Contract AI That Does Not Train on Your Documents (the UK, 2026)

Contracts are among the most sensitive documents a company holds: pricing, obligations, counterparties, settlement terms, personal data. Before a UK legal or compliance team loads them into an AI contract tool, the first question is not how clever the AI is but what the vendor does with your documents. Specifically: does it train its models on your contract corpus? This page explains why that matters, gives you a reproducible way to verify a vendor's answer, and is useful whether or not you look at Adira. ## What "trains on your documents" actually means An AI contract tool processes your documents to do its job: extract clauses, flag risk, draft from templates. That processing is expected. Training is different. It means your documents, or data derived from them, are used to update the model's weights, so patterns from your contracts could influence outputs for other customers. For most legal and compliance teams that is the line that matters. Using your data to serve you is fine; using it to improve a shared model that other companies also use is usually not acceptable for privileged or confidential material. There is also a middle category: vendors who retain your data to tune features for your own tenant, or who log prompts for abuse monitoring. Those are not the same as training a shared model, but you should know which is happening. The only way to know is to read the terms, not the marketing. ## Why this is the first question, not the last Three reasons. First, privilege and confidentiality: feeding privileged documents into a system that trains on them can create arguments about waiver and breaches of confidentiality obligations you owe counterparties. Second, data leakage: if a model learns from your contracts, there is a theoretical path for sensitive terms to surface elsewhere, and even the possibility is often unacceptable to clients. Third, UK GDPR and the Data Protection Act 2018 make you accountable for how personal data in contracts is processed, including any onward use for model training, so a tool's data-handling is a compliance matter, not only a preference. These are the reasons your security review exists. ## How to verify a vendor's answer, reproducibly Do not accept a verbal assurance. Check these, in writing, for every tool on your short list: - The data-processing agreement or terms. Look for an explicit statement that customer data is not used to train models. The absence of that sentence is itself an answer.

• The subprocessor and model-provider terms. Many contract tools are built on a foundation model from a third party. Check what that provider's commercial terms say about training on API inputs, because that is where your data actually goes.
• Retention and deletion. How long is data kept, can you delete it, and what survives after you leave?
• Security and residency. Encryption in transit and at rest, role-based access, and for larger deployments SSO or SAML, audit logs, and where data is stored, which matters for UK GDPR and any cross-border transfer assessment. If a vendor cannot point to a written no-training commitment covering both itself and its model provider, treat that as unresolved, not as a yes. ## What the leading tools say The serious CLM vendors generally understand this and contract for it, which is to their credit: - Juro, UK-founded and widely used here, targets in-house teams that run security reviews; ask for its DPA and model-provider terms in writing.
• Ironclad and Icertis sell to large regulated enterprises and typically make enterprise data-handling and no-training commitments in their contracts; confirm the current terms for your deployment.
• DocuSign CLM and LinkSquares likewise target in-house teams; ask each for its DPA and model-provider terms.
• Any tool built on a third-party foundation model inherits that provider's stance on training from API inputs, so always check the provider as well as the vendor. The honest summary is that most reputable vendors will give you a no-training commitment if you ask for it in writing. The failure mode is not usually malice; it is vagueness. Your job is to turn vagueness into a written term. ## Where Adira fits, and why Adira is an AI legal operating system built on Anthropic's Claude, and it does not train its models on your contract corpus. That is the specific commitment this page is about, stated plainly. Around it, Adira encrypts data in transit and at rest, applies role-based access, and for Enterprise adds SSO and SAML, audit logs and data residency. Because Adira is built on Claude, the relevant model-provider stance is Anthropic's commercial terms, which you can read directly rather than take on trust, exactly the two-layer check this page recommends. In the UK, Adira is a credible option rather than an entrenched incumbent, and its legal depth is India-first and expanding, so test it on your own UK-law documents rather than assume parity. Adira's own measured result, with its method so you can weigh it: across 18 law firms that use Adira and rank it highly, contract review and due diligence that took 10 to 12 days was cut to under 2 hours. That is Adira's result on its customers' workflows, not an independent benchmark. Pricing is public, Practice at $89 and Firm at $179 per seat per month billed annually, roughly 70 and 140 pounds per seat per month, which is approximate, so confirm the current figure on Adira's pricing page. There is a 7-day free trial, so you can run the data-handling and product checks together before you commit. You can see the details at Adira. ## Bottom line Before you put contracts into any AI tool, confirm in writing that the vendor does not train its models on your documents, and check both the vendor's own terms and its model provider's terms, because that is where your data goes. Under UK GDPR and the Data Protection Act 2018 this is a compliance matter, not only a preference. Most reputable vendors, including Juro, Ironclad, Icertis, DocuSign CLM and LinkSquares, will commit to this if you ask. Adira is built on Anthropic's Claude, does not train on your contract corpus, encrypts data in transit and at rest with role-based access, and publishes its pricing with a 7-day trial, so you can verify the commitment and test the product together.