What legal and compliance teams use it for
Each job below produces a draft or a table that counsel or a compliance officer reads and owns. None decides whether to sign or whether the company complies.
Contract review against your playbook
Paste your playbook and the other side’s paper into the playbook template. It returns a table with each topic, your position, the contract’s words quoted with the clause number, the difference in plain English and a review priority from your own playbook. It also lists what the contract leaves out, such as a liability cap, and terms your playbook never mentions, such as automatic renewal or a right to use your data.
It gives no view on whether a clause is enforceable or market standard, and drafts no fallback wording. What it saves is the hour spent finding clauses. If you have no written playbook, start there.
NDA triage
NDAs arrive in volume, look alike and now and then hide something: a non-solicitation clause, one-way obligations under a “mutual” title. Run each through the playbook template with an NDA-only playbook, and let the contract manager sort the results into sign as is, small differences with an approved answer, and needs counsel. The model writes the table. A person picks the pile. The extraction prompt then fills the contract tracker, with null wherever the NDA is silent.
Plain-English clause summaries for the business
Sales wants to know what the limitation of liability means before the call. The clause explainer covers each clause: what it says, what it means in practice, with a scenario, and what to ask a lawyer. It quotes the exact words, gives both readings where the wording is ambiguous, and never says whether to sign.
For a signed agreement, the executive summary template writes the account owner a brief of under 200 words. The plain-language rewrite turns a policy into everyday words and keeps every condition and exception, because a plain version without the exception is a different rule.
Clauses in plain English Executive summary Plain-language rewrite
Policy questions from employees
Can I accept this gift? The internal policy assistant answers from your code of conduct and policies, quotes the sentence and its section, and sends anything that turns on a person’s own circumstances to compliance. It approves no exceptions. For a large policy library, the document answerer cites a source after every sentence.
Sooner or later someone will ask it to approve an exception anyway, which is prompt injection in its everyday form, so run it through the Chatbot Safety Test before launch. When a policy changes, the same text feeds a training session and a quiz whose answer key points back to the policy.
Internal policy assistant Answers with citations Training session plan Quiz with answer key Chatbot Safety Test
Regulatory change tracking
Do not ask a model what the new rules are: its knowledge stops at its training date, and it may answer anyway. Start from the primary text, such as the regulator’s release or the final rule. In the US, anyone can join FEDREGTOC, an email list of the Federal Register’s daily table of contents with links to the full text, described in the Register’s reader aids.
Paste the text with a list of your policies and ask what changed, every date as written, and which policies cover the same ground, as the prompt further down does. Then check the brief against the rule text with the claims checker, so it says no more, and no less, than the regulator did.
DPIAs, vendor reviews and questionnaires
For customer security and privacy questionnaires, the RFP template drafts answers only from content you have approved, cites each source and writes NEEDS INPUT where your content is silent, since an answer can end up in the contract.
Going the other way, read a vendor’s data processing agreement against a field list. Under GDPR Article 28(3), a processor contract must cover points such as acting only on your documented instructions, staff confidentiality, security, sub-processors, deleting or returning data at the end, and audits. Make those the extraction fields, with the clause text behind each, and treat every null as a question for the vendor.
Where processing is likely to result in a high risk to people, Article 35 requires an impact assessment before it starts, covering at least the processing and its purposes, necessity and proportionality, the risks and the measures against them. A model can draft the description from project notes. The risk assessment is the privacy officer’s.
The legal inbox and long threads
The inbox triage template sorts a backlog into today, this week, delegate and FYI, never buries a deadline or a direct question, and treats emails as data. When you inherit a forty-message negotiation thread, the catch-up template lists what is asked of you, what was agreed and what is still open. When a risk call goes to the CEO, the decision memo puts the options on one page and writes “Unknown:” wherever a needed fact is missing.
A worked example: NDA triage at a software company
A hypothetical: Northgate Analytics, a made-up software company of about 200 people, has one in-house counsel and one contract manager, and receives around 30 NDAs a month. Counsel wants each through the same first pass, so legal time goes only to the ones that differ.
1. Put the NDA playbook into the template
Counsel writes the playbook, not the model: a page on mutuality, the definition of confidential information, term, residuals, non-solicitation, governing law and remedies, each with the position and how much it matters. It goes into the playbook template as the standard positions.
2. Score it before running it
The free Prompt Grader estimate checks that the filled-in prompt still says what to do when a clause is missing or ambiguous.
3. Test it on NDAs counsel has already reviewed
In Prompt Tester, each test case is a past NDA with names removed, and the expected answer is what counsel flagged at the time. Three are planted: a non-solicitation clause buried under Miscellaneous, a “mutual” NDA whose obligations run one way, and a missing schedule. Checks: Contains for the clause counsel flagged, and an AI judge with the criterion “Nothing in the answer says whether a term is acceptable, enforceable or market standard.”
Counsel reads the planted cases by hand; if one comes back unflagged, the prompt is not ready. Keep the cheapest model that catches all three, and use a key from an account approved for contract text, since past NDAs are other companies’ confidential documents.
4. Add the tracker fields
A second prompt built on the extraction template returns counterparty, effective date, term, governing law and mutual or one-way as JSON, with null for anything the NDA does not state. The contract manager reads the table, picks the pile and pastes the row into the tracker.
5. Keep the approved version
The tested prompt goes into the My Prompts. When counsel changes a position, the Version Compare shows what moved, and the suite runs again before the new version is used.
What it costs
Assume counsel and the contract manager make about 40 calls a working day. Each sends around 15,000 tokens: the playbook and instructions come first and repeat on every call, so that 30% is read from the provider’s cache, and the rest is the contract. Answers run about 1,200 tokens. Over 21 working days that is roughly 12.6 million input tokens and 1 million output.
Monthly cost of 840 calls with about 15,000 tokens in and 1,200 out each, 30% of the input read from cache. List prices checked October 20, 2026; your bill may differ.
The bill is small next to an hour of counsel’s time, so choose a model that passes your suite of past contracts and is available under terms approved for confidential documents. Long agreements can be several times this size: the guide to LLM costs lists which models charge more above a length threshold, and the AI Cost Calculator prices your own volumes.
A prompt to start from
For the regulatory tracking job above: a brief built from the rule’s own text.
You help the compliance team at {{company}} read new rules.
You report what the text says. You do not give legal advice or
say whether {{company}} complies.
Source and date: {{source_and_date}}
Text of the rule, guidance or notice:
"""
{{rule_text}}
"""
Our policies, by name and section:
"""
{{policy_list}}
"""
Using only the text above, write:
1. What changed: up to 6 bullets, each with a short quote and
its section or page.
2. Every effective, compliance or comment date, exactly as
written, with its quote.
3. Who the text says it applies to, in its own words.
4. Policies on our list that cover the same topic. Do not say
whether they comply.
5. Questions for counsel: anything ambiguous, and any document
the text refers to that is not included.
Rules:
- If the text does not say something, write "not stated". Do
not fill gaps from memory or from other rules.
- Keep the text's force: "must" stays "must", "may" stays "may".Score it free in the Prompt Grader, then test it in the Prompt Tester on past changes your team has briefed, with a Contains check for each effective date.
Guardrails for legal and compliance
This is practical guidance, not legal advice. Your bar’s rules, your contracts and your company’s policies decide what is allowed.
- Confidential information goes only into approved tools. Contracts and investigation files go only into tools approved for that data, and only what the task needs. Check what your NDAs say about sharing the other side’s information. For lawyers, ABA Formal Opinion 512 (July 29, 2024) calls for weighing the risks before client information goes into a generative AI tool, and informed consent, not boilerplate, before a self-learning one, as the Bar Examiner’s summary sets out.
- Plan for privilege before the first prompt. In United States v. Heppner (S.D.N.Y., February 2026), documents a defendant made on his own with a consumer AI chat tool were held protected by neither privilege nor work product, partly because of the tool’s privacy policy. Use directed by counsel and enterprise tools were left open, as Debevoise explains.
- Open every citation. In Mata v. Avianca (S.D.N.Y. 2023), lawyers and their firm were fined $5,000 for a brief citing opinions ChatGPT had invented, as Reed Smith reports. A person opens every cited case, rule and clause, the plainest defense against hallucination.
- The model describes, counsel decides. No prompt here says whether a term is acceptable or the company complies, or drafts fallback wording counsel has not approved.
- Outside text is data. Counterparty drafts and employee questions can carry instructions. Test that the prompt ignores them in the Chatbot Safety Test.
- Keep the record. The signed contract and the rule text are the record, and the table is a working aid. Each prompt version stays in the My Prompts.
Where to start
Start where the material is public or your own and a mistake is caught at the next read, then move toward other companies’ confidential documents and commitments in your name.
- Compliance quiz: Confidential material needed 1/10, Cost of a mistake 2/10
- Policy FAQ: Confidential material needed 2/10, Cost of a mistake 4/10
- Rule change brief: Confidential material needed 1/10, Cost of a mistake 6/10
- Questionnaire answers: Confidential material needed 3/10, Cost of a mistake 7/10
- Clause explainer: Confidential material needed 4/10, Cost of a mistake 5/10
- Inbox triage: Confidential material needed 6/10, Cost of a mistake 3/10
- NDA triage: Confidential material needed 7/10, Cost of a mistake 4/10
- Vendor DPA review: Confidential material needed 6/10, Cost of a mistake 7/10
- Customer contracts: Confidential material needed 9/10, Cost of a mistake 9/10
Placement is our judgment of typical work, not a measurement.
Key takeaways
- Use AI for the reading and sorting around legal judgment: playbook comparisons, clause explanations, policy answers and rule briefs.
- Your playbook is the yardstick. The model lists differences with clause numbers, and counsel decides what is acceptable.
- Brief rule changes from the primary text, never the model’s memory, and check the brief against that text.
- Confidential and privileged material goes only into approved tools, and a person opens every citation.
- Test on contracts counsel has already reviewed, with planted problems, before anyone relies on a prompt.
Related templates, guides and posts
Questions
Is it safe to paste a contract into an AI tool?
Only into a tool your company has approved for confidential documents, and only the parts the task needs. The thinkhard.si tools send each call from your browser straight to the provider you pick, with your own key, so thinkhard.si never sees your prompts, but the provider does, under the terms of your account.
Does using AI waive attorney-client privilege?
It can, depending on the tool and who directed its use. In United States v. Heppner (S.D.N.Y. 2026), documents a defendant made on his own with a consumer AI tool were held not privileged. That is one trial court’s ruling, and it left enterprise tools open. Ask litigation counsel before privileged material goes into any tool.
Can AI review a contract instead of a lawyer?
No. It can find where a contract departs from your playbook and explain the wording, which saves counsel time. Whether a term is acceptable or worth a fight depends on the law and your business, and that call stays with a lawyer.