Back to Blog
In-house legalReview & risk

Reviewing NDAs and vendor agreements at volume without reading every line

In-house teams face contract volume that no amount of headcount fixes. Playbook-driven review changes what a lawyer spends attention on.

The volume problem in-house teams actually have

The characteristic in-house problem is not that contracts are hard. It is that most of them are not hard, and there are too many of them for that to help.

NDAs, vendor agreements, purchase terms, statements of work and renewal notices arrive from every function in the business, on the counterparty's paper about as often as on the company's own. Most are unremarkable. A minority contain something that matters: an uncapped indemnity, an assignment of IP that should have been a licence, a term that auto-renews for three years, a governing law clause nobody would have agreed to if asked. The routine ones and the dangerous ones sit in the same queue and look the same from the outside.

This produces two failure modes, and teams usually have both. The first is delay: legal becomes the bottleneck, the business waits, and eventually a manager signs something unreviewed because the deal could not wait. The second is flattening: to keep up, everything gets the same shallow pass, so the unremarkable contracts absorb more attention than they need and the dangerous one gets no more than they do.

Adding headcount addresses the queue but not the structure. What changes the structure is deciding in advance what counts as acceptable, so that reading only happens where the answer is not already known.

What a legal playbook is, in operational terms

A playbook is the team's positions written down precisely enough to be applied by someone who was not in the room when they were decided.

For each clause type it states three things: the preferred position, the range that can be accepted without escalation, and the point past which the answer is no. A limitation of liability entry might set the preferred cap, the lower cap acceptable for low-value vendors, the carve-outs that must survive any cap, and the categories that cannot be capped at all. Each entry ideally carries the fallback language to propose, not just the standard, because a negotiator needs a sentence to send back rather than a principle.

Most teams already have a playbook, distributed across senior lawyers' heads, a template folder and the memory of past negotiations. Writing it down is the work, and it is legal work rather than software work. Doing it surfaces disagreements that were never resolved, positions that made sense for a business the company no longer is, and clauses where the honest answer is that it depends and needs to stay a human decision.

Automation only becomes possible after this. A tool applies a playbook; it cannot supply one. Asking software to infer a risk appetite from past contracts is asking it to reproduce the inconsistencies in them.

Automated redlining: what it sorts and what it escalates

Automated review works by comparison, not comprehension. It identifies which clauses are present, classifies them, compares each against the corresponding playbook entry, and sorts the result into three groups: conforming, deviating within the acceptable range, and outside it.

The value is in the sorting more than in the markup. A reviewer who opens a contract already knowing that eleven clauses conform, three deviate acceptably and one sits outside policy is doing a different job from one who opens at page one. The generated redlines for the deviating clauses are a starting draft, useful because someone has to type the fallback language, not because the tool decided anything.

Two failure modes deserve planning for. Missing clauses are harder than bad clauses: a tool comparing clause by clause can pass a contract that is silent on limitation of liability altogether, which is usually worse than a poor cap, so a playbook should be checked for presence as well as content. And non-standard drafting defeats classification — an obligation spread across three sentences in an unrelated section, or a defined term that quietly redraws the scope of "Confidential Information", will not be caught by clause-level matching.

The design principle that follows is that the escalation path matters more than the accuracy rate. A system that flags too much is recoverable. One that silently passes what it did not understand is not. Prefer tools that report what they could not classify.

Multi-jurisdiction clauses and where automation stops

Playbook automation assumes the answer is knowable in advance. Cross-border work is where that assumption stops holding, and it is worth being precise about why.

Part of it is genuinely mechanical and automates well: identifying the governing law and forum clauses, noticing the absence of an arbitration clause, checking that the data protection terms reference the right regime, flagging that a template written for one jurisdiction has been reused in another. That is presence-and-consistency checking, and it is a reasonable thing to hand to a tool.

What does not automate is whether a clause is enforceable, or advisable, where a dispute would actually be heard. That depends on local law, on how local courts have treated similar terms, and on the commercial relationship. A tool that offers a jurisdiction-specific conclusion is making a claim it cannot support. A tool that flags that a clause was drafted for a different jurisdiction and should be confirmed with local counsel is doing the useful part.

The honest framing is that automation changes which contracts reach a qualified lawyer, not whether one is needed. Across a multi-jurisdiction portfolio the realistic goal is that every contract requiring local advice is identified as requiring it, and the rest clear without it. That is a routing problem, and routing is something software does well.