Flagging risky contract clauses with AI in n8n

A supplier contract, an NDA, an amendment: most SMBs sign them after a quick read-through, for lack of time or a dedicated legal budget for every document. The issue isn't a lack of diligence — it's volume. A 60-day auto-renewal clause or an unbalanced liability cap can slip through a 15-page document without anyone catching it. This guide walks through an n8n workflow that reads an incoming contract, extracts its sensitive clauses, assigns each one a risk level, and logs everything — a first automated filter ahead of human review, not a substitute for it.

Why this filter makes sense ahead of human review

Standard contracts concentrate a limited number of genuinely sensitive clause categories: term and renewal, termination, liability and penalties, intellectual property, confidentiality, and — increasingly — personal data processing by subcontractors. That's exactly the structure formalized by the CUAD dataset (Hendrycks et al., NeurIPS 2021), which annotates over 13,000 clauses across 41 categories on 500 real contracts: the authors show that language models trained to spot these categories produce usable results, while noting that meaningful room for improvement remains before relying on them without supervision. That's precisely the logic to apply in n8n: automate the spotting, not the decision.

A 2018 LawGeex study, run with advisors from Stanford, Duke and USC, compared a specialized AI to 20 experienced corporate lawyers on spotting risk in NDAs: the AI reached 94% accuracy versus 85% on average for the lawyers, in 26 seconds versus 92 minutes. That speed gap is the strongest argument for this kind of workflow: it's not about replacing legal expertise, it's about concentrating it on the 10% of clauses that actually deserve it.

Workflow architecture

The pipeline fits in four steps: receive the contract, extract the text, run structured AI analysis, then log and alert.

1. Trigger and text extraction

The contract arrives by email (an IMAP trigger, as in the AI email triage workflow), via upload through a Form Trigger, or dropped in a watched Google Drive folder. The binary file then goes through an Extract From File node for native-text PDFs; for a scanned contract (a photocopy, a digitized handwritten signature), you first need an OCR pass — see our guide on extracting data from PDF invoices with AI, the same logic transposes directly to contracts.

2. Structured output schema

This is the heart of the workflow: an AI Agent or Information Extractor node, paired with a Structured Output Parser, using a JSON schema that forces the model to answer in a usable format rather than free-form prose. See our Structured Output Parser guide for the exact syntax. A minimal schema for this case:

{
  "clauses": [
    {
      "type": "auto_renewal | termination | liability | intellectual_property | confidentiality | data_subprocessing | penalties | other",
      "excerpt": "exact quote from the contract",
      "risk": "low | medium | high",
      "justification": "one-sentence reason for the risk level"
    }
  ],
  "overall_score": "low | medium | high",
  "notice_period_days": 0
}

The system prompt should spell out concrete criteria rather than letting the model judge in the abstract — for instance, a termination notice period under 30 days or an unlimited liability clause for the client should be explicitly flagged "high risk". Without written rules like these, two runs on the same contract can produce different scores.

3. Logging and audit trail

Each analysis gets inserted into a Supabase table (contract_analyses) with the document ID, the date, the overall score, and the JSON detail of the clauses — exactly the pattern described in our GDPR audit trail with Supabase guide. This timestamped traceability matters in a dispute: it proves a check was actually run before signature, and what it found.

4. Alert and human sign-off

When overall_score is "high", a Slack node or a Wait human-approval step notifies legal or procurement, with a link to the contract and a summary of the flagged clauses. Nothing is blocked automatically: the workflow speeds up detection, but the decision to sign stays human.

Going further: comparing against your company's standard clauses

Once this foundation is in place, the next step is comparing each extracted clause against an internal "playbook" (your accepted standard clauses) via vector search: standard clauses get indexed in Supabase with pgvector, as described in our RAG with Supabase guide, and each clause from the incoming contract is compared by semantic similarity to automatically surface deviations from your usual negotiating position. That's exactly the architecture covered by the Assistant RAG Pack (€119): document ingestion, embeddings, pgvector storage, and a chat interface with citations.

Limits and best practices

Three things to watch before putting a workflow like this into production:

• Hallucinated citations: always ask the model to quote the exact excerpt from the contract for each flagged clause, and make it explicit in the prompt that it must never invent text. An excerpt that doesn't appear word-for-word in the original document is a red flag.
• Error handling: a badly extracted contract (a corrupted PDF, a failed OCR pass) should never default to a "low risk" score — set up an Error Workflow that routes these cases to manual review instead of letting them pass silently.
• Personal data subprocessing: if the contract involves a data transfer to a subprocessor, cross-check this detection against your GDPR processing register to confirm a DPA (Data Processing Agreement) is actually in place.

This kind of documentary safeguard, paired with automatic follow-ups on incomplete files, is exactly what the Compliance & Audit Pack (€149) covers: conversational questionnaires, a timestamped audit trail, and an AI-generated summary report. For a team handling compliance, document triage, and an internal RAG assistant together, the Complete FlowKit Bundle (€269 instead of €347 bought separately) bundles all three packs.

Wrapping up

Automating the first pass on a contract with n8n doesn't replace a lawyer — it focuses their time on the clauses that actually matter. Structured extraction, an explicit risk score, a timestamped audit trail, and human sign-off on sensitive cases: those four building blocks are enough to turn a stack of unread PDFs into an actual review process, without blowing up the legal budget.