AI for Contract Review: Tools & Confidentiality

There are two guides hiding inside "AI for contract review." One is a workflow: extract the clauses, compare them to your standard positions, flag what deviates. This page covers it in detail.

The other is the question that decides whether you may run the workflow at all — and it is the one every vendor page is silent about, because it is an argument against pasting things into their product:

The reason careful practitioners do not use ChatGPT on contracts is not that it is bad at contracts. It is that the contract is usually somebody else's confidential information, and a consumer chatbot is a third party.

This is a guide to using software. It is not legal advice, and it does not tell you what any clause means or whether to sign anything.

The Challenge

Contract review is a volume problem wearing a judgment problem's clothes. A thirty-page agreement contains perhaps a dozen provisions that actually matter, buried in boilerplate, and finding them is a slow, attention-expensive read that humans do badly at 6pm on a Friday.

The work decomposes into repeatable tasks: find the clauses that matter, compare them to your standard position, notice what is absent, explain it in plain language. All four suit a language model. And yet adoption among the people who do this professionally is cautious in a way that looks irrational from outside. It is not irrational. It is the confidentiality problem.

The exposure, stated plainly

The document is usually not yours to disclose. A commercial contract is confidential information belonging to at least one other party, and very often it is itself covered by an NDA enumerating who may see it. Handing it to a third party outside that list is a disclosure. That the third party is a model rather than a person does not obviously change the analysis, and nobody should want to be the test case.

Consumer accounts are not a private notebook. On ChatGPT Free and Plus, conversations are used to improve OpenAI's models unless you switch off Improve the model for everyone in Data Controls. Google's Gemini Apps privacy notice is blunter: a subset of chats "are reviewed by human reviewers," and — verbatim — "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services." Reviewed chats are kept up to three years, even after you delete your activity.

Deletion is a promise, not a guarantee. In 2025 a court order in the New York Times' litigation against OpenAI forced the company to preserve consumer ChatGPT output logs that would otherwise have been deleted — including deleted chats and Temporary Chats. The obligation was lifted that autumn, but a slice of April-to-September 2025 user data is still held while the case proceeds. Anthropic's documentation makes the point from the other side: even under a zero-data-retention arrangement it "may retain data where required by law or where it has been flagged" by trust-and-safety systems, for up to two years. Litigation overrides retention settings — as it does everywhere. It is simply not what "delete chat" sounds like.

For lawyers, a professional duty sits on top. ABA Formal Opinion 512 (July 29, 2024): "self-learning" generative AI tools — those that train on input data — "create risks that confidential information input into the tool may be disclosed to others," and a lawyer must obtain informed client consent before inputting confidential client information into one. It forecloses the obvious dodge — "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." D.C. Bar Ethics Opinion 388 (April 2024) frames the same duty as two questions: will the provider or strangers to the relationship see this, and will my input change what later users are told?

And the privilege risk is no longer hypothetical. In United States v. Heppner (S.D.N.Y., February 2026), Judge Jed Rakoff held that dozens of documents a criminal defendant had generated using a consumer version of Claude were neither privileged nor protected work product. Orrick, O'Melveny, Paul Weiss and McDermott published client alerts within weeks; the Harvard Law Review blog covered it as a question of first impression.

Read the holding narrowly, because it is narrow. Rakoff's reasoning rested on facts specific to that defendant: he used the tool on his own initiative, without his counsel's direction, and a chatbot is not an attorney — so the communications were not made to a lawyer for the purpose of obtaining legal advice, and the work-product doctrine, which turns on preparation at counsel's direction, did not attach. The vendor's terms (which contemplated that inputs could be disclosed) featured in the analysis, but they were not the whole of it. Several of the client alerts note that had counsel directed the use, a Kovel-style argument might have brought it inside the privilege.

So the honest statement is not "a chatbot transcript is never privileged." It is that a transcript is a document, it is discoverable like any other document, and the protections you might assume attach to it may not. Whether privilege attaches in your situation is a question for your own counsel — not for this page, and not for a case decided on someone else's facts.

How AI Solves It

Set confidentiality aside for one paragraph, because the capability is real.

A model reading a contract is doing structured extraction over text it can see. It will find the liability cap, quote it, name the defined terms it depends on, note the carve-out. Given your standard positions, it will tell you which clauses depart from them and by how much. Given a dense paragraph, it will restate it in language a non-lawyer can act on.

What it is not doing is deciding anything:

A model does not know your risk tolerance, your negotiating position, or the quirks of the governing law. It flags. A human decides.

A one-sided indemnity is a red flag in one deal and the price of entry in another, and nothing in the prompt tells the model which deal you are in. Worse, it will not tell you that it does not know — it produces a confident, fluent assessment either way. See hallucinations.

Used properly, AI collapses the first-pass read: the mechanical hour spent locating the provisions that matter. That hour is the one you get back. It does not collapse the review.

Recommended Tools & Models

The tool follows from the document, not the other way round. So the first artifact you need is not a tool. It is a decision tree.

What may never go into a consumer account

Absent a specific agreement that changes it, treat all of these as never:

• A client's contract, in any form, if you are a lawyer or work for one
• Anything under an NDA — which is most commercial contracts you did not draft
• Anything privileged, including your own notes on privileged advice
• Third-party confidential information — the counterparty's pricing, its customer schedule
• Personal data — names, salaries, health information

What changes the answer

Three things, and only three:

1. A vendor contract saying your inputs are not used for training. Standard on business tiers. The baseline, not the finish line.
2. A zero-data-retention (ZDR) arrangement, under which the provider does not store your prompts and outputs at rest after the response returns. This is what D.C. Bar Opinion 388 was pointing at when it distinguished free products that collect inputs from paid ones offering negotiated confidentiality terms.
3. A data-processing agreement (DPA) — or a BAA where health data is involved. The legal instrument, not the marketing page, is what you are buying.

The published policies, checked July 2026. Verify them yourself; they change, and the change is not announced to you.

One footnote: DeepSeek's open weights and DeepSeek's hosted service are different products. The model on your laptop sends nothing anywhere; the app stores data on servers in mainland China. Mistral Le Chat is often recommended for EU-hosted processing — if that is why you are choosing it, read its current terms rather than its reputation.

The exception that eats your zero-retention agreement

This is the sort of thing that makes a negotiated ZDR arrangement quietly stop being one, and it is why the table above ends with verify it yourself.

Since 9 June 2026, Anthropic operates a category of covered models — currently Claude Fable 5 and Mythos-class models — for which prompts and outputs are retained for 30 days to support safety work, on every platform where those models are offered. That retention applies notwithstanding an existing zero-retention arrangement, and it reaches Claude Console, Claude Code and Enterprise, and access through Bedrock, Google Cloud and Microsoft Foundry alike.

The failure mode writes itself. A firm negotiates ZDR, believes its inputs are not stored, then picks a covered model from a dropdown — and now has thirty days of retained client material it does not know about. ZDR is configured per workspace and scoped to particular models. Ask which models your arrangement actually covers, and ask again when the vendor ships a new one. A retention promise is a statement about a specific product at a specific time, not a property of your account.

The path almost nobody offers you: run the model locally

If none of the three unlocks exist — no enterprise account, no ZDR, no DPA, and a document you may not disclose — the answer is not "give up," and it is certainly not "paste it anyway."

Run an open-weight model on your own machine. The document never leaves the disk it is already on. No vendor, no retention policy, nothing for a preservation order to reach. Ollama serves a local model behind an OpenAI-compatible API in one command; LM Studio does the same with a desktop GUI and no terminal, which makes it the easier start if you are not a developer.

Sensible models — all genuinely open-weight: Llama 4, Gemma 4 (Apache 2.0), Mistral Medium 3.5, DeepSeek V4 (MIT), GLM-5.2 (MIT). They are not as sharp as a frontier model — but a first-pass extraction you are permitted to run beats a brilliant one you are not.

Check the licence, not the reputation. "Open" is not a property of a brand. Qwen3.7-Max, for example, is proprietary and closed-weight despite the family's open-source history — there are no weights to download, so there is nothing to run locally, and reaching for it means sending the document to an API after all. That is the precise mistake this section exists to prevent.

One trap, and it is new. Ollama now offers cloud models — tags ending in -cloud, such as gpt-oss:120b-cloud — which run inference on Ollama's servers and require you to be signed in to ollama.com. Ollama states its cloud does not retain data, but the document has still left your machine. If the whole point is that nothing is transmitted, use only local tags, and check: pull the model, disconnect from the network, run your prompt. If it answers, you are local. If it errors, you were not.

On the cloud path, Claude Opus 4.8 and Gemini 3.5 handle long documents best — a contract with schedules is long, and all of it has to fit in one context window. The model is rarely the bottleneck. The playbook is.

Step-by-Step Implementation

1. Classify the document before you open any tool

Thirty seconds, every time. Whose confidential information is in this? If the answer is anyone but you — a client, a counterparty, an employee — you are on the local path or the enterprise path, never the consumer path. Is it covered by an NDA that enumerates permitted recipients? And, after Heppner: if this transcript were produced in discovery, what would it show?

2. Write the playbook — this is the actual asset

A playbook states, for each clause type you care about, what you accept, what you push back on, and what you will not sign:

Limitation of liability. Accept: cap at 12 months' fees, mutual. Push back: cap below 12 months, or one-sided. Escalate: uncapped liability beyond the standard carve-outs.

Ten to fifteen entries covers most commercial agreements. It takes an afternoon, and it is what converts a general-purpose model into something useful for your contracts. Without it you get a summary; with it you get a diff. It is also the only fix for the failure mode in step 5.

3. Set up the private path

Install Ollama or LM Studio, pull a model, run the airplane-mode test above. If you have an enterprise account instead, confirm in writing which agreement covers your usage and whether it includes ZDR. "We have ChatGPT at work" is not an answer to that question.

4. Extract the clauses and flag the risks

Rule 5 is not decoration. A long contract with schedules can exceed a model's context window, and the failure mode is not an error message — it is a truncated document, silently reviewed as though complete. If the answer is anything but "I read all of it," split the contract by section and run the prompt on each.

5. Compare against the playbook — and run absence as its own pass

6. Do the human pass

The output is a list of flags. Now the part no model does: decide. Which deviations matter for this counterparty, this deal size, this relationship? Which are worth the negotiating capital?

Then verify. Take three flags at random and check the quoted text against the contract, character for character. If the model invented a clause number, find that out now rather than in front of the counterparty.

Real-World Examples

Example 1: The indemnity that was not there

Before. A contract manager runs a services agreement through a model and asks for the risks. The output is excellent: a liability cap at three months' fees, an auto-renewal with 90 days' notice, a broad IP licence. Three real findings, correctly quoted. She takes them to the negotiation and gets two fixed.

What the review missed: the agreement contained no supplier indemnity at all — not for IP infringement, not for data breach, not for anything. The model did not flag it, because the model was reading the document, and an absent indemnity is not in the document. There was no clause to summarize, no heading to notice, no sentence to quote. It described what it saw, faithfully and completely.

This is the blind spot, and it is structural: a model reviewing text is very good at what is present and very bad at what is absent. The output looked complete. Nothing in it said "and by the way, there is no indemnity here."

After. The same contract, run through Pass B above — a line-by-line sweep against a checklist of clauses she expects. The output now carries a section headed CLAUSES YOUR PLAYBOOK EXPECTS THAT THIS CONTRACT DOES NOT CONTAIN, and the first line of it is the indemnity.

What changed: not the model, not the contract. The checklist. Absence is only detectable against an expectation, and the expectation has to come from you.

Example 2: The cap that was not a cap

Before. A model reports, correctly and verbatim: "Clause 12.1: The Supplier's total aggregate liability under this Agreement shall not exceed the Fees paid in the twelve (12) months preceding the claim." Reasonable. Standard. Nobody looks twice.

What it did not follow: Clause 12.1 opened "Subject to Clause 12.4," and Clause 12.4 — three pages later, under a heading about excluded losses — reinstated unlimited liability for a category of claim broad enough to swallow most of what could go wrong. Meanwhile "Fees" was a defined term excluding the largest recurring charge in the deal, so the cap was a fraction of what it appeared to be.

After. Rules 3 and 4 of the extraction prompt: quote the definition too, and follow the cross-reference. The output now shows Clause 12.1, Clause 12.4 and the definition of "Fees" side by side. The reviewer draws the conclusion; the model has simply stopped hiding the pieces.

Example 3: The confidentiality near-miss

Before. A paralegal has a 60-page share purchase agreement, a client who wants a summary by morning, and a personal ChatGPT account. He pastes the whole thing in and asks for a plain-language summary of the warranties.

That is a client's confidential document — very likely under an NDA naming permitted recipients, quite possibly containing personal data — pasted into an account whose default setting uses conversations to improve the model, producing a transcript that, per Heppner, is not privileged. He has done nothing malicious. He has done the natural thing.

After. The same paralegal installs LM Studio, downloads Gemma 4, disconnects from the network, and runs the same prompt. It takes ninety seconds longer and the prose is slightly less elegant.

What changed: the summary is close to identical, and the document never left the laptop. That is the whole trick, and it is free. The reason it appears in no vendor's guide is that it does not sell anything.

Industry-Specific Applications

Law firms. The professional-conduct layer sits on top: Formal Opinion 512 and its state analogues, and — for anything approaching client information — consent that is specific rather than boilerplate. A firm with an enterprise agreement and ZDR is in a different position from a solo practitioner with a Plus subscription, and the difference is contractual, not technical. Rules vary by jurisdiction. Check yours, not this page.

In-house legal and procurement. The strongest use case here: you generally own the document, and your organization has the enterprise agreement. High-volume inbound paper — NDAs, vendor terms, order forms — is where a playbook comparison pays for itself in a week.

Founders without counsel. AI can tell you what a contract says. It cannot tell you what it means for you, and it will not tell you when the question is above its pay grade — it will answer anyway. Use it to arrive at your lawyer's office with specific questions, not to skip the visit.

Regulated sectors. If the contract touches health or financial data, the vendor instrument is the whole game: a BAA where health information is involved, a DPA where personal data is. Neither is available on a consumer plan at any price.

Outside the US. The confidentiality logic generalizes; the authorities do not. The ABA opinion, the bar opinions and Heppner are US sources. Your jurisdiction has its own conduct rules and privilege doctrine, and GDPR adds obligations that no amount of no-training terms disposes of on its own.

Best Practices

• Classify the document before you open the tool. Whose confidential information is this? Everything follows.
• When in doubt, go local. Ollama and LM Studio cost nothing and remove the question entirely.
• Run the airplane-mode test. Disconnect and confirm the model still answers. Watch for Ollama's -cloud tags.
• Demand verbatim quotes with clause numbers. A paraphrase is a place for an error to hide.
• Make the model follow cross-references and quote definitions. That is where the real terms live.
• Run absence as its own pass, against a checklist. The model will not volunteer what is missing.
• Write the playbook. One afternoon; it is the difference between a summary and a diff.
• Ask where it stopped reading. Silent truncation is the quietest failure here.
• Never let the output be the decision. It flags; you decide.

Common Pitfalls

The absent clause. The defining failure of this use case. A model reports what the document contains. The missing indemnity, the cap that was never drafted, the termination right you do not have — none of these produce text, and text is all the model has. Only a checklist catches them.

Misread cross-references and defined terms. A cap "subject to Clause 14.3" is not a cap. A term defined narrowly in Schedule 2 is not the term you assumed. Contracts are built so that the sentence in front of you is not the whole story, and that sentence is all the model summarizes.

Hallucinated clause numbers. A model will cite "Clause 8.4" with total confidence when the contract has no Clause 8.4, and the citation looks exactly like the eleven correct ones around it. This is not a fringe worry in legal AI: a Stanford RegLab and HAI study of retrieval-grounded legal research tools, published in the Journal of Empirical Legal Studies in 2025, found Lexis+ AI and Westlaw's AI-Assisted Research hallucinating between 17% and 33% of the time — a hallucination being a wrong statement of law or a real citation that did not support the claim made. Those are domain-specific tools with retrieval built in. A general chatbot with a pasted PDF has fewer guardrails, not more.

Silent truncation. A long agreement with schedules can exceed the context window. The model does not announce this. It reviews what fits and presents the result as a review of the contract.

Treating extraction as solved. The Contract Understanding Atticus Dataset (CUAD) — 510 commercial contracts, over 13,000 clauses annotated under attorney supervision across 41 clause categories — exists precisely because the job is hard, and its own paper concluded that model performance left "substantial room for improvement." Expect false flags alongside the real ones.

The consent that is not consent. For lawyers: a line in the engagement letter is not informed consent under Formal Opinion 512, which says so in as many words.

Assuming the enterprise badge covers you. "We have Copilot at work" says nothing about whether your usage sits inside the tenant carrying enterprise data protection, and "we have ChatGPT" says nothing about which plan. Find out which contract governs — in writing.

Letting the model advise. The moment it starts telling you what to accept — and it will, cheerfully, if you ask — you are taking legal advice from a text predictor that owes you no duty.

Measuring Success

Time to first pass. The concrete win. Time your current manual read before you start, so you know what you replaced. Thomson Reuters' 2025 Future of Professionals report is the figure everyone quotes — professionals expect to save around five hours a week — but note what it is: a self-reported prediction, not a measurement of anyone's saved hours.

Flag precision. Of the issues raised, what fraction were real? A tool that flags everything is a tool you stop reading.

Absent-clause catch rate. The metric that matters most and that nobody tracks. When you review by hand afterwards, did the AI pass catch what was missing? If not, your playbook is too short.

Quote fidelity. Zero forwarded quotes that fail a text search against the contract. Pass or fail.

Confidentiality incidents: zero. The metric you notice only when it fails. Audit your prompt history. Has a client name crept in?

Cost Analysis

The local path: free. Ollama, LM Studio and the open-weight models cost nothing; the only requirement is a machine with enough memory. For documents you may not upload, that is the entire budget.

The consumer path: $20/month, and it does not buy what you need. A paid ChatGPT or Claude plan buys speed, context and higher limits. It does not buy a DPA, it does not buy zero retention, and it does not change what a court would make of the transcript.

The business path: the real answer for an organization. Business tiers carry no-training terms by default and make a DPA available; ZDR is negotiated on top, on approval, and for OpenAI it is restricted to eligible API endpoints. A procurement exercise, not a checkout page.

Setup: three to four hours, most of it writing the playbook — a one-time cost, and the part that compounds.

What none of it buys: your judgment, your knowledge of the deal, and your responsibility for what gets signed.

Related Tools

• Ollama — run an open-weight model locally; the document never leaves your machine
• LM Studio — the same, with a desktop GUI
• Claude — long documents and literal instruction-following, on commercial terms
• ChatGPT — capable generalist; know which plan you are on
• Google Gemini — very large context for contracts with heavy schedules
• Microsoft Copilot — reviewing inside Word, under a tenant's enterprise data protection
• NotebookLM — cites the passage each claim came from, which is the right behaviour when the risk is invented clause numbers
• Perplexity AI — background research on a counterparty, using no confidential input

Related Models

• Claude Opus 4.8 — strong on long, cross-referenced documents and literal instructions
• Claude Sonnet 5 — the everyday workhorse for extraction and playbook comparison
• Gemini 3.5 — very large context for contracts running to hundreds of pages
• GPT-5.5 — capable generalist for plain-language restatement
• Llama 4 — open weights, runs locally, nothing leaves your machine
• Gemma 4 — Apache 2.0; small enough to run comfortably on a laptop
• DeepSeek V4 — MIT-licensed open weights for the local path
• GLM-5.2 — MIT-licensed open weights; another local option

New to prompting? Start with prompt engineering — the two instructions carrying this workflow, quote it verbatim and tell me what is absent, are one sentence each, and they are the difference between a plausible review and a usable one. See also privacy and large language models.