AI contract review: what it automates and where it stops

TL;DR. AI contract review is the first pass over an incoming document, before a lawyer sits down with it. The system pulls out the key fields, shows how the document differs from your own template clause by clause, and flags risky wording with an explanation. A person still decides. Two things most write-ups skip: diffing against a template and judging risk are different mechanisms and must not be merged; and a contract pasted into a cloud chatbot has left your perimeter.

What AI contract review actually is

The contract arrives in the counterparty's edit. The lawyer then reads all of it — checks the structure, hunts for added and deleted clauses, marks the wording that shifts liability. An hour and a half per document. And that time goes into proofreading, not into deciding.

AI review covers exactly that part. What comes out isn't a verdict on whether the contract is good or bad — it's an annotated document: here's what differs from your norm, here are the clauses where the balance moved, here's why. The lawyer starts somewhere other than page one.

How it works: four steps

1. Parsing that preserves clause structure. The contract is read as a tree of clauses and sub-clauses, not as flat text. This isn't a technical nicety: lose the structure and moving a paragraph one page up reads as a change in substance, which buries the report in noise. PDFs with complex layout and scans need a real parser — the text layer alone won't do.
2. Key field extraction. Parties, subject, dates, amounts, payment terms, liability, termination. Structured data you can work with programmatically from there on.
3. Diffing against your template — deterministically. Which clauses were added, removed, rewritten. A language model has no business here: comparing two trees is an ordinary algorithmic task, and handing it to a model means volunteering a chance of invention where an exact answer exists.
4. Risk flagging — by the language model. This is where a model belongs: it reads the changed clause and explains what in the wording creates exposure, by category (liability, deadlines, penalties), quoting the text.

Splitting steps three and four is the main decision in the whole design. When diffing and risk judgment go to the model in one request, you cannot tell "the model found a real difference" from "the model made it up." Split them, and the list of differences is mechanically checkable, leaving only the interpretation in doubt. And that part is visible: every flag carries a quote.

What automates well

• Finding differences from your template, including the quiet edits mid-document — the ones a human eye slides past by page twenty.
• Extracting fields into a table — dates, amounts, details across a stream of contracts, with no manual re-typing.
• First-pass flagging of standard risks: one-sided termination, asymmetric penalties, vague acceptance deadlines.
• Volume work on same-shaped documents — routine supply, leases, addenda to a framework agreement. The bigger and more uniform the flow, the more obvious the gain.

What doesn't automate

Worth being precise here, because "hallucinations" as a word doesn't describe the problem.

• A missed error stays missed. Every flag is quote-verified: say "risk here" and show the fragment, or the flag is dropped. That works in one direction only. An invented risk gets filtered out; a risk the model never noticed is caught by nothing — it simply isn't in the report. So AI review shortens reading time without removing it for deals that matter.
• Case law and the history of the relationship. Wording that looks standard on paper can be painful with this particular counterparty, or in your particular industry. The model sees a document, not a history.
• Non-standard deals. M&A, complex real estate, government contracts, cross-border work — where the cost of an error is high and the document resembles nothing before it, first-pass annotation saves little.
• Liability. It can't be delegated to a system. Hence the "the system prepares the material, a person decides" construction — not cautious marketing language but an architectural requirement: the model has to explain every flag, otherwise you re-check it all from scratch anyway.
• Template freshness. Diffing runs against whatever document you consider the norm. If the template goes stale, so do the results — silently.

Where your contract text goes

The question nearly every write-up on this topic walks around. Paste a contract into a public chatbot and the document is on someone else's servers. For employees' personal data, the commercial terms of a deal, or a counterparty's project, that's a separate conversation about Russian data-protection law (152-ФЗ) and internal policy. Have it before rollout, not after.

Three options:

• Cloud API. Fast and cheap, fine for documents that were never confidential to begin with.
• Redaction before sending. Names, amounts, and identifiers are stripped out. It works, but only partly: the shape of a deal is often reconstructable from redacted text.
• Local inference. The model runs on the company's own server and documents go nowhere. More expensive in hardware — and the only option where "where is our contract right now" has one clear answer.

That third option isn't theory. On the call-analytics project we deployed the whole pipeline locally precisely because the recordings were not allowed to leave the client's perimeter. Contracts are the same problem underneath, and it gets settled during the audit, before any work starts.

Where to start

The sequence that saves money isn't "pick a tool." It's answering three questions first.

1. What counts as your norm. Until a reference template is pinned down, there's nothing to diff against — any tool will compare the contract to an abstract idea of a good contract rather than to yours. Usually it turns out the company has three templates, all slightly different.
2. What your volume is. Five contracts a month are cheaper to handle by hand than to automate. The conversation starts making sense somewhere north of a few dozen documents a month, and really pays off where the documents are alike.
3. Where the perimeter runs. The answer to the previous section drives budget more than anything else: cloud API and local inference differ by an order of magnitude in hardware cost. Deciding it after picking a tool means doing the work twice.

Then take two dozen contracts a lawyer has already reviewed and run them through the system. Comparing that against what the person found shows the real gain on your documents — before a budget is committed to it.

How we built it

• AI contract analysis: template diffing and risk detection — PDF and DOCX parsing that preserves clause structure, deterministic diffing against the reference template, risk flags by category with explanations. First-pass review goes from an hour and a half of reading to a report in minutes.
• Counterparty due diligence: an AI agent across registries and sanctions lists — the neighbouring problem: a tax ID goes in, a sourced opinion on the signing company comes out.

The mechanics of searching across documents are covered separately in the RAG assistant guide — it answers the adjacent question: how to find the right clause across thousands of documents, rather than how to review one.

If contract review has become your bottleneck — let's talk for 30 minutes.