Introducing ComplianceOne for Law Firms: matter context, structured regulatory knowledge and lawyer-controlled work.
Everyone wants to know which AI model we use.
It is often the first question I hear when discussing AesirX ComplianceOne, Forseti AI and our new ComplianceOne for Law Firms solution. Do we use Claude? GPT? Something else?
My answer sometimes surprises people: the model is the customer's decision.
We are not building a business around reselling access to a particular model. We are building the infrastructure that makes AI useful in real organizational work - where context, permission, process, verification and accountability matter more than a compelling chat response.
The interesting question is no longer simply which model is smartest? It is which system can deliver a reliable, traceable outcome in the environment where the work actually happens?
Who this article is for: Managing partners, legal innovation leaders and legal operations teams at law firms. The principles also apply to enterprise compliance, privacy and risk teams in regulated organizations.
TL;DR: AesirX ComplianceOne and ComplianceOne for Law Firms use Forseti AI with a bring-your-own-keys (BYOK) approach. Customers can choose supported Anthropic, OpenAI and compatible model endpoints, including appropriate self-hosted or sovereign AI deployments. Our differentiator is the agentic harness: matter and organizational context, decomposed regulatory frameworks, specialized skills and tools, controlled workflows, human approvals and records of sources, revisions, actions and approvals. That design supports data-control decisions, makes model substitution practical and separates platform licensing from AI compute costs. Frontier models still matter, but the lasting operational value increasingly resides in the system around them.
In this article:
- Why the agentic harness matters more than a model subscription.
- What BYOK changes for enterprise control and Vietnam's regulatory environment.
- How the approach works from law-firm client intake to client delivery.
- What an honest comparison with Harvey, Legora and direct API pricing reveals.
- Why model choice could become a procurement decision rather than a strategic dependency.
The model is an engine. The harness is the operating system.
A large language model can summarize documents, reason about a question or draft an answer. Those capabilities are valuable, but they are not a complete compliance program or legal service.
A real workflow needs to know which matter it belongs to, what information the user is authorized to access, which regulation and version applies, what tools are permitted, what evidence must be retained, and who must approve the outcome.
That is what we are engineering at AesirX.
Forseti AI operates inside a broader agentic harness that brings together:
- Controlled context: Matter-specific documents, organizational data, processes and approved knowledge sources, separated by permissions and tenancy.
- Operational regulatory packs: Frameworks decomposed into obligations, references, requirements, decision points and reusable tasks - not simply giant PDFs placed in a vector database.
- Agents, skills and tools: Purpose-built capabilities for research, assessment, drafting, evidence retrieval, form preparation, routing and structured workflows.
- Orchestration and process: Predictable stages, validation gates, escalation paths and appropriate human-in-the-loop decisions.
- AI governance and audit lineage: Records of sources, actions, relevant model and prompt configurations, approvals, changes and the final output.
The model supplies reasoning capability. The harness supplies the operating discipline that turns it into work product.
“A model can generate an answer. An agentic harness must know the matter, apply the right rules, execute the process, preserve the evidence and know when a human must decide.”
Visual caption: One agentic harness, multiple customer-selected models - and one governed process for real work.
This distinction is why we use a bring-your-own-keys model. Firms configure their own supported OpenAI or Anthropic provider accounts and model settings. The customer chooses the economics, provider, deployment and risk posture. We focus on the workflows that make that choice productive.
That does not mean all models perform equally well on every task. They do not. Strong reasoning, document understanding, tool use, context-window handling and Vietnamese legal-language performance still require testing.
The point is to test and select the right model inside a consistent, controlled architecture, not to make a single vendor a permanent dependency.
BYOK is a governance decision, not just a pricing feature
BYOK is sometimes described as a way to avoid AI markups. It can do that, but for enterprise customers the more important outcome is optionality.
With an external API, the organization controls its account, credentials, selected model, contractual relationship and spending policies. With an appropriately deployed first-party or sovereign model, it may also be able to keep inference and sensitive inputs within a chosen infrastructure environment.
In both cases, the agentic harness can retain consistent permissioning, workflow approvals and audit records.
There is an important distinction: supplying your own API key does not by itself keep data inside Vietnam, guarantee that a provider will not retain prompts, or establish compliance.
Those questions depend on the provider, service terms, technical configuration, actual data flows and applicable law. A sovereign label alone is no substitute for due diligence.
Why this matters in Vietnam
Vietnam's Data Law, Law 60/2024/QH15, with implementing Decree 165/2025/NĐ-CP, establishes obligations around data governance and cross-border handling, including particular rules concerning important and core data.
The Personal Data Protection Law, Law 91/2025/QH15, and Decree 356/2025/NĐ-CP establish a separate framework for personal-data processing and cross-border transfers, including assessment requirements and specified exceptions.
These laws do not impose one blanket prohibition on every international transfer. The answer depends on the data, the processing arrangement, the applicable legal provisions and whether a relevant exception applies.
Yet this complexity is precisely why organizations should not design their AI operations around an assumed ability to send every prompt and document to an overseas service.
Consider a bank analyzing internal incidents, a fintech handling sensitive case records, a public body processing controlled information, or a law firm managing confidential client matters. Each may need a different deployment and model policy.
If the model is a replaceable component, the organization has more options to meet its requirements without rebuilding every workflow.
“Data sovereignty is not a checkbox beside an AI model. It is an architectural decision about where data flows, where processing happens, who has access, and what evidence proves the controls.”
That is also a more sustainable procurement approach: decide which data and tasks may use a commercial API, which require stronger contractual protections, and which should stay inside a controlled or sovereign environment.
From client intake to delivery: what this means for law firms
Our new AesirX ComplianceOne for Law Firms, powered by Forseti AI, applies that architecture to the actual lifecycle of a legal matter.
A typical flow starts with client intake. A firm opens a controlled matter workspace, records the request and imports the relevant client documents.
The system then works against matter-specific knowledge, applicable regulatory packs and approved research sources. Agents can assist with initial issue spotting, structured research, analysis, drafting and preparation of client deliverables.
Review and sign-off remain with the responsible legal professionals.
Lawyer review is part of the work product's lifecycle. Approval is tied to the specific revision and evidence reviewed; subsequent changes can require renewed review.
A firm’s experience should become an institutional asset. ComplianceOne for Law Firms lets teams select matter material, manually redact it, obtain independent review and explicitly publish it to an approved audience. Useful knowledge can circulate across the firm while access to the originating private matter remains controlled.
ComplianceOne for Law Firms brings structured Vietnamese regulatory references into the matter workspace, alongside the firm's documents, confirmed facts and reviewed knowledge.
The workspace also connects client engagements, practice teams and individual matters, helping firms coordinate work while keeping private matter access explicit.
The value is not merely accelerating one drafting step. It is connecting the stages:
Intake → Matter context → Regulatory research → Analysis and drafting → Lawyer review → Client delivery, with access controls, source traceability and audit evidence maintained through the process.
Illustrative law-firm workflow
Consider a fictional client asking a law firm to assess a proposed data-processing arrangement. The team opens a private matter, adds the relevant documents and records the facts that still need confirmation. Forseti assists with research against the installed regulatory references and selected, approved firm knowledge. The lawyer reviews proposed applicability, identifies missing information and prepares a source-linked work product. Approval attaches to the exact revision reviewed. If the underlying evidence changes, the earlier assessment can become stale and require another review.
Visual caption: Forseti AI connects the legal matter lifecycle while keeping legal judgment and final approval with lawyers.
The same concept applies to enterprise compliance work. In ComplianceOne, Forseti AI can work within governance processes for data mapping, privacy assessments, vendor risk, cross-border assessment preparation, incidents, and remediation.
Example: Vietnam cross-border personal data assessment
Consider an enterprise preparing to transfer personal data outside Vietnam. In an illustrative ComplianceOne workflow, Forseti AI uses the relevant regulatory pack to identify applicable obligations under the Personal Data Protection Law (Law 91/2025/QH15) and Decree 356/2025/NĐ-CP. It can help assess the proposed transfer against applicable requirements and exceptions, identify missing information and prepare a structured assessment linked to supporting evidence. The responsible privacy or legal professional reviews and approves the assessment, with legal references, evidence and decisions connected in the governance record.
“The valuable unit of AI is not a token or a chat message. It is a defensible piece of work delivered in the correct context, with the right controls and a clear owner.”
Legal AI economics: separate the platform from the inference
The legal AI market is advancing rapidly. Harvey Intake and Legora Intake are examples of serious investment in legal intake and workflow automation.
Their offerings are not identical to our law-firm matter-workspace proposition, and I would not suggest that every feature can be compared one-for-one. The difference is not whether an AI platform has a harness. It is who controls the model, who controls the data and context, and whether the economics remain transparent as model capabilities evolve.
But their market development exposes an important commercial question:
Should a law firm be required to buy its AI processing through the application vendor, or should it be able to choose and pay for inference directly?
Our approach for ComplianceOne for Law Firms is a fixed platform price per seat with no AesirX token-consumption charge.
The firm selects its supported AI model, pays that provider directly under its own account - or funds its own hosted infrastructure - and can align the choice with the sensitivity and difficulty of each task.
For perspective, Harvey and Legora do not publish dependable standard seat-price lists. Published third-party estimates vary enough that using them to claim a precise saving would be misleading.
Legora has, however, publicly introduced consumption-based pricing for Agent Pro, while saying its standard Agent remains included for existing customers under the announced terms.
A proper commercial comparison therefore requires actual proposals, included features, usage assumptions and deployment conditions - not an unsourced claim about competitor pricing.
| Commercial dimension | AesirX ComplianceOne for Law Firms | Harvey Intake | Legora Intake / Agent Pro |
| Platform pricing | Fixed per-seat licensing | Custom enterprise quote; public standard rate not established | Custom quote; standard rates not public |
| AI compute economics | Customer pays selected provider directly, or operates approved infrastructure; no AesirX token meter | Verify included capacity and any overages in the quote | Agent Pro is consumption-priced; standard Agent terms differ |
| Model selection and hosting | Supported commercial APIs, compatible endpoints, self-hosted/sovereign options | Confirm provider and deployment choices contractually | Confirm provider and deployment choices contractually |
| Cost comparison | Platform fee + direct inference / infrastructure + operating costs | Contract-specific total cost | Contract-specific platform + any consumption charges |
What direct inference pricing can look like
Here is an illustrative direct model inference cost for 1,000 defined token workloads, not a claim about what any vendor charges or what a complete agentic workflow will cost.
Assume 1,000 defined token workloads, each using 20,000 input tokens and 4,000 output tokens. Across those workloads, usage totals 20 million input tokens and 4 million output tokens.
Using Anthropic's published 7 October 2026 API prices:
| Example model | Input rate / 1M tokens | Output rate / 1M tokens | Illustrative direct API cost |
| Claude Haiku 5.5 (up to 100k-token prompts) | $0.10 | $0.50 | $4 |
| Claude Sonnet 5.5 | $2.00 | $10.00 | $80 |
The arithmetic is simple. The implications are more interesting.
The same nominal token volume can cost substantially different amounts depending on the model selected.
But equal token volume does not imply equal answer quality, equal number of agent steps, or successful completion of the same task. Those outcomes must be tested.
These figures exclude platform seats, retrieval and tool costs, caching variations, self-hosting hardware, security, operational overhead and taxes.
Real agentic workflows may involve multiple model calls, document processing, tool execution and retries, so direct inference costs should not be treated as the total cost of completing a task.
This is why I prefer letting an organization select models by measured quality, risk and cost per accepted work product, rather than paying for a bundled AI capability whose underlying economics are difficult to separate.
“A firm should be able to evaluate AI by the quality, risk and cost of accepted work, and retain the freedom to change its model provider.”
As models become easier to replace, context becomes harder to reproduce
I believe 2027 will bring more realistic self-hosted and sovereign model options for enterprises.
Smaller, more efficient models, improved inference software and increasingly capable open-weight systems are making that direction plausible.
It will not happen at the same rate for every organization: infrastructure, security, operational staffing, language performance and the quality bar for complex reasoning remain real constraints.
Nor am I arguing that frontier-model providers such as Anthropic, OpenAI or xAI will cease to matter.
They are likely to keep pushing the boundaries of reasoning, reliability, multimodality and tooling. For some tasks, the best frontier model will justify its premium.
What changes is where durable value accumulates.
A model can be swapped. A carefully developed body of organizational context, permissions, regulatory knowledge, workflow skills, integration tools, validation rules and audit evidence is much harder to replace.
That is where organizations build lasting operational advantage - and where vertical AI vendors must continue demonstrating value beyond access to a powerful model.
For us at AesirX, the goal is not to persuade a customer that our preferred model is the only safe choice. It is to give them the infrastructure to make responsible choices as capabilities, regulations and economics change.
The sustainable model for enterprise AI is not model first.
It is context first, governed execution throughout, and freedom to choose the model that fits the task.
See it in action
See what model-independent, governed agentic AI looks like in practice.
Contact me for a demonstration tailored to either ComplianceOne's enterprise compliance workflows or ComplianceOne for Law Firms' matter-based legal workflows.
Message me on LinkedIn or contact me at ronni@aesirx.io to arrange a demo.
Learn more: aesirx.io
Ronni K. Gothard Christiansen
Technical Privacy Engineer & CEO
