Contract Review Checklist: 5-Pass System Before You Sign

Contract risk is the number one litigation concern for US businesses. According to Norton Rose Fulbright's 2025 Annual Litigation Trends Survey of more than 400 general counsel and in-house litigation leaders, 82% of organizations were involved in at least one lawsuit in 2024, with contract and employment disputes topping the list.

Running a contract review checklist won't replace legal judgment, but it means you're never signing blind. It also makes any attorney time you bring in considerably more productive.

This guide walks through the five passes to run before you sign, the criteria for triaging contracts by risk level, and the specific traps that cost startups the most.

What is a contract review checklist?

A contract review checklist is a repeatable set of checks that confirms an agreement's business, legal, and compliance provisions are present and acceptable before you sign. Under deadline pressure, even careful reviewers skip steps, and a written list makes the same checks happen on every contract.

Contract review itself means analyzing an agreement to find missing protections, non-standard language, and clauses your company wouldn't normally accept. The checklist turns that analysis into a sequence anyone on your team can run.

Commercial terms vs. legal terms

The most useful way to divide a contract is by what each provision does.

Term type	What it covers	Who usually reads it closely
Commercial terms	Pricing, deliverables, timelines, service levels	The founder or deal owner who negotiated them
Legal terms	Liability, indemnification, confidentiality, compliance, disputes	Often nobody, at a startup without counsel

Who this is for, and what it can't do

This checklist is built for founders, operators, and lean legal teams who sign vendor agreements, customer contracts, NDAs, and employment agreements without a bench of lawyers behind them. It works for contracts you receive and contracts you send.

The checklist tells you whether a clause is present and whether it looks unusual, but not whether the trade is worth making, as that requires legal judgment.

The contract review checklist: 5 passes to run before you sign

Run the passes in order. The first catches deal-breaking errors, while the later ones carry most of the risk.

1. Confirm the commercial terms

Start with the deal itself. These items are quick to verify and easy to overlook under deadline pressure.

Parties and signatories: Confirm the legal entity name exactly, including the suffix (Inc., LLC, Ltd.), and that the person signing has the authority to bind that company.
Pricing and payment: Check the fee structure, currency, invoice timing, payment terms, late fees, and any right to raise prices, including usage charges, overage rates, and minimum commitments in the order form.
Deliverables and acceptance: Pin down exactly what's being bought or sold, whether there's an objective acceptance test, and what happens if the work fails it.
Timelines and service levels: Confirm start dates, milestones, uptime commitments, support response times, and the remedy when any of them are missed.
Document hierarchy: Establish which document controls if the order form, MSA, and attached policies conflict, and whether terms incorporated by reference can change without notice.

Vague deliverables are where most vendor disputes start, so be sure to settle the commercial terms before you move to the risk clauses.

2. Check how risk is allocated

This pass separates a skim from a review. Limitation of liability, indemnification, and IP ownership decide who pays when something goes wrong, which is why attorneys and review tools target them first.

For the limitation of liability clause, check three things:

The cap: Confirm there is one and that it's mutual, keeping in mind that a cap tied to recent fees may be far below what you actually stand to lose.
The carve-outs: Read what sits outside the cap, such as confidentiality breaches, data incidents, or indemnification obligations, since broad carve-outs can leave a generous-looking cap protecting very little.
Excluded damages: Check whether waivers of consequential and indirect damages apply to both sides or only protect the other party.

Indemnification is a promise to cover the other side's losses. Map who indemnifies whom, for what, and whether the obligation runs both ways. An IP infringement indemnity from a vendor is standard, but one-way indemnities that cover everything arising from your use of a product are not. Also check who controls the defense, who can approve a settlement, and what notice is required before a claim is triggered.

Finally, review what each side warrants and disclaims, along with any insurance requirements. Customer paper often demands coverage levels that a seed-stage company doesn't carry.

Pro tip:

If customer paper requires insurance you don't have, raise it in your first round of comments, as coverage takes time to quote and bind.

3. Protect your IP, data, and confidential information

For software and AI companies, this pass can protect more value than any price line.

IP ownership and assignment: Confirm who owns what you build, deliver, and receive, and watch for assignment language broad enough to sweep in your pre-existing technology or general know-how.
License grants: Check scope, duration, exclusivity, revocability, and transferability, and look for use restrictions your product would breach on day one.
Feedback, residuals, and training rights: Decide whether the counterparty may use your inputs, outputs, or feedback to improve its products or train models, and state the answer explicitly rather than leaving the contract silent.
Data protection: Confirm a data processing addendum covers any personal data moving between the parties, with security, breach-notification, subprocessor, and deletion terms that match your obligations to your own customers.
Confidentiality: Define what counts as confidential, who may receive it, how long the obligation lasts, and the exceptions, bearing in mind that trade secrets need protection that outlasts a short fixed term.

If you're the vendor, keep ownership of your platform and limit customers to a license. US and EU DPAs also differ in ways that become relevant as soon as a customer operates in Europe.

4. Review the exit and dispute terms

Exit and dispute terms decide how hard it is to get out of a deal, and where you fight if it comes to that. The main clauses to check include:

Termination: Check whether you can terminate for convenience or only for cause, the cure periods, any termination fees, and which obligations survive.
Auto-renewal: Find the renewal term and the cancellation notice window, since a 60-day notice requirement on a three-year renewal is how a one-year deal becomes a long commitment.
Governing law and venue: Confirm where disputes are resolved and under which law, including arbitration and fee-shifting terms, because a distant forum raises the cost of enforcing every right in the contract.
Assignment and change of control: Check whether the contract survives an acquisition, or whether the other side can terminate or withhold consent when you're bought.
Notices and amendments: Confirm how notices must be delivered and that changes require a signed writing.

Pro tip:

If an acquisition is even a remote possibility, read the change-of-control clause now. A consent right you accept today becomes a diligence finding when a buyer's counsel reads it later.

5. Proofread the mechanics

Check that every capitalized term is defined, every cross-reference points to the right section, and the dates, figures, exhibits, and signature blocks are correct.

A misplaced decimal or a clause pasted from another deal can change the economics of an agreement, because the review focused on substance and nobody checked the numbers.

This is also the easiest pass to automate.

General Legal, an AI-native law firm primarily focused on contract work, launched Find The Fuck Up in February 2026, a free LLM-based app that catches misplaced decimals, undefined terms, and other mechanical errors. If you automate one part of your checklist, make it this one.

Flagging mechanical errors is one part of the process. The next step is building a repeatable review workflow that catches substantive risks without turning contract review into a bottleneck.

How to run the contract review checklist without slowing the deal

Keeping the review fast comes from matching the depth of review to the actual risk and letting software handle the first pass. This can be achieved in two steps.

1. Triage by risk tier

Not every document deserves the full treatment, and a mutual NDA shouldn't get the same time as a 60-page enterprise MSA to review.

Tier	Typical documents	How to review
Tier 1: standard, low risk	Mutual NDAs, simple order form	Commercial and confidentiality checks plus the mechanical pass
Tier 2: standard commercial	Vendor agreements, customer MSAs, DPAs	Full checklist, with extra time on risk allocation and IP
Tier 3: high stakes	Heavily negotiated paper, uncapped exposure, exclusivity, sensitive data	Full checklist, then an attorney before you send comments

Tier 3 contracts justify bringing in outside counsel, but only if the turnaround is fast enough to fit the deal. With the hybrid approach General Legal uses, standard commercial contracts typically come back within hours.

2. Use AI for the first pass, not the final word

In Better Call GPT, a 2024 study comparing large language models with human contract reviewers, junior lawyers averaged 56 minutes per contract, and the fastest model was 77 times quicker. Measured against senior lawyers' answers, the leading models also matched or exceeded junior lawyers' accuracy at identifying legal issues.

Identification isn't judgment, though, and unsupervised models still fabricate.

Stanford researchers writing in the Journal of Legal Analysis in 2024 found general-purpose models hallucinating on 58% (GPT-4) to 88% (Llama 2) of verifiable questions about federal court cases.

In addition, a database maintained by researcher Damien Charlotin has cataloged 1,492 US court cases involving AI-hallucinated content as of mid-October 2026.

Due to these risks, AI works best as a first-pass tool with a lawyer in the loop. Let software find the clauses and flag deviations, then have a lawyer decide what they mean and what to do about them.

Automation works best on repetitive, standardized paper and degrades on heavily negotiated or jurisdiction-specific agreements, which is exactly where getting it wrong costs the most.

Where startups get hurt most

Contracts with missed issues tend to come up during due diligence or after a dispute starts, at which point the leverage to fix them is gone. Five clause patterns cause most of the damage:

Trap	What it looks like	The checklist line that catches it
Uncapped liability	No ceiling on your exposure, or carve-outs that swallow the cap	Confirm a mutual cap and read every carve-out
One-sided indemnity	You cover the customer's losses, and they cover none of yours	Check who indemnifies whom, and for what
IP assignment errors	Pre-existing technology handed over, or a contractor's work never assigned to you	Confirm ownership of each category of work product
Auto-renewal lock-in	The notice window passes, and another term begins	Find the notice date and calendar it at signature
Distant venue, unfamiliar law	Enforcing your rights means litigating far from home	Check governing law, venue, and arbitration terms

While a contract review checklist can help you catch many of these issues, it’s not enough for end-to-end contract review.

A checklist won’t tell you what to push back on or how a counterparty will respond to a redline. That's the lawyer's job, and it's what you're actually paying for.

Still, this doesn’t mean you must send each contract to a traditional firm where hourly billing and multi-day turnaround make legal review the slowest step in the deal.

General Legal: Attorney-reviewed contracts, without the wait

If your contract review checklist flags a Tier 2 or Tier 3 issue, General Legal can take it from there.

Sentinel, the firm's contract AI, runs a first pass in about 10 seconds. Then, a US-barred attorney reviews the output, makes the judgment calls, and returns redlines and negotiation guidance, typically within hours. This means you get more than a list of flagged clauses; you receive attorney-reviewed recommendations on how to address them before signing.

General Legal applies the same AI-assisted, attorney-reviewed approach across a broad range of legal services. Two key areas are:

Technology transactions, where software, SaaS, and AI agreements often involve complex liability, IP ownership, and licensing terms
Data privacy, where data processing addenda, GDPR and CCPA compliance, and cross-border transfers require careful attention to legal obligations and risk allocation

For routine agreements, General Legal also offers a Template Library with free, CC0-licensed templates for NDAs, MSAs, and Terms of Use.

You can create a free account and send the contract over directly, or book a 10-minute working session to talk through the issue first.

Key takeaways

82% of US organizations faced litigation in 2024, with contract disputes ranking as the top concern according to Norton Rose Fulbright's survey of 400+ general counsel.
A systematic five-pass contract review checks commercial terms first, then risk allocation, IP and data protection, exit provisions, and finally mechanical accuracy before signing.
Triaging contracts into three risk tiers—standard NDAs, commercial MSAs, and high-stakes agreements—ensures review depth matches actual exposure without slowing deals.
AI contract review tools can complete first-pass analysis 77 times faster than junior lawyers, but still require attorney oversight due to hallucination rates reaching 58-88% on legal questions.
Five common contract traps hurt startups most: uncapped liability, one-sided indemnities, IP assignment errors, auto-renewal lock-ins, and unfavorable dispute venues.

TL;DR

Why contract review matters	Contract disputes are the #1 litigation driver, affecting 82% of US businesses in 2024
Commercial terms pass	Verify parties, pricing, deliverables, timelines, and document hierarchy before examining risk clauses
Risk allocation pass	Check liability caps, carve-outs, indemnification scope, warranty disclaimers, and insurance requirements
IP and data pass	Confirm ownership of work product, license scope, feedback rights, data processing terms, and confidentiality protections
Exit and dispute pass	Review termination rights, auto-renewal windows, governing law, venue selection, and change-of-control provisions
Mechanical proofing pass	Verify defined terms, cross-references, dates, figures, and signature blocks to catch errors that change deal economics
Risk-based triaging	Match review depth to contract tier—simple NDAs need basic checks while enterprise MSAs require full analysis
AI-assisted workflow	Use AI for first-pass identification of issues, then have attorneys make judgment calls and negotiation decisions

FAQs

What's the difference between reviewing your own paper and the counterparty's?

Reviewing your own paper means checking that the other side hasn't changed your defaults. Reviewing the counterparty's paper, on the other hand, means every default works against you until you push back. The checklist is the same, but you're reading it from the opposite side of the table.

How do I know if a clause is standard or unusual?

Standard means what experienced counsel in that market routinely accepts without a fight: liability caps tied to fees paid, mutual confidentiality, IP ownership staying with the creator. One-sided indemnities, uncapped exposure, and venue clauses that put you in another jurisdiction are not standard. Knowing the difference is what you pay a lawyer for.

What contract red flags are worth killing a deal over?

The most common deal-breakers are uncapped liability with broad carve-outs, IP assignment language that sweeps in pre-existing technology, and exclusivity provisions that block you from serving other customers. Most other issues are negotiating points.

What's the difference between contract review and contract drafting?

Contract review analyzes an agreement someone else wrote, looking for risk and non-standard positions. Contract drafting starts from scratch, building the document around your preferred defaults. Review is reactive; drafting is where you set the terms.

What should I do if the counterparty won't negotiate a flagged clause?

Start by understanding whether the clause is actually standard in their industry or jurisdiction. If it is, the risk may be acceptable. If it isn't, escalate to an attorney before deciding whether to walk. Some positions that look immovable have alternatives, like carving out specific scenarios or capping exposure differently, that both sides can accept.

Contract Review Checklist: 5 Passes to Run Before You Sign