12 questions to ask before buying legal research software

Short answer: before signing up, get written answers on how the vendor handles your data, what its library covers, how it secures accounts, what the contract commits you to and how you leave. These twelve questions cover the essentials and double as documentation of the "reasonable efforts" your ethics rules expect.

Data handling

1. Is anything I type used to train AI models?

A good answer: "No" - in writing, covering the vendor and any AI provider it uses. If the answer is "yes, unless you opt out," find out how to opt out and confirm it's on.

2. Which third parties receive my data?

A good answer: a named list of subprocessors (hosting, AI model provider, payment processor, email) with what each receives.

3. How long is my data kept, and can I delete it?

A good answer: a stated retention period and a self-service or on-request deletion process, including for backups after a set time.

4. Where is data stored?

A good answer: the country and provider. Some clients and some matters have location requirements.

Security

5. Do you support two-factor authentication?

A good answer: yes, for every user, ideally with the option for the firm to require it.

6. Is data encrypted in transit and at rest?

A good answer: TLS for every connection and encryption on stored data, plus a short description of who at the vendor can access production data.

7. How will you tell me about a breach?

A good answer: a stated notification commitment in the terms or privacy policy.

Coverage and quality

8. Exactly which courts and years are covered, and how often is it updated?

A good answer: a coverage list you can check against your jurisdictions, and an update schedule.

9. Can the tool cite a case that isn't in your library?

A good answer: an explanation of how results are produced and how citations are checked against real decisions.

10. How do you measure accuracy?

A good answer: a described test method - not just "highly accurate." Ask what the tool misses, not only what it finds.

Contract and exit

11. What does the contract commit me to?

A good answer: clear term length, renewal and cancellation rules, and the price after any introductory period.

12. How do I get my work out if I leave?

A good answer: export of saved research, notes and history in a common format, and account deletion on request.

Keep the answers

Save the vendor's written answers - emails, policy links, screenshots of settings - in your firm's technology file. If a client, insurer or bar ever asks how you vetted a tool, that file is your answer.

Frequently asked questions

Do small firms really need vendor due diligence?

Yes. Model Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure of client information, and Rule 5.3 extends supervision duties to non-lawyer assistance, which ethics opinions apply to technology vendors. The effort can be proportionate - an hour of questions is reasonable for a small firm.

What if a vendor won't answer in writing?

Treat it as a warning sign, especially on training use and data deletion. Published terms and privacy policies count as written answers.

Should I ask for a security audit report?

Larger firms often ask for a SOC 2 report or equivalent. Smaller vendors may not have one; ask what controls they do have and decide whether that's reasonable for the data you'll enter.

Is a free trial enough to judge quality?

It's enough to test coverage and usefulness on your own questions. It isn't enough to judge data handling - that needs the written answers above.

Sources

• ABA Model Rules of Professional Conduct 1.6(c) and 5.3
• ABA Formal Opinion 477R, "Securing Communication of Protected Client Information" (2017)
• ABA Formal Opinion 512, "Generative Artificial Intelligence Tools" (2024)