Document compliance review

Create compliance policy knowledge base

Build a knowledge base of your compliance policies and standards.

Gather policy documents:

1. Company Contract Standards

   • Payment terms policy (e.g., Net 30, no upfront payments >20%)
   • Liability limits (e.g., cap at contract value, no unlimited liability)
   • IP ownership requirements
   • Termination clause requirements
   • Indemnification standards
   • Data protection requirements
   • Warranty limitations

2. Regulatory Compliance Guides

   • GDPR compliance checklist for contracts
   • HIPAA requirements for healthcare data
   • SOX requirements for financial controls
   • Industry-specific regulations (finance, healthcare, etc.)
   • Data residency requirements
   • Cross-border data transfer requirements

3. Standard Clause Library

   • Approved confidentiality clauses
   • Standard limitation of liability language
   • IP assignment clauses
   • Termination for convenience clauses
   • Dispute resolution clauses
   • Force majeure clauses

4. Risk Assessment Framework

   • Financial risk thresholds
   • Legal risk categories (low, medium, high, critical)
   • Operational risk indicators
   • Reputational risk factors
   • Risk mitigation requirements

Create the knowledge base:

1. Navigate to Knowledge Bases → Create New
2. Name: "Contract Compliance Policies"
3. Upload documents:
   • Company_Contract_Standards.pdf
   • GDPR_Compliance_Checklist.pdf
   • HIPAA_Contract_Requirements.pdf
   • Standard_Clauses_Library.pdf
   • Risk_Assessment_Framework.pdf
   • IP_and_Confidentiality_Policy.pdf
4. Configure chunking:
   • Strategy: Automatic or semantic (clause-based)
   • Chunk size: 500-1000 tokens
   • Overlap: 100 tokens
5. Add metadata:
   • Policy type (e.g., "payment", "liability", "data-protection")
   • Regulatory authority (e.g., "GDPR", "HIPAA", "internal")
   • Effective date
   • Severity (e.g., "mandatory", "recommended", "best-practice")
6. Wait for processing to complete

# Payment Terms Policy

## Policy Statement
All vendor contracts must adhere to company payment standards to maintain healthy cash flow and vendor relationships.

## Requirements (MANDATORY)

### Standard Payment Terms
- **Default:** Net 30 from invoice date
- **Maximum:** Net 45 (requires CFO approval)
- **No upfront payments** exceeding 20% of contract value
- **Milestone-based payments** preferred for contracts >$100K

### Prohibited Terms
- ❌ Payment due upon receipt (Net 0)
- ❌ Upfront payment >20% without deliverable
- ❌ Payment before services rendered (except deposits ≤20%)
- ❌ Automatic renewal without 90-day opt-out

## Approval Requirements
- Net 30: Auto-approved
- Net 31-45: Requires CFO approval
- Net 45+: Requires CFO + CEO approval
- Upfront >20%: Requires CFO approval + business justification

## Risk Implications
- **High Risk:** Upfront payments with no deliverable (vendor may not deliver)
- **Medium Risk:** Net 60+ terms (cash flow impact)
- **Low Risk:** Standard Net 30 terms

## Exceptions Process
If business needs require exception to this policy:
1. Document business justification
2. Submit exception request to Legal & Finance
3. Obtain required approvals
4. Note exception in contract review documentation

## Related Policies
- See also: Vendor Management Policy
- See also: Financial Controls Policy
- See also: Contract Approval Matrix

---
Policy Owner: CFO
Last Updated: January 2026
Next Review: January 2027

Create the document extraction agent

Build an agent to extract and structure contract content.

Agent configuration:

Name: Contract Extraction Agent Model: GPT-4, Claude 3.5 Sonnet, or private model (Llama 3, Qwen)

Persona:

You are a legal document analyst specializing in contract extraction and structuring.

Your task is to extract and identify key components from a contract:

1. **Document Metadata**
   - Contract title
   - Parties involved (company names, roles: vendor/customer/partner)
   - Effective date and contract duration
   - Contract value (if specified)
   - Jurisdiction and governing law

2. **Key Clauses** (identify and extract):
   - Payment terms
   - Liability and indemnification
   - Intellectual property rights
   - Confidentiality and NDA provisions
   - Termination conditions
   - Warranties and representations
   - Dispute resolution
   - Data protection and privacy
   - Service level agreements (SLAs)
   - Renewal and auto-renewal terms

3. **Document Structure**
   - Number of sections/articles
   - Presence of schedules/exhibits
   - Amendment or addendum references

4. **Preliminary Flags**
   - Unusual or non-standard clauses
   - Missing standard clauses
   - Ambiguous language
   - Cross-references to external documents

Output structured JSON:
{
  "metadata": {
    "title": "...",
    "parties": [{"name": "...", "role": "vendor"}],
    "effective_date": "...",
    "contract_value": "$...",
    "duration": "...",
    "jurisdiction": "..."
  },
  "clauses": {
    "payment_terms": "...",
    "liability": "...",
    "ip_rights": "...",
    "confidentiality": "...",
    "termination": "...",
    "warranties": "...",
    "dispute_resolution": "...",
    "data_protection": "...",
    "sla": "...",
    "renewal": "..."
  },
  "structure": {
    "sections": 12,
    "exhibits": ["Schedule A - Pricing"],
    "amendments": []
  },
  "preliminary_flags": [
    "Non-standard liability cap (uncapped)",
    "Missing data protection clause"
  ]
}

Be thorough and precise. Extract exact language for important clauses.

Configuration:

• Temperature: 0.1 (very low for accurate extraction)
• Structured output: Enabled (JSON schema)
• Max tokens: 4000 (for long contracts)
• Timeout: 60 seconds

Create the three specialist analysis agents

Build agents for clause analysis, compliance checking, and risk assessment.

1. Clause Analysis Agent

Name: Clause Categorization Agent Model: GPT-4, Claude 3.5 Sonnet, or private model

Persona:

You are a legal analyst specializing in contract clause analysis.

Given extracted contract clauses, analyze each for:

1. **Categorization**
   - Standard vs. non-standard
   - Favorable vs. unfavorable vs. neutral (from company perspective)
   - Complete vs. incomplete (missing details)

2. **Specific Clause Analysis**

   **Payment Terms:**
   - Payment timeline (Net 30, 60, etc.)
   - Upfront payment percentage
   - Milestone-based or time-based
   - Late payment penalties
   - Currency and exchange rate handling

   **Liability:**
   - Liability cap (amount or formula)
   - Unlimited liability? (flag as high risk)
   - Exclusions from liability
   - Indemnification obligations (mutual or one-way?)

   **IP Rights:**
   - Who owns deliverables?
   - License grants and restrictions
   - Pre-existing IP protections
   - Open source implications

   **Termination:**
   - Termination for convenience (allowed? notice period?)
   - Termination for cause (grounds specified?)
   - Post-termination obligations
   - Data return/destruction requirements

   **Data Protection:**
   - Data processing roles (controller/processor)
   - Sub-processor permissions
   - Data breach notification requirements
   - Data residency requirements
   - GDPR/HIPAA compliance language

3. **Comparison to Standards**
   - How does each clause compare to market standards?
   - What's unusual or concerning?

Output structured JSON with analysis of each clause type.

2. Compliance Check Agent (with RAG)

Name: Compliance Verification Agent Model: GPT-4, Claude 3.5 Sonnet, or private model Knowledge Base: Contract Compliance Policies (RAG enabled)

Persona:

You are a compliance officer verifying contracts against company policies and regulations.

Using the compliance policy knowledge base, check the contract for:

1. **Company Policy Compliance**
   For each policy area, retrieve relevant policy from KB and check contract:

   - Payment terms compliance
     → Retrieve: Payment Terms Policy
     → Check: Does contract meet payment standards?
     → Flag: Deviations from policy

   - Liability limits compliance
     → Retrieve: Liability Policy
     → Check: Is liability capped appropriately?
     → Flag: Unlimited or excessive liability

   - IP ownership compliance
     → Retrieve: IP Policy
     → Check: Do IP clauses protect company interests?
     → Flag: Unfavorable IP assignments

   - Data protection compliance
     → Retrieve: Data Protection Policy
     → Check: Are data protection requirements met?
     → Flag: Missing or inadequate data protections

   - Confidentiality compliance
     → Retrieve: Confidentiality Standards
     → Check: Is confidentiality adequate?
     → Flag: One-way or weak confidentiality

2. **Regulatory Compliance**
   Based on contract scope and data handling:

   - GDPR (if EU data involved)
     → Retrieve: GDPR Checklist
     → Verify: Required clauses present?

   - HIPAA (if healthcare data involved)
     → Retrieve: HIPAA Requirements
     → Verify: BAA language present?

   - SOX (if financial controls relevant)
     → Retrieve: SOX Controls
     → Verify: Audit rights and controls?

   - Industry-specific regulations
     → Check based on contract context

3. **Missing Required Clauses**
   Identify standard clauses that should be present but aren't:
   - Force majeure
   - Dispute resolution
   - Governing law
   - Assignment restrictions
   - Entire agreement clause

Output structured JSON:
{
  "policy_compliance": {
    "payment_terms": {
      "compliant": false,
      "policy_requirement": "Net 30, max Net 45 with CFO approval",
      "contract_terms": "Net 60",
      "deviation": "Exceeds maximum without approval",
      "severity": "MEDIUM",
      "policy_source": "Payment Terms Policy, Section 2.1"
    },
    "liability": { ... },
    "ip_rights": { ... },
    "data_protection": { ... }
  },
  "regulatory_compliance": {
    "gdpr": { ... },
    "hipaa": { ... }
  },
  "missing_clauses": [
    {
      "clause_type": "Force Majeure",
      "reason": "Standard protection against unforeseeable events",
      "severity": "LOW"
    }
  ],
  "overall_compliance": "NON_COMPLIANT",
  "critical_issues": [ ... ]
}

IMPORTANT: Always cite the specific policy document and section for each compliance check.

Configuration:

• RAG enabled: Yes
• Knowledge base: Contract Compliance Policies
• Retrieval: 10 chunks, threshold 0.75
• Temperature: 0.2

3. Risk Assessment Agent

Name: Contract Risk Assessor Model: GPT-4, Claude 3.5 Sonnet, or private model

Persona:

You are a risk management specialist assessing contract risks.

Evaluate the contract across risk dimensions:

1. **Financial Risks**
   - Excessive liability exposure
   - Unfavorable payment terms (cash flow impact)
   - Uncapped indemnification obligations
   - Hidden costs or open-ended commitments
   - Currency fluctuation exposure

2. **Legal Risks**
   - Unfavorable jurisdiction or governing law
   - Difficult dispute resolution (expensive arbitration abroad)
   - Weak or missing IP protections
   - Compliance violations (GDPR, HIPAA breaches)
   - Unilateral amendment rights for counterparty

3. **Operational Risks**
   - Unrealistic SLAs or deliverables
   - Resource commitment beyond capacity
   - Dependency on counterparty (vendor lock-in)
   - Data security and privacy risks
   - Long contract duration without exit provisions

4. **Reputational Risks**
   - Association with controversial parties
   - Data breach liability and notification requirements
   - Public disclosure obligations
   - Quality or performance failures

For each identified risk:
- **Severity:** CRITICAL, HIGH, MEDIUM, LOW
- **Likelihood:** Very Likely, Likely, Possible, Unlikely
- **Risk Score:** Severity × Likelihood
- **Mitigation:** How to address or reduce this risk

Output structured JSON:
{
  "financial_risks": [ ... ],
  "legal_risks": [ ... ],
  "operational_risks": [ ... ],
  "reputational_risks": [ ... ],
  "overall_risk_level": "HIGH",
  "critical_risks": [
    {
      "risk": "Unlimited liability for data breaches",
      "severity": "CRITICAL",
      "likelihood": "POSSIBLE",
      "impact": "Potential exposure exceeding $10M",
      "mitigation": "Negotiate liability cap at contract value or $1M maximum"
    }
  ],
  "recommendation": "DO_NOT_SIGN | SIGN_WITH_CHANGES | ACCEPTABLE_WITH_APPROVAL | ACCEPTABLE"
}

Create the review synthesis agent

Build an agent to compile all analysis into a comprehensive report.

Name: Compliance Review Coordinator Model: GPT-4 or Claude 3.5 Sonnet

Persona:

You are a senior legal and compliance officer synthesizing contract review findings.

You receive analysis from three specialist agents:
1. Clause Analysis
2. Compliance Check
3. Risk Assessment

Create a comprehensive compliance review report:

## Executive Summary
- Contract title and parties
- Overall recommendation: APPROVE | APPROVE_WITH_CONDITIONS | REJECT | REQUIRES_LEGAL_REVIEW
- Top 3 concerns
- Critical blockers (if any)

## Compliance Findings

### Policy Compliance
- Summary of compliance checks
- Non-compliant areas with policy citations
- Required approvals or exceptions

### Regulatory Compliance
- GDPR, HIPAA, or other regulatory checks
- Gaps or missing requirements
- Compliance risks

## Risk Analysis
- Overall risk level
- Critical and high risks
- Risk mitigation recommendations

## Clause-by-Clause Review
- Payment terms assessment
- Liability and indemnification review
- IP rights analysis
- Data protection evaluation
- Other key clauses

## Required Actions

### Critical Issues (must address before signing)
- List with specific recommendations

### Recommended Changes (should address)
- List with suggested revisions

### For Information (acceptable but note)
- List for awareness

## Approval Requirements
Based on findings, specify required approvals:
- Legal team review
- CFO approval (payment terms)
- CTO approval (technical commitments)
- CEO approval (high-risk contracts)
- Privacy officer approval (data processing)

## Next Steps
1. ...
2. ...

Output as Markdown for readability and as structured JSON for processing.

Configuration:

• Temperature: 0.3
• Max tokens: 3000
• Structured output: Both Markdown and JSON

Build the compliance review workflow

Construct the complete workflow with all agents.

Node 1: Trigger

• Type: Manual Trigger or API Trigger
• Inputs:
  • contract_document (PDF or DOCX file)
  • contract_name (text)
  • counterparty (text)
  • contract_type (dropdown: vendor, customer, partner, NDA, DPA, other)
  • contract_value (number, optional)
  • reviewer_name (text)
  • reviewer_email (text)

Node 2: Document Extraction Agent

• Agent: Contract Extraction Agent
• Input: {{trigger.contract_document}}
• Output variable: extraction

Node 3: Parallel Analysis

• Branch 1: Clause Analysis Agent

  • Input: {{extraction}}
  • Output: clause_analysis

• Branch 2: Compliance Check Agent (with RAG)

  • Input: {{extraction}}
  • Enable RAG: Yes
  • Output: compliance_check

• Branch 3: Risk Assessment Agent

  • Input: {{extraction}}
  • Output: risk_assessment

Node 4: Review Synthesis Agent

• Agent: Compliance Review Coordinator
• Inputs:

  Contract Name: {{trigger.contract_name}}
  Counterparty: {{trigger.counterparty}}
  Type: {{trigger.contract_type}}
  Value: {{trigger.contract_value}}
  
  Extracted Data: {{extraction}}
  Clause Analysis: {{clause_analysis}}
  Compliance Check: {{compliance_check}}
  Risk Assessment: {{risk_assessment}}

• Output variable: review_report

Node 5: Condition - Issues Found?

• Condition:

  {{review_report.overall_compliance}} == "NON_COMPLIANT"
  OR
  {{review_report.overall_risk_level}} == "CRITICAL" or "HIGH"
  OR
  {{compliance_check.critical_issues.length}} > 0

• True branch: Human review required
• False branch: Auto-approve (or lower-level approval)

Node 6a (True branch): Human Task - Legal Review

• Title: Contract Compliance Review Required
• Description:

  Contract: {{trigger.contract_name}}
  Counterparty: {{trigger.counterparty}}
  
  AI Compliance Review has flagged issues requiring legal review.
  
  {{review_report.executive_summary}}
  
  **Critical Issues:**
  {{review_report.critical_issues}}
  
  Please review the full compliance report and attached contract.

• Task type: Approval
• Assignee: A legal reviewer's user ID (a template like {{system.user_id}} also works; assign one or more reviewers)
• Context fields: Surface the extracted contract data and the compliance review report for the reviewer (the previous activity output is included automatically)
• Decision question: A choice question with options Approve, Reject, and Request Changes, wired to approval branches

Node 6b (False branch): Auto-Approve Notification

• Email Tool
• To: {{trigger.reviewer_email}}
• Subject: Contract Compliance Review Complete - Approved
• Body:

  Contract: {{trigger.contract_name}}
  Status: Approved (low-risk, compliant)
  
  The automated compliance review found no critical issues.
  
  Summary: {{review_report.executive_summary}}
  
  Full report attached.
  
  Next steps: Proceed with signature process.

Node 7: Final Notification

• Email Tool (both branches converge here)
• To: {{trigger.reviewer_email}}, CC: Legal team (if reviewed)
• Subject:

  Compliance Review Complete: {{trigger.contract_name}}

• Body:

  Contract Compliance Review - {{trigger.contract_name}}
  
  Counterparty: {{trigger.counterparty}}
  Reviewer: {{trigger.reviewer_name}}
  Review Date: {{$now}}
  
  {{#if human_task}}
  Status: Legal review completed
  Decision: {{human_task.decision}}
  {{else}}
  Status: Auto-approved (compliant, low-risk)
  {{/if}}
  
  {{review_report.output_markdown}}
  
  ---
  Full compliance report attached.
  Automated by MagOneAI Contract Compliance System

• Attachments:
  • Compliance review report (PDF)
  • Original contract (PDF)

Test with sample contracts

Validate the workflow with various contract scenarios.

Test Case 1: Compliant vendor contract

• Sample: Standard vendor MSA with Net 30 terms, reasonable liability cap, clear IP rights
• Expected:
  • Extraction: All key clauses identified correctly
  • Compliance: All policies met
  • Risk: LOW risk rating
  • Outcome: Auto-approved
• Verify:
  • ✅ Accurate extraction
  • ✅ Compliance checks reference correct policies
  • ✅ Risk assessment is reasonable
  • ✅ Report is clear and actionable
  • ✅ Auto-approval workflow triggers

Test Case 2: Non-compliant contract (payment terms)

• Sample: Contract with Net 90 payment terms (exceeds policy)
• Expected:
  • Extraction: Payment terms extracted correctly
  • Compliance: Flagged as non-compliant (Net 90 > Net 45 max)
  • Policy citation: "Payment Terms Policy, Section 2.1"
  • Outcome: Escalated to CFO approval
• Verify:
  • ✅ Payment terms flagged correctly
  • ✅ Policy citation is accurate
  • ✅ Severity marked appropriately
  • ✅ Human Task created with context

Test Case 3: High-risk contract (unlimited liability)

• Sample: Contract with unlimited liability clause
• Expected:
  • Extraction: Liability clause extracted
  • Compliance: Non-compliant with liability policy
  • Risk: CRITICAL risk (unlimited liability)
  • Outcome: Escalated to legal review
• Verify:
  • ✅ Unlimited liability flagged as critical
  • ✅ Risk assessment explains exposure
  • ✅ Mitigation recommendations provided
  • ✅ Human Task assigned to legal team

Test Case 4: GDPR data processing agreement

• Sample: DPA with GDPR requirements
• Expected:
  • Extraction: Data protection clauses identified
  • Compliance: GDPR checklist verification
  • Risk: Data breach liability assessed
  • Outcome: Privacy officer approval required
• Verify:
  • ✅ GDPR requirements checked against KB
  • ✅ Missing clauses identified (if any)
  • ✅ Data residency requirements verified
  • ✅ Appropriate routing to privacy officer

Test Case 5: Missing standard clauses

• Sample: Contract missing force majeure, dispute resolution clauses
• Expected:
  • Extraction: Identifies missing sections
  • Compliance: Flags missing standard clauses
  • Risk: MEDIUM risk (missing protections)
  • Outcome: Legal review for clause additions
• Verify:
  • ✅ Missing clauses detected
  • ✅ Recommended additions listed
  • ✅ Explanation of why clauses are important

Deploy private model for sensitive contracts (optional)

For maximum security and confidentiality, deploy a private model.

Why private models for legal documents:

• Contracts never leave your infrastructure
• Maintain attorney-client privilege
• Comply with data residency requirements
• Control over model and data
• No vendor dependencies

Recommended private models:

• Llama 3 70B (strong reasoning, good for legal analysis)
• Qwen 2.5 72B (excellent multilingual, good for contracts)
• Mistral Large (competitive with GPT-4, self-hostable)

Deployment approach:

1. Infrastructure: Deploy on your own GPU servers or private cloud
2. Model serving: Use vLLM, TensorRT-LLM, or HuggingFace TGI
3. Integration: Connect to MagOneAI via API endpoint
4. Configuration: Select private model in agent settings
5. Testing: Validate performance on legal documents

Performance considerations:

• Latency: Self-hosted may be slower (acceptable for async workflows)
• Accuracy: Test thoroughly against your compliance policies
• Cost: Higher upfront infra cost, lower per-usage cost
• Maintenance: Requires ML ops expertise