Contract Review: The Process and Steps for In-House Counsel

Contract review is the process of checking an agreement against the business deal, the company's approved positions, and applicable law, then deciding which terms to accept, negotiate, or escalate before signature.

For in-house counsel, the hard part often comes after finding the clause. The vendor will not change its terms. Security needs an answer before launch. An amendment changes the provision everyone has been reading. A useful review connects the language to a recommendation and puts the decision with someone authorized to make it.

GC AI is an enterprise legal AI platform built for in-house legal teams. Our CEO and co-founder, Cecilia Ziniti, was a general counsel three times and worked in-house at Amazon and Cruise.

Ziniti built GC AI to solve problems she encountered firsthand as an in-house lawyer.

In contract review, that shows up in workflows that apply company Playbooks, let counsel verify source language through Exact Quote, research legal questions, and carry proposed edits into Word. As of October 2026, 2,100+ legal teams, including 300+ public companies, use GC AI. Our customers include SKIMS, Wayfair, Bass Pro Shops, and TIME.

What Is Contract Review?

A contract review tests whether the written agreement delivers the deal the business expects and identifies the legal, financial, and operational risks it creates. Its output should include proposed changes, unresolved questions, and a recommendation about the terms the company can accept.

Contract review connects to five separate decisions:

• Review: What does the agreement require, and what should change?
• Negotiation: Which changes should the company request, and what can it offer in exchange?
• Exception approval: Who may accept a departure from company policy?
• Signing: Who is authorized to commit the company to the final agreement?
• Contract management: Who owns the obligations and deadlines after signature?

One person may perform several roles. Record the authority for each decision so a legal recommendation does not become an assumed business approval.

Contract Review at a Glance

These six principles guide an in-house contract review from intake through signature and handoff.

• Document set: Review the complete agreement, including documents that change or override the main contract.
• Risk: Assign review depth based on the exposure. A small purchase can still create significant data or operational risk.
• Company positions: Use an approved playbook to identify deviations, then check how the clauses work together.
• Exceptions: When the counterparty refuses a change, assess feasible mitigations and route the remaining risk to the authorized approver.
• AI assistance: Use AI to prepare and investigate issues. Verify the contract passages and legal authorities before relying on the analysis.
• Handoff: Finish with an approved signature version, a record of exceptions, and owners for the obligations.

The Contract Review Process in Six Stages

Use these six stages for a new agreement, renewal, or amendment. Adjust the depth to the risk and the company's review policy.

1. Intake: Establish the deal and the complete document set.
2. Risk Triage: Choose the reviewers and depth of review.
3. First Pass: Apply the company's approved playbook.
4. Clause Review: Read material terms together.
5. Negotiation: Choose the changes that matter and escalate exceptions.
6. Approval and Signature: Verify approvals, the final agreement, and the handoff.

Intake: Establish the Deal and the Document Set

Ask the business owner what the company is buying, selling, licensing, or promising. Confirm the contracting entities, commercial value, term, launch or renewal deadline, and consequence of delay. Identify who can answer questions about the service, money, data, and implementation.

Collect the main agreement, order form, statement of work, data processing agreement (DPA), security schedule, and any incorporated terms that apply. Save the version of online terms the draft incorporates, and check whether the counterparty can change them later. For a renewal or amendment, include the signed original and every relevant amendment. Ask which version the counterparty expects the company to sign.

Existing agreements can change the review. Before negotiating a renewal, establish what governs today.

Our Contract Intelligence groups related agreements and amendments and presents their Current Terms with source references. Counsel checks the document family and the operative amendment before using that result as the starting point.

By the end of intake, the team should have a complete review packet, a clear business objective, a deadline, and owners for any missing information.

Risk Triage: Choose the Reviewers and Depth

Contract value is one input. A modest software purchase with production access can warrant more scrutiny than a larger purchase on approved terms.

Assess the agreement across five dimensions:

• Exposure: personal data, confidential information, intellectual property, regulated activity, safety, or business continuity.
• Commitment: total cost or revenue, duration, renewal, exit costs, and remedies.
• Complexity: multiple documents, amendments, jurisdictions, unusual provisions, or unfamiliar law.
• Leverage: whose paper it is, whether terms can change, and whether the business has a workable alternative.
• Timing: the deadline and the time other reviewers need to answer.

Define what each tier changes. Standard paper within approved parameters may follow a delegated route. A data-intensive service may need legal and security review. An unfamiliar jurisdiction or material issue outside the team's expertise may need specialist counsel. Follow the company's approval policy at every tier.

By the end of triage, the team should know the review route, which specialists are needed, and when legal can give its first response based on the available inputs.

First Pass: Apply the Company's Approved Playbook

A contract playbook makes the team's position usable: the preferred term, an acceptable fallback, the escalation trigger, and the person authorized to approve an exception. Identify whether the company is the buyer or seller before applying it. A favorable liability cap for one side may be unfavorable for the other.

With our Playbooks, counsel can run defined checks against a contract in Word or the web app.

For AI review in Word, choose the approved Playbook, identify whether the draft is company or third-party paper, and add relevant deal context before starting the review. The Playbooks workflow distinguishes Pass, Fallback, and Flag results and lets counsel inspect proposed changes.

See how to run a Playbook review in GC AI:

A prebuilt Playbook can help the team get started. Check its positions against company policy before treating it as the team's standard.

For the buyer in the software as a service (SaaS) example below, consider this illustrative company position:

Customer data must not be used to train models for other customers. Any exception requires the designated legal and business approvals. Flag broader permissions and any inconsistent terms in the DPA or incorporated policies.

This is a hypothetical company rule. Whether it is appropriate depends on the service, data, and company's requirements.

Ask the Playbook review to flag missing protections as well as unfavorable clauses. A draft may omit the security schedule or exit assistance the business assumed the vendor would provide.

By the end of the first pass, counsel should have the deviations, the relevant contract passages, proposed fallbacks, and the questions that need closer review.

Clause Review: Read the Terms Together

The first pass identifies issues to investigate. Counsel decides what they mean in the complete agreement.

Start with these six areas, then add the checks the deal requires:

Risk-Bearing Area	Read Together	Decision to Make
Limitation of liability and indemnity	Cap, exclusions, indemnified claims, defense control, and remedies	Which party bears each loss, and does an exception defeat the intended limit?
Data protection and security	Data definitions, permitted uses, DPA, security schedule, and incident duties	Can the parties perform the service under these restrictions and commitments?
IP and confidentiality	Ownership, licenses, feedback rights, reuse rights, and confidentiality exceptions	Does either party receive rights the business did not intend to grant?
Fees, scope, and performance	Order form, deliverables, acceptance, price changes, and service remedies	Does the written bargain match the approved purchase or sale?
Term, termination, and auto-renewal	Renewal notice, termination rights, fees on exit, transition, and survival	Can the company leave when it needs to, and what continues afterward?
Assignment and disputes	Transfers, change of control, governing law, venue, and dispute procedure	Who may inherit the obligations, and how would the company enforce them?

Use Exact Quote to retrieve the relevant contract language, then open the source and read its definitions, exceptions, and related provisions. Accurate quotation helps verification; counsel still has to assess the interpretation.

Record each material issue with its source, business impact, proposed position, permitted fallback, and decision owner. The contract review checklist provides the detailed checks for this stage.

By the end of clause review, counsel should have an issue list that separates what the contract says, what company policy requires, and what remains uncertain.

Negotiation: Choose the Changes That Matter

Sort the issues into required changes, preferred changes, commercial trades, and terms the business can accept if a named team owns the resulting obligation. Prepare a fallback before sending the opening position. For help developing positions and responses for the next round, see our AI contract negotiation guide.

Give the business a short explanation of the material choices: what the counterparty wants, the consequence for the company, what legal recommends, and who needs to decide.

GC AI for Word lets counsel work on proposed edits alongside the agreement. For a deeper look at carrying review decisions into markup, see our AI contract redlining guide.

Hayley McAllister, Senior Counsel, Head of Commercial Legal at Jasper, describes using the Word integration for this work:

Once the Word plugin rolled out, I pretty much exclusively started using it for all of my redlining and contract review.

If the counterparty refuses a material change, identify what the company can control: the data it supplies, access it grants, scope it launches, or commitment it makes. Confirm that the proposed mitigation is feasible, has an owner, and leaves an acceptable residual risk. Some issues still require declining the deal.

By the end of negotiation, the team should have the redline, a business decision summary, and any exception request with the remaining exposure stated plainly.

Approval and Signature: Verify the Final Agreement

Compare the proposed signature version with the last reviewed draft, especially if the counterparty sends a clean copy without tracked changes. Revisit any material late change and the approval it affects.

Confirm the entities, commercial terms, incorporated documents, resolved comments, and signing authority. Match accepted exceptions to the approval record. After signature, preserve the executed copy and tell the responsible teams what they must do, by when, and under which provision.

At the end of the process, the team should have the executed agreement, a record of approved exceptions, and an obligation handoff with owners and dates.

Contract Review Process Flowchart

The process is iterative rather than strictly linear. A missing document, rejected change, or late revision can send the agreement back to an earlier stage.

!Contract review process flowchart: complete intake, assign risk tier, run the Playbook, review material issues, negotiate or escalate, verify approvals and the final version, sign and hand off

The main decision branches are:

• Documents or business facts are missing: Return to intake with a specific request and owner.
• The draft departs from an approved position: Check the source language and related terms, then propose a permitted fallback or escalate.
• The counterparty rejects a required change: Assess feasible mitigations and seek authorized exception approval or decline the deal.
• A later draft changes a material term: Return that issue to the reviewer and, where needed, the approver.
• The final version and required approvals are complete: Send for authorized signature, then preserve the executed agreement and obligation handoff.

A Worked Example: Conflicting Data Terms in a SaaS Agreement

The company is buying software that will process customer data. The vendor sends its master services agreement (MSA) and DPA before launch. The business wants to proceed, but the vendor's proposed use of that data exceeds the company's approved position.

The following provisions and workflow are illustrative. They are not terms from a customer contract or results from a product test.

Document	Illustrative Language	Review Issue
MSA data-use clause	Supplier may use Customer Data to improve the Services and train models used by other customers.	The broad permission may exceed the company's approved data-use position.
DPA processing clause	Supplier will process Customer Personal Data only on Customer's documented instructions to provide the Services.	The narrower restriction applies to Customer Personal Data and may not cover other Customer Data.
DPA precedence clause	If this DPA conflicts with the MSA concerning Customer Personal Data, this DPA controls.	The precedence rule may resolve the conflict for Customer Personal Data without resolving the broader permission for other Customer Data.

The review turns on the definitions. If Customer Data includes confidential business information as well as personal data, the DPA's precedence clause may address only part of the MSA's broader permission. Counsel must also check whether model training falls within the agreed services or documented instructions.

A flag saying “the DPA takes precedence” would leave that question unanswered. The useful work is to identify the affected data, determine which provision applies, and coordinate the revisions.

Give AI the Documents and a Specific Question

Supply the complete agreement set, the approved Playbook, and a short deal summary. Include the data categories and the business's intended use. For a renewal, add the existing signed terms and amendments.

Adapt this example prompt:

Example Prompt

We are the customer buying this service. Review the attached MSA, DPA, and order form against our approved data-use position. Compare the definitions of Customer Data and Customer Personal Data. Quote the relevant permissions, restrictions, and precedence terms. Separate conflicts from missing facts. Propose coordinated changes and a short business decision summary. Do not treat a prior exception as approved policy.

For each issue, request the document and clause, the relevant text, the reason it matters, the applicable company position, a proposed change, and the unresolved question. A missing attachment should remain an open issue.

Use Research for the Questions the Contract Cannot Answer

A contract may raise a legal question that the playbook cannot settle. Specify the transaction facts, jurisdiction, and issue before asking for research.

For example, if the service will process personal data from California and Colorado, counsel could ask GC AI to investigate the rules on the vendor's proposed secondary uses and the required contract restrictions in each state. Supply the same facts about the service and data for both questions. GC AI Research can combine uploaded documents with current sources. For complex questions, it may launch Research Agents in parallel and synthesize their findings with citations.

Ask for the contractual analysis, company position, and researched legal requirements separately. Counsel then opens the cited authorities, checks their relevance and current status, and resolves any conflict before deciding which language to propose.

Turn the Analysis Into a Decision Record

For the hypothetical SaaS agreement, request a decision record that keeps the analysis and approval path visible:

• Issue: The MSA permits training for other customers. The DPA restricts processing of Customer Personal Data, leaving the treatment of other Customer Data to be checked.
• Source check: Read both data definitions, the permitted-use clauses, the precedence provision, and incorporated policies.
• Proposed position: Illustrative MSA revision: “Supplier may use Customer Data only to provide the Services to Customer and must not use Customer Data to train models for other customers.” Counsel must check the defined Services, identify any other uses the business intends to permit, and align the DPA and incorporated terms.
• Business question: What information will users supply, and can the intended service operate under the proposed restrictions?
• If the vendor refuses: Assess whether limiting data or deployment scope is practical. Identify what risk remains and route it to the designated approver.
• Before release: Counsel reviews the proposed redline; business and security owners confirm the facts and feasible controls; the authorized approver decides any exception.

Counsel can ask GC AI to draft the coordinated redline and stakeholder summary from that record, then review both before they leave the company. Save the reviewed drafts, source documents, and any exception decision in the matter record so the next reviewer can follow what changed and why.

How In-House Teams Use GC AI for Contract Review

In-house teams can work in our workspace and in Word. Teams that work in ChatGPT can also use the GC AI ChatGPT Plugin, where available, to bring our legal intelligence into ChatGPT. Plugin access is separate from direct access to Astra for Law, so teams should confirm which model and tools are enabled.

The customer examples below show how teams combine a GC AI first pass with their own review thresholds and use it to draft language that addresses a missing protection.

Wayfair: Pair the First Pass With Risk Triage

On CZ and Friends, our podcast about how in-house legal leaders are changing the way their teams work, Lauren Anderson, then Senior Counsel at Wayfair, describes the team's approach:

We use GC AI often. We've implemented a process where you rely on it for a first pass.

Anderson explains that the team varies its attention by contract category and monetary threshold.

A SaaS vendor accessing personal information or operating within Wayfair's systems calls for a different review from a routine renewal. She and former colleague Mary Ambacher also describe a process for procurement to handle some contracts while attorneys focus on higher-risk work.

For teams designing their own process, the useful lesson is to pair an AI first pass with clear review thresholds. Decide which agreements need attorney attention and why before treating a faster initial review as a completed decision.

Liquid Death: Turn a Missing Clause Into a Proposed Fix

Tiffany Lee, General Counsel and Corporate Secretary at Liquid Death, describes using GC AI to flag issues, summarize agreements, and draft missing provisions. When a confidentiality clause is missing, she says:

I’ll just ask it to draft one I can drop right into the agreement

That connects issue spotting to the next piece of work: proposed language counsel can assess. Before using a new clause, check it against the agreement's definitions, related provisions, and the company's position.

We can help prepare the review and proposed changes. The team still needs to know who can approve the position and any remaining exception.

Who Owns Each Contract Review Decision?

Set responsibilities before an urgent agreement arrives. Approval and signing authority should follow the company's rules.

Role	Responsibility	Handoff
Business owner	Confirm the business objective and facts; decide commercial tradeoffs within delegated authority	Decision requested, consequence, deadline, and feasible alternatives
Legal operations or contract manager	Check intake, route work, maintain the process record, and follow up	Complete documents, missing inputs, reviewer, and next action
In-house counsel	Analyze legal issues, recommend terms, negotiate, and identify required escalation	Verified issue, proposed wording, fallback, and recommendation
Finance, security, privacy, or procurement	Assess the functional risk and feasibility of commitments	Relevant clause, deal context, and a specific question
Authorized exception approver	Accept or reject deviations within the company's delegated authority	Remaining exposure, mitigation, legal recommendation, and business rationale
Authorized signatory	Commit the company to the approved final agreement	Final version and evidence that required approvals are complete

When Should You Involve Outside Counsel?

Seek specialist counsel when the issue exceeds the team's expertise or requires independent advice. Examples include an unfamiliar jurisdiction, novel regulatory question, financing or tax structure, disputed IP ownership, or threatened litigation.

The amount at stake informs escalation, but a high-value agreement does not automatically require outsourcing. Consider whether specialist analysis could change the recommendation. Send a focused question, the relevant documents and facts, work completed so far, and the required deadline.

How Long Should Contract Review Take?

Set a service expectation by contract type and risk tier. Specify when the clock starts, what legal will deliver first, and how missing information affects the deadline.

Measure three intervals separately:

Measure	What It Captures	Useful Diagnostic
Legal touch time	Active time counsel spends reading, analyzing, drafting, and verifying	Is the first pass or source checking taking too much work?
Elapsed legal review time	Time from the defined review start to the legal decision or handoff, including recorded waits	Is legal waiting for facts, specialists, or an approver?
Request-to-signature time	The full interval from request to execution	Where do intake gaps, counterparty turns, and signature delays occur?

Compare similar agreements and track where delays occurred. A faster first pass helps counsel, but it does not resolve an unanswered security question or make the counterparty return its markup.

Establish a baseline before changing the process. Then track whether issues reach the right owner sooner and whether verification takes less work. Keep quality measures alongside time: missed material issues, unnecessary flags, rework, and late changes after approval.

Connect Each Review to the Next One

After signature, preserve what the team learned: the accepted exception, why it was approved, whether it was deal-specific, and any obligation that needs follow-up. Change the standard Playbook only after the authorized owner approves the new position.

When the next amendment or renewal arrives, use the operative terms as the baseline. Contract Intelligence's Current Terms workflow helps identify the terms across linked agreements and amendments. Check the source documents before carrying a prior concession into a new recommendation.

Contract review, contract intelligence, and contract lifecycle management (CLM) serve related needs. Review analyzes and negotiates the language. Contract intelligence helps answer questions across the document portfolio. CLM workflow handles routing, approvals, signatures, and other lifecycle tasks. Keep those responsibilities explicit when deciding which systems the team needs. For teams looking beyond review to intake, approvals, signatures, and obligation tracking, our AI contract management guide covers the broader lifecycle.

Contract Review Guides by Agreement and Task

Use the process above to decide the route, then go deeper where the agreement or workflow requires it:

• Confidentiality agreements: NDA review playbook
• Data-processing terms: DPA review
• Master services and SaaS agreements: MSA review and SaaS agreement checklist
• Vendor paper: Vendor agreement review
• Employment and contractor terms: Employment contract review and independent contractor agreement review
• Repeatable review at volume: Contract review automation
• Choosing review or markup software: AI contract review and contract redlining software
• Questions across signed agreements: What is contract intelligence?

Make Every Contract Review Traceable From Clause to Decision

A strong contract review process connects the complete agreement to the company's approved positions, makes each material decision explicit, and leaves a record another reviewer can verify. AI can support the first pass, research, and drafting, but counsel still needs to trace material findings to source language and keep approval authority clear.

Bring a previously negotiated agreement to your GC AI evaluation, along with its schedules, approved playbook, and final redline. Ask us to walk through the first pass, a disputed provision, and the resulting redline and business summary.

Compare the output with your team's known issues and accepted exceptions. Check what GC AI missed, whether the edits preserve the deal, and how much verification the review requires. Use that evidence to decide which agreements can follow your standard route and which need deeper review or escalation.