Contract Review Checklist for In-House Counsel: 7 Stages

Maury Bricks, General Counsel at ARKO Corp, did not start out wanting a contract review checklist. He started out proud of avoiding AI entirely. On the CZ and Friends podcast, GC AI’s show hosted by CEO and three-time general counsel Cecilia Ziniti, he described the moment a colleague changed his mind:

I was not using AI, proudly staying away from ChatGPT and everything, saying, you know, not needed. I’m smart, I can do my work. And Michele showed me. I love how I type in ‘please redline this document’ and then press Easy Prompt, and it’s like, did you mean you wanted to know these 40 things? And I’m like, yes, that’s exactly what I wanted. I wanted to know those 40 things.

Those 40 things are a contract review checklist, and every in-house lawyer runs one on every agreement, whether it lives in your head, on a Word template, or inside a legal AI platform. Writing it down is what turns reading a contract into reviewing one, and it keeps a buried indemnity or an auto-renewal from reaching the CEO’s desk unflagged.

Below is a complete, copy-ready contract review checklist for in-house counsel, built the way the work moves: triage first, the risk clauses next, the counterparty’s paper after that. World Commerce and Contracting estimates (2020) that weak contracting erodes roughly 9% of annual revenue through missed entitlements, scope disputes, and avoidable risk. A checklist is the cheapest insurance against that leakage.

The In-House Contract Review Checklist

A contract review checklist is a written set of items an in-house legal team verifies on every incoming agreement, organized so that the highest-risk terms get attention first. The point of the sequence is leverage: you spend your scarce attention where the dollars and the liability live, and you let a repeatable process carry the rest. The seven stages below run in review order, so use the list as a quick index, then work through the specific items under each one.

1. Triage the contract by risk

2. Confirm the parties, term, and renewal

3. Pin down the commercial terms

4. Flag the risk-allocation clauses

5. Check the counterparty’s paper for red flags

6. Redline against your playbook and fallbacks

7. Route for approval and signature

Triage the Contract by Risk

Decide how hard to look before you start reading. Sort each incoming contract into a risk tier by dollar value, data sensitivity, term length, and whether it uses your paper or the counterparty’s. A mutual NDA on your template is a five-minute review; a three-year data processing agreement with uncapped liability is not. Triage is what keeps a lean team from giving a renewal the same hour it gives a bet-the-company deal.

• Confirm which side’s template the contract sits on

• Note the total contract value and payment exposure

• Flag whether the deal touches personal data, IP, or regulated activity

• Set a review depth and turnaround based on the tier

Confirm the Parties, Term, and Renewal

Verify who is bound and for how long. Check that the named entities match the signing parties, that the effective date and term are unambiguous, and that renewal is something you control. Auto-renewal with a 90-day notice window is one of the most common ways companies stay locked into vendors they meant to leave. In a 2021 agreement between Cenntro Electric Group and a European counterparty, the renewal term reads: “the term of this Agreement will automatically renew for additional successive one (1) year terms unless either Party provides written Notice of non-renewal at least ninety (90) days prior to the end of the then-current term.” Miss that 90-day window and you are locked in for another full year.

• Correct legal entity names and signing authority

• Effective date, initial term, and renewal mechanics

• Notice period required to prevent auto-renewal

• Assignment and change-of-control rights

Pin Down the Commercial Terms

Read the money before the boilerplate. Confirm pricing, payment timing, and any caps or escalators match the business deal, and that service levels and remedies are spelled out in writing.

• Pricing, fees, and any annual escalators

• Payment terms and late-payment consequences

• Service levels, credits, and remedies

• Expense, pass-through, and reimbursement terms

Flag the Risk-Allocation Clauses

This is the heart of any contract review checklist: the clauses that decide who pays when something goes wrong. Read each one against your company’s standard position, and note where the draft departs from it. These eight carry most of the risk in a commercial agreement:

The label matters less than the balance. In a 2024 consulting agreement between Caterpillar and Suzette M. Long, the indemnity runs both ways: “Each party shall indemnify, defend, and hold harmless the other party, along with its affiliates, directors, officers, employees and agents from and against any and all suits, claims, demands, losses, damages, costs and expenses.” Mutual is the position to anchor on, so flag any one-way version that protects the counterparty alone.

For deeper, clause-by-clause review of specific agreement types, see the SaaS agreement checklist and the vendor agreement review workflow.

Check the Counterparty’s Paper for Red Flags

When you are reviewing the other side’s template, the work shifts from confirming your terms to catching theirs. Counterparty paper favors the counterparty by design, so scan for the patterns that move risk onto you.

• Uncapped liability, or carve-outs that swallow the cap

• One-sided or asymmetric indemnification

• Auto-renewal paired with a long notice window

• Unilateral amendment rights (“we may update these terms”)

• Assignment without consent

• Missing clauses entirely, such as a confidentiality or data protection section that should be there

Tiffany Lee, General Counsel and Corporate Secretary at Liquid Death, described how she handles that last one:

If it sees a missing confidentiality clause, I’ll just ask it to draft one I can drop right into the agreement, no leaving the system, no reformatting.

Catching a missing clause is harder than reviewing a present one, because there is no text to react to. A written checklist is what surfaces the gap, and it is the reason “what is not here?” belongs on every review.

Redline against Your Playbook and Fallbacks

Mark up the contract against your standard positions so each pass starts from a known baseline. Your playbook holds the preferred language, the acceptable fallback, and the walk-away line for each key clause, so redlining becomes a matter of matching the draft to a position you can reuse on every deal. This is where AI contract redlining software earns its keep, carrying your standard markup into Word automatically.

• Apply preferred and fallback language for each flagged clause

• Note your walk-away positions before negotiation starts

• Keep comments tied to specific contract language

• Track which positions you conceded for the next renewal

Route for Approval and Signature

Close the loop with clear escalation thresholds. Define which terms a reviewer can approve alone and which require finance, security, or the GC, so nothing ships above someone’s authority and nothing waits on the GC that did not need to.

• Approval thresholds by dollar value and risk tier

• Required sign-offs from finance, security, or privacy

• Final version control and clean execution copy

• Storage and key-date tracking after signature

A Contract Review Checklist by Contract Type

The seven stages hold for any agreement, but the clauses that matter most shift by contract type. A few quick variants:

NDAs: Definition of confidential information, term of the obligation, permitted disclosures, return-or-destroy requirements, and whether it is mutual.

SaaS and MSAs: Service levels and credits, data protection and security, liability cap relative to fees paid, IP and usage rights, and renewal mechanics. The SaaS agreement checklist breaks down the six clauses that carry the risk.

Vendor and procurement contracts: Pricing and escalators, indemnification, insurance requirements, termination for convenience, and sub-contractor flow-downs.

DPAs: Processing scope, sub-processor approval, breach notification timing, data transfer mechanism, and audit rights.

Make the Checklist Reusable

The fastest way to use this checklist is to turn it into something your team runs the same way every time, rather than a document someone remembers to open. A reusable version does three things a flat list cannot: it standardizes what “reviewed” means across reviewers, it gives junior team members a structured first pass, and it creates a record of which positions you held or conceded.

In GC AI, each stage can live as a saved skill the whole team runs on any contract, including pre-built ones like Review an NDA, Vendor MSA Review, and Review SaaS AI Terms, plus custom skills that encode your own standard positions and escalation thresholds. A reviewer builds the skill once, and everyone runs it on every deal.

KT Farley, Chief Privacy Officer and Associate General Counsel at Helix, described what that looks like on a real team:

The ability to create and store reusable prompts and share them across the team has completely changed the work required to review standard work. Junior teammates now run the checklist prompt first and bring me the output as the predicate for my review.

That is the highest-leverage version of a checklist: a senior reviewer designs it once, the team runs it on every contract, and the first time a junior teammate’s pass catches an auto-renewal the GC would have missed, it pays for itself.

How to Run Your Contract Review Checklist in GC AI

A legal AI platform built for in-house counsel turns the checklist from a document you remember to open into a workflow that runs on every contract automatically. GC AI was built by Cecilia Ziniti, a three-time general counsel, to do exactly the work in-house teams do most.

That is what Maury Bricks ran into when “please redline this document” came back as 40 specific things to check. Load your standard positions into Playbooks, and GC AI applies them to every incoming contract, with pre-built playbooks for NDAs, DPAs, and MSAs and custom playbooks that encode your own.

Exact Quote ties every flag to the precise language in the source contract with character-level citation, so a reviewer can trace each item on the checklist back to the clause that triggered it.

And because GC AI for Word runs inside Microsoft Word, the redline, the issue spotting, and the drafted replacement clause happen where the contract already lives.

The reliability question matters for legal work, and GC AI publishes its own evidence. On the In-House Legal Bench, GC AI’s May 2026 evaluation across 100 in-house tasks and more than 1,200 attorney-developed criteria, it scored 86.8%, ahead of ChatGPT at 79.8%, Claude at 68.4%, and Gemini at 57.5%.

On security, GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, with zero data retention agreements with OpenAI and Anthropic, and AES-256 encryption. More than 2,100 legal teams across 53 countries use GC AI as of September 2026, including the legal departments at Snyk, Tipalti, Columbia Sportswear, and Wayfair, as well as 300+ public companies.

How to Choose Software to Run Your Checklist

If you are choosing the software that will run this checklist, the buying decision has its own short checklist. The full version lives in the guide to AI contract review for in-house counsel; the essentials:

• Built for in-house counsel: the workflows assume a lean team reviewing high volume across the business

• Citations to the source: every flag traces to the exact contract language, so you can verify each one against the source

• Works in your tools: review happens in Word and your existing workflow, with no copy-paste between systems

• Customizable playbooks: the platform learns your own standard positions and fallbacks

• Security you can show procurement: SOC 2 Type II, GDPR, and clear data retention terms

• Proof you can check: published benchmarks and customer outcomes you can verify

For a wider view of the category, the guide to in-house counsel AI software covers what to buy first and what to skip.

Start with One Contract

The best way to test a contract review checklist is to run it on a contract you already know. Take an agreement you reviewed by hand last week, run it through your checklist, and see what a structured pass catches that a manual read missed. Teams that adopt GC AI see value before the first month is out, and reclaim an average of 14 hours per person per week, according to GC AI’s December 2025 ROI study of more than 100 active customers. With nearly half of corporate legal budgets going to outside counsel per ACC benchmarking, faster in-house review is where lean teams reclaim budget.

You can also learn the underlying technique in GC AI’s legal AI classes taught by former general counsels, including how to build review prompts your whole team can reuse.