Review Contract

/review-contract -- Contract Review Against Playbook

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review a contract against your organization's negotiation playbook. Analyze each clause, flag deviations, generate redline suggestions, and provide business impact analysis.

Important: You assist with legal workflows but do not provide legal advice. All analysis should be reviewed by qualified legal professionals before being relied upon.

Invocation

/review-contract <contract file or URL>

Review the contract: @$1

Workflow

Step 1: Accept the Contract

Accept the contract in any of these formats:

• File upload: PDF, DOCX, or other document format
• URL: Link to a contract in your CLM, cloud storage (e.g., Box, Egnyte, SharePoint), or other document system
• Pasted text: Contract text pasted directly into the conversation

If no contract is provided, prompt the user to supply one.

Step 2: Gather Context

Ask the user for context before beginning the review:

1. Which side are you on? (vendor/supplier, customer/buyer, licensor, licensee, partner -- or other)
2. Deadline: When does this need to be finalized? (Affects prioritization of issues)
3. Focus areas: Any specific concerns? (e.g., "data protection is critical", "we need flexibility on term", "IP ownership is the key issue")
4. Deal context: Any relevant business context? (e.g., deal size, strategic importance, existing relationship)

If the user provides partial context, proceed with what you have and note assumptions.

Step 3: Load the Playbook

Look for the organization's contract review playbook in local settings (e.g., legal.local.md or similar configuration files).

The playbook should define:

• Standard positions: The organization's preferred terms for each major clause type
• Acceptable ranges: Terms that can be agreed to without escalation
• Escalation triggers: Terms that require senior counsel review or outside counsel involvement

If no playbook is configured:

• Inform the user that no playbook was found
• Offer two options:

1. Help the user set up their playbook (walk through defining positions for key clauses)
2. Proceed with a generic review using widely-accepted commercial standards as the baseline

• If proceeding generically, clearly note that the review is based on general commercial standards, not the organization's specific positions

Step 4: Clause-by-Clause Analysis

Apply the following review process:

1. Identify the contract type: SaaS agreement, professional services, license, partnership, procurement, etc. The contract type affects which clauses are most material.
2. Determine the user's side: Vendor, customer, licensor, licensee, partner. This fundamentally changes the analysis (e.g., limitation of liability protections favor different parties).
3. Read the entire contract before flagging issues. Clauses interact with each other (e.g., an uncapped indemnity may be partially mitigated by a broad limitation of liability).
4. Analyze each material clause against the playbook position.
5. Consider the contract holistically: Are the overall risk allocation and commercial terms balanced?

Analyze the contract systematically, covering at minimum:

For each clause, assess against the playbook (or generic standards) and note whether it is present, absent, or unusual.

Detailed Clause Guidance

Limitation of Liability

Key elements to review:

• Cap amount (fixed dollar amount, multiple of fees, or uncapped)
• Whether the cap is mutual or applies differently to each party
• Carveouts from the cap (what liabilities are uncapped)
• Whether consequential, indirect, special, or punitive damages are excluded
• Whether the exclusion is mutual
• Carveouts from the consequential damages exclusion
• Whether the cap applies per-claim, per-year, or aggregate

Common issues:

• Cap set at a fraction of fees paid (e.g., "fees paid in the prior 3 months" on a low-value contract)
• Asymmetric carveouts favoring the drafter
• Broad carveouts that effectively eliminate the cap (e.g., "any breach of Section X" where Section X covers most obligations)
• No consequential damages exclusion for one party's breaches

Indemnification

Key elements to review:

• Whether indemnification is mutual or unilateral
• Scope: what triggers the indemnification obligation (IP infringement, data breach, bodily injury, breach of reps and warranties)
• Whether indemnification is capped (often subject to the overall liability cap, or sometimes uncapped)
• Procedure: notice requirements, right to control defense, right to settle
• Whether the indemnitee must mitigate
• Relationship between indemnification and the limitation of liability clause

Common issues:

• Unilateral indemnification for IP infringement when both parties contribute IP
• Indemnification for "any breach" (too broad; essentially converts the liability cap to uncapped liability)
• No right to control defense of claims
• Indemnification obligations that survive termination indefinitely

Intellectual Property

Key elements to review:

• Ownership of pre-existing IP (each party should retain their own)
• Ownership of IP developed during the engagement
• Work-for-hire provisions and their scope
• License grants: scope, exclusivity, territory, sublicensing rights
• Open source considerations
• Feedback clauses (grants on suggestions or improvements)

Common issues:

• Broad IP assignment that could capture the customer's pre-existing IP
• Work-for-hire provisions extending beyond the deliverables
• Unrestricted feedback clauses granting perpetual, irrevocable licenses
• License scope broader than needed for the business relationship

Data Protection

Key elements to review:

• Whether a Data Processing Agreement/Addendum (DPA) is required
• Data controller vs. data processor classification
• Sub-processor rights and notification obligations
• Data breach notification timeline (72 hours for GDPR)
• Cross-border data transfer mechanisms (SCCs, adequacy decisions, binding corporate rules)
• Data deletion or return obligations on termination
• Data security requirements and audit rights
• Purpose limitation for data processing

Common issues:

• No DPA when personal data is being processed
• Blanket authorization for sub-processors without notification
• Breach notification timeline longer than regulatory requirements
• No cross-border transfer protections when data moves internationally
• Inadequate data deletion provisions

Term and Termination

Key elements to review:

• Initial term and renewal terms
• Auto-renewal provisions and notice periods