Which Provisions Need a Second Look in a Contract Risk Assessment?
A contract risk assessment under deadline needs a shortlist. See how deal context sets counsel's order, how clauses interact, and what to read before signing.
A contract risk assessment finds the terms in an agreement that could cost your organization money, data, or control, and decides what to do about each one. Contract risk analysis checklists and likelihood-and-impact matrices tell you which kinds of risk to look for. Under a deadline, counsel also has to decide which provisions in this contract, for this deal, get a second look first.
Take a hypothetical request that lands at 3:00 p.m. on a Friday afternoon. The VP of Support wants the contract for an AI customer support platform signed by Monday, at $180,000 a year, billed annually in advance. The provider's paper comes in three parts: a master services agreement (MSA), an order form, and online terms the MSA pulls in by URL. The platform will read your support tickets, so it will hold your customers' names, email addresses, and order histories.
We'll follow this request from Friday afternoon to Monday's signature. Harvey reviews all three documents first, and counsel uses those results to rank the provisions that need a second look and to check the final copy before signing.
Harvey's First Pass Turns Three Documents Into Four Flags Against Your Playbook
The three documents go through Contract Intelligence, Harvey's contract review AI. It checks each document against your team's standard positions, which Harvey can build from contracts you've already signed.Those positions live in your contract playbook, and clauses that no rule covers get flagged as well.
In this example, four provisions come back flagged. The provider's right to train its models on customer data, its right to add subprocessors by updating a web page, and a 36-month auto-renewal each depart from your positions. The MSA's change-in-terms provision matches no rule at all, so it goes to counsel for manual review. It lets the provider update its online terms by posting them, and it makes those terms control in a conflict.
Your playbook in this example accepts a 12-month cap for software subscriptions, so the provider's cap doesn't come back as a deviation. Counsel also checks precedent. In this example, two earlier AI tool agreements that process customer data closed with a separate, higher cap for data-protection breaches.
In Practice: At Repsol, review of a single contractual clause used to take the compliance team 30 to 60 minutes. With Harvey, the team has cut that time by over 90%, typically to a few minutes.
This In Practice episode shows how legal teams build and run Playbooks directly in Word, the kind of review the support platform's paper gets on Friday.
Counsel's Contract Risk Assessment Ranks Five Provisions by What This Deal Puts at Stake
By 5:00 p.m., counsel orders a shortlist from the four flags, the precedent note, and what this deal puts at stake. The order is counsel's own call. Here's the shortlist counsel builds, with all provisions and positions hypothetical:
Order | Provision | Why counsel ranks it here | Deal context |
|---|---|---|---|
1 | The provider may use customer data to train its models (online terms) | Data used in training is hard to claw back, so this is the hardest term to fix after signing | Support tickets carry your customers' personal data, which brings in privacy review |
2 | The provider may update the online terms by posting them, and the online terms control in a conflict (MSA) | No playbook rule covers it, and it can rewrite provisions 1 and 4 after signing | The training right and the subprocessor terms both live in the online terms |
3 | A liability cap of 12 months' fees, with no separate cap for data breaches (MSA) | It matches your standard, but it would limit recovery for a data breach to $180,000 | The platform holds customer personal data, and two earlier AI tool deals got a data cap |
4 | New subprocessors added by updating a web page, with no notice or objection right (online terms) | Customer data can reach companies your security team hasn't reviewed | Security and privacy reviewers need a say before data moves |
5 | After a 12-month initial term, a 36-month automatic renewal unless notice comes 60 days before the term ends, with fees up 7% each renewal year (order form) | It costs money, but the cost is known and a timely notice can stop it | The VP of Support can make the renewal call before the notice deadline |
The cap sits third even though it matches your standard, because this deal puts more at stake than the standard assumed.
The renewal's cost is easy to state. If nobody gives notice, the hypothetical company commits to $192,600, $206,082, and $220,508 in years two through four, about $619,000 on top of the first year's $180,000. That math assumes the 7% compounds on the $180,000 first-year fee at the start of each renewal year. Catching notice dates like this one across every contract is the work of auto-renewal tracking.
A contract review checklist decides how much review a whole agreement gets. The shortlist works one level down, inside a single contract. That evening, counsel sends the provider requests on the first four provisions and sends the renewal to the VP of Support as a business decision.
A 12-Month Cap That Fits a Project Tool Falls Short for a Platform Holding Customer Data
Picture the same cap language in two hypothetical deals at $180,000 a year, with fees billed annually in advance. A cap of fees paid in the prior 12 months comes to $180,000 in both. In this example, that general cap covers every claim, data-related ones included, with no carve-out for indemnities or data breaches. Counsel confirms that assumption against the contract's exclusions and indemnities.
The first deal is a project-management tool that stores task lists and no customer personal data. Its realistic failures are outages and lost work. In this example, the team can switch tools within a week, nothing business-critical runs on it, and the business owner accepts the residual outage risk, so the cap can stand.
The second deal is the support platform. Its realistic failure is a breach of your customers' personal data, and the costs of notification, claims from your own customers, and regulatory inquiries can exceed $180,000. The same words leave the company carrying most of that exposure.
A contract risk analysis that rates the cap by category gives both deals the same starting point. The deal facts then decide whether this cap, in this contract, needs a second look.
Five Questions Keep Counsel's Triage Consistent From Deal to Deal
Counsel's order on Friday rested on five questions.
What data does the provision touch? Provisions that govern personal or regulated data move up the list, and they bring privacy and security reviewers with them. The training right and the subprocessor clause both qualify.
Can the other side change it after signing? A term the provider can rewrite on its own puts the provisions it governs at risk too. That reach put the change-in-terms clause second.
How hard is it to undo? Data used in training is hard to pull back, while a renewal can be stopped with a timely notice. Harder-to-reverse terms go first.
What does recovery look like if it goes wrong? The cap sets the ceiling on what the company recovers, including for a breach at a subprocessor. That reach is why counsel put the cap above the subprocessor terms.
Who else must weigh in? Some provisions add a reviewer whatever the deal size. Triggers include personal or regulated data, security, insurance, IP ownership, an unfamiliar governing law, or an unusual contracting entity. Here, privacy and security took the data terms, and insurance reviewed the cyber policy's limits.
Counsel can keep the five questions in the team's documented review guidance. Clause positions belong in the Playbook, where each reviewer applies the same rules, so counsel can add one for terms pulled in by URL.
A Change-in-Terms Clause Can Reopen Terms You Already Negotiated
The provider's MSA pairs two clauses that read harmlessly on their own. Here is how they might read in this hypothetical deal:
"2.3 Provider may update the Online Terms from time to time by posting a revised version at the URL above. Updates take effect when posted."
"14.2 If this Agreement conflicts with the Online Terms, the Online Terms control."
Read together, they let the provider rewrite the training right or the subprocessor terms after signing, even if counsel negotiates both down on Friday. The cap compounds the problem, since under the general cap assumed here, a breach at a subprocessor added under rewritten terms would still be capped at $180,000. Fixing the cap without fixing clause 2.3 would leave the data terms open, which is why counsel put the change-in-terms clause above the cap.
Counsel asks for three changes. The MSA should control over the online terms, and the negotiated data terms should move into the MSA. Updates that affect customer data, security, or subprocessors should also need the company's written consent. Whether a posted update binds a customer depends on the wording and the governing law, so counsel checks that point too.
The Last Hour Before Signing Goes to What Changed in the Execution Copy
By 9:00 a.m. on Monday, the provider has agreed to the requests on the first four provisions in this example. The MSA now bars training on Customer Data, carries the subprocessor terms, and controls over the online terms, and updates affecting Customer Data, security, or subprocessors need written consent. A separate cap of three times annual fees, $540,000, covers breaches of the data-protection and security terms for Customer Data. New subprocessors need 30 days' notice with a right to object.
Privacy and security sign off on the data terms, and insurance reviews the cyber policy's limits, exclusions, and retention against the exposure above the new cap. Under your approval policy in this example, the VP of Support accepts the exposure that remains above the cap and outside the cyber policy's coverage. The VP also accepts the renewal as written, with finance signing off on a possible four-year spend of about $799,000. The notice deadline, 60 days before the first anniversary, goes into your CLM.
The last hour goes to the execution copy, compared in full with the version both sides agreed. AI contract comparison from version to version tells you what changed, and here it surfaces one edit. The definition of Customer Data now excludes "Usage Data," which the provider defines to include prompts, outputs, and interaction logs. Counsel also saves a dated copy of the online terms the execution copy points to and confirms it matches Friday's version, since the page at that URL can change.
That one definition touches four fixes, because the training ban, the data cap, the subprocessor objection right, and the consent right for data-affecting updates all apply to Customer Data. Support tickets flow through prompts and logs. Counsel asks the provider to limit Usage Data to aggregated, de-identified service metrics, which your playbook permits in this example. Had the provider refused, privacy, security, insurance, and the VP would have had to revisit their sign-offs before signing.
The provider agrees and sends a corrected execution copy, which puts prompts, outputs, and logs back inside Customer Data. Counsel compares it in full again, and privacy confirms the de-identified metrics carve-out meets its standard. Counsel then rechecks the four fixes and confirms security's sign-off, insurance's coverage review, and the VP's acceptance still cover the exposure they did at 9:00.
With the order form still showing the renewal terms the VP accepted, an officer with signing authority for the commitment signs the agreement at 1:00 p.m.
Harvey Handles the First Pass, and Counsel Owns the Contract Risk Assessment
The contract was signed Monday, on the timeline the business asked for. Counsel read five provisions closely, fixed four, and handed the fifth to the business owner with its cost stated. Deal context put the cap on counsel's shortlist, and counsel added the change-in-terms clause because it could rewrite two of the fixes. The version check caught a narrowed definition before signing.
For in-house legal teams, Harvey takes on the first pass that is filled Friday afternoon in this example. It reads every document against your Playbook, flags clauses no rule covers, and on signing day shows what changed in the execution copy. Counsel makes every call on what to fix, what to escalate, and when to sign. Request a demo to see Harvey review a provider's paper against your Playbook before your next deadline.
Contract Risk Assessment Questions, Answered
What is a contract risk assessment?
A contract risk assessment is the review of one agreement, usually before signing, to decide which terms to accept, negotiate, or escalate. Contract risk management is the wider, ongoing practice of tracking obligations and exposure across the portfolio after signing.
What are some examples of contract risk?
Common contract risk examples include uncapped indemnities, one-sided termination rights, broad IP assignments, exclusivity, and most-favored-customer pricing. Others depend on context, such as a forum selection clause that sends disputes to a court where you have no counsel.
Is contract risk analysis the same as a contract risk assessment?
Usually, yes, since the two terms are often used interchangeably. Where they differ, analysis tends to mean working out what could go wrong in a term, and assessment adds the decision about what to do.
How does risk assessment in contracts work with AI contract analysis tools?
The tool compares each clause with your playbook and flags departures, and a lawyer decides what the flags mean for the deal. Automated contract risk assessment tools differ in whether they review against your own positions or a generic template. Testing one on a contract you've already negotiated shows which kind you have.
What should a contract risk assessment checklist include?
Beyond the clauses, it should capture the deal facts the clauses depend on. Those include what data the counterparty will hold, the contract value, and the date the business needs the contract signed.
Can AI decide which contract risks matter most for a deal?
No, that call stays with counsel. AI can flag deviations and uncovered clauses, but what matters most depends on facts outside the document, such as how the business will use the product.
