clmSpace
Documentation
Software procurement

clmAI Procurement legal review

clmAI Procurement reviews the supplier against your due-diligence policy with the skills expected of a SaaS-specialist legal counsel, and grounds every finding in evidence.

What the agent reads

The review uses everything on the request: the requestor’s form answers, every uploaded supplier document (PDF, DOCX, XLSX, CSV and text, with OCR for scanned PDFs) and the captured online terms. Content is provided in full, and even large document sets are read in their entirety so every finding rests on the complete record. The evidence manifest records exactly what was reviewed, so coverage is transparent.

The structured review

The output is a structured table of diligence items, each with:

  • an Issue: the point being assessed (for example liability cap, data location, sub-processors, termination, security accreditations);
  • a Status: the agent’s assessment against your policy, or Unverified where the documents do not settle it;
  • Notes grounded in a quote: the Source passage the finding rests on.
Unverified means unverified
When the supplied material does not support a conclusion, the agent marks the row Unverified instead of inferring one. A human resolves these rows before the request can be approved. See Verifier sign-off.

The recommendation

The review emits one advisory recommendation:

  • Approve: no material blockers found.
  • Approve (with conditions): acceptable once specific protections are added, which become the mitigation rider.
  • Reject: material issues that the agent judges should stop the purchase.

The recommendation is paired with a short rationale. It is advice to the Verifier, not a decision: the Verifier may confirm or override it.

Gap analysis

Alongside the review, the agent produces a gap analysis: where the supplier’s terms fall short of your policy and what would close each gap. This feeds the mitigation rider.

Supplier profile research

The agent also compiles a short dossier of the supplier’s publicly-stated posture (for example claimed certifications such as SOC 2 or ISO 27001). These are recorded as asserted, not independently verified, and stored alongside the other downloadable artifacts.