NDAs are high-volume and mostly routine, which makes them a natural first use of AI in an in-house legal team. They are also where small wording changes, such as a residuals clause or a hidden non-solicit, can carry real risk.
This checklist shows what AI should check in each NDA, how to set playbook positions, which issues must always go to an attorney and what a useful review output looks like.
Note: This article is general information, not legal advice. Playbook positions are examples only. Your team's positions should come from qualified counsel and reflect your jurisdiction and business.
What AI Should and Should Not Do in NDA Review
• AI should: classify the NDA type, compare each clause to your playbook, quote the exact text it relies on, flag missing clauses and suggest approved fallback wording
• AI should not: approve deviations, decide business risk, negotiate with the counterparty or sign off on the final document
ABA Formal Opinion 512 says lawyers may not leave it to generative AI alone to perform tasks that call for professional judgment. Design your workflow so the attorney decision is a recorded step, not an assumption.
Step 1: Classify Before You Review
The right positions depend on the NDA type. Have AI identify it first and route accordingly.
• Mutual vs one-way (and which way): are you disclosing, receiving or both?
• Purpose: sales evaluation, M&A, vendor onboarding, partnership, hiring
• Counterparty paper or yours: your template needs a lighter check than third-party paper
• Employee or contractor agreement: different statutory notices may apply (see clause 13)
Step 2: The 14-Point Clause Checklist
For each clause, the AI output should state: found or missing, the quoted text, playbook match (green), acceptable fallback (amber) or outside playbook (red).
| # | Clause | What AI should check | Example playbook position (illustrative) |
|---|---|---|---|
| 1 | Definition of confidential information | Scope; marking requirements; oral disclosures | Accept reasonable marking; flag "all information" with no limits when we receive |
| 2 | Standard exclusions | Public, already known, independently developed, received from third party | All four present; red if independent development is missing |
| 3 | Permitted purpose | Specific and limited | Must name the purpose |
| 4 | Permitted recipients | Employees, advisors, affiliates; need-to-know | Advisors allowed under confidentiality duties |
| 5 | Standard of care | Reasonable care or same as own | Reasonable care; flag stricter standards |
| 6 | Term and survival | Disclosure period; how long duties last; trade secret carve-out | Fixed term with trade secret survival |
| 7 | Compelled disclosure | Notice and cooperation if legally required | Notice where lawful; no duty to resist |
| 8 | Return or destruction | Timing; backup and legal-hold exceptions | Allow archival copies under continuing duty |
| 9 | Residuals | Right to use information retained in memory | Red by default; attorney decision |
| 10 | Non-solicit / non-compete | Any restriction beyond confidentiality | Red; route to attorney |
| 11 | No license / no obligation to proceed | No IP grant; no deal commitment | Must be present |
| 12 | Remedies | Injunctive relief; indemnity; liquidated damages | Accept injunctive relief; red on indemnity or liquidated damages |
| 13 | Required notices and carve-outs | Whistleblower and regulator carve-outs; statutory limits | Attorney check on every employee or contractor NDA |
| 14 | Governing law, venue, assignment | Jurisdiction; assignment on change of control | Per company standard |
Treat the table as a starting skeleton. GC AI's NDA playbook article uses a similar preferred, fallback and walk-away structure.
Clause 13 Deserves Special Care
Some NDA terms are limited or shaped by statute. AI can flag their presence or absence, but an attorney must decide what applies.
• Defend Trade Secrets Act notice: 18 U.S.C. § 1833(b) requires employers to give notice of whistleblower immunity in contracts with employees that govern trade secrets or confidential information
• SEC whistleblower communications: SEC Rule 21F-17 bars actions that impede someone from communicating with SEC staff, including enforcing a confidentiality agreement
• Speak Out Act: 42 U.S.C. § 19403 makes certain pre-dispute nondisclosure and nondisparagement clauses unenforceable for sexual assault and sexual harassment disputes
• State law: many states add their own limits; your counsel should maintain this list
These items are why "auto-approve green NDAs" should never apply to employment-related confidentiality agreements.
Step 3: Routing Rules
Write routing rules as plainly as the clause positions. A simple three-lane model works for most teams.
➤ Green lane: your own template, unchanged, or counterparty paper fully within playbook. A designated reviewer confirms the AI output and approves, under a policy an attorney has signed off.
➤ Amber lane: fallback positions only. Reviewer applies approved fallback wording; attorney spot-checks a sample.
➤ Red lane: any red flag, any missing standard exclusion, any residuals, non-solicit, indemnity or clause 13 issue. Attorney reviews and decides.
Whether non-lawyers may approve green-lane NDAs is a policy decision for your general counsel, not a technical setting.
Sample AI Review Output
Below is an illustrative output for a fictional one-way NDA where your company is receiving information.
• Type: one-way, we receive; purpose: vendor evaluation; counterparty paper
• Clause 2, exclusions: 🔴 independent development exclusion missing. Quote: "...shall not include information that is or becomes publicly available..." (three exclusions found). Suggested fallback: approved exclusion wording v3.
• Clause 6, term: 🟢 three years from disclosure, trade secrets survive while protected.
• Clause 9, residuals: 🔴 found. Quote: "...may use any information retained in the unaided memory of its personnel..." Route to attorney.
• Clause 10, non-solicit: 🔴 found in section 11.2, twelve months. Route to attorney.
• Clause 12, remedies: 🟡 injunctive relief plus prevailing-party fees. Fallback available.
• Lane: Red. Reviewer: [attorney name] Decision: [ ] Date: [ ]
Notice the output quotes text and section numbers. A flag without a quote cannot be checked quickly and should be treated as unverified.
Step 4: Set Up the Tool Responsibly
• Confidentiality: ABA Opinion 512 asks lawyers to understand a tool's terms, who can access inputs and whether data is retained or used for training before entering client information
• Playbook source of truth: keep positions in a versioned document owned by a named attorney; our guide to building a contract playbook for AI review covers rule templates
• Validation: run past NDAs with known attorney decisions through the tool before live use and compare results
• Audit trail: store the AI output, reviewer, decision and date with each executed NDA
• Change control: re-validate whenever the playbook, model or prompt changes
Opinion 512 also notes that a lawyer who has checked a tool's accuracy on a sample may need less review on later similar work. Keep the record of that sample check.
Metrics Worth Tracking
Track your own numbers rather than relying on vendor claims.
○ Turnaround time from receipt to signature, by lane
○ Share of NDAs in each lane
○ Attorney overrides of AI flags, by clause
○ Missed issues found later, by clause
○ Playbook changes triggered by repeated overrides
Override patterns tell you where the playbook or the prompt is unclear.
Common Mistakes
○ Letting AI summaries replace reading red-lane clauses
○ Accepting flags with no quoted text
○ One playbook for mutual, one-way and employment NDAs
○ No owner for the playbook, so positions drift
○ Skipping re-validation after a model update
○ Treating employee confidentiality agreements like vendor NDAs
Our Own Product Note
Disclosure: this is our own product. LuMay Legal Agents (Lexintis) include AI contract review for legal teams. The checklist above is tool-neutral; for broader context, see our guide to AI contract review for law firms.
Next Step
Pull your last 20 executed NDAs, mark the attorney decisions on each of the 14 clauses and use that set to validate any AI tool before it touches a live agreement.
References
• ABA Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024): https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
• 18 U.S.C. § 1833, Exceptions to prohibitions (DTSA immunity and notice): https://www.law.cornell.edu/uscode/text/18/1833
• 17 CFR § 240.21F-17, Staff communications with individuals reporting possible securities law violations: https://www.law.cornell.edu/cfr/text/17/240.21F-17
• 42 U.S.C. § 19403, Speak Out Act limitation: https://www.law.cornell.edu/uscode/text/42/19403
• GC AI, NDA Review Playbook: Preferred, Fallback, Walk-Away: https://gc.ai/blog/nda-review-playbook
