legal

---
name: legal
description: Legal workflows — contract review, compliance checks, NDA triage, risk assessment, legal briefs. Use when reviewing contracts, checking compliance, triaging NDAs, assessing legal risk, or drafting legal documents. Not legal advice — analysis support for qualified professionals.
routing:
  triggers:
    - "legal"
    - "contract review"
    - "compliance check"
    - "NDA"
    - "legal risk"
    - "legal brief"
    - "vendor check"
    - "german compliance"
    - "DSGVO"
    - "GoBD"
    - "TDDDG"
    - "AI Act compliance"
    - "eIDAS"
  category: business
  force_route: false
  pairs_with: []
user-invocable: true
---

# Legal Workflows

Analysis support for in-house legal teams. Contract review, compliance checks, NDA triage, risk assessment, legal writing, and response generation.

**Disclaimer**: Analysis support, not legal advice. Review by qualified counsel required.

---

## Mode Detection

Classify the request into one mode before proceeding. If the request spans modes, choose the primary and note the secondary.

| Mode | Signal Phrases | Core Output |
|------|---------------|-------------|
| **CONTRACT** | review contract, clause analysis, redline, playbook, negotiate | Clause-by-clause analysis with GREEN/YELLOW/RED flags and redline suggestions |
| **COMPLIANCE** | compliance check, GDPR, HIPAA, CCPA, SOX, regulation, data protection, DSGVO, GoBD, TDDDG, eIDAS, AI Act, NIS2, KRITIS, Grundschutz, TISAX, DORA | Applicable regulations, requirements checklist, risk areas, approvals needed |
| **NDA** | NDA, triage NDA, non-disclosure, confidentiality agreement | GREEN/YELLOW/RED classification with screening checklist |
| **RISK** | legal risk, risk assessment, exposure, severity, escalation | Severity x Likelihood matrix score with escalation path |
| **WRITING** | legal brief, memo, legal response, draft response, template | Structured legal document in appropriate format |
| **VENDOR** | vendor check, vendor status, agreement status, what's signed | Agreement inventory, gap analysis, upcoming deadlines |

---

## Reference Loading Table

Load only the references required by the detected mode.

| Mode | References to Load |
|------|-------------------|
| CONTRACT | `references/contract-review.md` |
| COMPLIANCE | `references/compliance-frameworks.md`, `references/german-business-compliance.md` |
| NDA | `references/nda-triage.md` |
| RISK | `references/risk-assessment.md` |
| WRITING | `references/legal-writing.md` |
| VENDOR | `references/contract-review.md` (for gap analysis context) |

Always load `references/llm-legal-failure-modes.md` for every mode. LLM failure awareness is non-negotiable in legal work.

---

## Mode: CONTRACT

**Framework**: INTAKE -> ANALYZE -> FLAG -> REDLINE -> STRATEGIZE

**Phase 1: INTAKE** -- Accept the contract and gather context.

- Accept contract as file, pasted text, or URL reference
- Determine: which side the user is on (vendor/customer/licensor/licensee/partner), deadline, focus areas, deal context (size, strategic importance, existing relationship)
- If user provides partial context, proceed and note assumptions

**Phase 2: ANALYZE** -- Clause-by-clause review.

Load `references/contract-review.md` for the full clause analysis methodology.

1. Identify contract type (SaaS, services, license, procurement, partnership)
2. Read entire contract before flagging -- clauses interact (uncapped indemnity may be mitigated by broad LOL)
3. Analyze each material clause against playbook or market-standard positions
4. Cover at minimum: LOL, indemnification, IP, data protection, confidentiality, reps/warranties, term/termination, governing law, insurance, assignment, force majeure, payment

**Gate**: Every material clause analyzed. No clause reviewed in isolation.

**Phase 3: FLAG** -- Classify deviations.

| Flag | Meaning | Action |
|------|---------|--------|
| **GREEN** | At or better than standard. Minor commercially reasonable variation. | Note for awareness. No negotiation. |
| **YELLOW** | Outside standard but within negotiable range. Common in market. | Generate redline + fallback + business impact. |
| **RED** | Outside acceptable range. Material risk. Escalation trigger. | Explain risk. Provide market-standard alternative. Recommend escalation. |

**Phase 4: REDLINE** -- Generate specific alternative language for YELLOW and RED items.

Each redline includes: current language (exact quote), proposed language, rationale (suitable for counterparty), priority (must-have / should-have / nice-to-have), fallback position.

**Phase 5: STRATEGIZE** -- Negotiation strategy.

- Tier 1 (deal breakers): uncapped liability, missing DPA for regulated data, IP jeopardizing core assets, regulatory conflicts
- Tier 2 (strong preferences): LOL adjustments, indemnification scope, termination flexibility, audit rights
- Tier 3 (concession candidates): preferred governing law, notice periods, minor definitions, insurance certificates

Lead with Tier 1. Trade Tier 3 to secure Tier 2. Escalate before making any Tier 1 concession.

**Gate**: Top 3 issues identified. Negotiation priority established. Concession candidates named.

**Output format**:
```
## Contract Review Summary
**Document**: [name] | **Parties**: [names] | **Side**: [role] | **Basis**: [Playbook/Generic]

## Key Findings
[Top 3-5 issues with severity flags]

## Clause-by-Clause Analysis
### [Clause] -- [GREEN/YELLOW/RED]
**Contract says**: ... | **Standard**: ... | **Deviation**: ... | **Impact**: ... | **Redline**: ...

## Negotiation Strategy
[Priorities, concessions, approach]
```

---

## Mode: COMPLIANCE

**Framework**: SCOPE -> MAP -> ASSESS -> RECOMMEND

**Phase 1: SCOPE** -- Understand the proposed action.

- What is being done (feature launch, data processing, marketing campaign, new vendor)
- What data is involved (personal data categories, sensitive data, regulated data)
- Which geographies (determines applicable regulations)
- Who is affected (customers, employees, partners, public)

**Phase 2: MAP** -- Identify applicable regulations.

Load `references/compliance-frameworks.md` for regulation-specific requirements.

Map all potentially applicable frameworks. Check for overlapping or conflicting requirements across jurisdictions.

**Phase 3: ASSESS** -- Check each requirement.

| Requirement | Status | Action Needed |
|-------------|--------|---------------|
| [Requirement] | Met / Not Met / Unknown | [Specific action] |

For each risk area, assess severity and mitigation path.

**Phase 4: RECOMMEND** -- Prioritized action list with approvals needed.

**Gate**: All applicable regulations identified. Requirements checked. Approvals mapped.

**Output**: Quick assessment (Proceed / Proceed with conditions / Requires further review), applicable regulations table, requirements checklist, risk areas, recommended actions, approvals needed.

---

## Mode: NDA

**Framework**: ACCEPT -> SCREEN -> CLASSIFY -> REPORT

Load `references/nda-triage.md` for the full screening checklist and common deviations catalog.

**Phase 1: ACCEPT** -- Accept NDA in any format.

**Phase 2: SCREEN** -- Systematic evaluation against 10 screening criteria.

Agreement structure, definition scope, receiving party obligations, standard carveouts (public knowledge, prior possession, independent development, third-party receipt, legal compulsion), permitted disclosures, term/duration, return/destruction, remedies, problematic provisions (non-solicit, non-compete, exclusivity, standstill, residuals, IP assignment).

**Phase 3: CLASSIFY**

| Classification | Criteria | Routing |
|----------------|----------|---------|
| **GREEN** | All criteria pass. Standard mutual, all carveouts, reasonable term, no prohibited provisions. | Standard delegation. Same-day approval. |
| **YELLOW** | Minor deviations: broader definition, longer term, missing one carveout, narrow residuals, non-preferred jurisdiction. | Counsel review. 1-2 business days. |
| **RED** | Wrong type, missing critical carveouts, non-solicit/non-compete, perpetual term, broad residuals, hidden IP assignment, liquidated damages. | Full legal review. Do not sign. 3-5 business days. |

**Phase 4: REPORT** -- Structured triage report with specific issues, risks, and suggested fixes.

**Gate**: Every screening criterion evaluated. Classification justified.

---

## Mode: RISK

**Framework**: IDENTIFY -> SCORE -> CLASSIFY -> DOCUMENT

Load `references/risk-assessment.md` for the full severity/likelihood matrix and documentation standards.

**Phase 1: IDENTIFY** -- Define the risk clearly with background and context.

**Phase 2: SCORE** -- Apply Severity (1-5) x Likelihood (1-5) matrix.

- Severity: Negligible (1) through Critical (5), calibrated to financial exposure as % of deal/contract value
- Likelihood: Remote (1) through Almost Certain (5), calibrated to precedent and triggering events
- Risk Score = Severity x Likelihood

**Phase 3: CLASSIFY**

| Score | Level | Color | Escalation |
|-------|-------|-------|------------|
| 1-4 | Low | GREEN | Accept. Monitor quarterly. |
| 5-9 | Medium | YELLOW | Mitigate. Assign owner. Monthly review. |
| 10-15 | High | ORANGE | Senior counsel. Outside counsel if needed. Weekly review. |
| 16-25 | Critical | RED | GC/C-suite/Board. Outside counsel. Litigation hold if applicable. Daily review. |

**Phase 4: DOCUMENT** -- Risk memo with contributing factors, mitigating factors, mitigation options, recommended approach, residual risk, monitoring plan.

**Gate**: Both severity and likelihood ratings justified with specific rationale. Score calculated. Escalation path defined.

---

## Mode: WRITING

**Framework**: CLASSIFY -> DRAFT -> REVIEW

Load `references/legal-writing.md` for format templates and escalation triggers.

**Phase 1: CLASSIFY** -- Determine document type.

| Type | Use Case |
|------|----------|
| Legal memo | Internal analysis of a legal question |
| Legal brief | Summary of issue, law, and recommendation |
| Legal response | Templated response to common inquiries (DSR, litigation hold, vendor question, NDA request, subpoena) |
| Meeting brief | Pre-meeting context, talking points, action items |
| Incident brief | Rapid brief for developing situations (breach, litigation threat, regulatory inquiry) |

**Phase 2: DRAFT** -- Generate document in the appropriate format.

For legal responses: check escalation triggers before generating. If any trigger fires (regulatory inquiry, potential litigation, criminal exposure, media attention, multiple jurisdictions), stop and recommend escalation instead of a templated response.

**Phase 3: REVIEW** -- Present draft for user review. Note any assumptions, gaps, or areas needing counsel input.

**Gate**: Document type correctly identified. Escalation triggers checked. All required elements present.

---

## Mode: VENDOR

**Framework**: IDENTIFY -> INVENTORY -> GAP ANALYSIS -> REPORT

**Phase 1: IDENTIFY** -- Accept vendor name. Handle variations (legal name vs. trade name, abbreviations, parent/subsidiary).

**Phase 2: INVENTORY** -- Search for all agreements with the vendor. For each agreement found, capture: type (NDA/MSA/SOW/DPA/SLA), status (active/expired/in-negotiation), effective date, expiration date, auto-renewal details, key terms.

**Phase 3: GAP ANALYSIS** -- Identify what exists vs. what should exist.

Required agreements by relationship type:
- **Data processor**: NDA + MSA + DPA + SOW minimum
- **SaaS vendor**: NDA + MSA/SaaS Agreement + DPA (if personal data) + SLA
- **Professional services**: NDA + MSA + SOW(s)
- **Hardware/commodity**: NDA + Purchase Agreement

Flag: agreements expired but with surviving obligations, approaching expirations (90-day window), DPA gaps when vendor handles personal data.

**Phase 4: REPORT** -- Consolidated status report with gap analysis and upcoming actions.

**Gate**: All available sources checked. Gaps identified. Approaching deadlines flagged.

---

## LLM Failure Mode Awareness

Legal analysis is a high-risk domain for LLM failures. Load `references/llm-legal-failure-modes.md` and apply these guards on every mode:

| Failure Mode | Guard |
|-------------|-------|
| Fabricated case law or citations | Verify all citations with user before including. State "verify this citation" when referencing specific law. |
| Invented regulatory requirements | Distinguish between "this regulation requires X" (high confidence, well-known) and "check whether this applies in your jurisdiction" (lower confidence). |
| Jurisdiction confusion | Always ask which jurisdiction applies. Ask which jurisdiction applies. State which jurisdiction the analysis covers. |
| Overconfident analysis | Use calibrated language: "likely," "typically," "in most jurisdictions" rather than absolutes. |
| Missing clause interactions | Read entire contract before analyzing individual clauses. Clauses interact. |
| Stale legal knowledge | Training data has a cutoff. Recommend counsel verify current regulatory state, especially for recently enacted or amended laws. |

---

## Error Handling

| Error | Cause | Solution |
|-------|-------|----------|
| No contract provided | User asks for review without document | Prompt for document in any format |
| Ambiguous jurisdiction | Multi-jurisdiction deal | Ask user to specify primary jurisdiction. Note differences. |
| No playbook configured | First use, no organizational standards | Proceed with market-standard positions. Note clearly. |
| Contract too long (50+ pages) | Large agreement | Offer to focus on most material sections first, then complete review |
| Conflicting regulations | Cross-border requirements clash | Flag conflicts explicitly. Do not pick a winner. Recommend counsel. |
| Template needed for unknown type | No template for the inquiry type | Help user create a template following the creation guide in references |