# Enterprise OCR for Law Firms: What Changes at Scale

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2025-04-21T02:14:19Z
- Updated: 2026-10-11T19:22:20Z
- Category: Choosing legal OCR
- Canonical: https://www.schemalaw.com/blog/enterprise-ocr-for-law-firms

> What enterprise OCR for law firms involves at scale: security and contract review, sign-in and export questions to ask, and planning 100,000 pages a month.

Enterprise OCR for law firms is the same conversion a solo lawyer buys, wrapped in the things a large firm must have before anyone may use it: a completed security review, a negotiated contract, written answers on sign-in, deletion and export formats, a named person to call, and capacity for steady high volume.

The recognition itself rarely decides an enterprise purchase. What decides it is whether the product can pass the firm's review and fit the way hundreds of people already work. This post goes through each of those requirements and what to ask about it, so the evaluation team can separate what the firm needs from what merely sounds large. Where Schema Law does not offer something a large firm may want, such as single sign-on or custom export layouts, the post says so.

At firm scale, tie the tool to matter management so each upload stays with the right client. Ask your legal project management lead how outside counsel guidelines treat vendor tools, and run a conflict check before a shared account sees files from two sides of a dispute. Your duty of confidentiality covers the copies you export into document management, so name an owner who deletes them when the matter closes.

## What changes when OCR is bought for a whole firm?

When OCR is bought for a whole firm, the buyer stops being one person with a document and becomes a group with a process. IT, information security, the general counsel's office, practice support and finance each hold a veto. The product has to satisfy all of them, and the people who will use it are often not in the room.

Five things shift at once.

| At a small firm | At a large firm |
| --- | --- |
| One lawyer decides and signs up | A committee evaluates over weeks or months |
| Each person has an account | Access follows the firm directory |
| The vendor's standard terms apply | The contract is reviewed and negotiated |
| Deletion is a personal habit | Retention follows a written policy |
| Exports are opened by a person | Exports feed other systems |

### Who needs what

- **Information security** needs written answers about how documents are handled, and evidence behind the answers.
- **IT** needs users to arrive and leave through the directory, without a second set of passwords.
- **The general counsel's office** needs contract terms that protect client confidences and satisfy client engagement terms.
- **Practice support and litigation support** need output that loads into the tools they already run.
- **Finance** needs a predictable cost and a way to see which groups use the service.
- **Lawyers and paralegals** need it to work on the documents they actually receive.

The last group is the easiest to forget. A product that clears every review and reads the firm's faxes badly has still failed. Put a paralegal and a practice support analyst on the evaluation team, and give them real files to test. The post on [what the best OCR for lawyers is](https://www.schemalaw.com/blog/what-is-the-best-ocr-for-lawyers) describes how to run that kind of trial.

## Which enterprise features matter and which are noise?

The enterprise features that matter are the ones that let the firm control who gets in, what happens to documents, and whether the output fits its systems. Features that are noise are those that sound substantial in a proposal but change nothing about risk or daily work. Judge each one by asking what would go wrong without it.

| Feature | Why it matters | What to ask |
| --- | --- | --- |
| Single sign-on | One place to grant and remove access | Which identity providers and protocols are supported? |
| No per-seat charge | Occasional users are not rationed | Is there any cap on users or workspaces? |
| Retention set by policy | Deletion does not depend on individuals | Can rules differ by matter or client? |
| Security questionnaire and contract review | The firm's review can be completed | Who answers, and how fast? |
| Custom export layouts | Output loads without manual rework | Who builds the layout, and who maintains it? |
| A named support contact | Problems reach a person who knows the account | What are the hours and response times? |
| Volume sized to the firm | Peaks do not stop work | What happens when the monthly allowance is reached? |

### Signs of noise

- **A long feature list with no answers behind it.** If the vendor cannot say how a feature works, it will not survive the security review.
- **Accuracy percentages with no test set.** A figure measured on someone else's documents says little about yours. Run your own pages.
- **Controls nobody will administer.** Fine-grained permissions are only useful if someone at the firm will maintain them.
- **Certification logos offered in place of answers.** A certificate can support an answer. It does not replace reading what the vendor actually commits to for your documents.

### What one enterprise plan lists

As a concrete reference, the Schema Law Enterprise plan is $999 a month and lists exactly these items: 100,000 pages a month, no fixed page limit per document, security questionnaire and contract review, and a named contact for support. The [pricing page](https://www.schemalaw.com/pricing) shows it next to the smaller plans.

Set that against the table above and four rows have no match. Schema Law has no single sign-on, no retention rules, no custom export layouts and no price that covers a whole firm's staff: each account is for one person, on every plan. Every plan runs the same software, with the same eight export formats and the same uploads of several files at a time. What the Enterprise plan adds is volume and service. If the missing rows are requirements at your firm, that settles the question before the security review starts.

## Single sign-on and user management

Single sign-on lets people reach the OCR tool with the same firm account they use for everything else. The firm's identity system decides who gets in, so when someone leaves and their account is disabled, their access to the tool ends with it. For a large firm that single point of control is the reason to require it.

NIST defines [single sign-on](https://csrc.nist.gov/glossary/term/single_sign_on) as an authentication process in which one account and its authenticators are used to access multiple applications, generally implemented with a federation protocol. "Federation protocol" is the part to pin down with a vendor, because your identity provider and the product have to speak the same one.

### Questions for the identity team to ask

1. Which federation protocols does the product support, and has it been used with our identity provider?
2. Are accounts created automatically the first time a person signs in, or must an administrator add them?
3. When we disable a person in the directory, how quickly do they lose access, and are their open sessions ended?
4. Can access be limited to a group in our directory, so only approved staff can sign in?
5. Does our multi-factor requirement apply, given that sign-in happens through our provider?
6. Is there any way to sign in that bypasses single sign-on, such as a local password, and can it be turned off?

Question 6 catches a common gap. A product can offer single sign-on and still leave a side door open.

### Users, seats and workspaces

Pricing by seat pushes firms to share logins or ration access, and both are bad for accountability. Ask every vendor what one account covers, whether a plan's price counts people or pages, and what it costs to add the hundredth occasional user.

Then ask who can see what. In a firm with ethical walls, the question is whether a person on one matter can open documents uploaded for another. Get the vendor to describe, in writing, how documents are separated between users, and test it with two accounts. The post on [private OCR](https://www.schemalaw.com/blog/private-ocr#who-else-can-see-a-document-in-a-shared-workspace) covers access in tools that pool a team's documents.

Schema Law's answers are short. It does not offer single sign-on on any plan, Enterprise included. People sign in with a Google account, one person per account. Documents belong to the account that uploaded them, and no other account can see them. There are no shared workspaces and no administrator who adds or removes users.

For a large firm that has two consequences. The firm's control over access is its control over the Google accounts people sign in with, so find out who at the firm manages those accounts before anyone starts. And a colleague who needs a converted document gets the exported file, saved wherever the firm keeps the matter, because there is nothing inside the product to share. If your identity team requires federation with the firm directory, put the six questions above to vendors that offer it, and record this as a gap for Schema Law.

## Security questionnaires and contract review

A security questionnaire is the firm's written list of questions about how a vendor protects data, and contract review is where the answers become obligations. For enterprise OCR, both must be finished before client documents are uploaded. A vendor that will not complete the firm's questionnaire or discuss its terms is not selling to enterprises.

### What the questionnaire should cover for an OCR tool

Generic questionnaires run to hundreds of questions. For a tool that receives client documents, make sure these are answered clearly:

- **Use of documents.** Are uploads used to train or improve any model, the vendor's or anyone else's?
- **Separation.** How are one firm's documents kept apart from another's?
- **Subprocessors.** Which other companies handle documents or their contents, and under what terms?
- **Encryption.** How are files protected in transit and in storage?
- **Retention and deletion.** How long are originals, outputs and backups kept, and what does deletion remove?
- **Staff access.** Which of the vendor's people can open a customer document, and when?
- **Incidents.** How and when will the firm be told about a breach?
- **Exit.** What happens to the firm's documents when the contract ends?

The post on [whether it is safe to upload client documents to an OCR tool](https://www.schemalaw.com/blog/is-it-safe-to-upload-client-documents-to-an-ocr-tool#which-questions-should-you-ask-an-ocr-vendor) goes through vendor questions in more depth.

### Turning answers into contract terms

An answer in a questionnaire is a statement. A clause is a promise. For each answer that the firm is relying on, find the matching term in the contract or ask for one. Confidentiality, use restrictions, deletion on termination and breach notice are the usual four. Whether a given set of terms meets the firm's professional obligations is a legal judgment for the firm, and the rules differ by jurisdiction. The post on [attorney-client privilege and AI tools](https://www.schemalaw.com/blog/attorney-client-privilege-and-ai-tools) discusses the duties involved.

### Where Schema Law stands

Schema Law lists the same lines for every plan. Four of them answer questionnaire items: your documents are never used to train an AI model, documents stay inside your own account, files are encrypted in transit and at rest, and you can delete any document at any time. The site's [security commitments](https://www.schemalaw.com/#security) give the wording, and the homepage adds that nothing is pooled across firms, published, or made visible to other customers. The Enterprise plan adds "Security questionnaire and contract review" as a listed item, which is the plan to ask about if your firm needs an OCR vendor security review completed before anyone uploads.

On retention, be exact in the firm's own records. Schema Law has no retention setting and deletes nothing automatically. A document stays until the person who uploaded it deletes it, and deleting removes the original file and everything parsed from it. A firm whose policy sets a retention period has to meet it by procedure, with each person deleting uploads when the work is done.

Those are the published statements. Everything beyond them, including any certification, audit report or detail of where documents are processed, is something to ask for during review and not something to assume.

### Keep the firm's policy in step

A completed review approves a tool for defined uses. Record the approval in the firm's policy on outside tools, with any limits, so lawyers know what they may upload. The post on [law firm AI policy for document uploads](https://www.schemalaw.com/blog/law-firm-ai-policy-document-upload) includes clauses for that record.

## Custom export layouts for firm systems

A custom export layout is output arranged to a specification the firm supplies, so files load into its systems without someone reshaping them by hand. At small volume a person can rename columns and reorder fields. At firm volume that manual step becomes a full-time job and a source of errors.

Start with what a standard product gives you. Schema Law exports eight formats on every plan: Word, Excel, CSV, JSON, searchable PDF, plain text, Markdown and HTML. Many firm needs are met by one of those. A custom layout becomes necessary when a downstream system insists on particular field names, column order, file naming or delimiters.

Schema Law does not offer custom export layouts or load files on any plan, Enterprise included. The eight standard formats are the whole list. If a system at your firm needs something else, either the firm reshapes a standard export on its own side, or it buys from a vendor that builds layouts to order. The rest of this section covers what to ask such a vendor.

### What to put in the specification

A vendor can only build what you describe. For each target system, write down:

1. **The system and the import it uses.** Name the product and the import function, and attach its documentation.
2. **A sample file that imports cleanly.** One real, working example is worth pages of description.
3. **Every field, in order.** Name, data type, whether it is required, and where the value comes from.
4. **Delimiters, encoding and line endings.** These are where imports most often fail.
5. **File naming and folder structure.** Including how page and document numbers are padded.
6. **How to treat what is missing.** An empty field, a blank page, a page that could not be read.
7. **An acceptance test.** A set of documents and the result the firm expects, agreed in advance.

For review platforms, the specification is usually a load file. The post on the [Concordance load file format](https://www.schemalaw.com/blog/concordance-load-file) explains the fields and delimiters, and the guide to [creating a load file from scanned PDFs](https://www.schemalaw.com/blog/how-to-create-a-load-file-from-scanned-pdfs) covers building one yourself.

### Ownership after delivery

Systems change. When the firm upgrades its review platform or document management system, the layout may need to change with it. Agree who maintains the layout, how changes are requested and how long they take. Keep the specification and the acceptance test in the firm's own records, so the layout does not live only in a vendor's memory.

### Try the standard formats first

Before commissioning anything from any vendor, try the standard CSV and JSON exports against the target system. If a short script or an import mapping on the firm's side closes the gap, that may be simpler to own than a custom layout. With Schema Law it is the only route, so run this test early. The post on [scanned PDF to JSON](https://www.schemalaw.com/blog/scanned-pdf-to-json) describes what the structured export contains.

## Planning volume at one hundred thousand pages a month

Planning volume at one hundred thousand pages a month means knowing where the pages come from, when they peak, and who is allowed to spend them. An allowance that size disappears quickly when one large production arrives, and sits unused in a quiet month. Forecast by source, not by firm-wide average.

### Build the forecast from the bottom up

List the streams of scanned paper the firm handles and estimate each one separately.

| Stream | How to estimate it | Pattern |
| --- | --- | --- |
| Incoming productions | Page counts from the last year of productions received | Irregular, with large peaks |
| Records requests | Matters opened times typical records per matter | Steady |
| Closed-file digitization | Boxes scheduled per month | Controllable |
| Transactional due diligence | Data room sizes from recent deals | Peaks at deal time |
| Day-to-day scans | A two-week sample from several practice groups | Steady |

Use the firm's own history for each. Scanner and copier logs, vendor invoices for outsourced scanning, and review platform page counts are all records the firm already holds.

### Put the number in daily terms

One hundred thousand pages a month is ten times the 10,000 pages on Schema Law's Team plan. Spread over a month of about 21 working days, it comes to roughly 4,800 pages a day. Compare that with what the firm's busiest scanning station produces in a day, and you will see whether the allowance is generous or tight.

### Plan for the peaks

A single production can exceed a month's steady volume. Decide in advance:

- **What happens at the limit.** Ask the vendor whether work stops, slows or continues at an added charge.
- **Who may commit a large batch.** One group using the whole allowance in a week leaves others stuck.
- **What can wait.** Closed-file digitization can be scheduled around litigation peaks.

The guide to [batch OCR for discovery documents](https://www.schemalaw.com/blog/batch-ocr-discovery-documents) covers splitting and tracking a large set once it is approved.

### Document size is its own limit

Monthly volume and the size of a single document are separate constraints. Schema Law's Team plan lists up to 1,000 pages per document, and its Enterprise plan lists no fixed page limit per document. The 20 MB limit on each uploaded PDF, PNG or JPEG still applies on every plan, so a long color scan can be too large in megabytes while being fine in pages. Measure your largest real files both ways before you rely on either figure, and plan to split or rescan the ones over 20 MB.

### Track use by group

On Schema Law the page allowance belongs to one person's account, not to the firm. A firm that wants a single pool routes its uploads through one account, whose holder keeps the upload log, or buys an account for each heavy user and adds up the plans. With any vendor, ask what usage reporting is available, and at what level. If the firm intends to allocate cost to practice groups or matters, it needs page counts broken down that way. The post on [OCR cost per page](https://www.schemalaw.com/blog/ocr-cost-per-page) explains how to turn a plan price and a volume into a per-page figure for that allocation.

Review the forecast after the first three months. Real use will differ from the estimate, and it is the first quarter's numbers that tell you whether the plan fits.

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)