How can you review contracts with AI without sending documents outside the firm?

You can review contracts with AI without the document leaving the firm: the language model runs on infrastructure controlled by the firm itself, reads the contract, flags risky clauses and suggests changes, and every answer points to the passage it came from. The decision on what to accept, negotiate or reject remains the lawyer's.

Have you ever stopped to think how many copies of a confidential contract exist after someone pastes the text into a public AI tool? This article explains what a contract AI does, why the place where it runs matters, and how to start without betting the whole firm on a tool.

In the legal vertical DOUVRAS designed, the contract assistant has four functions: contract analysis, clause review, risk identification and improvement suggestions. It can also help with drafting, starting from templates the firm already uses.

In practice, this means tasks like these:

Targeted reading. Finding, in a 40-page contract, the penalty, termination, jurisdiction, confidentiality and price adjustment clauses, and showing where each one is.

Comparison with the firm's standard. Pointing out where the draft received departs from the template the firm usually accepts.

List of points of attention. Putting together a draft with the clauses worth discussing with the client, each one with the original passage next to it.

What it does not do is decide. A language model makes mistakes, sometimes in a very confident tone. It does not know the client's strategy, the relationship with the other party or what was agreed off paper. That is why, in the design we use, the AI's output is always a draft for review, never a legal opinion.

A contract is one of the most sensitive documents that passes through a firm. It holds personal data of the parties, amounts, commercial terms and, often, strategic information that is not personal data but is protected by professional confidentiality.

The OAB Code of Ethics and Discipline states, in arts. 35 and 36, that lawyers must keep confidential the facts they learn in the practice of the profession and that communications with the client are presumed confidential. Brazil's data protection law, the LGPD, requires processing limited to what is necessary (art. 6), security measures from the design stage (art. 46), and only allows international data transfers under the cases in art. 33.

The architecture of the DOUVRAS legal vertical starts from three guarantees: local processing, so documents do not leave the controlled environment; encryption in communications; and encrypted local backup, with keys exclusive to the firm. With this, the contract is not handed to an AI vendor for processing, and the AI step does not depend on a server abroad.

This does not solve the LGPD or confidentiality on its own. We have written about that limit in Does a local LLM solve the LGPD and attorney confidentiality?. But it removes the biggest risk of using a public tool: not knowing where the document went.

In Stanley Kubrick's film 2001: A Space Odyssey (1968), the HAL 9000 computer controls the ship and, at a critical moment, answers the astronaut: "I'm sorry, Dave. I'm afraid I can't do that." HAL's problem is not being intelligent. It is that nobody on board can see why it decides what it decides.

A contract AI cannot work like HAL. That is why the DOUVRAS AI agents and assistants service includes a source-aware knowledge base, tests, guardrails, an escalation flow, logs and shutdown criteria.

Applied to contracts, the flow looks like this:

Input. The lawyer sends the contract to the assistant, inside the firm's environment. The assistant only consults the sources authorized for that task, such as the contract itself and the firm's standard templates.

Analysis. The model locates the requested clauses, compares them with the standard and marks the points of attention.

Answer with a passage. Each finding comes with a quote of the contract passage it came from, so the lawyer can check it in seconds.

Record. What was asked, which documents were consulted and what was answered is recorded for as long as the firm decides.

AI speeds up reading. Responsibility stays with whoever signs. In our design, three moments always remain with a person:

Before. Someone decides which contracts and which templates the assistant may read, and who may use it.

During. The lawyer checks each point of attention against the quoted passage. A finding without a passage does not count.

After. No draft or opinion goes to the client or to the other party without review by a lawyer.

This is the escalation flow that appears in the scope of the service: the assistant knows what it can do on its own, and anything beyond that goes back to a person.

The common mistake is to buy a "legal AI" and try to plug it into everything at once. A safer path is to start small:

Choose one type of contract. One the firm reviews often and whose standard is already clear, such as service agreements or non-disclosure agreements.

Define what a good result is. For example: the assistant finds every penalty and termination clause a lawyer would find, and shows the passage for each one.

Test with contracts already reviewed. Compare what the AI flags with what the lawyer flagged before. That makes it clear where it gets things right and where it gets them wrong.

Define when to switch it off. If the assistant errs above what the firm accepts, it goes back for adjustment or out of use.

DOUVRAS serves professional services, such as firms and consultancies that sell trust and expertise. In a local-AI contract review project, we design the architecture, install the model in the firm's environment, connect the assistant only to authorized sources and deliver tests, operating limits, an escalation flow, logs and shutdown criteria.

DOUVRAS is not a law firm and does not issue legal opinions. The technical part is ours; the legal judgment on each contract belongs to the firm. If you want the overview first, read how to use AI in a law firm without exposing client data.

And here is the question: in your firm, how many hours a week go into finding clauses, rather than thinking about them?

Douglas Henrique, DOUVRAS Labs.

Does AI replace the lawyer's review?

No. It locates clauses, compares them with the standard and lists points of attention with the source passage. The decision and the responsibility remain with the lawyer.

Is the contract stored inside the model?

In the architecture we use, the assistant consults the authorized documents at the moment of the question. What is recorded, and for how long, is defined in the project.

Is running the AI inside the firm enough to comply with the LGPD?

Not on its own. It reduces sending data to third parties, but purpose, access control, security and record-keeping remain the firm's obligations.

Brazil. Law No. 13,709 of August 14, 2018 (General Personal Data Protection Law). planalto.gov.br

Federal Council of the OAB. OAB Code of Ethics and Discipline, Resolution No. 02/2015. oab.org.br

Kubrick, Stanley. 2001: A Space Odyssey. Metro-Goldwyn-Mayer, 1968.

DOUVRAS Labs. AI agents and assistants. douvras.com