Where to start with AI · First workflow No. 4

Reviewing incoming NDAs

An NDA review assistant, rolled out in two stages: first it flags deviations for the lawyer, then, on its own, it clears NDAs that differ from the template only in the designated fields.

A first AI use case doesn’t need to be spectacular. It does need to be narrow enough to test, measure, and improve.

Download the Scoping Sheet (PDF, 2 pages) View the Carousel (PDF)

Low risk, but only within a strict scope

Nondisclosure agreements (NDAs) meet all four tests of a good first workflow: they come up often, they have a clear owner, they call for a clear output (a clause-by-clause issues list), and they are a pain point that legal, sales, and procurement already feel.

The use case is low-risk only within a strict scope:

A written standard position template, fallbacks, and red lines approved.
Simple NDAs only no licensing, exclusivity, or non-compete terms.
No final legal judgment left to AI: the lawyer makes the call.
Unusual, sensitive, or ambiguous NDAs routed to legal.

The assistant compares each NDA against a template and a standard position the legal team already has. The risk does not go away. It becomes more visible, measurable, and manageable once the position, the scope, and the escalation thresholds are defined.

A three-step approach

Write down the standard position

Document the template, acceptable fallbacks, and red lines clause by clause; give each rule an owner and a dated version. The tool comes after.

The assistant flags deviations, the lawyer decides

The assistant compares the incoming NDA with the standard template and the playbook, flags deviations clause by clause, cites the relevant rule, and suggests fallback language from the approved clause library. The lawyer accepts, negotiates, or redrafts. Every correction is logged by clause type.

The assistant clears NDAs that match the template

It clears for signature, without lawyer review, any NDA that uses the current standard template and differs only in the designated fields, for an approved agreement type and counterparty. It routes to legal any departure from the template, however slight, any NDA on the counterparty’s paper, and any sensitive agreement. A person always signs.

Moving from stage 1 to stage 2

The move to stage 2 should not be decided in advance. It depends on what legal observes during stage 1: the accuracy of the deviations flagged, the deviations missed, and the system’s ability to recognize NDAs that fall outside its scope.

Deviations caught and missed, by clauseCorrections needed, by clause typeExceptions correctly routedNo significant incident observed within the tested scopeA current playbook, each rule with an owner

Prospect NDAs on the standard template could move to stage 2, while partnership NDAs stay in stage 1.

Reference architecture: how the system stays under control

Clause-by-clause segmentation of the NDA, text comparison against the standard template, deterministic rules for designated fields and red lines, an analysis drafted by an LLM instructed to cite the playbook and an approved fallback, and input and output guardrails with routing to legal. A loop connects the log, lawyer review, and the evaluation set.

Click the diagram to open it full size.

The controls required before any autonomous answer:

Evaluation. A reference set of about 150 past NDAs, pseudonymized or anonymized as the test requires, with expected deviations annotated by a lawyer. Metrics: deviations caught and missed by clause, classification accuracy, and the rate at which exceptions are correctly routed. Rerun whenever the model, a rule, or the instructions change.

Observability. Every NDA processed is logged: clauses identified, deviations flagged, rules cited, routing decision. Contracts and counterparty data: log minimized, access restricted to authorized roles, retention defined by purpose and applicable obligations.

Identity and access. SSO (SAML or OIDC). Only legal can change the playbook, the template, or the clause library. Signing authority stays with authorized signatories.

Data. Hosting and data transfers verified for the chosen solution; contractual terms barring use of the data for model training; encryption; confidentiality owed to counterparties; documented Swiss FADP assessment.

Application security. Protection against prompt injection, including in the text of the incoming NDA. Scope limited to three outcomes: prepare an issues list, clear a template-matching NDA for signature, or route to legal. A person always signs.

Corrections go first into improving the playbook, rules, instructions, and evaluation set. Retraining the model is neither the starting point nor a substitute for that work.

The goal

The goal is not to take contract review away from legal. It is to shorten turnaround on standard NDAs, stop rereading the same clauses by hand, and free up lawyers’ time for agreements that call for context and judgment.

Download the Scoping Sheet (PDF) View the Carousel (PDF)

Illustrative case: fictitious company; all figures are approximate. Sergio Castagna Consulting is a member of the OpenAI Partner Network and a registered partner in the Google Cloud Partner Network. The tool comes after the problem is defined.