AI NDA Review: Apply Your Standards and Redline in Word
Caitlin Price, Social Media & Content Marketer•Published •Updated
AI NDA review helps in-house counsel compare a nondisclosure agreement with company positions, investigate departures, and prepare proposed edits. When a vendor or prospective partner sends its paper, the review should produce a checked issue list and redline that explain what you can accept, what to negotiate, and who must decide any exceptions.
GC AI is an enterprise legal AI platform built for in-house legal teams and used by 2,100+ legal teams, including those at Nestlé, Riot Games, and Wayfair. Use it to review NDAs against your company's positions and prepare advice for the business.
Our CEO and co-founder, Cecilia Ziniti, served as general counsel at Anki, BloomTech, and Replit after working in-house at Amazon and Cruise. She built GC AI around the work of helping a company achieve its goals. For an NDA, that means connecting the contract language to the information the business plans to share and the obligations it can perform.
Triage the NDA Before Starting the Review
First establish whose form you have, which parties will disclose information, and what the discussion involves. An unchanged company template may qualify for business approval under your policy. Counterparty paper, changes to an approved form, or a disclosure outside that policy call for legal review.
On CZ and Friends, GC AI's podcast with legal and business leaders, Chuck Kable, then general counsel and corporate secretary at Innovative Renal Care, recalled a CFO's request for the company's template NDA:
It took three attorneys, two days, maybe three.
Kable introduced a self-service process that generated the stock form and retained a Word copy for lawyers if negotiations followed. His team's form-generation process illustrates a useful routing decision: give approved-form requests a defined path, and direct lawyers to the agreements that need negotiation.
For counterparty paper, ask the deal owner what each side will disclose, who needs access, and whether the information includes source code, sensitive technical material, or trade secrets. Those answers determine which company positions apply.
Apply Your Company's Positions to the Vendor's NDA
Use GC AI Playbooks to review NDAs against your team's approved positions. Each Playbook stores preferred terms, conditional fallbacks, and review criteria, then compares NDA clauses against those standards to flag departures and suggest changes for lawyer review. Agree on your team's positions and escalation rules in an NDA review playbook before using them as review instructions.
Consider an illustrative vendor NDA. Your company is evaluating a software vendor. You will share product roadmaps, and the vendor will share technical architecture. The vendor supplies a mutual NDA.
Your team's instructions reject permission to reuse confidential information from memory and allow a limited backup-retention exception after IT confirms how it would work. These are hypothetical positions your team could choose for the example; they do not define market standards or report product-test results.
Prepare the review in this order:
-
Confirm that you have the complete current NDA, including any incorporated terms or attachments. Identify unreadable text or missing documents before drawing conclusions from an apparent omission.
-
Supply the company names, disclosure purpose, information flows, and relevant approved positions. Use an account and configuration authorized for that information.
-
Open the NDA in Word, open the GC AI add-in, and select the team's Playbook. Identify the document as counterparty paper and add the matter-specific context.
-
Run the review. Inspect the analysis, suggested changes, issues outside the Playbook, and escalation items.
Playbook review labels checks Pass, Fallback, or Flag. Pass indicates a match to the preferred position; Fallback indicates a conditional position; Flag identifies a conflict or missing required information.
Our customer KT Farley, Chief Privacy Officer and Associate General Counsel at Helix, says:
Junior teammates now run the checklist prompt first and bring me the output as the predicate for my review.
Give the reviewing lawyer the findings alongside the source NDA and the company instructions used for that run.
Check These 11 Areas in the NDA
The appropriate position depends on the disclosure, your company's requirements, and applicable law.
| Area | What to Check |
|---|---|
| Parties and permitted recipients | Confirm the legal entities and who may receive information, including affiliates, employees, and advisers. Check conditions on onward disclosure and responsibility for recipients. |
| Mutual or one-way obligations | Match the obligations to who will disclose and receive information. A mutual title alone does not establish reciprocal protection. |
| Definition of confidential information | Read the confidentiality clause for covered information, marking requirements, oral disclosures, and exclusions. |
| Term and survival | Separate the agreement's term from the survival of confidentiality duties. Check whether a fixed end date fits the information, including material that may remain a trade secret. |
| Permitted use and exclusions | Check the stated purpose and treatment of information already known, independently developed, publicly available, or lawfully received from another source. Inspect any proof requirements. |
| Compelled disclosure | Check notice where legally permitted, protective measures, and limits on disclosure required by law or legal process. |
| Residuals | Identify permission to use information retained in unaided memory. Assess what that permission would allow in light of the information you plan to disclose. |
| Return or destruction | Check triggers, deadlines, and treatment of legal holds, backups, retained copies, and continuing duties, including after termination. |
| Non-solicitation | Review any non-solicitation clause for its business purpose, scope, and enforceability under applicable law. |
| Remedies and additional obligations | Identify remedies for breach, IP transfers, indemnities, liability allocations, fee-shifting, and other commitments beyond confidentiality. |
| Governing law and jurisdiction | Compare the governing law and dispute forum with approved positions. Identify departures requiring a legal or commercial decision. |
A clause can affect another clause's meaning. For example, a narrow permitted-use provision may offer less protection if a residuals clause separately allows broad reuse.
Verify the Findings Against the Source
AI can miss an issue or suggest an unsuitable change. At this checkpoint, counsel verifies the findings and proposed treatment against the complete NDA and company instructions. A review with no flags does not establish approval to sign.
Our Exact Quote feature opens cited source language so you can inspect the passage supporting a finding. Read its definitions, exceptions, and related provisions before accepting the analysis.
In the illustrative vendor NDA, two findings might require different next actions:
| Illustrative Source Language | Departure and Next Action |
|---|---|
| Section 8: “Recipient may use Confidential Information retained in unaided memory for any purpose.” | This conflicts with the supplied instruction against reuse of confidential information. Counsel proposes deleting the permission and checks whether another provision grants similar rights. |
| Section 7: “Within five business days after written request, Recipient shall destroy all Confidential Information and all copies, including backups.” | The company instruction permits a limited backup exception. IT must confirm the active-system deletion deadline, backup retention cycle, and access restrictions before counsel proposes wording the company can perform. |
Keep the operational question open until its owner answers. The contract identifies an obligation; it does not establish that your systems can meet it.
Redline the NDA and Explain the Changes to the Business
With GC AI for Word, you can request proposed redlines to selected provisions or the full agreement. Give it the verified issue and intended position, then inspect the tracked changes in Word.
IT confirms that the company can meet the five-business-day deadline for active systems, but cannot selectively purge routine backups on demand. An illustrative replacement for Section 7 could read:
Upon written request, Recipient shall destroy Confidential Information in its active systems within five business days. Recipient may retain copies required by applicable law or a valid legal hold, and copies in routine backups until deletion under its ordinary retention cycle. Retained Confidential Information remains subject to this Agreement's confidentiality and use restrictions. Recipient may access retained copies only for legal compliance or disaster recovery.
This language assumes the stated IT confirmation. Counsel would still need to check the retention cycle, the agreement's defined terms, and whether confidentiality and use restrictions continue for the retained copies.
For Section 8, request deletion of the residuals permission under the supplied company position. Check both changes in context, accept or reject the proposed edits, and prepare the version you intend to send.
Ask GC AI to draft a short business note from the checked findings and redline. An illustrative note might say:
Legal proposes removing the permission to reuse confidential information from memory and adding a limited exception for routine backups and required retention. IT has confirmed the active-system deadline and backup process. Please confirm that the planned exchange covers product roadmaps and technical architecture. If the vendor insists on residuals rights, return the issue to legal before sharing the roadmaps.
Compare the note with the redline. The business should receive the conditions counsel intends to approve, including any disclosure that must wait.
Review the Counterparty's Response and Final Version
Suppose the vendor accepts the backup exception but retains residuals rights. Apply an approved fallback if one covers the proposed language and disclosure. Otherwise, explain the remaining risk to the person authorized to approve the exception. The deal owner can explain the commercial need; the designated approver decides whether to accept the departure.
If the parties agree to remove residuals rights, compare the returned draft with your last reviewed version. Check that the deletion survived and that another provision does not restore the same permission.
Before signature, confirm the final text, parties, permitted purpose, recorded exception approvals, and signing authority. The person who approves a risk exception and the person authorized to sign may be different people.
Keep the executed NDA and approval record in your team's designated system. Retain the permitted-use and deletion obligations where the business and IT owners can find them. If the negotiation supports a change to the shared standard, have the Playbook owner approve and save that change deliberately. A concession for one vendor should carry its matter-specific context.
Choose AI NDA Review Software by the Work You Need
Compare products using the same NDA, company positions, and required deliverables. If intake routing, approvals, signature, and repository administration drive the purchase, include those requirements in the evaluation alongside clause analysis.
We recommend GC AI for in-house teams that want to connect a shared review standard with source checks, a negotiated document, and advice to the business. Test that recommendation on a representative NDA your team is authorized to process.
Require a findings list with source references, a proposed Word redline, and a short business recommendation. Check whether the output:
-
Identifies known departures and distinguishes missing text from missing source documents.
-
Applies the supplied position and any fallback conditions.
-
Keeps the recommendation consistent with the proposed contract language.
-
Identifies unresolved questions and the people who must answer them.
Record missed issues, unnecessary edits, and the time needed to reach a checked deliverable. Bring that NDA and your company guidance when you see GC AI in action.
