Speeding up legal review without delegating judgement.

Three concrete uses

1. 01Reviewing supplier contracts against your contract policy

   AI Act level · Minimal risk

   1. 01Written policyPositions, fallbacks, escalation thresholds
   ↓→
   2. 02Contract analysedClause by clause
   ↓→
   3. 03Deviations flaggedWith the fallback clause
   ↓→
   4. CheckDecision by the lawyer in charge
   ↓→
   5. 04Lawyer’s decisionEscalated above threshold

   The problem

   Supplier contracts arrive on the other party’s paper and each lawyer reviews them with their own benchmarks. Liability, personal data and reversibility are handled unevenly.

   What the AI does

   AI compares each clause with the written positions of your contract policy, flags deviations and proposes the planned fallback clause. It does not negotiate, accepts no deviation and signs nothing.

   Data needed

   Contract policy with positions and fallbacks, standard contracts, the contract received and the history of authorised concessions.

   Who signs off

   The lawyer in charge rules on each deviation; above the set thresholds, the legal department decides.

   Minimal under the AI Act (EU); the concern is the confidentiality of contracts entrusted to the tool and where it is hosted.

   • RAG
   • Guardrails
   • AI hosting

2. 02Linking each new text to the processes it affects

   AI Act level · Minimal risk

   1. 01Text publishedOfficial source only
   ↓→
   2. 02Sourced summaryArticles and dates cited
   ↓→
   3. 03Processes affectedRecord and process map
   ↓→
   4. CheckApproval by the lawyer or DPO
   ↓→
   5. 04Actions assignedOwner and deadline

   The problem

   Texts pile up, from EU regulations to authorities’ guidelines, and the watch remains a list of links. Nobody knows which processes must change, or who must act.

   What the AI does

   AI summarises each official text, matches it against the record of processing and the process map, and suggests the owners concerned. It gives no legal characterisation and closes no action.

   Data needed

   Official sources monitored, record of processing activities, inventory of AI uses and the process map with its owners.

   Who signs off

   The lawyer or the data protection officer approves the analysis before any action is assigned.

   Minimal: internal document analysis. The main risk is an error on a date or an article, hence the mandatory source citation.

   • RAG
   • Hallucination
   • Evaluation

3. 03Preparing responses to data subject access requests

   AI Act level · Minimal risk

   1. 01Request receivedIdentity checked, clock started
   ↓→
   2. 02Systems identifiedFrom the record of processing
   ↓→
   3. 03Draft responseExtracts, third-party data masked
   ↓→
   4. CheckApproval by the data protection officer
   ↓→
   5. 04Response sentAfter the DPO’s check

   The problem

   An access request means finding a person’s data across many systems within one month. The search is manual and the response rarely complete.

   What the AI does

   AI identifies the systems concerned from the record of processing, prepares the extracts and drafts a response. It sends nothing to the person and decides on no refusal or restriction.

   Data needed

   Record of processing, the person’s identifiers, extracts from the systems concerned and approved response templates.

   Who signs off

   The data protection officer checks identity, completeness and the masking of third-party data before anything is sent.

   Minimal under the AI Act (EU); the GDPR applies in full, since the tool processes the data of the person and of third parties.

   • AI agent
   • Logging
   • Human oversight