AI in Legal and Contract Review: What In-House Teams Can Automate, and Where the Risk Stays

AI contract review is the use of language models to read, classify, compare and mark up agreements against a company's own standards, so that lawyers spend their time on the clauses that matter instead of the ones that never change. It is now mainstream in corporate legal departments: the ACC and Everlaw survey of 657 in-house legal professionals, published in October 2025, found generative AI use had more than doubled in a year, from 23 percent to 52 percent. The evidence on quality is split by task. AI tools beat lawyers on extraction and document questions in the Vals Legal AI Report of February 2025, but lost to them on redlining, and the leading legal research tools still hallucinated on 17 to 33 percent of queries in a Stanford study. The position taken here: let the business self-serve low-value standard agreements with AI under a legal playbook, keep a lawyer on everything that moves material risk, and never let a model's output reach a court, a regulator or a counterparty without human verification.

This is a business decision guide for executives, not legal advice. Your own counsel should set the playbook and the thresholds.

Key Takeaways

• Legal touches every deal, hire and vendor. AI removes most of the reading on standard agreements, not the judgement on non-standard ones.
• Independent benchmarks show AI ahead of lawyers on data extraction, document Q&A and summarization, and behind them on redlining and on research in public filings. Vendor studies claiming near-perfect accuracy should be read as marketing.
• Hallucinated citations are a sanctionable failure, not a hypothetical one. A public tracker of court decisions involving AI-fabricated material listed 2,246 cases as of October 31, 2026.
• Privilege is unsettled. In February 2026 a federal judge in New York held that a defendant's chats with a consumer AI tool were neither privileged nor work product; a court in Michigan reached a different result on work product the same day.
• The decision is a triage: self-serve with AI, AI first pass plus lawyer sign-off, or fully manual, set by contract type and value at risk.

Why Legal Is Where the Volume Problem Sits

Every function generates contracts: sales order forms, procurement supplier terms, HR offer letters and severance releases, IT software licences. Most are close to a template, and most in-house teams still read them line by line, because nobody can tell in advance which one hides the unusual indemnity.

The cost of not reading carefully is measurable. World Commerce and Contracting, the contract managers' association, reported in an August 2025 whitepaper that the average business loses almost 9 percent of contract value through poor contract management, with an average value erosion of 8.6 percent. Best performers sit near 3 percent; the worst lose 15 percent or more.

High volume, mostly standard content and money hidden in the exceptions: that is the pattern where AI earns its place. It is the same pattern seen in AI-driven HR screening, with one important difference: in legal, the output is often a binding commitment.

What AI Does Across the In-House Legal Workflow

Contract intake and triage

Intake triage is the step where an incoming contract is classified by type, counterparty, value and deviation from template, and routed to the right reviewer. For most teams it is the lowest-risk, highest-return starting point: a misrouted contract gets caught by the reviewer it lands with.

First-pass review against a playbook

A playbook is the legal team's written position on each clause: preferred language, acceptable fallbacks and walk-away points. AI compares a counterparty draft against it and produces an issues list. Here the playbook matters more than the model: without a written one, the tool has nothing consistent to compare against.

Clause extraction and obligation tracking

Extraction pulls renewal dates, notice periods, liability caps and service levels from signed contracts into a register, and obligation tracking turns them into alerts. The technology is the same document AI used across finance and operations, covered in how document AI extraction works. This is where the WorldCC value-erosion figure is most directly attacked: missed renewals and unclaimed service credits are extraction failures, not negotiation failures.

Redlining standard agreements

AI can propose tracked changes to bring a counterparty's NDA or standard order form back to the company's positions. On simple, high-volume agreements this works well enough to let the business self-serve. On complex agreements the evidence below says lawyers still do it better.

Legal research

Research assistants answer questions of law and cite authorities. It is the task with the most documented failures, because models produce plausible citations to cases that do not exist.

E-discovery and investigations

Technology-assisted review is long established in litigation. Generative models extend it to summaries and chronologies, under mature controls: sampling and validation against human-coded sets.

The legal task table

What the Evidence Says About Accuracy and Time Saved

The evidence base is better than in most functions, because legal academics have run controlled studies. It still needs sorting into independent work and vendor claims.

Three conclusions follow. AI is reliably faster: Vals found the tools between six and 80 times faster than lawyers, depending on the task. Quality is task-dependent, and the tasks where AI loses, redlining and research, are the ones that create binding language or cite authority. And the near-perfect numbers come from vendors; the LawGeex answer key was built partly from all participants' answers, including the AI's.

Adoption surveys mostly come from vendors too. Thomson Reuters, which sells CoCounsel, reported in February 2026 that 47 percent of corporate legal respondents worked at organizations using generative AI, in a survey of 1,514 professionals. FTI Consulting and Relativity put general counsel team use at 87 percent in March 2026. Read the direction, not the decimal.

The more telling number is about measurement. In a November 2025 ACC and Everlaw follow-up survey of 284 legal leaders, only 12 percent said they track technology return on investment. The fix is to pick a unit of work, such as cost and cycle time per contract, and measure it before and after.

Where It Fails

Hallucinated citations, and the courts' response

The failure that made legal AI famous is still happening. The cases below are a sample, each verified against the decision or reliable reporting:

Researcher Damien Charlotin's tracker listed 2,246 such decisions worldwide as of October 31, 2026. Large firms and specialist tools are not immune, and courts treat it as a supervision failure, so the exposure travels up to whoever was responsible for the work. For the control patterns that reduce this failure, see how to control AI hallucination in production.

Non-standard deals

Playbook review works because standard agreements are repetitive. A joint venture, an acquisition or a settlement is not. There is no playbook position to compare against, and the risk lies in what is missing from the draft as much as in what is there. AI does not reliably notice an absent clause that a lawyer would expect.

Jurisdiction nuance

The same clause can be enforceable in one jurisdiction and void in another: non-competes, liability caps and consumer terms all vary. A tool used on cross-border agreements needs jurisdiction-specific playbooks, and a lawyer qualified in the governing law for anything outside them.

Privilege and Confidentiality: The Unsettled Risk

When a contract or a legal question goes to a model, two questions follow: does the provider keep or use the data, and does sending it waive legal privilege?

The confidentiality risk is familiar. In May 2023 Samsung banned staff in one of its largest divisions from using generative AI on company devices after engineers uploaded internal source code to ChatGPT, Bloomberg reported. Enterprise terms now usually exclude training on customer data, but they differ and need checking clause by clause. The broader question of how to evaluate an AI vendor applies in full.

The privilege question is newer and live. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled from the bench on February 10, 2026, and issued a written opinion on February 17, holding that a criminal defendant's conversations with a consumer AI chatbot were neither privileged nor work product. The reasons were that the tool is not a lawyer, that the provider's privacy policy allowed sharing with third parties, so there was no reasonable expectation of confidentiality, and that the material was not prepared at counsel's direction. The opinion left room for enterprise tools with different terms to be treated differently. On the same day as the Heppner bench ruling, February 10, 2026, a magistrate judge in the Eastern District of Michigan, in Warner v. Gilbarco, held that a self-represented plaintiff's ChatGPT-assisted materials were protected work product, reasoning that AI tools are tools, not persons. Two district courts, no appellate ruling.

The practical consequence is a policy line: privileged material goes only into enterprise tools with contractual confidentiality, under counsel's direction, never into consumer tools.

What the Professional Rules Say

Lawyers are bound by professional-responsibility rules, and the main bodies have issued guidance:

• American Bar Association Formal Opinion 512, issued July 29, 2024, applies the existing duties of competence, confidentiality, communication, candor, supervision and reasonable fees to generative AI. It says client informed consent is required before information about a representation is entered into a self-learning tool, and that boilerplate in an engagement letter is not enough. It is advisory, not binding.
• State bars. The State Bar of California approved practical guidance in November 2023, the Florida Bar adopted Ethics Opinion 24-1 in January 2024, and the New York State Bar adopted its task force report in April 2024.
• Courts. Judge Brantley Starr of the Northern District of Texas issued one of the first standing orders in May 2023, requiring lawyers to certify that AI-drafted content was checked by a human.
• Regulators. The Solicitors Regulation Authority in England and Wales authorized Garfield.Law on May 6, 2025, as the first AI-driven law firm, limited to small debt claims and requiring client approval at each step.

For in-house teams, supervision is the duty that bites: a general counsel who lets the business self-serve contracts with AI is accountable for how that process is designed. The wider question of who answers when an autonomous system makes a costly mistake is covered in the agent liability and accountability gap.

In-house contract review is not a high-risk use under the EU AI Act: Annex III, point 8, covers AI used by or for judicial authorities. The Digital Omnibus on AI, published on July 24, 2026, also moved most high-risk obligations to December 2, 2027, and those for AI embedded in regulated products to August 2, 2028.

The Decision: Which Contracts the Business Can Self-Serve

The triage below sets the AI role and human sign-off by contract type and value at risk. Thresholds are illustrative; legal and finance should set them together.

Self-service is safe only where the contract is on a template, deviations are pre-approved and an error is small and recoverable. Every other row gets a named lawyer.

What the Vendor Market Offers

The market has consolidated around research platforms, contract-lifecycle tools and Word add-ins. Harvey announced a 550 million US dollar raise at a 15.5 billion dollar valuation in September 2026. Thomson Reuters bought Casetext, maker of CoCounsel, for 650 million dollars in August 2023. LexisNexis made its Protégé assistant generally available in the US in January 2025. Luminance raised a 75 million dollar Series C in February 2025, and Spellbook a 50 million dollar Series B in October 2025. Funding measures investor conviction, not accuracy: ask for results on your own contracts, scored by your own lawyers.

How to Roll It Out

1. Write the playbook first. No playbook, no self-service.
2. Start with extraction on signed contracts. It recovers renewal and obligation value at the least risk and builds the register every later step needs.
3. Pilot first-pass review on NDAs, measuring cycle time and how often lawyers override the AI's issues list.
4. Open self-service only when the override rate is low and stable, with a one-click escalation to legal.
5. Set the privilege policy in writing: which tools, which data, under whose direction.

The Position, and Its Tradeoff

The recommended stance is AI for reading and routing, lawyers for judgement and signature. AI does intake, extraction and first-pass review on everything; the business self-serves only templated, low-value agreements; a named lawyer stays on every contract that moves material risk and every document that cites authority.

The tradeoff is speed. A stricter line keeps more contracts in the legal queue, and the business will push back. Some teams will draw the line higher and accept more small errors for faster deals. That is legitimate if it is deliberate, with the error rate measured and the threshold written down. What is not defensible is drift: a self-service scope that grows until a model is negotiating material terms no lawyer has read.

Frequently Asked Questions

Can AI review contracts as accurately as a lawyer?

On some tasks, yes. The Vals Legal AI Report of February 2025 found the best tools ahead of a lawyer baseline on data extraction, document questions and summarization, but behind lawyers on redlining. Accuracy depends on the task, the tool and the quality of the company's playbook.

Is it safe to upload contracts to an AI tool?

It depends on the tool's contractual terms. Enterprise agreements usually exclude training on customer data and provide confidentiality commitments; consumer tools often do not. A February 2026 New York federal ruling held that chats with a consumer AI tool were not privileged, so privileged material belongs only in enterprise tools used under counsel's direction.

Which contracts can the business review without legal?

Only templated, low-value agreements where every permitted change is pre-approved by legal, such as mutual NDAs on company paper or standard order forms within deal desk rules. Anything with non-standard terms, data processing, employment releases or material liability needs a lawyer's sign-off.

What happens if AI invents a legal citation?

Courts sanction the lawyers who file it. In the US cases summarized above, fines ranged from 1,000 to 10,000 dollars, alongside reprimands, removal from cases and referrals to bar regulators. More than 2,200 such decisions had been logged worldwide by October 2026.

The Bottom Line

Legal was always going to be early: its raw material is repetitive language. The evidence shows where AI is safe: reading, classifying, extracting and comparing. It also shows where it is not: binding language on novel deals, and authority cited without verification.

Draw the self-service line at the template and the pre-approved fallback, measure what crosses it, and keep a lawyer's name on everything else. That gets most of the speed without betting a material contract on a model's best guess.