← Blog Automating a process
Automate contract review with AI without trusting it blindly
You can automate contract review with AI, but the system shouldn’t decide on its own. AI works well for finding clauses, extracting obligations, and comparing a contract against an internal policy. Legal decisions still need human review.
Key takeaways
- AI speeds up the first read: it finds parties, dates, payments, termination, confidentiality, and other clauses that take time.
- The flow needs 5 steps: intake, extraction, clause search, playbook comparison, and traceable human approval.
- A summary isn’t enough: measure omissions, false positives, and citations before using AI on real contracts.
- Confidentiality must be designed: review retention, permissions, personal data rules, and whether documents train models.
What can AI do in contract review?
AI works best as a reading filter for contracts, not as an automatic lawyer.
A good system can receive a PDF, Word file, or email with attachments. Then it separates the text, identifies sections, and returns structured output: parties, dates, currency, payments, renewal, termination, and obligations.
It can also search for specific clauses. Examples include limitation of liability, exclusivity, intellectual property, confidentiality, jurisdiction, and data protection. If it finds something, it should cite the exact contract excerpt.
Microsoft Azure AI Document Intelligence has a prebuilt model for contracts. It uses OCR, extracts fields such as parties, jurisdiction, ID, and title, and returns JSON. The documentation says it currently supports English documents. For Spanish contracts, test with your own files before buying or building.
The American Bar Association says generative AI can assist with contract review, due diligence, compliance, and legal drafting. It also tells lawyers to consider competence, confidentiality, supervision, and client communication when using AI, in Formal Opinion 512. This article is not legal advice.
In practice, the question isn’t whether AI can read a contract. The question is whether you can prove when it’s right, when it’s wrong, and who approves the final decision. We treat it as a measurable AI automation flow with stricter legal controls.
How do you automate contract review step by step?
The flow works when every step leaves evidence. If there’s only a chat with the contract, it’s hard to audit what happened.
- Receive and classify the document. The system identifies contract type, language, version, attachments, and status. It doesn’t treat an NDA and a master services agreement the same way.
- Extract structured data. AI extracts fields in table or JSON format: parties, term, payments, renewal, penalties, jurisdiction, personal data, and signatures. Each field should store the source page or paragraph.
- Search for risk clauses. The system searches for clauses defined by the legal team. Examples include unlimited liability, automatic renewal, assignment without approval, or misassigned intellectual property.
- Compare against a playbook. The playbook says what the company accepts, what needs edits, and what must be escalated. Microsoft Copilot for legal matters uses a strategy notebook in Word, breaks it into rules, and reviews the document against them, according to its support documentation.
- Send to human review with traceability. AI proposes findings, but the lawyer or owner approves. They should see the cited text, applied rule, risk level, and suggested action.
Which option fits best: tool, platform, or custom build?
The best option depends on volume, confidentiality, language, and how much of your legal judgment is documented.
| Option | When it helps | Main risk |
|---|---|---|
| Feature in Word or a legal suite | Few contracts and a simple playbook | Hard to measure omissions in your operation |
| Legaltech tool | Repeated contracts and standard review | May not fit Latin American Spanish |
| Automation platform | Workflow with email, folders, and approvals | Falls short when review is complex |
| Custom build | High volume, sensitive data, or internal rules | Requires ongoing evaluation and operation |
Cost and timeline depend on contract types, document quality, repository integrations, and the human review level required. If you need to connect email, a document manager, or a CRM, design it with integrations and APIs, not as an isolated chat.
How do you validate that AI didn’t miss an important clause?
Validation should happen before production. Repeat it when contracts, models, or internal rules change.
First, build an evaluation set. Include real or anonymized contracts, scanned versions, attachments, and difficult cases. The legal team marks the clauses and risks the system must find.
Then measure three things. One: how many relevant clauses it found. Two: how many findings it invented or flagged incorrectly. Three: whether it cited the right text. If the system doesn’t cite the excerpt, review becomes guesswork.
NIST AI RMF 1.0 recommends measuring, evaluating, comparing, and monitoring AI risks. It says AI systems should be tested before deployment and regularly during operation. It also asks teams to document test sets, metrics, and tools used in testing and validation, in the AI RMF 1.0 framework.
There’s a practical reason to be strict. The study “Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools” reported that proprietary legal RAG tools hallucinated between 17% and 33% in the authors’ evaluation, in the Yale Institution for Social and Policy Studies report. The topic was legal research, but the lesson applies: plausible text still needs evidence.
Spanish contracts need more testing. The 3CEL paper says legal corpora for NLP in Spanish are scarce. It presents a corpus with 373 annotated tenders, 19 categories, and 4,782 labels for contract understanding, in 3CEL on arXiv. Don’t assume an English result will repeat in Spanish.
If the system searches your contracts or policies, it may work like a RAG system. In that case, measure excerpt retrieval, evidence-based answers, and omissions. We don’t want it to sound good. We want it to find what it was supposed to find.
What does an AI contract review look like in practice?
This example is illustrative. It doesn’t describe a client and doesn’t replace legal review.
Input: the procurement team uploads a vendor services contract in PDF. The contract has attachments, payment terms, confidentiality, intellectual property, personal data processing, and early termination.
Process: the system extracts fields, searches for clauses defined by legal, and compares each finding against an internal policy. If it finds unlimited liability or automatic renewal, it flags the issue.
Output: the owner receives a table with the finding, cited excerpt, applied rule, and suggested action. The options are accept, request a change, or escalate to a lawyer. The final decision stays in an approval queue.
Control: before production, the team tests known contracts. If the system misses critical clauses or cites the wrong text, it doesn’t go live. Rules, prompts, extraction, or search are adjusted.
Before uploading similar contracts, check training and retention. OpenAI says that, since March 1, 2023, API data isn’t used to train or improve models unless the customer opts in. It also says abuse monitoring logs are retained by default for up to 30 days, with special controls for eligible customers, in its API data guide.
If your workflow handles Colombian personal data, review local rules. Colombia’s SIC Circular 2 of 2024 says Statutory Laws 1266 of 2008 and 1581 of 2012 apply to data processing used to develop, test, monitor, or implement AI systems. It also says privacy by design and by default is a proactive measure, and that an impact assessment may be needed when there is high risk for data subjects, in the compiled text of Circular 2 of 2024.
What we do
Frequently asked questions
How do you automate contract review without replacing the lawyer?
Use AI to prepare the review. It can extract data, search for clauses, compare against a playbook, and generate a report with citations. The lawyer or legal owner reviews the findings and approves the decision. The system should show which rule it applied and which text it used.
How do you search for specific clauses in contracts with AI?
Define a closed list of clauses and examples. Then the system searches for related excerpts and returns the exact citation, not only a summary. Test with contracts where you already know the answer, so you can measure misses and false alerts.
What tool works for reviewing contracts in Spanish?
It depends on your contracts. Some tools work for summaries, but fail with local language, attachments, or negotiated clauses. Before choosing, test with real Spanish contracts, measure omissions, and check whether the tool supports your playbook and privacy controls.
Can AI detect abusive or risky clauses?
It can flag clauses that match criteria defined by legal. That isn’t the same as an automatic legal conclusion. For abusive clauses, governing law, or negotiation strategy, the output should be reviewed by a legal professional.
Is it safe to upload confidential contracts to an AI tool?
It can be safe if the provider offers the right controls and your company configures permissions, retention, audit logs, and data processing rules. Don’t upload confidential contracts to personal tools without an enterprise agreement. Check whether data is used for training and how long it’s retained.
Written by
Quarl engineering team
We are an AI engineering team in Medellín. We build and run systems that reach production — automations, assistants and agents — and for three years we ran an assistant for two million users across ten countries.
See how we work →Want to apply this in your company?
In fifteen minutes we tell you whether it is worth it, free and with no pitch. The proposal arrives within 48 hours.