What was checked, and what came out?
An internal market study dated 3 October 2026 collected 120 finding rows on AI tools available to Israeli law firms — vendor claims, capabilities, terms and prices — and classified each row by what was found online:
| Status | Rows of 120 |
|---|---|
| Documented | 51 |
| Configuration-dependent | 39 |
| Not shown | 30 |
"Independent check" is the evidence type in 32 rows: in most of them, the record is that no public document was found, not that a contradicting document was found.
What exactly is missing?
| What is missing from public documents | Rows (of 30) |
|---|---|
| Log export / SIEM | 7 |
| Price / quote | 7 |
| Hebrew / Israeli law | 6 |
| DPA / processing agreement | 5 |
| Matter / client separation | 2 |
| Human approval step | 1 |
| Other | 2 |
The grouping into categories is a reading of the row contents, not a field in the source file. The two largest categories — logs and price — are unsurprising: global vendors publish log export only at the top enterprise plan, and prices in dollars without a local quote. The next three — Hebrew, a plan-level DPA, matter separation — are precisely what the Bar opinion asks about.
Why is "not shown" not "does not exist"?
Because the missing documents are usually the kind vendors provide in negotiation rather than on the website: a signed DPA, a current subprocessor list, log API documentation, a permissions demonstration in a trial account. All of these may exist. What the count says is that a firm cannot complete the check on its own — and that any classification of a system as "closed" under sections 10–11 and 40 must rest on a document received, not on a product page.
What do section 47 and Regulation 15 require?
Section 47 of the opinion (version of 18 September 2026) requires examining the vendor, its contractual commitments, information security, access, deletion and subprocessors — and monitoring changes (section 48). Regulation 15 of the Protection of Privacy Regulations (Data Security), as amended by Amendment 13, requires a risk assessment before engaging an external party and a written agreement defining the data, systems, processing type, term and return or destruction at the end; the Privacy Protection Authority's guide attaches a preliminary questionnaire (Annex A) and periodic oversight (Annex B). Both frameworks assume the documents will be obtained from the vendor — not found by search.
Checklist: what to ask, why, and what counts as an answer
| What to ask the vendor | Why (section) | What counts as an answer |
|---|---|---|
| Processing agreement (DPA) for the plan purchased, not a marketing page | ss. 41.4, 47 · Reg. 15(a)(2) | Signed copy or final draft; plan name in the agreement body |
| Subprocessor list and processing regions | s. 47 · Reg. 15 | Dated list; change-notification mechanism |
| No-training and no-transfer commitment — at the actual account level | ss. 40.1–40.2 | A contract clause, not a general policy statement |
| Retention and deletion: periods, deletion at termination, written confirmation | s. 41.4 · Reg. 15(a)(2) | Retention schedule; deletion procedure; deletion confirmation |
| Log export / SIEM connection at the plan purchased | ss. 46.1, 53 | API or screen documentation; what is logged and for how long |
| Permission separation at matter level (not only user/organisation) | s. 41 | Demonstration in a trial account; permission-model documentation |
| Human-approval step before an externally consequential action | ss. 52–54 | Configuration setting; what counts as an 'external action' |
| Documented support for Hebrew and Israeli law | ss. 19–24 (competence) | Output samples; legal sources the system accesses |
| Price at the plan purchased, in NIS, including VAT and support | s. 42.2 (fee transparency) | Written quote; not a general dollar price list |
The practical rule: any row answered with "yes, we have that" without a document stays "not shown". Any row answered with a document that refers to a plan other than the one purchased stays "configuration-dependent".
What to do with this in practice?
- Start from the plan, not the product. The same product name appears in the file under different statuses by plan and region.
- Ask for the nine documents before a demo. A vendor that cannot provide a plan-level DPA and a subprocessor list — a demo will not change the classification.
- Document the check. Section 46.1 expects documentation; Regulation 15 expects periodic oversight. A vendor that changes terms returns the row to "configuration-dependent".
Frequently asked questions
Is a vendor that does not publish a DPA on its website a problematic vendor?
Not necessarily. Many vendors provide a DPA only in negotiation. The question is not whether the document is on the website, but whether it is received, signed, and refers to the plan purchased. A vendor that does not provide it even on request — that is an answer.
Who in the firm should perform the check?
The opinion (sections 45–47) places responsibility on the firm and the lawyer responsible for the policy; Regulation 15 — on the database controller. In practice it requires a lawyer, an information-security function and whoever manages the engagement. The check can be assisted by an external adviser; the responsibility cannot.
How often is the check repeated?
Section 48 of the opinion requires monitoring of changes in terms, versions and connections; the Regulation 15 guide expects periodic oversight (Annex B). No fixed frequency is set by law; a change of plan, subprocessor or terms of use is a trigger for a repeat check.
Does the checklist replace legal advice?
No. It is a list of documents to request, not an opinion on vendor suitability. Whether the configuration passes the tests of the Bar opinion and Regulation 15 is assessed by matter, contract and specific configuration, and remains with the lawyer.