Reviewing contracts with AI without losing control: a workflow with human oversight

Contract review is probably the task where AI has entered law firms earliest and most forcefully: clause extraction, comparison against templates, deviation detection. The risk is not in using it, but in using it without a workflow, so that nobody knows what the machine reviewed and what the person decided. This is a workflow that integrates AI while keeping professional control at the points that require it.

Phase 1: preparation and the confidentiality boundary

Before uploading anything to any tool, two decisions: which documents may leave the firm's perimeter and under what guarantees. The practical rule is that only what the client authorises, or what has been genuinely anonymised, leaves the building, and remember that removing names does not always anonymise: metadata and contract context can identify the parties. This boundary must be part of the firm's internal AI policy, as set out in Interpretative Circular 3/2026 of the Code of Ethics and in our guide on which clauses to demand from an AI vendor.

Phase 2: extraction and clause mapping

AI delivers its greatest value in the first sweep: identifying parties, subject matter, deadlines, penalties, jurisdiction, exit clauses and annexes, and building a map of the contract that can be compared against the firm's template or the checklist for that transaction type. At this phase the output is raw material, not analysis: it lets the lawyer read the contract with a smart index in hand instead of starting cold.

Quality control here is mechanical but non-negotiable: verify against the original document every extracted data point that will have consequences (amounts, dates, percentages). Hallucination in extraction is less frequent than in generation, but it exists, and the lawyer answers for it as if they had written it themselves.

Phase 3: comparison and deviation detection

With the map validated, the tool compares the contract against the standard: missing clauses, deviating language, thresholds that differ from the usual. This is the phase that saves the most time in document-heavy transactions, and where the temptation to delegate judgement must be resisted most: an atypical clause is not necessarily unacceptable, and a standard one is not necessarily convenient. AI tidies the terrain; risk assessment remains the lawyer's.

Phase 4: decision and traceability

Recommendations to the client must be reconstructable: what was detected, what was manually verified, what was decided and why. A simple practice is to add a methodological annex to the report distinguishing automated work from professional analysis. Besides being a guarantee for the client, it is the best internal defence against a future claim.

Points of no return

Some decisions should never leave the human phase: the aggregate risk assessment of the transaction, the negotiation strategy, the acceptance of liability or penalty clauses, and any communication to the client. AI can prepare all of them; signing them off is another matter.

Common mistakes when starting out

Firms starting out tend to fall into three traps: using the general-purpose tool of the moment instead of one with proper legal contractual guarantees; asking directly for the final report instead of going phase by phase, which makes the process unverifiable; and not recording which tool and version was used on each matter, which complicates any later reconstruction. Starting with a bounded pilot (one contract type, one client, one responsible lawyer) allows the workflow to be tuned before rolling it out.

To go deeper into the technique, see our guides on legal prompting for law firms and on the AEPD's generative AI policy, plus our analysis of the Tirant study on Spanish lawyers' real use of AI.