Azure Document Intelligence vs Docling

Azure Document Intelligence 25

Read as a closed service with official SDKs, from the service's own models as this run reads other Azure and AWS listings. The REST specification in Azure/azure-rest-api-specs has had no API or description change since 3 August, only tooling (TypeSpec suppressions on 3 and 13 August, the folder move of 28 September, linter rulesets on 14 October). The what's new page's newest entry is the March 2026 tax model update, more than 180 days back. The newest SDK releases, Java 1.0.10 on 18 August and 1.0.11 on 6 October 2026, only raise azure-core and azure-core-http-netty. Dependency-only releases count half on the 90-day line and can't set the recency line, as azure-translator, so the 8 October departure that gave 15 on the Java date is withdrawn (0 of 30). Two dependency-only releases at half each, and no service change, in 90 days (0 of 20). A what's new page with one entry in 2026, Microsoft Q&A and the SDK issue trackers on GitHub, which we did not read (8 of 15). Official SDKs in four languages target the current GA API, but Python (1.0.2, 26 March 2025), JavaScript (1.1.0, 8 May 2025) and .NET (1.0.0, 16 December 2024) have had no release since (12 of 15). The Python package declares Python 3.8 to 3.12 and is built in the azure-sdk pipelines, whose results we did not check (5 of 10). 0+0+8+12+5 = 25.

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

Azure Document Intelligence 20

No x402, MPP or L402 (0). Per-1,000-page prices are public through the Azure Retail Prices API without a login, while the pricing page shows "$-" until a script fills it (20). F0 gives 500 pages a month, but it sits on an Azure account, and the free account page asks for a phone number and a credit or debit card (0). A person signs up in a browser (0).

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

Azure Document Intelligence 71

Microsoft Entra ID bearer tokens with Azure RBAC and managed identities, or two resource keys. The OpenAPI document and the docs give the key only as a header (30). RBAC can limit a caller, but a resource key reaches every data-plane call, among them deleting custom models, and nothing asks for confirmation. Analysis itself changes nothing (14 of 20). The service returns text from untrusted documents, and no guidance on injected instructions was found in the pages read (0 of 15). The Foundry Tools diagnostic logging page describes Audit and RequestResponse logs through Azure Monitor once the owner adds a diagnostic setting. We did not confirm the fields for Document Intelligence (12 of 15). MSRC coordinated disclosure and bounty policies and a CSAF feed. The microsoft.com security.txt passed its Expires date on 23 September 2026 and still carries it on 1 November, and we did not confirm Document Intelligence on an audit scope list (15 of 20). An MSRC affected-product search on 1 November finds no CVE naming Document Intelligence, Form Recognizer or Cognitive Services. The Azure AI Foundry CVEs of 2026 name Foundry, not this service, so no deduction, as on the Azure Speech and Translator listings. 30+14+0+12+15 = 71.

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

Azure Document Intelligence 79

Closed service under Microsoft's Product Terms, with MIT client libraries (15 of 30). The data privacy page, dated 22 July 2026, says data is processed in the resource's region, held with results for 24 hours in storage shared by customers in that region and logically isolated, then deleted, with a delete call for earlier removal. It says nothing on whether documents are used to improve the service, the Product Terms' training clause covers generative AI services only, and we did not read the Data Protection Addendum (22 of 30). The overview gives a version table with dated retirements, v2.1 on 15 September 2027, announced three years ahead, and v3.0 on 30 March 2029 (20). Processing stays in the resource's region. The sub-processor list is on the Service Trust Portal, which we did not read (12 of 20).

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

Azure Document Intelligence 64

API reading. pages limits what is analysed, outputContentFormat=markdown gives one Markdown string and add-ons are off unless asked for. The result still carries every word and line with polygons, with no field selection, and the limits page allows a response of up to 500 MB (14 of 25). List calls page with nextLink. No filter on models or operations, and an analysis result comes back whole (12 of 20). Errors are JSON with a code, a message and an inner code such as InvalidContentLength or ModelNotReady that says what to change (16 of 20). No idempotency key, so a repeated POST starts and bills a second analysis. Results stay for 24 hours, so polling again is safe (10 of 20). A call needs only a model ID, api-version and a URL or bytes, and SDKs exist for Python, JavaScript, .NET and Java. Every analysis takes a POST and at least one GET (12 of 15).

Docling 77

About 25 MCP tools in the default groups (15), selectable as conversion, generation and manipulation groups, with anchor tools to read one part of a document (22 of 25). max_num_pages, max_file_size and page ranges on conversion, Markdown or JSON export (15 of 20). Errors are exceptions with messages, such as an unknown document key listing the valid ones (12 of 20). readOnlyHint and destructiveHint on the MCP tools, and conversions are repeatable (18 of 20). Sensible defaults and one call to convert; Python only, with a docling-client package for docling-serve (10 of 15). 22+15+12+18+10 = 77.

Azure Document Intelligence 86

A public OpenAPI 2.0 document for 2024-11-30 in Azure/azure-rest-api-specs, generated from TypeSpec, with 27 operations (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with Accept: text/markdown came back as Markdown, so half (5 of 10). Operation descriptions are one line each and restate the operation name. The overview says which model fits which document and links a page on choosing between this service and Content Understanding (14 of 20). 25 enums, 94 length, pattern and range constraints and a pattern on pages and modelId. queryFields is a free list of strings and the either-or between urlSource and base64Source is stated only in prose (13 of 15). An example on every operation, and an error page with nine top-level codes and 30 inner codes. 429 is not in that table (14 of 15). Dated api-version values, a what's new page and an SDK release history page (15).

Docling 77

No OpenAPI file is published; docling-serve is a FastAPI app that serves its schema when run, and docling-mcp's tools carry typed inputs with Field descriptions from Pydantic (20 of 25). No llms.txt on the docs site; Markdown docs and AGENTS.md in the repository (5 of 10). MCP tool docstrings say what each tool returns and which other tool supplies its key, with little on when not to use one (14 of 20). Pydantic types with descriptions, few enums (12 of 15). Many runnable examples in docs/examples, with errors raised as Python exceptions that name the fix, such as OperationNotAllowed and unknown document keys listing valid ones (11 of 15). Changelog per release (15). 20+5+14+12+11+15 = 77.