When employees produce contracts with freely available AI tools, a risk arises that only becomes visible months later. Which contract types are most exposed, and how to put guardrails in place without slowing the work down.
How shadow AI arises in a company
The typical sequence looks like this. A salesperson needs a distribution agreement at short notice for a new partner in Spain. Legal is tied up at quarter end and an answer will take time. In the shared folder there is a 2022 version someone else adapted for a different case. So he opens an AI tool, describes the situation and has a professional-looking contract two minutes later.
Against the version from the folder, what has changed above all is the quality of the disguise. A contract pasted together from old ones stands out on reading, because formatting, numbering and register jump around. An AI-generated contract reads cleanly throughout. It looks reviewed, although it is not.
The contract types where it really hurts
Not every contract carries the same risk. It becomes critical where a single clause has a long tail and the error only surfaces when it is too late to correct it.
Sales and commercial agency agreements. The classic example under German law is the compensation claim under section 89b of the Commercial Code. Whether it arises and at what level depends on how the contract is drafted, and the bill arrives years later on termination. Add to that territorial protection, price maintenance and non-compete provisions, where competition law sets the limits. A model will phrase a resale price maintenance clause entirely coherently even when it is unlawful.
Procurement and framework supply agreements. Here it is about liability, warranties, contractual penalties and retention of title. Above all it is about whose standard terms apply. Generate your procurement document freely and you lose the defence clause the company has used for years, and you notice only when a loss occurs. Depending on company size, supply chain due diligence obligations come on top, and they have to be passed on contractually.
Contracts with freelancers. Badly drafted instruction rights, working time provisions and integration clauses lead to bogus self-employment. The consequences are retroactive social security contributions with late payment surcharges, going back years. A language model knows the distinguishing criteria but does not weight them the way the audit practice of the social security authorities does.
Data processing agreements. Article 28 GDPR sets out a mandatory catalogue. An AI-generated version usually contains all the keywords and still not the provisions that reflect your own data protection organisation: technical and organisational measures, sub-processor relationships, third country transfers. These contracts get read at the first supervisory review.
Employment contracts. Fixed terms without objective justification fail on formal defects. A fixed-term agreement must be in writing before work begins, and a version produced in a chat and sent by email does not meet that requirement. A fixed-term employment relationship becomes an open-ended one.
Letters of intent and term sheets. The most dangerous case, because it looks harmless. An LOI is supposed to be non-binding. Whether it is comes down to the wording. An AI pointed at “binding key terms” will readily produce a text with binding effect that nobody read as the conclusion of a contract.
What connects these cases: the error is invisible at the moment of signature. It shows up on termination, at the audit, at the supervisory enquiry or in litigation.
Why bans do not work
The obvious response is a policy prohibiting the use of external AI tools for contract documents. Many companies now have one. They change behaviour very little.
The reason is simple. The policy does not remove the time pressure that triggers the behaviour. Nor does it close the gap in the template library. Someone facing a deadline who finds no template will take a route, and the ban only ensures they stop talking about it. Visible risk becomes invisible risk.
On top of that, the policy punishes the legitimate core of the behaviour. The colleague wanted to work faster. That is the right instinct.
The convenient route has to be the correct route
Only one thing works: the approved route has to be faster than the workaround.
For the critical contract types that means a template with stored logic. The clauses are fixed and approved by legal. The questionnaire reflects the decisions to be taken in the case at hand, and the conditions behind it ensure certain combinations never arise in the first place. A distribution agreement for an EU country automatically gets the clause variant that applies there.
Then there is the threshold. Up to a defined order value the business unit generates the document itself; above it the template routes to an approval. That logic can be built into the template instead of written into a policy nobody reads.
The decisive point is that the AI does not disappear. It is allowed to help, in the places where it helps: finding the right template when somebody describes in their own words what they need, filling the questionnaire from an existing file or email thread, supplementing individual details. What it is not allowed to do is invent the clause text.
How this works technically
For that to hold, the document has to be produced by rules. A prompt does not fix an output, it only influences it. Only a stored template guarantees the wording. We described why at length in Deterministic AI: does it even exist?.
At Lawlift this runs through two points of access. In the Word add-in, people keep working where they already are: find the template by description, fill in the questionnaire, generate the document. The AI can read an unstructured set of material — an email thread, a PDF or Word file, even images — and answer the questionnaire from it. The user checks the results and, at the end, presses “Generate document”. The document is then produced, with all approved clauses and the right layout.
The second route leads through the Model Context Protocol into MCP-capable chat applications. That reaches exactly the colleagues who would otherwise turn to an open chat. They keep working in the chat, search for the template there, have the questionnaire filled from the file and check the result. The generated document comes out fully formatted, with the approved clauses.
The difference from an open chat is barely visible from the outside and substantial in substance. The employee experiences the same speed. The company keeps control of its clause base.
A pragmatic way in
Start with a short inventory: which contracts are produced outside legal, and for which of those does no template exist? The intersection is your risk area, and it is usually smaller than feared.
Then prioritise by tail, not by volume. One commercial agency agreement a year weighs more than a hundred standard purchase orders.
Build templates with questionnaires for the prioritised cases. AI-supported templating accelerates this considerably, because variable passages, conditions and repetitions are detected and proposed automatically from an existing contract. A build that used to take weeks is doable in an afternoon.
And make the route visible. A template nobody can find is not a template. How to set this up for a legal department is shown on our page for legal departments.