Contract review and clause extraction

• Every document in the data room is read, classified and checked for missing pages or unreadable scans within hours of access being granted.
• The clauses on your checklist are extracted into a structured table, each one linked to the page and paragraph it came from.
• Each clause is compared with the firm's or client's playbook, and deviations are flagged with the playbook position they depart from.
• A draft review note and a draft report section are prepared for the associate to check, edit and finish.
• The AI only ever sees the documents of the matter it is working on. Ethical walls and matter access are enforced by the platform, not by the prompt.
• A solicitor reviews every flag and every draft, decides what it means for the client, and owns the advice. Nothing goes to the client without them.

• SRACode of Conduct for Solicitors 3.2 and 3.5; Code of Conduct for Firms 2.1, 4.3 and 4.4
  →

  The service must be competent, and supervisors remain accountable for work done through others, including work done with AI. Every extraction and every draft note is reviewed by a lawyer, and the supervising solicitor signs off the report. The firm's governance, systems and controls cover the AI like any other risk, with the COLP involved from discovery.

• SRAConfidentiality (paragraph 6.3) and the warning notice on misuse of AI (17 August 2026)
  →

  Client information only goes into an AI system with contractual, technical and organisational safeguards: data processed in the UK, never used to train a model, never kept longer than the matter needs, and never reachable by anyone outside the matter. Public chatbots are blocked for client work. The SRA's notice restates existing duties; it doesn't create new ones.

• SRAConflicts and ethical walls (paragraph 6.5)
  →

  Where the firm holds confidential information for another client, it may only act if effective measures leave no real risk of disclosure. A shared search index across matters would break that. Each matter has its own index and encryption key, and the platform checks the firm's matter-security records on every retrieval.

• CourtsLegal professional privilege
  →

  Privilege depends on confidentiality. Data room documents and the firm's review notes stay in an environment the firm controls, open only to the matter team, with a log of who and what saw each document. Putting client documents into a public AI tool risks losing both confidentiality and privilege.

• Law Society and the courtsGenerative AI guidance for solicitors, and the courts' warnings on unchecked AI output
  →

  The Law Society's guidance and the judiciary's AI guidance both say the lawyer stays responsible for anything produced in their name. In 2025 the High Court warned that putting fictitious AI-generated material before a court can lead to referral to the regulator or contempt proceedings, and that firm leaders are expected to have controls in place. Every clause in a report is checked against the source page.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Data rooms hold personal data, often employment contracts with salaries and sometimes health or disciplinary records. That means a DPIA before the pilot, clear controller and processor roles, processing in the UK, retention tied to the matter file, and checking the data room terms and NDA for any limits on how documents may be processed.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A supervising solicitor named on every matter that uses the AI, who signs off the report.
• A knowledge lawyer who owns the playbook and checklist, with change control and a re-test when either changes.
• A lawyer-marked sample on every matter, to measure missed clauses before anyone relies on the table.
• Matter intake checks: the engagement letter, the client's AI terms and the data room NDA allow this kind of processing.
• A clear rule that public AI tools are never used for client documents, backed by technical blocks, not just policy.
• Lawyers trained before go-live, including what the AI misses: context outside the document, and clauses phrased in unusual ways.

1. 3–4 weeks

   Discovery

   Map today's review process, measure the baseline on recent matters, agree the clause checklist, check client terms and the wall system, and involve the COLP and DPO.

2. Gate · must be true to passBaseline agreed, wall integration confirmed, DPIA started, client-terms position agreed.

3. 8–10 weeks

   Pilot

   Two or three closed matters, in shadow mode: the AI reviews documents the team has already reviewed, and the two are compared clause by clause.

4. Gate · must be true to passMissed clause rate within agreed limits, zero access outside the matter in testing, COLP and partner sign-off.

5. 4–6 weeks

   Production

   Live matters in one practice group, with a lawyer-marked sample on each, monitoring and a rollback plan.

6. Gate · must be true to passMonitoring, support, rollback plan and lawyer training in place.

7. Ongoing

   Scale

   Add clause types and practice groups one at a time: real estate, finance, then in-house contract intake.

8. Gate · must be true to passEach new clause type passes the same sample test.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   One search index for the whole firm, so a lawyer behind an ethical wall can retrieve the other side's documents.

   How the design avoids it

   An index and a key per matter, and the wall system checked by the platform on every retrieval.

2. 2

   Goes wrong

   The clause table is trusted before anyone has measured what it misses.

   How the design avoids it

   A lawyer-marked sample on every matter, and the missed clause rate reported to the supervising solicitor.

3. 3

   Goes wrong

   A flag without a source, so lawyers can't check it quickly and stop checking at all.

   How the design avoids it

   Every extraction quotes the source text and links to the page. No citation, no flag.

4. 4

   Goes wrong

   The data room NDA or the client's terms didn't allow this processing, and nobody checked.

   How the design avoids it

   Client terms and data room terms checked at matter intake, with an on-prem-only option for matters that need it.

5. 5

   Goes wrong

   Associates paste documents into public AI tools because the approved route is slower.

   How the design avoids it

   Make the approved route the quickest one, and block public tools for client work.

1. April–September 2027
   The SRA's revised Statement of Solicitor Competence (consultation closes 3 December 2026) is expected to add technology and AI to the existing competences, including checking AI output and supervising others' use of it.

   Keep training records and supervision logs that show lawyers can check and challenge the AI's output, not just use it.

2. 2026–2027
   The ICO's statutory code of practice on AI and automated decision-making, required since May 2026.

   Keep the DPIA, the processing records and the retention rules for data room personal data in a form you could show the ICO.

3. 2026–2027
   The Legal Services Board's AI plan for 2026/27: coordination across the legal regulators, and sandbox testing of legal AI through the government's AI Growth Lab.

   Keep the accuracy testing evidence from the pilot. Regulators and clients will increasingly ask how you know the tool works.

4. 2028
   The NCSC's post-quantum cryptography milestone: a full migration plan by 2028.

   Privileged documents stay sensitive for decades. Record which encryption protects each matter store and keep it easy to change.