How to Use AI in a Contract Approval Workflow

At Wayfair, senior counsel Lauren Anderson and her team reviewed close to 300 agreements in two and a half months at year-end. She used GC AI for a first pass, then focused legal attention on each contract’s spend and risk. That review is the starting point for a contract approval workflow.

A new software vendor that will handle customers' personal data may need privacy, security, and data-processing review; under company policy, an unchanged routine renewal may require less scrutiny.

On GC AI's podcast CZ and Friends, CEO Cecilia Ziniti interviews legal and business leaders about leading teams and using AI at work. Anderson explained how she starts a review:

Here are these four things that I care about, are they contained in this agreement?

Once the review identifies what needs approval, send each issue to the person your company's rules put in charge. Record the decision and anything that must happen before the deal can go ahead.

GC AI is a turnkey legal AI platform used by 2,200+ legal teams as of November 2026, including 300+ public companies. Customers include TIME, SKIMS, and Columbia Sportswear.

For contract approval, GC AI can compare the contract with your company's rules and draft a summary with links to the source documents. Your company's rules say who can approve the spending, data use, and contract terms. GC AI helps those people review the information.

What Needs to Happen Before a Contract Can Be Approved?

A lawyer may decide that the contract language is acceptable, but different colleagues may still have to approve the spending or a departure from company policy. And the person who accepts that business risk may not be the person authorized to sign.

The process starts with the business request and the contract. Legal, finance, privacy, and security reviewers check the parts assigned to them. Before anyone signs, confirm that the required people have approved the deal, the steps required before signing are finished, and the signer has permission to sign for the company. Afterward, save the signed contract and its approval record.

A negotiated change can undo an earlier approval. If the price, intended data use, or accepted liability changes after someone signs off, the affected decision has to be reconsidered before the contract is released.

Put one person in charge of tracking the request’s progress and unfinished conditions. This coordinator keeps the requests, answers, and supporting documents together. Each approver handles only the decisions that company policy allows them to make.

Two policies guide that work. Your contract review policy says when a contract needs review. Your delegation of authority policy says who can approve spending, accept an exception, or sign. The workflow puts those rules into practice for each deal.

Who Has to Approve What?

To see how those rules work together, let’s use a company buying a software service as an example.

The contract costs $80,000 a year for three years, plus a $20,000 setup fee. In this scenario, the CFO must approve purchases that commit the company to more than $100,000 over the initial contract term. Three years of fees plus setup comes to $260,000, so the purchase needs the CFO's approval.

The vendor's software will process customer personal data. Assume the buying company normally requires a $160,000 vendor liability cap for data-breach claims, twice the $80,000 annual fee. The vendor instead proposes to cap its liability for those claims at $80,000, so accepting that lower cap would require an exception to the buyer's approved position. The purchasing company requires privacy and security clearance, plus approval by the general counsel and VP of that liability exception. All of those requirements apply to this purchase.

A liability cap limits what the vendor would have to pay for claims covered by that clause. Accepting a lower cap means accepting more risk. That is a separate decision from approving the price. The table shows who needs to decide what in this example. These roles and spending limits are made up; use your company's own rules for a real deal.

Skipping a required review needs its own approval. First check whether company policy allows that review to be waived. If it does, ask the person named in that policy to approve the waiver.

For a real purchase, check which costs your company's rules require you to count. Renewal terms, optional purchases, usage fees, contract changes, different currencies, and related purchases can affect the total or the approval rules. If some charges are unknown, say so in the approval request.

A low price does not remove the need for privacy or security review. And the CFO's approval to spend money does not also approve a change to the liability cap. Keep those decisions separate from permission to sign.

Give Each Approver the Information Needed to Decide

Once you know who needs to decide, give each person the information they need. Start with the legal intake details: which company will sign, what it wants to buy, who requested the purchase, when an answer is needed, and how the vendor will use company or customer data. Gather the order form and all the terms, schedules, and amendments that apply.

For the software purchase, an order form alone may not include the liability terms. You also need the agreement it refers to. And calling the product “analytics” does not explain which customer data the vendor can access. Get those details before asking someone to approve the risk.

Put those details into a decision packet: a short summary of what needs approval, the supporting documents, and any unanswered questions. For the CFO, it could look like this:

Decision requested: Approve $260,000 for the software's first three years, including the $20,000 setup fee.

Supporting information: The order form, the contract terms it refers to, the cost calculation, confirmation from the person responsible for the budget, and the company's spending approval rule.

Open question: Are there usage charges or other costs that company policy requires you to include?

Decision record: Save the CFO's answer, date, what it covers, and any conditions. The spending request stays open until that answer is recorded.

The privacy and security teams need a request about data use. The general counsel and business VP need one about the lower liability cap.

Give each person the relevant contract language, the company's rule, the lawyer's recommendation, and any conditions. Keep the requests, document versions, and decisions together so everyone can see what has been agreed.

At Snyk, Senior Managing Counsel Alexis Palmer used GC AI to find clauses about ending a contract and summarize them for accounting. Those clauses were scattered through a long enterprise agreement.

For an approval request, the same approach gives the person making the decision the relevant contract terms and the lawyer’s recommendation. Palmer explained why the lawyer still needs to weigh the risks:

It doesn't replace the human element of risk assessment, it just gives me the time to focus on that part.

How GC AI Helps Prepare and Check the Packet

For the first draft, provide GC AI with the contract and your company’s rules: spending limits, who can sign, and the contract terms the company normally accepts. Files lets legal teams organize those reference materials for reuse. If two policy versions disagree, the lawyer must confirm which one applies before naming the approver.’

With Playbooks, a lawyer can check the vendor's liability clause against the company's preferred wording and the backup terms it allows. The lawyer decides which differences need approval. GC AI can then pull the sources and unanswered questions into a draft summary:

Example prompt: Contract approval decision packet

Use the attached contract, company standards, approval rules, and signing rules to prepare a decision packet. Separate contract facts, company rules, recommendations, and missing information. Cite the contract clause and policy section behind each issue. Name the person who needs to decide only when the supplied rules identify that person. Show the total cost and flag unknown charges. List anything that must happen before the deal can proceed and who needs to act next. Leave the approval fields blank.

Use the draft to prepare a separate request for each person who needs to approve the purchase.

For this example, that means the CFO, privacy and security reviewers, and the general counsel and business VP. Keep each request open until the right person has made and recorded the decision.

Before sending those requests, the lawyer checks the draft against the source documents. Exact Quote opens the cited passages so the lawyer can check the liability cap, any exceptions, the policy version, and the amounts in the cost calculation. Check the arithmetic, too, and correct any errors.

If accepting the lower liability cap depends on changing the contract, GC AI for Word can help draft those changes directly in Word. Senior commercial counsel Laura Knight describes first-pass redlines against her company's templates, including “clear, concise explanations for edits.” The lawyer checks the changes and includes them with the approval request so the approver can see the proposed wording.

Once the packet works well, save its instructions in GC AI's Skill Library. A teammate can use the same structure for the next contract, then check that deal's facts and the current company rules. Approval of an exception for one deal does not change the rule for every future deal.

What Happens When Approval Comes With Conditions?

Even with the right information, an approver may say yes only if a safeguard is in place. Sharon Johnson, Mode Global's SVP and chief legal officer in the episode, starts by asking what the business wants to accomplish:

Our default on our team is really trying to figure out, what are you trying to accomplish? How can we get there safely?

When a prospective customer asked Mode Global to establish operations in Mexico, winning the business was uncertain. Johnson's team prepared the entity and compliance groundwork while structuring commitments, including a potential lease, so they could fall away if Mode Global did not win the deal. Mode Global won the deal. Johnson's example shows how legal can define conditions that protect the company while allowing a business opportunity to proceed.

Apply that idea to the software purchase. Suppose the security team allows the vendor to use only a limited set of customer data. The business VP accepts the lower liability cap only if that limit is enforced. Record which data is allowed, who will enforce the limit, and what proof is needed before signing. “Approved subject to security” is too vague to tell anyone whether the deal is ready.

A conditional yes comes with limits. Check what must happen before signing and what the company allows you to finish afterward.

Make that visible in the approval record. Is the request waiting for an answer, approved, approved with conditions, sent back for changes, rejected, or reopened after a change? Record who decided, which contract version and terms they approved, and who needs to act next.

Track those answers in the system or record your company uses for approvals. Wait to send the contract for signature until all required decisions are recorded and all conditions that must be met before signing are complete.

Some reviews can happen at the same time. Finance can check the cost while privacy and security check data use, as long as each team has the information it needs. Other decisions may depend on those answers. If security allows only limited data but the business needs the full customer dataset, bring the conflict back to the people who made those decisions. They need to agree on a plan that works before the purchase can proceed.

If someone cannot respond, follow the company's rules for asking a backup approver or taking the question to someone else. If no one else has permission to decide, the request stays open, even when a deadline is approaching. Once the required decisions are recorded, the coordinator can check whether the contract is ready for signature.

When Is the Contract Ready to Sign?

The last approval does not mean that any later version can be signed. Before release, the coordinator must confirm that all decisions cover the final contract, pre-signature conditions have been met, and the designated signer has authority for the contracting entity and transaction. For the hypothetical software purchase, the finished record could look like this:

Illustrative release record

Final documents and cost: Request SW-026; order form version 4 and agreement version 3, which the order form refers to. The total for the first three years is $260,000. The person responsible for the purchase confirmed that no other costs need to be counted under the example policy.

Spending: The CFO approved this amount and purchase, with confirmation from the person responsible for the budget.

Data use: Privacy and security approved the limited set of customer data. The person setting up the software provided proof that the data limit was in place.

Liability exception: The general counsel and business VP accepted the lower liability cap for that limited data use. The lawyer checked that the final contract used the wording they approved.

Ready to sign: All conditions required before signing are complete. The signer has permission to sign for this company and deal. The person responsible for the contract will save the signed version and approvals and track the renewal notice date.

For a real deal, keep the relevant contract clauses and company rules beside each decision, along with the person's name and the date. The example above shows how employees would record their approvals in the company's approval system.

Keep checking until the final contract is signed. If the vendor changes the liability clause after approval, send the new wording back to the people who approved the earlier version. For a contract change or renewal, check whether the earlier approvals still cover the price, term, data use, and risks. Recalculate the cost when company policy requires it.

After signing, save the signed contract and approval record under the company's recordkeeping rules. Name the people responsible for ongoing safeguards, contract obligations, and renewal notices, and give each task a due date. Keep track of anything the company allows you to finish after signing. Only move a required pre-signing task until later if company policy allows it and the right person approves the change.

Test the Process on One Recent Contract

Before using this process on a live deal, try it on a contract your team has already finished. Give GC AI the contract and the approval rules, and ask it to draft a decision packet. Then ask a teammate to compare the draft with the approval record. Did it identify the right people, cite the right documents, use the correct contract version, and capture the conditions?

Next, imagine the vendor changes a clause just before signing. Would your process send that change back to the people whose decisions it affects? Use any missing source, wrong approver, or unfinished condition you find to improve the instructions before the next live request.