Harvey
- Rank
- Score
- 18/149
- 51 out of 100
Harvey is a generative AI product for the legal industry, developed by Counsel AI Corporation and headquartered in San Francisco. It was founded in 2022 by Winston Weinberg and Gabriel Pereyra, and it is described as a provider of customised large language models for law firms and in-house legal teams.
Is Harvey safe?
Harvey scores 51 out of 100 and ranks 18 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is Harvey scored?
Harvey is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50No document found - No
Did an outside organisation test the model before release?
Company claim0/50No document found
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
67.8This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. AI Incident Database and AIAAIC Repository, last 24 months.
1 event
AllegationAI Incident Database (opens in a new tab) · 12 Nov 2026These are reports, not proven findings.
Date Event Severity 22 Sep 2026 AIID #1728 · Law Firm Shapiro Arato Bach Reportedly Filed Fictitious Case Citation and Misattributed Quotations Using Harvey's Legal AI Platform in New York Federal Court22 Sep 2026 · Low (reported) Low (reported)
Protecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50No document found - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“Our Websites and Services are not directed to anyone under the age of 18.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026
Model documentation
0Points for each confirmed yes.
- No
Does the model card describe what the model can do?
Company claim0/25No document found - No
Does the model card report test results?
Company claim0/25No document found - No
Does the model card state the model's limitations?
Company claim0/25No document found - No
Does the model card describe safety safeguards?
Company claim0/25No document found
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
Security programme and certifications
100Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Vulnerability Disclosure Program: Contact: mailto:security-reports@harvey.ai”
harvey.ai security contact (opens in a new tab) · 20 Oct 2026 - Yes
Does it state it holds a SOC 2 Type II report?
Company claim33/33“Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls.”
harvey.ai security page (opens in a new tab) · 22 Oct 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls.”
harvey.ai security page (opens in a new tab) · 22 Oct 2026
Software vulnerabilities
Not enough dataData breaches
Not enough dataNo problems found in 2 public records. That is not proof.
Clear privacy policy
80Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“The Personal Data we collect includes: a) Account Information: When you or your employer creates an account with us and throughout the time…” MoreLess
“The Personal Data we collect includes: a) Account Information: When you or your employer creates an account with us and throughout the time you or your employer uses the Services, we collect certain information associated with your account, including your name, email address, and information about your profession and professional experience, language preferences, account credentials, payment information, and your transaction history with us (collectively, “Account Information”).”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - No
Does the privacy policy say whether your data is used to train AI?
Company claim0/20harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“We retain the Personal Data we collect from you for as long as necessary for the purposes described in this Privacy Policy.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We share your personal data with the following categories of recipients: a) Our Affiliates: We will share Personal Data that we collect, suc…” MoreLess
“We share your personal data with the following categories of recipients: a) Our Affiliates: We will share Personal Data that we collect, such as Account Information with any corporate affiliates.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“Subject to certain exceptions and exemptions provided by law and where applicable, you may have the right to: Access, correct, update, or re…” MoreLess
“Subject to certain exceptions and exemptions provided by law and where applicable, you may have the right to: Access, correct, update, or request deletion of your Personal Data.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026
Training-data defaults
100100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Not found
Can you stop your data being used for training?
Company claim0/50harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Request portability of your personal data, (i.e. your data to be transferred in a readable and standardised format).”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“Subject to certain exceptions and exemptions provided by law and where applicable, you may have the right to: Access, correct, update, or re…” MoreLess
“Subject to certain exceptions and exemptions provided by law and where applicable, you may have the right to: Access, correct, update, or request deletion of your Personal Data.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. UK competition regulator cases, US Justice Department settlements, last 5 years, and regulator actions and open investigations into the company's AI products at half severity, last 3 years.
No events
RegulatorUK CMA cases (opens in a new tab) · 12 Nov 2026No events
RegulatorUS Justice Department (opens in a new tab) · 12 Nov 2026
Court judgments
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Court rulings against the company on privacy, consumer or competition claims, upheld on appeal, last 5 years.
No events
Regulatorcourtlistener.com (opens in a new tab) · 10 Nov 2026
Privacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“If you have any questions or concerns about our use of your Personal Data, please contact our Data Protection Officer using the following de…” MoreLess
“If you have any questions or concerns about our use of your Personal Data, please contact our Data Protection Officer using the following details: privacy@harvey.ai.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“Complain to a supervisory authority.”
harvey.ai privacy policy (opens in a new tab) · 22 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
3 Nov 2026
Score 51
Method 3 Nov 2026
-1
2 Nov 2026
Score 52
Method 2 Nov 2026
-1
1 Nov 2026
Score 53
Method 28 Oct 2026, update 2
-1
28 Oct 2026
Score 54
Method 28 Oct 2026, update 2
-9 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 63
Method 21 Oct 2026
+2
21 Oct 2026
Score 61
Method 21 Oct 2026
-2
20 Oct 2026
Score 63
Method Not recorded
+11 · Reason not recorded
15 Oct 2026
Score 52
Method Not recorded
-1
14 Oct 2026
Score 53
Method Not recorded
-