Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement prohibits Harvey and its Subprocessors from training AI models using Customer Content or Customer Data. Subprocessors other than cloud storage providers are also prohibited from retaining or logging Customer Content or Customer Data for human review.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an explicit contractual prohibition on AI model training from customer inputs and outputs, and extends that restriction to Subprocessors. The carve-out for cloud storage providers from the human review and retention prohibition is an operationally relevant limitation that compliance teams should assess against their data handling requirements.
Under this clause, Customer Content and Customer Data submitted to the Service are contractually excluded from AI model training by Harvey and its Subprocessors. Cloud storage providers used by Harvey are not subject to the prohibition on retaining or logging Content for human review.
Cross-platform context
See how other platforms handle No AI Training on Customer Data or Content and similar clauses.
Compare across platforms →Monitoring
Harvey AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Harvey will not train any AI models using Your Content or Customer Data. Subprocessors will not train any AI models using Your Content or Customer Data. Subprocessors, except for cloud storage providers, will not retain or log for human review Your Content or Customer Data.Excerpt from Harvey AI's Terms of Service
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 5 data minimization and purpose limitation principles, as well as CCPA restrictions on use of personal information beyond disclosed purposes. The DPA, which controls on data processing subject matter, may provide additional specificity on processing purposes. The EU AI Act may require evaluation regarding the use of data in training foundation or fine-tuned models deployed in legal contexts. (2) GOVERNANCE EXPOSURE: Medium. The explicit no-training commitment addresses a material concern for legal sector clients subject to professional responsibility rules and attorney-client privilege obligations. The cloud storage provider carve-out from the human review prohibition is a conditional limitation that may require further diligence depending on which Subprocessors are classified as cloud storage providers. (3) JURISDICTION FLAGS: EEA and UK customers are subject to GDPR and UK GDPR purpose limitation requirements, which independently constrain training use of personal data beyond disclosed purposes. California customers may have rights under CCPA regarding use of personal information. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request the current Subprocessor list to identify which providers are classified as cloud storage providers and therefore outside the human review prohibition. The DPA governs Subprocessor management obligations and should be reviewed alongside this provision. (5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should confirm that the Subprocessor list at https://harvey.ai/legal is current and maps to the categories of data submitted. Teams should assess whether the cloud storage carve-out creates any residual exposure under applicable data protection frameworks or professional responsibility rules.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes an explicit contractual prohibition on AI model training from customer inputs and outputs, and extends that restriction to Subprocessors. The carve-out for cloud storage providers from the human review and retention prohibition is an operationally relevant limitation that compliance teams should assess against their data handling requirements.
Under this clause, Customer Content and Customer Data submitted to the Service are contractually excluded from AI model training by Harvey and its Subprocessors. Cloud storage providers used by Harvey are not subject to the prohibition on retaining or logging Content for human review.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.