Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Three AI tools, three trust models, one decision a Canadian small firm has to make in 2026. Microsoft 365 Copilot, Thomson Reuters CoCounsel, and Harvey AI sit on the shortlist of nearly every 5-to-25-lawyer firm we advise. Based on FC’s sourcing conversations with seven Ontario and British Columbia firms over the last six months, each fits a different slice of the privilege-and-residency puzzle.
The LSO’s 2024 white paper on licensee use of generative AI still frames how Rule 3.1-2 competence meets Rule 3.3-1 confidentiality, so picking the wrong tool creates a compliance problem more than a UX problem. This comparison is a chapter inside our AI deployment guide for Canadian law firms.
Key Takeaways
- Microsoft 365 Copilot is the only one of the three with published Canadian pricing (CAD $24.43 per user per month on annual commitment, or CAD $34.20 month-to-month per Microsoft Canada, 2026) and a Canadian-tenant residency option through Microsoft 365 Advanced Data Residency.
- CoCounsel (Thomson Reuters) ships legal-specific skills like deposition prep and contract review, runs on Microsoft Azure infrastructure, and is sold through Canadian Thomson Reuters reps. Pricing is quote-only.
- Harvey AI lists SOC 2 Type II and ISO 27001 certifications and offers US, EU, and AU regional endpoints. There is no published Canadian regional endpoint and no public price (Harvey.ai, 2026).
- None of the three is a turnkey LSO compliance solution on its own. Each requires a written AI policy that names the tool, its data flows, and the confidentiality protocol Rule 3.3-1 implies.
Snapshot: how the three vendors compare
The table below is the spine of the rest of this article. Every dimension carries an evidence link in the vendor sections that follow. Where a vendor doesn’t publish a number, we say so rather than guessing.
| Dimension | Microsoft 365 Copilot | CoCounsel | Harvey AI |
|---|---|---|---|
| Canadian tenant residency | Yes, via Microsoft 365 Advanced Data Residency | Azure-hosted; Canadian region available on request | No published Canadian region (US, EU, AU only) |
| Rule 3.3-1 confidentiality fit | Strong with E5 + Purview controls | Strong; matter-scoped workspaces | Strong technically; residency caveat for Ontario clients |
| SOC 2 / ISO 27001 | SOC 2 Type II, ISO 27001, ISO 27018 | SOC 2 Type II via Thomson Reuters | SOC 2 Type II, ISO 27001 |
| Per-user monthly cost (verified) | CAD $24.43 annual / $34.20 m2m | Pricing not published; quote only | Pricing not published; quote only |
| Best for | Firm-wide drafting, Outlook, Teams | Litigators and contract-heavy practices | Larger firms with US/EU caseloads |
| Key risk | SharePoint oversharing without Purview | Lock-in to TR ecosystem | CLOUD Act exposure on US region |
1. Microsoft 365 Copilot for Microsoft 365
Microsoft 365 Copilot is the AI assistant embedded in Word, Outlook, Teams, Excel, and SharePoint. For Canadian firms already on the Microsoft 365 stack with Business Premium or E3/E5, it’s the path of least resistance.
Pricing is the only one of the three that’s public: Microsoft Canada lists CAD $24.43 per user per month on annual commitment, and CAD $34.20 month-to-month as of Q2 2026. Tenant data stays inside Microsoft 365 Advanced Data Residency boundaries when the firm enables that feature, and Redmond commits in writing that customer prompts are never used for foundation-model training.
The real privilege story sits at the configuration layer. Copilot reads whatever a logged-in user can read, so a SharePoint site with broken permissions is a one-prompt-away breach. Pairing Copilot with Purview sensitivity labels on privileged content is the control that closes that loop. Our Copilot oversharing playbook covers the lockdown sequence, and the general Copilot vs ChatGPT vs Claude comparison covers non-legal context.
Pros: Best-in-class integration with Outlook and Teams. Canadian residency option. Single SKU your IT admin can already manage. Predictable pricing.
Cons: Not legal-specific (you build the prompts and templates yourself). Requires Purview + sensitivity labels to be safe at scale. If your DMS is NetDocuments or iManage, you’ll need the connector layer covered in our NetDocuments and iManage Copilot integration guide.
Best for: A 5-to-25-lawyer Canadian firm that already runs Microsoft 365, wants firm-wide drafting and email triage, and has either an internal IT lead or an MSP that can stand up Purview properly.
2. Thomson Reuters CoCounsel
CoCounsel is the legal AI assistant from Thomson Reuters, the publisher behind Westlaw and Practical Law. It’s built around legal-research skills (deposition summaries, contract review memos, clause extraction, witness prep) rather than generic productivity tasks. The model runs on Microsoft Azure, giving it a path to a Canadian region, and Thomson Reuters sells it through Canadian field reps.
Pricing is the friction point. Thomson Reuters doesn’t publish a list price. Based on FC’s sourcing conversations with two Toronto firms in Q1 2026, we tell clients to assume CoCounsel costs four to six times Copilot per seat, then ask the rep for a written quote. Amy Salyzyn’s 2025 Slaw.ca primer recommends piloting any legal-specific AI tool before standardizing on it. We’d second that.
“We piloted CoCounsel against Copilot on a six-week clause-review trial. CoCounsel was sharper on litigation-style work, but Copilot won on what we actually do day-to-day: drafting, redlining, and Outlook triage. Residency in Canada and a price we could read off a public page sealed it.”
Pros: Legal-trained skills (deposition prep, clause extraction, Westlaw retrieval). Matter-scoped workspaces. Strong vendor reputation in Canadian litigation circles.
Cons: Quote-only pricing. Tight coupling to the Thomson Reuters ecosystem. The Canadian-region claim is real but requires being asked for in the contract.
Best for: Litigation boutiques, mid-size commercial-law firms, and any practice where deposition or contract review volume justifies a specialist tool over a general one.
3. Harvey AI
Harvey is the AI platform that put legal AI on the Bay Street radar. It serves large firms, in-house teams at multinationals, and a growing roster of professional-services shops. Per Harvey’s security page, the product carries SOC 2 Type II, ISO 27001, GDPR, and CCPA compliance, with regional app endpoints for US, EU, and AU customers.
What Harvey doesn’t offer, as of this writing, is a published Canadian regional endpoint. A Canadian firm routes through US tenancy by default, putting data inside CLOUD Act jurisdiction. For a Bay Street commercial firm with US M&A workflows, that’s usually acceptable. For a Toronto family-law boutique handling child-protection files, it usually isn’t. Pricing isn’t public and the buying motion is enterprise sales, so a 12-lawyer firm rarely makes the shortlist.
Pros: Strongest reputation among AmLaw 100 firms. Strong security posture. Built specifically for legal workflows.
Cons: No Canadian region. Enterprise sales motion that’s a poor fit for small firms. No public pricing.
Best for: Larger Canadian firms with significant US or EU caseloads, and a procurement team that can negotiate residency terms in the master agreement.
Editorial pick
FIELD NOTE FROM MIKE
Of the seven Ontario and British Columbia firms we’ve sourced AI tooling for in the last six months (five Toronto, one Hamilton, one Vancouver, ranging 6 to 22 lawyers), six picked Microsoft 365 Copilot on top of E5 with Purview sensitivity labels.
The seventh, a 21-lawyer litigation boutique, ran a CoCounsel proof of concept and stayed. Zero picked Harvey. The single question that decided five of those engagements was “Can you point to the data residency clause in writing?”
Copilot may not be the smartest model on the market. The reason for the pick is that the firm already pays for Microsoft 365, already trusts the residency boundary, and already has a tenant their MSP can lock down. We’d revisit CoCounsel the moment deposition prep becomes a weekly task.
Mike Pearlstein, CISSP, Fusion Computing. Based on FC engagement data, Q4 2025 to Q1 2026.
That pick only holds if the firm pairs the deployment with a written AI policy naming the tool, the data flows, and the human-review checkpoint. Without that, all three vendors are equally risky. Use the LSO-specific AI policy template for the language and our general AI acceptable-use policy guide for the structural elements.
Further reading and primary sources
- Law Society of Ontario white paper on the future of the legal profession. LSO position on competence and emerging technology.
- Federation of Law Societies of Canada Model Code of Professional Conduct. the harmonized national rules referenced by all 14 provincial and territorial law societies.
- Ontario Superior Court ruling on AI-generated authorities (CanLII). a precedent case that informs current AI-citation practice.
- Mata v. Avianca, Inc. docket (CourtListener). the U.S. precedent that triggered the global wave of AI-citation sanctions.
- Slaw.ca commentary on AI and Canadian legal practice. ongoing peer commentary from Canadian legal academics and practitioners.
HOW THIS GUIDANCE WAS ASSEMBLED
This article draws on FC’s anonymized client data across multiple 2025-26 Ontario and British Columbia law-firm engagements, plus a named-client moment with the principal of a Toronto litigation boutique whose Copilot rollout we led through full LSO Rule 3.3-1 review.
It also draws on an original survey of 11 partners and 9 associates conducted during 2026 Q1 onboarding calls, plus an FC internal benchmark covering Copilot, Purview, and Entra ID deployment timelines across 18 small-firm rollouts.
Layered over all of it is first-person field observation from CEO Mike Pearlstein’s 12-year practice supporting regulated Canadian SMBs through privilege-sensitive technology change.
Frequently asked questions
Is Microsoft 365 Copilot allowed under LSO Rule 3.3-1 for a Canadian law firm?
Copilot can be deployed in a way that supports Rule 3.3-1 confidentiality, because the rule applies to the lawyer’s conduct rather than the tool. The firm needs a written AI policy, Purview sensitivity labels on privileged content, and Canadian tenancy through Microsoft 365 Advanced Data Residency. Microsoft commits in writing that customer prompts are not used to train foundation models, which is the contractual baseline the LSO 2024 white paper on generative AI implies.
Does CoCounsel keep Canadian client data in Canada?
CoCounsel runs on Microsoft Azure, which makes a Canadian region technically available. Thomson Reuters keeps residency commitments off public marketing pages, so a Canadian firm must ask the rep for the residency clause in writing and add it to the master agreement. Otherwise, the default routing may send prompts and matter content through US infrastructure, which raises CLOUD Act exposure for files connected to Ontario clients.
What does Harvey AI cost for a small Canadian law firm?
Harvey keeps pricing off the website, and the enterprise sales motion suits firms over 25 lawyers. From public reporting and our sourcing conversations, a Harvey seat runs at multiples of what a Microsoft 365 Copilot seat costs in Canada. Don’t assume Harvey is on the menu until a rep confirms a quote. The shortlist for most Canadian small firms collapses to Copilot or CoCounsel.
Can a Canadian law firm just use ChatGPT instead?
ChatGPT Business and Enterprise offer contractual non-training commitments, but neither offers Canadian data residency by default. Pasting privileged content into a free ChatGPT account is the failure mode the LSO 2024 white paper flags. For a firm that wants a general-purpose AI tool, Copilot is the safer Canadian default because the tenant residency story is more mature. Our general Copilot vs ChatGPT vs Claude comparison covers the trade-offs.
How do these tools integrate with NetDocuments or iManage?
Microsoft 365 Copilot supports NetDocuments and iManage through the Microsoft Graph connector framework, with content surfaced into Copilot prompts when the connectors are configured. CoCounsel ships native iManage and NetDocuments integrations. Harvey supports DMS integration through enterprise contracts. The integration layer is where the privilege story usually fails, so it’s worth a separate planning conversation; we walk through it in our NetDocuments and iManage Copilot integration guide.
Which tool has the strongest cybersecurity certifications?
All three carry SOC 2 Type II. Microsoft adds ISO 27001 and ISO 27018 (the cloud-privacy standard) through the broader Microsoft 365 platform. Harvey publishes SOC 2 Type II and ISO 27001 on its security page. CoCounsel inherits Thomson Reuters’ SOC 2 posture. If your insurance carrier asks for ISO 27001 specifically, Microsoft and Harvey are the easier asks. Our cybersecurity services hub covers how we map vendor certifications to firm-level controls.
Bottom line
For a Canadian small firm in 2026, the realistic shortlist is two tools. Copilot wins on residency and price transparency; CoCounsel wins on legal-specialist depth; Harvey suits larger firms with US caseloads.
The deciding factor lands on the AI policy, the Purview configuration, and the human-review checkpoint behind the tool. Read the full LSO-compliant AI playbook and book a call before renewal forces the choice.
