Contract Review With AI for Businesses: What to Ask and Check

Contract Review With AI for Businesses: What to Ask and Check

To review a contract with AI, ask it to read the document and return a map: parties, subject matter, deadlines, amounts, obligations, termination, penalties and ambiguous points, always quoting the original passage. Then you check each item against the text and take the questions and decisions to a lawyer. AI speeds up the reading and organizes the conversation, but it does not replace legal advice.

Key takeaways

• Ask for a map of the contract, not a verdict: clauses, deadlines, obligations and risks, each with the exact passage that supports it.
• Protect the data before you upload: use a tool your company has approved and remove anything the reading does not need.
• Check every finding against the original text. An answer with no quoted passage should be treated as suspect.
• AI points, the lawyer decides: interpretation, negotiation and legal validity stay with a qualified professional.
• Start with one common contract type and agree in advance how you will tell whether the AI-assisted review helped.

What AI does well and what it should not do with a contract

A common contract, such as a services agreement, commercial lease, supply agreement or partnership, is a long, repetitive text full of internal cross-references. That is where AI helps: it reads fast, organizes the content and does not get tired by clause twenty.

What it usually does well:

• Extracting dates, term lengths, automatic renewal, notice periods and payment deadlines.
• Listing each party's obligations in plain language.
• Locating clauses on termination, penalties, price adjustment, exclusivity, confidentiality and jurisdiction.
• Comparing the contract you received with a template your company already uses and pointing out the differences.
• Suggesting questions to ask the other party or your lawyer.

What it should not do on its own: state that a clause is valid or abusive, decide whether you should sign, rewrite a clause for final sending without review, or interpret the contract in light of a specific case. Those points depend on context, case law and professional responsibility. Language models can also be wrong while sounding certain: they can invent a passage, swap a deadline or ignore an attachment. That is why the design of the process matters more than the choice of tool. For the broader division of tasks, read what not to delegate to AI in your business.

What to protect before pasting the contract

Contracts often contain personal data (names, tax IDs and addresses of partners and representatives), sensitive commercial terms and, sometimes, a confidentiality clause that restricts sharing the text itself. Before sending anything to an AI tool, answer these questions:

• Does the company have an approved tool for this use, with settings that define how data is handled? If not, the internal rule needs to exist first. A good starting point is a company policy for employee ChatGPT use.
• Does the contract have a confidentiality clause that forbids sharing its content with third parties? If so, talk to your legal counsel first.
• Is there personal data the analysis does not need? Replace it with placeholders such as Party A and Party B whenever possible.
• Who in the company may upload contracts, and who may see the answers?

Brazil's data protection law (LGPD) applies to the processing of personal data even when it appears inside a contract. The national data protection authority (ANPD) publishes official guidance on the subject. Minimizing data, limiting who has access and logging usage are simple practices that reduce risk without blocking the work.

There is also a technical precaution: the contract text is third-party content and can contain hidden instructions or phrases that try to steer the model's behavior. This is rare in ordinary contracts, but it is a known risk, described in the OWASP list of risks for applications built on language models. The practical defense is the usual one: the AI only reads and summarizes, it takes no action, and a person checks the result.

How to ask: what to request from the AI, step by step

The most common mistake is asking whether the contract is good. The question is too broad and the answer will be generic opinion. Ask for small, verifiable tasks with structured output. A sequence that works:

• Step one, identification: ask for the parties, the subject matter, the signing date, the term and the attachments mentioned. Also ask what seems to be missing, such as an attachment that is cited but not included.
• Step two, deadlines and dates: ask for every deadline (term, renewal, notice, payment, delivery, correction of failures), each with the clause number and the exact passage.
• Step three, obligations: ask for a separate list of what each party must do, who is responsible and the deadline.
• Step four, money: ask for payment terms, price adjustment, penalties, interest, withholdings and any costs that fall on your company.
• Step five, exit: ask for the grounds for termination, the penalties, what happens to data and materials at the end, and the chosen jurisdiction.
• Step six, risks: ask it to flag unusual, one-sided or ambiguous clauses, or clauses that contradict another part of the contract, explaining why and without saying whether they are valid.
• Step seven, open questions: ask for a list of questions to take to your lawyer and to the other party.

An opening request can look like this:

Read the contract below and return a plain-text list of deadlines and obligations; for each item, cite the clause and copy the exact passage; if you cannot find it, write not found; do not give an opinion on legal validity.

Requiring an exact quote and explicitly allowing the answer "not found" are the two instructions that most reduce invention. If you want to turn this into a routine, the same logic of fields, rules and checking appears in extracting data from PDFs with AI, which is useful when the contract arrives as a scanned file.

How to check the AI's answer: a checklist

Checking is what turns a fast reading into a reliable one. It does not need to be long, but it must always be done. Use this list:

• Does every item have a clause number and a quoted passage? Find the passage in the original document, word for word.
• Do the deadlines and amounts match the text? Numbers and dates are where errors cost the most.
• Did the AI take attachments, amendments and cross-references into account? A clause can be changed by an attachment it never read.
• Was anything left out? Pick one or two important clauses at random and check that they appear in the map.
• Are the risk notes specific to this contract or generic? A warning that would fit any contract has little value.
• Does the answer claim anything about the law, validity or the outcome of a dispute? Mark it for the lawyer and do not accept it as fact.
• Is the document the final version? Compare the file name, date and clause numbering with what the other party sent.

If two or three checks fail on the same contract, do not patch the AI's text: redo the request with smaller tasks or read the whole contract the traditional way. Checking also works as a measurement: note what the AI got right, what it got wrong and how long the review took, so you can decide with evidence and not impressions. For a fuller approach to this, see how to measure an AI automation pilot.

Illustrative scenario: a services contract

Imagine, as an example, a mid-sized company that receives an ongoing services contract from a supplier. The person in charge of operations uploads the text, without unnecessary personal data, to the company's approved tool and asks for a map of deadlines, obligations, payment, termination and risks, with quotes.

The AI returns the map and highlights three points: an automatic renewal that requires written advance notice, a clause that lets the supplier adjust the price by a criterion defined in an attachment, and a limitation of liability that seems to cover only one of the parties. It also warns that the service-level attachment is mentioned but was not included in the file.

The person checks the passages, confirms that the renewal and adjustment points are correct, and asks the supplier for the missing attachment. Then they take a one-page summary to the lawyer with the three clauses, the quotes and the generated questions. The lawyer does not have to start reading from scratch: they begin with points already located, but they still read the contract and decide what to negotiate, what to accept and what to refuse. The AI shortened the preparation, and the decision stayed with the person who carries professional responsibility.

When to take it to a lawyer and what to bring

The simple rule: use AI to understand and prepare, and use the lawyer to decide. Take the contract to a lawyer whenever there is:

• An amount that matters to the company's cash flow, or a long-term commitment.
• Clauses on exclusivity, non-compete, intellectual property, limitation of liability or indemnity.
• Personal data processing at scale, which involves the LGPD and possibly an impact assessment. For that case, see the data protection impact assessment for AI projects.
• A foreign party, a sector-regulated contract, or a jurisdiction outside your state.
• Any point where the AI's reading and yours differ.

What to bring to make the consultation more focused:

• The contract in its final version and all attachments.
• The generated map, with the quotes already checked.
• The list of flagged risks and open questions, marking what is the AI's opinion and what is a fact in the text.
• The business context: what the company needs from the contract, what it can afford to lose and which deadlines matter.

Always separate three layers in the conversation: what is in the documentation or the text, what is experience using the tool, and what is hypothesis. The AI mainly produces the second and third, and the lawyer validates the first in light of the law. If you want to follow how AI regulation is changing, read about Brazil's AI regulation and what companies should watch.

How to apply this in your company: map, limit, pilot, transfer

The method we use for any AI process fits contract review well.

• Map: find out how contracts are reviewed today. Who receives them, who reads them, how long it takes, and where delays and missed deadlines happen. Choose one recurring contract type.
• Limit: define which data may be sent, which tool is allowed, who has access and what the AI never does, such as giving an opinion on validity or sending anything to the other party.
• Pilot: run the workflow on real contracts of a single type, recording the request, the answer and the check, with a success criterion agreed in advance, such as correct items in the map or deadlines that no longer slip by unnoticed.
• Transfer: hand the team the request script, the checking checklist and the escalation rule, and decide from the records whether to expand, adjust or stop.

The NIST AI Risk Management Framework offers useful language for this kind of decision: map the context, measure, manage and govern the use of AI. You do not have to adopt it in full, but it is a reminder that risk depends on the use, not only on the model.

Frequently asked questions

Can I trust AI to tell me whether a contract is safe to sign? No. AI can point out unusual clauses and relevant deadlines, but it does not know your business, the law that applies to your case or your negotiating position. Use the result as preparation and ask a lawyer to validate it before you sign.

Is it safe to send contracts to an AI tool? It depends on the tool, its settings and the content of the contract. Use a solution approved by your company, remove unnecessary personal data, check for a confidentiality clause and record who used it. If in doubt, consult your legal counsel and the ANPD guidance.

Which types of contract are good to start with? Start with common, recurring contracts, such as services, supply or leases, where the risk of error is lower and it is easy to compare against a company template. Avoid starting with complex, high-value contracts or those with a foreign party, which need a lawyer from the beginning.

How do I stop the AI from inventing clauses or deadlines? Require an exact quote for each item, allow it to answer "not found" and check the numbers against the original document. Split the request into small tasks and, if the errors keep repeating, go back to traditional reading and adjust your script before trying again.

Sources

• NIST: AI Risk Management Framework
• OWASP: Top 10 for LLM Applications
• ANPD: Autoridade Nacional de Proteção de Dados