legal

# Legal Workflows

Analysis support for in-house legal teams. Contract review, compliance checks, NDA triage, risk assessment, legal writing, and response generation.

**Disclaimer**: Analysis support, not legal advice. Review by qualified counsel required.

---

## Mode Detection

Classify the request into one mode before proceeding. If the request spans modes, choose the primary and note the secondary.

| Mode | Signal Phrases | Core Output |
|------|---------------|-------------|
| **CONTRACT** | review contract, clause analysis, redline, playbook, negotiate | Clause-by-clause analysis with GREEN/YELLOW/RED flags and redline suggestions |
| **COMPLIANCE** | compliance check, GDPR, HIPAA, CCPA, SOX, regulation, data protection, DSGVO, GoBD, TDDDG, eIDAS, AI Act, NIS2, KRITIS, Grundschutz, TISAX, DORA | Applicable regulations, requirements checklist, risk areas, approvals needed |
| **NDA** | NDA, triage NDA, non-disclosure, confidentiality agreement | GREEN/YELLOW/RED classification with screening checklist |
| **RISK** | legal risk, risk assessment, exposure, severity, escalation | Severity x Likelihood matrix score with escalation path |
| **WRITING** | legal brief, memo, legal response, draft response, template | Structured legal document in appropriate format |
| **VENDOR** | vendor check, vendor status, agreement status, what's signed | Agreement inventory, gap analysis, upcoming deadlines |

---

## Reference Loading Table

Load only the references required by the detected mode.

| Mode | References to Load |
|------|-------------------|
| CONTRACT | `references/contract-review.md` |
| COMPLIANCE | `references/compliance-frameworks.md`, `references/german-business-compliance.md` |
| NDA | `references/nda-triage.md` |
| RISK | `references/risk-assessment.md` |
| WRITING | `references/legal-writing.md` |
| VENDOR | `references/contract-review.md` (for gap analysis context) |

Always load `references/llm-legal-failure-modes.md` for every mode. LLM failure awareness is non-negotiable in legal work.

---

## Mode: CONTRACT

**Framework**: INTAKE -> ANALYZE -> FLAG -> REDLINE -> STRATEGIZE

**Phase 1: INTAKE** -- Accept the contract and gather context.

- Accept contract as file, pasted text, or URL reference
- Determine: which side the user is on (vendor/customer/licensor/licensee/partner), deadline, focus areas, deal context (size, strategic importance, existing relationship)
- If user provides partial context, proceed and note assumptions

**Phase 2: ANALYZE** -- Clause-by-clause review.

Load `references/contract-review.md` for the full clause analysis methodology.

1. Identify contract type (SaaS, services, license, procurement, partnership)
2. Read entire contract before flagging -- clauses interact (uncapped indemnity may be mitigated by broad LOL)
3. Analyze each material clause against playbook or market-standard positions
4. Cover at minimum: LOL, indemnification, IP, data protection, confidentiality, reps/warranties, term/termination, governing law, insurance, assignment, force majeure, payment

**Gate**: Every material clause analyzed. No clause reviewed in isolation.

**Phase 3: FLAG** -- Classify deviations.

| Flag | Meaning | Action |
|------|---------|--------|
| **GREEN** | At or better than standard. Minor commercially reasonable variation. | Note for awareness. No negotiation. |
| **YELLOW** | Outside standard but within negotiable range. Common in market. | Generate redline + fallback + business impact. |
| **RED** | Outside acceptable range. Material risk. Escalation trigger. | Explain risk. Provide market-standard alternative. Recommend escalation. |

**Phase 4: REDLINE** -- Generate specific alternative language for YELLOW and RED items.

Each redline includes: current language (exact quote), proposed language, rationale (suitable for counterparty), priority (must-have / should-have / nice-to-have), fallback position.

**Phase 5: STRATEGIZE** -- Negotiation strategy.

- Tier 1 (deal breakers): uncapped liability, missing DPA for regulated data, IP jeopardizing core assets, regulatory conflicts
- Tier 2 (strong preferences): LOL adjustments, indemnification scope, termination flexibility, audit rights
- Tier 3 (concession candidates): preferred governing law, notice periods, minor definitions, insurance certificates

Lead with Tier 1. Trade Tier 3 to secure Tier 2. Escalate before making any Tier 1 concession.

**Gate**: Top 3 issues identified. Negotiation priority established. Concession candidates named.

**Output format**:
```
## Contract Review Summary
**Document**: [name] | **Parties**: [names] | **Side**: [role] | **Basis**: [Playbook/Generic]

## Key Findings
[Top 3-5 issues with severity flags]

## Clause-by-Clause Analysis
### [Clause] -- [GREEN/YELLOW/RED]
**Contract says**: ... | **Standard**: ... | **Deviation**: ... | **Impact**: ... | **Redline**: ...

## Negotiation Strategy
[Priorities, concessions, approach]
```

---

## Mode: COMPLIANCE

**Framework**: SCOPE -> MAP -> ASSESS -> RECOMMEND

**Phase 1: SCOPE** -- Understand the proposed action.

- What is being done (feature launch, data processing, marketing campaign, new vendor)
- What data is involved (personal data categories, sensitive data, regulated data)
- Which geographies (determines applicable regulations)
- Who is affected (customers, employees, partners, public)

**Phase 2: MAP** -- Identify applicable regulations.

Load `references/compliance-frameworks.md` for regulation-specific requirements.

Map all potentially applicable frameworks. Check for overlapping or conflicting requirements across jurisdictions.

**Phase 3: ASSESS** -- Check each requirement.

| Requirement | Status | Action Needed |
|-------------|--------|---------------|
| [Requirement] | Met / Not Met / Unknown | [Specific action] |

For each risk area, assess severity and mitigation path.

**Phase 4: RECOMMEND** -- Prioritized action list with approvals needed.

**Gate**: All applicable regulations identified. Requ