Tech Contract Review — Lawve Plugin for Anthropic Skill

Tech Contract Review — Lawve Plugin for Anthropic

Purpose

Precision contract analysis for tech-sector agreements. Goal: zero open ambiguity. Flag risk, redline bad clauses, verify jurisdiction, and synthesize actionable output. Operates like a senior tech-transactional lawyer with red pen ready.

Scope — Contract Types Covered

| Type | Full Name | Primary Risk Focus | |------|-----------|--------------------| | MSA | Master Services Agreement | Liability caps, IP ownership, termination rights | | DPA | Data Processing Agreement | GDPR/CCPA compliance, sub-processor obligations, breach notification | | SOW | Statement of Work | Deliverable ambiguity, acceptance criteria, change-order traps | | LOE | Letter of Engagement | Scope creep, fee ambiguity, professional liability | | NDA | Non-Disclosure Agreement | Scope of confidential info, carve-outs, term/survival | | SLA | Service Level Agreement | Uptime definitions, remedy credits, exclusions | | EULA | End User License Agreement | License scope, IP reversion, audit rights | | IP Assignment | IP/Work-for-Hire | Ownership transfer completeness, moral rights, background IP | | Vendor/Supplier | Procurement Agreement | Warranty disclaimers, liability exclusions, IP indemnity | | API/Platform ToS | Terms of Service | Acceptable use restrictions, data retention, suspension rights |

Review Workflow

Step 1 — Contract Intake

Before reviewing, establish:

Document type — identify which contract type(s) above apply
Parties — identify each party and their role (customer / vendor / processor / controller)
Effective date & term
Governing law & jurisdiction — see Jurisdiction Analysis section
Execution status — draft, signed, or in negotiation?

Step 2 — Jurisdiction Analysis

ALWAYS perform jurisdiction analysis first. It affects how every clause is interpreted.

Key Questions

What governing law clause applies? (e.g., "laws of the State of California", "laws of England and Wales", "laws of India — IT Act 2000")
Is the jurisdiction enforceable given where parties are domiciled?
Does it conflict with mandatory local law (e.g., GDPR for EU data subjects overrides a non-EU governing law clause)?
Is there a dispute resolution mechanism? (court / arbitration / mediation) — and in which seat?

Jurisdiction-Specific Flags

| Jurisdiction | Key Mandatory Laws | Watch-for Clauses | |--------------|-------------------|-------------------| | India | IT Act 2000, DPDP Act 2023, Indian Contract Act 1872 | Cross-border data transfer restrictions, mandatory arbitration (Arbitration & Conciliation Act), stamp duty | | EU / EEA | GDPR (Reg 2016/679), NIS2, ePrivacy | DPA mandatory per Art. 28, SCCs for third-country transfers, right to audit | | US (Federal) | CCPA (CA), COPPA, HIPAA, CLOUD Act | Choice of law enforceability by state, CLOUD Act data access risk | | UK | UK GDPR, Data Protection Act 2018 | Post-Brexit adequacy, IDTA for international transfers | | Singapore | PDPA 2012 | Data intermediary obligations, breach notification 3-day window | | Global / Multi-Jurisdiction | — | Identify which law governs data privacy, which governs IP, potential conflict |

Rule: If governing law ≠ jurisdiction where data subjects reside, flag it. Privacy law follows the data subject, not the contract.

Step 3 — Clause-by-Clause Analysis

Scan ALL clauses. For each, classify:

🟢 Standard / Acceptable — market-norm, no action needed
🟡 Review / Negotiate — non-standard but not fatal; suggest edits
🔴 Red Flag / Reject — high risk; must be redlined or contract rejected
⚫ Missing / Absent — critical protection not present; must be added

Clause Category Checklist

A. Definitions

[ ] "Confidential Information" — is it over/under-broad?
[ ] "Intellectual Property" — does it include pre-existing IP? Background IP?
[ ] "Services" / "Deliverables" — vague definitions = scope creep risk 🔴
[ ] "Affiliates" — could bind third parties without consent?

B. Payment & Fees

[ ] Payment milestones tied to ambiguous deliverables 🔴
[ ] Unilateral fee increase clauses 🔴
[ ] Late payment interest rates — check usury limits per jurisdiction
[ ] Expense reimbursement — capped or uncapped?

C. Intellectual Property

[ ] Work-for-hire vs. license — who owns deliverables? 🔴
[ ] Background IP retained by vendor — is grant-back clause present?
[ ] AI-generated content ownership — increasingly critical for Anthropic contracts
[ ] Open source components — license compatibility (GPL contamination risk)
[ ] IP indemnity — does vendor indemnify for third-party IP infringement?

D. Data Protection (heightened for Anthropic/AI contracts)

[ ] Data controller vs. processor designation — matches reality? 🔴
[ ] Sub-processor obligations — approval mechanism required (GDPR Art. 28(2))
[ ] Data breach notification timeline — GDPR requires 72h; DPDP India requires prompt notice
[ ] Data deletion/return on termination — timeline specified?
[ ] Cross-border transfer mechanism — SCCs / adequacy / IDTA / BCRs?
[ ] Training data usage — CRITICAL for AI contracts: does vendor use customer data to train models? 🔴
[ ] Audit rights — customer right to audit processor's compliance?

E. Confidentiality

[ ] Scope of NDA obligations — mutual or one-way?
[ ] Carve-outs — publicly known, independently developed, required by law?
[ ] Survival period — post-termination confidentiality term (typically 2–5 years)
[ ] Residuals clause — allows vendor to retain and use learned knowledge 🔴

F. Liability

[ ] Liability cap — amount and basis (fees paid in 12 months is standard)
[ ] Consequential/indirect damage exclusion — one-way or mutual?
[ ] Carve-outs from cap — IP infringement, fraud, death/PI, data breach 🔴 (missing carve-outs = risk)
[ ] Insurance requirements — E&O, cyber liability specified?

G. Indemnification

[ ] IP infringement indemnity — vendor indemnifies customer? 🔴 if absent
[ ] Data breach indemnity — tied to processor obligations?
[ ] Third-party claims — "defend, indemnify, hold harmless" — is "defend" present?
[ ] Indemnity procedure — timely notice, control of defense required?

H. Warranties & Representations

[ ] Functionality warranty — does software/service perform per specs?
[ ] Non-infringement warranty
[ ] Disclaimer of all other warranties — "AS IS" disclaimers overly broad? 🟡
[ ] Virus/malware warranty
[ ] Compliance with laws warranty

I. Termination

[ ] Termination for convenience — notice period? fees payable?
[ ] Termination for cause — cure period defined? (typically 30 days)
[ ] Insolvency termination right
[ ] Effects of termination — data return, license wind-down, transition assistance?
[ ] Auto-renewal with inadequate notice period 🔴

J. Dispute Resolution

[ ] Jurisdiction clause — mandatory exclusive? matches governing law? enforceable?
[ ] Arbitration vs. litigation — seat, rules, number of arbitrators
[ ] Class action waiver — jurisdiction-specific enforceability
[ ] Equitable relief carve-out — IP/confidentiality breaches typically need injunctions

K. Force Majeure

[ ] Cyber attacks / ransomware — included or excluded? 🟡 (vendor should NOT include as FM excuse)
[ ] Pandemic — post-COVID, review carefully
[ ] Obligation to mitigate during FM event?
[ ] Customer right to terminate if FM exceeds threshold period?

L. Miscellaneous / Boilerplate

[ ] Entire agreement / integration clause — are all prior commitments captured?
[ ] Amendment procedure — written only? email sufficient?
[ ] Assignment — can vendor assign to acquirer without consent? 🔴
[ ] Waiver — non-waiver clause present?
[ ] Severability — does it include reconstruction obligation?
[ ] Notices — physical + email; effective when received or sent?

Step 4 — Suspicious Clause Detection (Sus Flags)

Always flag and redline these patterns:

🔴 Critical Sus Patterns

| Pattern | Sus Clause Type | Why Dangerous | |---------|----------------|---------------| | "perpetual, irrevocable, royalty-free license to use Your Data" | Data exploitation | Vendor keeps your data forever, can use for training | | "We may modify these terms at any time" | Unilateral amendment | Zero protection; future changes bind you silently | | "sole discretion" paired with termination or suspension | Arbitrary suspension | No cure right, no appeal | | Liability cap: "maximum [X]" with no carve-outs | Inadequate protection | Data breach could exceed cap with no recourse | | "including but not limited to" in exclusions list | Scope creep in exclusions | Potentially unlimited exclusion | | Assignment "including in connection with a merger or acquisition" without consent right | Change of control | Data and obligations pass to unknown acquirer | | "residuals" clause in NDA | IP leakage | Engineers who learn your secrets are free to use what they remember | | Auto-renewal notice period < 30 days | Lock-in trap | Impossible to miss renewal window in practice | | Indemnity for "any and all claims" without materiality threshold | Open-ended exposure | No floor on frivolous claims | | "notwithstanding anything to the contrary" without specifying what it overrides | Conflict bomb | This clause overrides EVERYTHING — dangerous position | | SOW deliverable defined only as "as mutually agreed" | Scope ambiguity | No enforceable deliverable definition | | "best efforts" for critical obligations | Unenforceable | Should be "shall" for material obligations | | DPA: no sub-processor list or approval mechanism | GDPR violation | Mandatory under Art. 28(2) | | AI/ML contract: no restriction on training data use | Model contamination | Customer data used to improve competitor-facing models |

Step 5 — Redlining Output

For each 🔴 and 🟡 clause, produce:

CLAUSE: [Section X.X — Clause Title]
RISK LEVEL: 🔴 Red Flag / 🟡 Review
ISSUE: [Plain-language description of the problem]
ORIGINAL TEXT: "[exact clause text]"
REDLINED REPLACEMENT: "[suggested replacement text]"
RATIONALE: [why this change protects the client]
JURISDICTION NOTE: [if jurisdiction-specific, call it out]

Step 6 — Active Research (Web Search Integration)

When reviewing:

Look up current regulatory requirements for identified jurisdiction (GDPR, DPDP Act, CCPA updates)
Search for case law on specific clause types if jurisdiction is identified
Check if DPA adequacy decisions are current for cross-border data transfers
Verify Anthropic's current DPA template against contract if reviewing a vendor DPA
Research industry standard benchmarks for liability caps in SaaS/AI contracts

Use web search for:

"GDPR adequacy decision [country] 2024"
"India DPDP Act 2023 requirements DPA"
"standard SaaS liability cap benchmark"
"CCPA amendment [year] requirements"

Step 7 — Contract Summary Output

After full review, produce structured summary:

CONTRACT REVIEW SUMMARY
═══════════════════════════════════════════════
Document: [Contract name/type]
Parties: [Party A] ↔ [Party B]
Governing Law: [Jurisdiction]
Effective Date: [Date]
Review Date: [Today's date]
Overall Risk Rating: 🔴 HIGH / 🟡 MEDIUM / 🟢 LOW
═══════════════════════════════════════════════

CRITICAL ISSUES (must fix before signing):
1. [Issue description + section reference]
2. ...

RECOMMENDED CHANGES (negotiate if possible):
1. [Issue description + section reference]
2. ...

MISSING PROTECTIONS (add these clauses):
1. [Missing clause description]
2. ...

JURISDICTION ALERTS:
- [Any mandatory law conflicts]

DATA PROTECTION SCORE: [X/10]
IP PROTECTION SCORE: [X/10]
LIABILITY BALANCE SCORE: [X/10]

RECOMMENDATION: ✅ Acceptable / ⚠️ Negotiate First / 🚫 Do Not Sign
═══════════════════════════════════════════════

Contract Type Deep-Dives

MSA (Master Services Agreement)

Key principle: MSA sets the legal framework; SOWs execute under it. Watch for:

SOW prevails over MSA conflict — or vice versa? (should be MSA prevails except for commercial terms)
Change order procedure — is it written? timeline for approval?
IP ownership of deliverables — work-for-hire must be explicit
Audit rights — for compliance AND financial accuracy

DPA (Data Processing Agreement)

GDPR Art. 28 mandatory elements — ALL must be present:

Subject matter, nature, purpose, type of data, categories of data subjects
Duration of processing
Obligations and rights of controller
Sub-processor approval and obligations
Data return or deletion on termination
Cooperation with supervisory authority
Security measures (Art. 32 reference)

For India DPDP Act 2023:

"Data Fiduciary" (controller) vs. "Data Processor" terminology
Consent mechanism requirements
Data Principal (subject) rights
Cross-border transfer restrictions (whitelist jurisdiction model)

SOW (Statement of Work)

Golden rule: if it is not written, it is not in scope. Flag:

Deliverables defined in functional terms, not technical specs
Acceptance criteria: must be objective, measurable, time-bound
Deemed acceptance after X days without objection — flag period length
Change management: no written change order = no scope change (protect this)
Payment tied to milestones vs. calendar — milestone preferred

LOE (Letter of Engagement)

Simpler than MSA but same IP and liability risks. Watch:

Professional liability — is it capped? At what?
Engagement scope — is it specific enough to avoid later disputes?
Conflict of interest provisions
File retention policy
Regulatory compliance (bar association / professional body rules if legal/audit engagement)

Red Lines (Non-Negotiable for Anthropic-Context Contracts)

These clauses must be flagged as absolute dealbreakers when reviewing contracts for AI/ML companies:

Training data license — vendor MUST NOT get rights to use customer data for model training without explicit, separate, opt-in consent
Unilateral IP assignment — all AI-generated output must have clear ownership; vendor cannot claim ownership of outputs generated using customer prompts/data
Unlimited liability for IP indemnity — AI companies face patent/copyright risk; liability must be capped or separately insured
No data deletion obligation — AI model vendors must commit to data deletion, not just anonymization
Waiver of audit rights on data processing — non-negotiable; must retain right to audit or receive third-party audit reports (SOC 2, ISO 27001)

Output Formats

| Situation | Output Format | |-----------|--------------| | Quick question ("is this clause ok?") | Inline analysis with risk rating | | Full contract review | Structured summary + clause-by-clause redlines | | Comparison of two versions | Side-by-side diff with change rationale | | DPA compliance check | GDPR/DPDP checklist with pass/fail/missing | | Contract drafting assistance | Draft language with alternatives | | Export to Word (.docx) | Use docx skill — redlines as tracked changes |

Important Disclaimers (Always Include in Output)

⚠️ This analysis is AI-generated legal guidance, not legal advice. Always have a qualified attorney in the relevant jurisdiction review before signing. This tool identifies risk patterns; it does not replace professional legal counsel for binding commitments.

Agent Skills: Tech Contract Review — Lawve Plugin for Anthropic

Install this agent skill to your local

Skill Files