Back to Blog
Contract Analysis AI: How It Works and What to Check

Contract Analysis AI: How It Works and What to Check

Contract Analysis AI: How It Works and What to Check

Lawyer reviewing a contract with AI assistance

AI contract analysis reads a contract, finds and labels its clauses, pulls out key data (parties, dates, amounts, obligations) and flags terms that depart from your own rules. It does not decide whether to sign. It sorts the pile so that a lawyer or a business owner spends their time on the five clauses that matter instead of the fifty that don’t. This guide explains the pipeline step by step, what the output looks like, how risk scores are built, and what a French company needs to verify on data protection before sending a single contract to a model.

Botiqueai
Shape AI Around Your Contract Workflow
BotiqueAI builds custom AI tools and automations for business processes, tailored to your needs and sector.
Explore BotiqueAI

TL;DR

  • AI contract analysis is a triage layer: it extracts, classifies and compares clauses to a reference, then ranks points of attention for a human.
  • The typical pipeline has five steps: ingest (with OCR for scans), identify clauses, extract data, assess risk against your rules, report.
  • A risk score is only as good as its criteria. It depends on who you represent, the applicable law and your commercial strategy, so treat it as a priority list, not a verdict.
  • In France, check GDPR (a processing agreement with the provider), data location, retention, and the AI Act role you hold as a deployer.
  • Start with one contract type and a written playbook, then measure against a manual review.

Table of Contents

What AI contract analysis actually does

Three tasks are often blended under one label, and separating them helps you judge any tool or project:

  • Search finds a concept or wording across a repository, for example every contract that mentions an exclusivity period.
  • Extraction fills structured fields: counterparty, effective date, term, renewal date, payment terms.
  • Review evaluates the language against a standard: is this liability cap acceptable for us?

This is the distinction drawn in a contract management vendor’s explanation of search, review and extraction. Contract analysis AI combines the three. It classifies each clause, extracts the essential terms, flags risks and compares the text with a playbook, as one legal-tech publisher describes it. The same source is clear that it is not a robot lawyer and does not decide whether to sign.

The French legal-tech view is consistent: the technology handles document processing at scale (clause extraction, gaps against a reference, version comparison), while interpretation, arbitration and decision stay with people. In practice that means the value is prioritization: the machine reads everything, the human reads what matters.

How the process works, step by step

Most solutions follow the same five-stage flow, described in a practical review workflow.

  1. Ingestion. You upload a PDF, a Word file or a scan. Scans go through OCR (optical character recognition) so the text becomes machine-readable. Enterprise systems can also take email attachments and bulk imports from an existing repository, according to a contract lifecycle vendor.
  2. Clause identification. The model segments the document and labels each block: termination, payment, indemnity, confidentiality, governing law.
  3. Data extraction. Parties, dates, amounts and obligations are pulled into fields you can sort and export.
  4. Risk analysis. Each clause is checked against parameters you define: your standard terms, your fallback positions, the rules you cannot accept.
  5. Reporting. You get a structured output: a summary, a list of flagged clauses, missing clauses, and sometimes suggested rewording.

The quality of steps 1 and 2 decides everything downstream. A badly scanned contract with skewed pages and stamps produces extraction errors that a polished risk report will then hide. This is why we always ask to see the worst documents in a client’s archive before designing anything, not the cleanest ones.

What the AI can find in a contract

Common extraction targets, as listed by a digital signature provider and by the lifecycle vendor above, include:

Category Typical items detected
Financial terms Payment terms, price, caps, penalties
Risk allocation Indemnification, liability caps and exclusions
Duration and exit Effective and expiry dates, automatic renewal, termination conditions
Obligations and rights Who must deliver what, by when, with which remedies
Data and confidentiality Data protection clauses, confidentiality scope
Deviations Missing clauses, non-standard wording, inconsistencies between obligations

The last row is where the business value sits for most teams. A French provider of contract analysis describes the comparison as running against a legal reference and the internal playbook, flagging unfavorable clauses, departures from the standard and contradictions. If you have no playbook, the tool has nothing to compare against, and you will get generic flags. Writing down your standard positions is the highest-return step of any project.

Where it earns its keep: use cases

The use cases that work best share two traits: high volume and repeatable questions.

  • Renewal and deadline tracking. Pull every notice period and auto-renewal date from hundreds of supplier agreements, so nothing renews silently.
  • Due diligence. Review a data room for change-of-control, exclusivity and termination rights.
  • Compliance audits. Find every contract that lacks a required data protection clause after a regulatory change.
  • Procurement and sales intake. First-pass review of standard NDAs and supplier terms before a lawyer sees only the exceptions.
  • Migration. Turn a folder of PDFs into a structured database when moving to a new contract system.

Vendors publish impressive time savings, often between 40% and 75% on review tasks. Those numbers come from vendor pilots on their own documents, so treat them as a hypothesis to test on your own contracts, not as a promise. A fair internal benchmark is simple: take 30 representative contracts, have a person review them the usual way, time it, then compare the AI-assisted result for both speed and missed issues.

How contract risk scoring works

Risk scoring turns clause-level flags into a number or a band so a team can route work. There is no single standard. Three approaches illustrate the range:

  • Per-clause scale. One published model rates each clause from 1 to 10 using three factors: financial exposure, likelihood of dispute and negotiability, as described by its own product page.
  • Multi-dimension scoring. Separate sub-scores for financial, legal, operational and regulatory risk, rolled up to an overall level that decides routing and approvals, as explained in a risk scoring guide.
  • Probability times impact. A 1 to 5 scale on each, multiplied, then banded from low to severe, as in an in-house risk assessment framework.

How to read a score

A score is a decision aid, not an objective measurement. It shifts with the party you represent, the governing law, the financial impact, insurability and your commercial strategy, as a French analysis of the topic points out. A liability cap that is a red flag for a buyer may be perfectly acceptable for a supplier.

A practical way to use scores:

  1. Define what “high” means in euros for your company (for example, exposure above a given share of contract value).
  2. Decide which band goes to legal, which to a manager, and which can be signed on standard terms.
  3. Review the clauses behind the score, never the number alone.
  4. Re-calibrate every quarter against disputes and renegotiations you actually had.

The most useful output is a ranked list of points of attention, each tied to a rule in your playbook or to the law. The score is just the sort order.

Limits you should plan for

Good projects name the limits up front, then design around them.

Accuracy varies with the type of clause. An academic exploratory study on language-model reading of terms of service found close to 84% correct answers on business-favorable clauses but about 60% on consumer-favorable ones, and results moved a lot with question wording (Kolt, Berkeley Technology Law Journal). That study used an older model and US documents, so it does not measure today’s tools in France. Its lesson holds: performance depends on how the task is framed and tested, which is why you test on your own contracts.

Context is human. AI can miss commercial context, misread specialized clauses and echo biases in historical agreements, so a person should validate before a counterparty’s proposal is rejected or accepted (Corporate Counsel Now).

Language and jurisdiction matter. A model tuned on common-law English contracts will not automatically handle a French contract with references to the Code civil. Ask for tests on French documents, including bilingual ones.

Professional duty remains. For lawyers, contracts flagged by AI still need the reviewing lawyer’s real judgment, and most contract analysis tools fall into the minimal or limited risk categories of the AI Act, according to Le Juriste du Futur (March 2026).

The design answer is a human-in-the-loop workflow: the AI proposes, a named person confirms, and the system logs both.

Limits you should plan for

Data protection and AI rules for French companies

Sending contracts to an AI service is a data operation. Contracts often contain names, signatures, email addresses and salary or pricing details, so passing them to a model can be processing of personal data under GDPR. A checklist to run through with any provider, including a custom build:

  • Roles and agreement. If the provider processes personal data on your behalf, you need a written agreement under article 28 of the GDPR. French guidance on AI SaaS also recommends qualifying separately the inputs, attachments, outputs, logs and any data used to train the model (donneespersonnelles.fr).
  • Provider’s own purposes. Ask whether your contracts can be used to improve the vendor’s models. The answer should be in writing.
  • Location and transfers. Where are the servers, which subprocessors are involved, and are there transfers outside the EU?
  • Security, retention and audit. How long are documents and outputs kept, who can access them, and what happens during an incident? An anonymization promise does not automatically guarantee anonymity, as the same guidance notes.
  • Confidentiality duties. Some contracts carry non-disclosure obligations, and some professions are bound by professional secrecy. Check that using AI is compatible before uploading.

For a deeper look at securing the pipeline, see our practical guide to AI data security for French businesses.

The AI Act in plain terms

The AI Act in plain terms

Under the EU AI Act, a company using a vendor’s tool is generally the deployer and the vendor the provider, each with its own obligations depending on the risk level, so responsibilities should be split in the contract (Atias Avocats). The calendar has moved: the Digital Omnibus on AI, in force since 27 July 2026, pushed obligations for stand-alone high-risk systems from 2 August 2026 to 2 December 2027, according to a summary of the new deadlines. Since most contract review tools sit in lower risk categories, the day-to-day constraint is usually GDPR, confidentiality and your own governance. Have counsel confirm the classification of your specific use. Our AI governance framework guide covers how to set owners and approval rules.

Our perspective

We build AI for business workflows, and contract analysis is one of those where the technology is easy to demo and hard to put into production. A tool that highlights clauses on a clean PDF impresses everyone. The real work starts with your messy archive, your playbook and your approval chain.

Our approach is to treat contract analysis as a workflow, not a product. We connect the model to your existing systems, such as your CRM, your document storage and your approval tools, so flagged clauses land where your team already works. Because every company negotiates differently, we build around your rules instead of forcing a generic template on you.

We favor a short proof of concept, often within 14 days, on one contract type, so you can measure speed and error rate on your own documents before committing further. Our process includes a free initial audit and no long-term contract is required. Deployments are designed to be GDPR-compliant, and we keep a human decision point on anything that carries legal weight.

The organizations that get the most out of this are not the ones that automate the most. They are the ones that decide clearly what the machine may prepare and what a person must sign.

Botiqueai

A realistic rollout plan

  1. Pick one contract family. NDAs, supplier agreements or customer terms. Not all at once.
  2. Write the playbook. For each key clause: preferred wording, acceptable fallback, red line, who approves exceptions.
  3. Assemble a test set. 30 to 50 real contracts, including poor scans and older versions.
  4. Run in parallel. Human review and AI-assisted review side by side. Compare time, misses and false alarms.
  5. Decide the routing. Which findings go to legal, which to the business owner, which are logged only.
  6. Document the data setup. Processing agreement, locations, retention, access rights.
  7. Review after 90 days. Adjust the playbook and thresholds from what really happened.

If you are comparing external providers for this, our guide on how to score proposals and then pilot for two to four weeks gives a simple grid. For the document handling that sits upstream of analysis, the requirements checklist for document automation lists what to define before you build.

Build a contract workflow around your own rules

If you want contract analysis connected to your CRM, your storage and your approval flow, our team designs custom AI automations around your playbook and your data constraints. For recurring steps such as routing flagged contracts, sending renewal alerts or filling a contract register, our n8n and Make automations can do the plumbing. No price is published for these services: we start with a free initial audit of your documents and your process.

Botiqueai

To discuss a first proof of concept, start from our homepage.

FAQ

Can AI replace a lawyer for contract review?

No. It is built to extract, classify and flag, which prioritizes the manual review rather than replacing it. Interpretation, negotiation strategy and the final decision remain human. In regulated professions, the reviewing lawyer’s judgment is still required on every flagged contract.

What file formats can AI contract analysis read?

Most systems accept native PDF and Word files, and scanned documents through OCR. Some also ingest email attachments and bulk imports from a repository. Scan quality strongly affects accuracy, so test with your worst documents, not your best.

There is no special regime for AI contract review itself. The usual rules apply: GDPR when contracts contain personal data, confidentiality and professional secrecy duties, security, and the AI Act where relevant. With a provider acting on your behalf, put an article 28 processing agreement in place and check data location, retention and any use for model training.

How should we interpret a contract risk score?

Use it to rank what to read first. The same clause can be low risk for one party and high risk for the other, and the score depends on your law, exposure and strategy. Always read the clauses behind a high score and recalibrate the thresholds periodically.

How long does it take to set up?

It depends on the contract types, the number of systems to connect and the quality of your archive. A narrow proof of concept on one contract family is the fastest way to see real results. Our own PoCs can often be delivered within 14 days.

Sources

© 2026 BotiqueAI — Reproduction prohibited without attribution.