How Legal Teams Use AI Training to Improve Contract Review and Risk Management

Any chance you could look at this contract today? Sales are chasing me on Slack again.

This is the story of how Takahashi (a pseudonym), the head of legal at a B2B services firm, ended up sitting down with the sales team, the business units and the IT department over the small matter of contract review.

Until about six months ago, the firm’s legal function was the destination for a steady stream of review requests: NDAs, service agreements, terms of use, distributor contracts and the rest. The volume kept climbing, yet the number of legal staff did not. Takahashi was forever buried in checking wording, comparing revision histories, cross-referencing past contracts and bouncing drafts back to sales.

The problem was not simply that everyone was busy. It was that legal could no longer carve out enough time for the work that genuinely warranted it: high-risk clauses, negotiation strategy and judgement calls on compliance.

From the sales team’s point of view, “legal review is slow and it stalls the deal”. From the business units’ point of view, “we cannot tell which clauses are actually dangerous”. And from IT’s point of view, “the rules on whether you may even feed a contract into an AI, and how to manage confidentiality, are decidedly fuzzy”.

So rather than letting legal tinker with generative AI in isolation, the firm began organising the use of contract-review AI as cross-functional AI training. They drew up clause checklists for each contract type, standardised the risk perspectives, and shifted to a model in which AI did the first pass and a legal team member then checked it.

The aim was never to hand legal judgement over to the AI. It was to make the first-pass check and the marshalling of issues more efficient, so that legal staff could concentrate on negotiation strategy, exceptions and risk management.

That said, contract-review AI is no panacea. Without confidentiality controls, review standards, sensible prompt design and a human making the final call, it can just as easily raise the risk of a wrong judgement or a data leak.

This article sets out, for those who want to adopt generative AI in legal work safely, what a legal department’s AI training should teach and how to embed it in day-to-day practice.

Why a legal department needs AI training

The interest in AI within legal functions is driven by three things: a rising tide of contract work, the quickening pace of business, and a shortage of legal talent.

The more a business grows, the more varieties of contract it accumulates. New transactions, outsourcing, SaaS usage, data provision, joint development, distributor agreements — the contract types keep multiplying. Yet you cannot conjure up experienced legal staff at short notice.

The upshot is that legal departments tend to slide into a familiar state:

• Contract review requests pile up and stall
• Sales and the business units chase ever more insistently
• The same sort of clause gets checked over and over again
• Time disappears into examining revision histories
• There is no room to concentrate on high-risk contracts
• Review perspectives vary from one lawyer to the next

The crucial point here is not to think of AI as a stand-in for a legal team member. What AI takes on comfortably is the first-pass tidying-up: classification, comparison, checking for omissions and drafting first cuts of text.

The final legal check, the decision on whether a contractual risk is acceptable, the choice of negotiating line and the compliance judgement — those remain firmly in human hands.

To share that dividing line not only within legal but with sales, the business units and IT, a legal department needs proper AI training.

For a broadly applicable view of responsible AI governance, the OECD AI Principles offer a useful international reference point when a legal department is framing its own rules for AI use.

What contract-review AI can and cannot do

Used properly, contract-review AI genuinely helps make legal work more efficient. Conflate what it can and cannot do, however, and you are courting trouble.

Work the AI is well suited to support

AI is at its most helpful with work that organises information against a fixed set of perspectives.

In contract review, for instance, the following uses are well worth considering:

• Identifying the contract type
• Checking for omissions against a clause checklist
• Extracting confidentiality, indemnity, termination and similar clauses
• Flagging auto-renewal clauses and early-termination conditions
• Summarising revision histories and differences
• A first-pass classification of clauses that look higher-risk
• Drafting the comments to send back to sales
• Marshalling the points that legal needs to confirm

With an outsourcing agreement, say, the points worth checking would include ownership of intellectual property, sub-contracting, acceptance of deliverables, indemnity, confidentiality and termination.

Hand the AI those perspectives and you can quickly work out “where to look”. Where a clause checklist for each contract type is already in good order, the AI becomes an easy aid for reducing the chance of an oversight.

Work you must not leave to AI

There are, equally, areas you plainly must not delegate to AI:

• The final decision to enter into a contract
• Deciding whether a legal risk is acceptable
• Judging how far you may concede in negotiation
• Concluding on points that call for outside counsel or a management decision
• The final judgement on compliance with laws and regulations
• Decisions on individual matters carrying litigation risk

AI has a habit of producing plausible-sounding prose. Whether that prose actually fits your own contracting policy, your past negotiating history, the latest changes in the law and your relationship with the client is quite another matter.

So contract-review AI must be used as an aid that organises the raw material for a decision. The legal team member’s role is not to adopt the AI’s output wholesale, but to test it and judge it against the firm’s own tolerance for risk.

On the use of generative AI in legal practice, professional bodies abroad have likewise stressed that the opportunities come hand in hand with the need for sound data management. Source: The Law Society — Generative AI: the essentials

What a legal department’s AI training should cover

Using generative AI safely in a legal department takes more than teaching people which buttons to press. The training needs to grapple with topics close to the actual work.

Review perspectives by contract type

Start by setting out, for each contract type, the points that warrant checking.

NDAs, outsourcing agreements, contracts of sale, distributor agreements and SaaS terms of use each call for attention to different clauses. Check every contract through the same lens and you risk missing the risks that matter.

In the training, organise the following for each contract type:

• The clauses that commonly appear
• The issues your own firm needs to be wary of
• The items where there is room to negotiate
• The items you will not, as a matter of principle, give ground on
• The conditions that make a legal check mandatory

Set this down as a clause checklist and the basis on which you brief the AI becomes far clearer.

For an NDA, the points to check would include the definition of confidential information, the purpose of disclosure, carve-outs, the confidentiality period, the scope of onward disclosure, indemnity, injunctive relief and obligations to return or destroy. For an outsourcing agreement, ownership of deliverables, sub-contracting, acceptance, defect handling, limitation of liability and termination conditions all matter.

Spelling out the differences between contract types in this way makes it easier for a person to evaluate the AI’s output.

Prompt design

The quality of contract-review AI output hinges on how the prompt is designed.

A vague request like the following, for example, tends to yield an equally vague answer:

Please review this contract.

Ask in the following way, by contrast, and you are far more likely to get output you can actually use:

You are an assistant supporting contract review. A legal team member makes the final decision. For the outsourcing agreement below, classify it on confidentiality, indemnity, intellectual property, sub-contracting and termination into three bands — “risk present”, “needs checking” and “no issue”. For each, set out your reasoning and the points a legal team member should confirm.

In the training, the important thing is not to leave prompts to individual whim but to develop them as standard prompts.

Including the following elements, in particular, makes the output easier to check:

• The AI’s role
• That a human is the final decision-maker
• The contract type
• The clauses to be checked
• The criteria for the risk classification
• The output format
• A rule that anything uncertain is flagged as “needs checking”
• Whether clause numbers or quotations from the original are required

It is also worth spelling out a rule that the AI should “say so when it does not know”. In the legal domain, surfacing the points that need checking is often safer than forcing a conclusion.

Criteria for the risk classification

Simply asking the AI to label something “risk present” is not enough. You need to decide what actually makes something a risk.

For an indemnity clause, for instance, the relevant perspectives include:

• Whether there is a cap on liability
• Whether indirect loss or lost profit is included
• Whether the wording leaves your firm carrying liability one-sidedly
• Whether the contract value and the scope of liability are in balance
• Whether the exceptions are drawn too widely

Aligning criteria of this kind across the firm makes the AI’s output easier to review.

That said, risk classification shifts with the firm’s line of business, the contract value, the client relationship and the conventions of the industry. So rather than adopting some generic “list of dangerous clauses” wholesale, you need to tune it to your own contracting policy.

Confidentiality and masking

Confidentiality is the point that matters most of all when a legal department uses AI.

Contracts can contain the names of counterparties, contract values, personal data, technical information, sales terms and undisclosed business information. None of that should be fed carelessly into an external service.

At a minimum, the training should cover these rules:

• Separate the information you may input from the information that is off-limits
• Mask counterparty and personal names where appropriate
• Abstract amounts and contract terms when considering them
• Keep highly confidential contracts out of the AI altogether
• Use only environments sanctioned within the firm
• Do not send the output straight on to outside parties

Sometimes simply swapping in “Company A” for the counterparty, “Person B” for the contact and “in the order of tens of millions of yen a year” for the value is enough to lower the risk of a leak. Even so, context can still give the game away, so for highly sensitive matters the sensible judgement may be to refrain from inputting anything at all.

AI use should be designed to put safety ahead of convenience.

The final human review

Finally, fold into the training the question of how a person checks the AI’s output.

The risk classifications and suggested edits the AI produces are, at best, a first cut. A legal team member checks them against the following:

• Whether the output matches the body of the contract
• Whether there are errors in clause numbers or quoted passages
• Whether it fits the firm’s contracting policy
• Whether it contradicts the past negotiating line
• Whether the judgement is unduly conservative, or unduly optimistic
• Whether the wording will make sense to sales and the business units

The governing principle is firm: rather than adopting AI output as it stands, a legal team member makes the call and owns it.

What to look for when choosing AI tools

When a legal department uses AI, the choice of tool matters too. There are several options: a general-purpose generative AI chat, a legal-tech product built specifically for contract review, an AI platform that can draw on internal knowledge, and so on.

When choosing, you should at the very least check the following:

• How input data is stored and used
• Whether you can control whether it is used for training
• Whether user permissions can be split by department or by matter
• Whether contracts and internal rules can be referenced safely
• Whether you can review operation logs and usage history
• Whether prompts and checklists can be shared across the team
• Whether it meets the firm’s information-security standards

A service such as Kanata, which lets you combine AI chat, AI summarisation, a learning-data library and a prompt library, is one option that makes it straightforward to bank a legal department’s training as internal knowledge. You might, for instance, register clause checklists by contract type, share standard prompts for review support, and keep running the same way after the training has ended.

Whichever tool you use, though, you still need to be clear about confidentiality controls, permission design, log management and where the responsibility for the final check sits. A tool’s features alone do not make legal risk go away.

How to run legal AI training

A legal department’s AI training tends to stick best when it pairs “time to learn the concepts” with “exercises close to the real work”.

Sort out the review scope and the rules before the training

First, narrow the scope before you start.

Take on every contract type from the outset and the discussion sprawls. For a first session it is more realistic to start with the contract types that come in high volume and lend themselves to tidy checklists, such as NDAs and outsourcing agreements.

Useful materials to prepare ahead of the training include:

• The firm’s own contract templates
• Clause checklists by contract type
• Examples of clauses that have often needed amending
• The conditions that require a legal check
• The rules on information that must not be input
• Masking examples
• The perspectives for reviewing AI output

If you intend to use real contracts in the training, you need to delete or replace counterparty names, personal names, amounts and any distinctive deal terms first, so they are fit to be handled as training data.

Run contract-review support exercises with AI chat

In the training, use fictional contracts or sample clauses and run review exercises with AI chat.

Rather than simply gazing at the AI’s output, the exercises put the following questions to participants:

• Are the risks the AI flagged reasonable?
• Are there issues it has missed?
• Can the suggested wording be used as it stands?
• If you were explaining this to sales, how would you rephrase it?
• Which points should go to outside counsel?

Building in the part where a person makes the judgement is what brings AI use closer to real practice.

Use AI summarisation to organise revision histories and negotiation trails

In contract review, following the trail of revision histories and exchanges of comments is itself a time sink.

AI summarisation lets you organise the differences before and after edits, the points the other side changed, the past negotiation trail and the issues still outstanding.

On matters where the exchanges with sales or the business units have dragged on, a summary of the following sort is especially handy:

• The main clauses changed this time
• The points the other side is pressing
• The points your side has already conceded
• The issues still awaiting a decision
• The items to confirm at the next meeting

This frees legal staff from re-tracing the history and leaves them more time for the judgement that actually matters.

That said, a summary can also contain errors or omissions. Where it informs an important decision, it must always be checked against the original text and the revision history.

The point of legal efficiency is not merely “looking faster”

Mention “legal efficiency” and the mind tends to leap to how quickly contracts can be reviewed. Reducing the backlog is, of course, important.

But the purpose of AI use in a legal department is not simply to process things faster.

What matters is creating a state of affairs like this:

• Routine checks get a first-pass tidy-up from the AI
• Legal staff concentrate on high-risk clauses
• Sales and the business units grasp the issues in advance
• Check perspectives are standardised by contract type
• Variation in review quality between individuals diminishes
• Compliance oversights become easier to head off
• Legal functions as “the department that lets the business proceed safely” rather than “the department that stops things”

Bringing in AI does not lighten legal’s responsibility. If anything, using AI throws the points that humans must decide into sharper relief.

So contract-review AI should be seen not merely as one feature of a legal-tech tool to be installed, but as a prompt to rethink how the legal department works.

Why training design has to take in sales and the business units too

Contract review is not work that legal can wrap up on its own. The understanding of the requesting parties — sales and the business units — matters just as much.

When a salesperson sends a contract to legal, for instance, review slows down if the following information is missing:

• The background to the deal
• The contract value
• The contract term
• The balance of power with the other side
• How far there is room to negotiate
• The conditions the business genuinely cannot give up
• The desired signing date
• Any comparable past contracts

In the AI training, it pays to tell not just legal staff but the requesting departments “what to sort out before handing it to legal”.

For the sales team, for example, you can provide a self-check prompt to use before requesting a review:

Before sending this contract to legal, please set out the deal overview, the contract term, the value, the clauses the other side has changed, the conditions sales cannot give up, and the points you want legal to confirm.

Use a prompt like this and you raise both the amount and the consistency of the information reaching legal.

As a result, legal spends less time establishing the facts from scratch and finds it easier to concentrate on judging the points that matter.

Operating rules for embedding AI use in a legal department

Holding the training counts for nothing if it never beds into daily work. Keeping generative AI use going in legal calls for operating rules.

Manage standard prompts

Leave the use of AI to individual discretion and output quality varies. Prepare standard prompts for each contract type and manage them within the legal department.

It is also important to keep a change history, so it is always clear which prompt is the current version.

Review the checklists regularly

The perspectives for contract review shift with the line of business, the law and the tendencies of counterparties. Leave a clause checklist untouched once written and the AI may keep answering against outdated criteria.

It is wise to set aside an opportunity — monthly or quarterly — to revisit the checklists.

Set the criteria for high-risk contracts

Not every contract needs reviewing to the same depth.

Contracts of the following sort, for instance, should be treated as high-risk and made subject to a detailed human review:

• A large contract value
• Handling personal or confidential information
• Intellectual property turning on the matter
• Heavy indemnity liability
• Contracts with overseas companies
• Contracts tied to a new business venture
• Significant departures from the standard template

AI can be used for the first-pass classification that helps identify high-risk contracts. The final judgement, however, must always be made by a legal team member.

Be clear about who owns the review of AI output

Decide who checks what the AI produces and who makes the final call.

Use it with the lines of responsibility left blurry and you drift into the dangerous habit of “well, the AI said so”.

Contract-review AI is not a device for shifting responsibility onto the AI. It is there to support the organising of information so that a person can make a responsible decision.

In summary: AI does not replace legal judgement; it creates the time to focus on it

The most important thing in a legal department’s AI training is not to convey how convenient AI is.

What counts is drawing a clear line between the work you leave to AI and the work humans must own.

Contract-review AI helps with organising contract types, checking against clause checklists, summarising revision histories and extracting risk issues. Legal judgement, the negotiating line and decisions on acceptable risk, by contrast, must continue to rest with legal staff.

Embedding AI use, moreover, takes more than installing a tool: confidentiality controls, standardisation, human review and regular reviews are all indispensable. Frameworks for managing AI risk and using it responsibly are increasingly well established.In Japan too, thinking on the governance and assurance needed to use AI safely and with confidence is steadily taking shape. Source: NIST AI Risk Management Framework

The aim of legal efficiency is not merely to look at contracts faster. It is to create a state in which legal staff can spend their time on the judgements that matter more.

If you are wrestling with a contract-review backlog, the realistic move is to start small. Narrow the contract types — to NDAs and outsourcing agreements, say — put clause checklists and standard prompts in order, and begin by building a flow of AI-led first-pass tidying followed by a human final check.

Q&A: Common questions about a legal department’s AI training