprise systems as desired via API and productised integrations'. Two bullets - the AI and OCR bullet and 'Seamless integrations' - carry promotional wording with nothing measurable behind them.
Ask: What does 'create custom AI models' involve for a customer - labelled examples, a training run, a review step - and who sees the training data?
Jurisdiction and legal content
Not confirmed
The product carries no legal content library and the page claims no jurisdictional coverage. It is addressed to 'ANZ procurement teams' and refers to surfacing 'opportunities and risks across your organisations in Australia & New Zealand', without naming any Australian or New Zealand statute, standard form or regulator. No statement was found about whether extraction models or risk definitions are tuned for Australian contracts or contract law.
Ask: Are the out-of-the-box extraction fields and risk definitions built for Australian contracts, or are they a global set we would have to retrain?
Who the vendor addresses
Public claim only
On the Australia/New Zealand site the product is placed under Procurement and addressed to 'ANZ procurement teams', with legal named as a team to collaborate with. The same site's Procurement menu describes the category as 'Power your procurement with Workday AI contract intelligence'. On Workday's United States pages the footer product menu instead lists 'For Legal' pointing to workday.com/en-us/products/contract-management/overview.html, so the vendor markets contract management to legal as well; that page was not opened. This profile is classified as general-purpose on the basis of the Australian page's own framing.
Ask: Which buyer does Workday sell Contract Intelligence to in Australia - procurement, legal, or both - and does the Australian go-to-market differ from the 'For Legal' positioning on your United States site?
Vendor content addressed to AI tools
Not confirmed
Checked deliberately on 2026-09-27. None of the five Workday pages read - the Australia/New Zealand product page, Trust at Workday, the legal index, the contracting entities page and the subprocessors page - contains a block or heading addressed to AI models, assistants, language models or crawlers setting out how the product should be described, and a search of those pages for 'llms.txt', 'instructions for AI', 'AI assistants' and 'language model' returned nothing. No site-wide check for an llms.txt or similar path was made, because no firecrawl map of workday.com was run within this product's evidence budget, so such a path elsewhere on the site has not been ruled out.
Ask: Do you publish any file or page addressed to AI models or crawlers - an llms.txt or similar - that describes Workday products or sets out how they should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the tool
Not confirmed
Nothing on the pages read addresses confidentiality obligations, privilege, or a customer's authority to load third-party contracts into the product. The product is described as reading an organisation's own agreements and syncing from its own repositories, but no statement was found about counterparty confidentiality obligations or about contracts that carry a restriction on processing by a third party. Workday's customer terms and Universal Data Protection Exhibit, named on the legal index, were not opened.
Ask: Where in your terms is the customer's warranty about the material it loads, and do you make any representation about confidentiality or privilege for contract text processed by the AI?
Model provider and model
Not confirmed
The vendor names its own AI and no third-party model provider. The page reads 'powered by Evisort AI' throughout, names 'Custom AI models' as a capability, and states the product can 'create custom AI models to track any term of interest'. No foundation model, no model vendor and no hosting arrangement for inference is named anywhere on the pages read. Workday's Responsible AI page, named on both the Trust hub and the legal index, was not opened within this product's evidence budget.
Ask: Which models perform extraction and the 'Ask AI' answers - your own, or a third party's - who hosts them, and will you name every model provider in the contract?
Subprocessors and where they sit
Public claim only
Workday publishes a subprocessors page (read 2026-09-27) with two lists as PDF downloads: 'Workday subprocessors for enterprise cloud applications', described as identifying 'the subprocessors that are authorized to process personal data for Workday enterprise cloud applications', and 'Workday subprocessors for professional services'. The page states 'Any subprocessor that processes our customers' personal data undergoes a thorough information security and data protection review' and offers a sign-up to 'receive notifications on the latest Workday subprocessors'. Neither PDF was opened within this product's evidence budget, so the named subprocessors, their countries and whether any is specific to Contract Intelligence are not established.
Ask: Does the enterprise cloud applications subprocessor list cover Contract Intelligence and the Evisort application, which subprocessors process contract content, and in which countries?
Use of our content to train models
Not confirmed
No statement was found on the pages read about whether customer contract content is used to train or improve Workday or Evisort models. The product page's only adjacent statements are that a customer can 'create custom AI models to track any term of interest' - which is customer-specific training rather than vendor training - and a key-capability bullet reading 'ISO-certified responsible AI'. Workday's Responsible AI page and its Universal Data Protection Exhibit, both named on the legal index, were not opened.
Ask: Is our contract content used to train or improve any Workday or Evisort model that serves other customers, is that position warranted in the contract, and does a customer-trained custom model stay confined to our tenant?
Use of corrections, ratings and edits
Not confirmed
Nothing read states what happens to a user's corrections to an extracted term or an 'Ask AI' answer. The page describes review and configuration functions - 'Interactive, always-current dashboards and reports are easily configurable' and creating custom AI models to track a term - without saying whether corrections are retained, read by Workday staff or used to change the shared models.
Ask: When a user corrects an extracted clause or date, or rates an 'Ask AI' answer, is that correction retained outside our tenant or used to change models that serve other customers?
Retention periods
Not confirmed
No retention period for contract documents, extracted data, prompts or model outputs was found on any page read. The product is described as a repository of the organisation's agreements, which implies retention for the term, but no period, no post-termination position and no separate treatment of prompts or AI outputs is published. Workday's customer terms and Universal Data Protection Exhibit were not opened within this product's evidence budget.
Ask: How long are contract documents, prompts and AI outputs retained during the term and after termination, and is any of it retained outside our tenant?
Deletion on request and on exit
Not confirmed
Nothing read addresses deletion of contract content, prompts or AI outputs, on request or on exit, and no period for deletion after termination was found. Workday's Universal Data Protection Exhibit and customer terms, which would carry a deletion obligation, are named on the legal index and were not opened.
Ask: On termination, within what period is our contract repository and all derived data deleted, including from backups and from any subprocessor, and will you certify deletion?
Who at the vendor can see our documents
Not confirmed
Nothing on the pages read states whether Workday or Evisort personnel can access a customer's contract documents, prompts or AI outputs, or under what controls. The Trust at Workday page states in general terms that Workday deploys safeguards and monitors its systems, and links a security page that was not opened. The subprocessors page states subprocessors undergo 'a thorough information security and data protection review' without describing access controls over their personnel.
Ask: Can Workday, Evisort or subprocessor personnel open our contract documents, on what authorisation, is that access logged, and can we see the log?
Access control available to us
Not confirmed
The product page names 'Advanced administration' as a key capability and states the product can 'Provide self-serve access to actionable insights about contract data to all your teams that need it', but no page read describes roles, permissions, single sign-on, multi-factor authentication or record-level restrictions. Whether the 'Ask AI' function honours a user's permissions over individual contracts is not addressed.
Ask: Does 'Ask AI' and advanced search honour per-contract permissions so a user cannot retrieve text from a contract they are not entitled to open, and what does 'Advanced administration' include?
Encryption
Not confirmed
No statement about encryption in transit or at rest, key management or customer-managed keys was found on any page read. Workday's security page, named on the Trust at Workday hub, and its 'Trusting Workday with Your Data Security Needs' datasheet, also linked from that hub, were not opened within this product's evidence budget.
Ask: How is contract content encrypted in transit and at rest in Contract Intelligence, who holds the keys, and is a customer-managed key option available?
Independent assurance
Public claim only
No certification, audit report or assessment was established for this product. The product page's key-capabilities list includes the bullet 'ISO-certified responsible AI', which names no standard, no certificate number, no scope and no certification body; on its own it does not establish a certification. The Trust at Workday page links a compliance page that was not opened. No SOC 2, ISO/IEC 27001, ISO/IEC 42001 or IRAP statement was found on any page read. GDPR: the vendor's own page states "latory standards, including the OECD Privacy Guidelines, the EU General Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act (HIPAA), APEC Pr" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10). HIPAA: the vendor's own page states "al Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act (HIPAA), APEC Privacy Framework, ISO 27001 International Standard for Information Secu" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10). IRAP: the vendor's own page states "earch/).  Australian IRAP Applies to: Workday Enterprise Products, Workday Adaptive Planning The Austra" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10). ISO 27001: the vendor's own page states "[Globe with lock icon](https://workday.scene7.com/is/image/workday/icon-globe-lock?fmt=webp-alpha) ISO 27001, 27017, 27018, 27701 Workday maintains a comprehensive, integrated Information" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10). ISO 42001: the vendor's own page states "[Globe with lock icon](https://workday.scene7.com/is/image/workday/icon-globe-lock?fmt=webp-alpha) ISO 42001 ISO 42001 is an international standard that specifies requirements for establi" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10). SOC 2: the vendor's own page states "ications.  SOC 2 Applies to: Workday Enterprise Products, Workday Adaptive Planning, Workday St" (https://www.workday.com/en-ae/why-workday/trust/compliance.html, checked 2026-10-10).
Ask: Which standard does 'ISO-certified responsible AI' refer to, what is the certified scope and who issued it, and which certifications cover Contract Intelligence itself - SOC 2, ISO/IEC 27001, ISO/IEC 42001, IRAP?
Contract terms
Not confirmed
No contractual document was opened. Workday's legal index (read 2026-09-27) names and links the documents that would apply: 'Customer Terms' and a 'Universal Data Protection Exhibit and FAQ' at workday.com/en-au/legal/universal-contract-terms-and-conditions/index.html, a mutual non-disclosure agreement, 'Binding Corporate Rules', a 'Data Privacy Framework Notice', a 'Transparency Report' and the 'Workday Privacy Statement'. So a standard published contract set exists; none of it was read within this product's evidence budget, and whether Contract Intelligence carries product-specific terms is not established.
Ask: Do the Universal Customer Terms and the Universal Data Protection Exhibit apply to Contract Intelligence unchanged, or are there product-specific or AI-specific terms we should be reading instead?
Cross-border transfer
Not confirmed
No statement about cross-border transfer of contract content was found. The contracting entities page shows Workday contracts through entities in nine jurisdictions including Australia, Ireland, Singapore, India, Canada and the United States, and the legal index names 'Binding Corporate Rules' and a 'Data Privacy Framework Notice' as Workday's published transfer instruments, neither of which was opened. Nothing read states where an Australian customer's contract content is stored or processed, or what safeguard applies to a transfer out of Australia.
Ask: For an Australian customer, which countries will our contract content be stored and processed in, and what safeguard applies to each transfer for Australian Privacy Principle 8 purposes?
Breach and incident notification
Not confirmed
No incident or breach notification commitment, and no notification period, was found on any page read. The Trust at Workday page states that Workday continuously monitors its systems, without any notification obligation. The Universal Data Protection Exhibit, which would carry a notification clause, was not opened.
Ask: Within what period will you notify us of a security incident affecting our contract repository, including an incident at a subprocessor, and to whom is that notice given?
Notice of change
Not confirmed
No notice commitment for changes to the product, its AI behaviour or its terms was found on the pages read. The only change-notification mechanism published anywhere read is on the subprocessors page, which offers a sign-up to 'receive notifications on the latest Workday subprocessors'. Nothing states how customers are told when an AI model, an extraction behaviour or a hosting arrangement changes.
Ask: How and how far in advance are we notified of a change to the AI models, to extraction behaviour, or to the hosting region for Contract Intelligence?
Getting out and taking our data
Not confirmed
Nothing read addresses exit. The product page states the product can 'Deliver structured contract data to other enterprise systems as desired via API and productised integrations', which describes an export path in use rather than an exit right, and no statement of a bulk export on termination, a transition period or a format was found. The customer terms were not opened.
Ask: On exit, can we take out the source documents and all extracted structured data in a documented format, over what period, and at what cost?
Connectors and what they can reach
Public claim only
The page names three repository connectors - 'Box, SharePoint, and Salesforce' - describing the function as 'Seamlessly sync contracts and data points across all your repositories', plus outbound delivery of structured contract data 'via API and productised integrations'. It does not state what permissions a connector requires, whether the sync is scoped to nominated folders or sites, or whether it reads anything beyond contracts. A Salesforce connector for the product is also listed on a third-party marketplace, which is a listing by that marketplace and not a Workday statement.
Ask: What permissions does the SharePoint or Box connector request, can it be scoped to nominated sites or folders, and does it read only the documents we designate as contracts?
Whether the tool reaches the internet
Not confirmed
Nothing on the pages read states whether the product can retrieve anything from the internet. The published description is repository-bound - 'Ask questions about your contracts in natural language and get clear, reasoned answers with links to sources', where the sources are described as the contracts themselves. Whether the underlying model can perform an external retrieval is not addressed.
Ask: Can the 'Ask AI' function or any agent in Contract Intelligence retrieve anything from outside our contract repository, and can that be disabled?
What the tool can do without being asked
Not confirmed
The published functions are read, extract, report and answer, plus outbound delivery of structured data by API. The page states dashboards and reports are 'always-current', which implies automatic re-processing as contracts arrive, and states data is delivered to other systems 'as desired', but nothing read states whether the product writes into any connected system, creates tasks or sends notifications on its own, or whether any such action requires human approval.
Ask: Does Contract Intelligence write anything back into Box, SharePoint, Salesforce or Workday, or send notifications, without a human pressing it, and can each such action be turned off?
Human review of output
Not confirmed
No statement about human review, verification of AI output or limits on reliance was found on the pages read. The page's framing is the opposite direction - 'Stop reading contracts. Start driving outcomes' and 'Transform long contracts into instant, actionable insights' - and the only verification affordance described is that answers come 'with links to sources'. No disclaimer that outputs must be checked, and no record of who checked an extracted term, is published on the page. Workday's Responsible AI page, which may address this, was not opened.
Ask: What in the product records that a person has verified an extracted obligation or date before it is relied on, and do you publish any guidance limiting reliance on AI output?
