A human-verification protocol for AI contract review: the missing piece in most law firms

More and more firms use AI tools for the first pass of a contract review: clause extraction, comparison against templates, detection of deviations. The technology works reasonably well, but practice has outrun governance: in most cases there is no document fixing who verifies what, at what depth and how that supervision is recorded. That protocol is today the piece separating professional use of AI from improvisation with ethical risk.

The duty is not new; the context is

The duty of supervision did not arise with AI: the lawyer has always answered for the work of associates, paralegals and suppliers. What changes with AI is speed and the appearance of reliability. A contract reviewed by a system that is right ninety-five per cent of the time creates a cognitive trap: the human reviewer tends to trust and skim. The protocol exists to counter exactly that, and European professional guidelines, starting with the CCBE guide on generative AI we analysed in this section, already demand it clearly.

Three risk tiers, three review depths

A realistic protocol does not demand the same review for everything. The first tier covers low-risk, highly standardised documents, such as non-disclosure agreements based on the firm's own template: here human verification can focus on the fields the system flagged as deviations plus a sampling read. The second tier, ordinary commercial contracts with negotiated clauses, requires full review of the substantive clauses even if the system has not flagged them: price, term, liability, termination and governing law. The third tier, singular or high-value transactions, returns to traditional full review and uses AI only as documentary support, never as a filter for what gets read.

Checkpoints and record-keeping

Two habits make the protocol auditable. The first is the mandatory checkpoint: the system does not deliver a final result until an identified person confirms they have completed the applicable review level. The second is the minimum record: which tool was used, which version of the document was processed, which review level was applied, who supervised and what issues were detected. Five fields in the file that, besides disciplining the work, are the best defence if a client or a court ever asks how that contract was reviewed.

How to implement it in two weeks

Implementation requires no consultants. The first week goes to inventorying reality: which AI tools are already in use, on which contract types and with what informal review. The second week, the protocol is drafted, two pages are enough, an owner is appointed and the team is briefed with two real examples. From then on, a one-hour quarterly review suffices to check the record is being kept and adjust the tiers if a contract type is misclassified. What does not work is the perfect twenty-page protocol nobody reads: a short one that gets applied beats an impeccable one that gets archived.

The cost of implementing it is low and the return immediate: fewer scares, a better defence of service quality and a commercial argument before clients who ask, increasingly, how their firm uses AI. Complement the reading with our analysis of AI and professional secrecy, the CCBE guide and the case of sanctions over AI-invented case law, the reminder of what happens when verification fails. More in our legal AI section.