Legal Contract Risk Review RAG Prompt

This prompt is designed for contract review systems that must identify risk patterns across agreements using retrieved clause context. The primary job-to-be-done is surfacing one-sided indemnification, uncapped liability, auto-renewal traps, missing termination rights, and other structural risks from a set of retrieved contract chunks. The ideal user is a legal operations team, contract analyst, or AI engineer building a RAG pipeline over a contract repository who needs structured, citable risk findings—not a lawyer seeking a final legal opinion. The prompt assumes that a retrieval step has already occurred and that the [CONTEXT] placeholder will be populated with the most relevant clauses from one or more agreements. Without this retrieved context, the prompt has nothing to ground its analysis and should not be used.

Use this prompt when your system needs to produce risk findings with clause citations, risk severity ratings (e.g., Critical, High, Medium, Low), market-standard comparisons, and suggested fallback positions. It is appropriate for internal contract review workflows where the output will be reviewed by a human before any negotiation or decision. Do not use this prompt for generating legal advice, making final risk determinations, or reviewing contracts outside the retrieved context window. It is also not suitable for contracts where the governing law imposes unique statutory requirements not reflected in the retrieved clauses, or for real-time negotiation support where latency constraints prevent human review of the AI's findings. In regulated environments, always pair this prompt with a human-in-the-loop approval step and log every output for auditability.

Before integrating this prompt into a production system, you should have a clear eval strategy that measures both false-positive risk flagging (flagging a clause as risky when it is market-standard) and missed risk categories (failing to flag a genuinely one-sided provision). The prompt's value comes from its structured output schema, which makes it easy to validate that every finding includes a clause citation, a severity rating, and a suggested fallback. If your contract repository contains agreements from multiple jurisdictions or industries, consider adding a [JURISDICTION] or [INDUSTRY] placeholder to help the model calibrate its market-standard comparisons. The next section provides the copy-ready prompt template you can adapt for your own contract review pipeline.

This template is designed to be the core instruction set for your RAG answer generation step. It forces the model to act as a contract risk analyst, grounding every finding in a specific clause from the provided context. The prompt is structured to prevent the two most common failure modes in legal AI: hallucinated clause references and risk severity inflation. Before pasting this into your harness, ensure your retrieval step has already returned the most relevant clauses for the contract under review. The prompt expects a curated context window, not a full document dump.

codeCopy
You are a contract risk analyst. Review the provided contract clauses against the risk categories below. For each risk identified, you must cite the exact clause text that triggered the finding.

[CONTEXT]
The following clauses were retrieved from the contract under review:
---
[RETRIEVED_CLAUSES]
---

[RISK_CATEGORIES]
Analyze the clauses for the following risk categories. For each category, provide a severity rating of LOW, MEDIUM, HIGH, or CRITICAL based on the definitions provided:
- Indemnification: [INDEMNIFICATION_RISK_DEFINITION]
- Limitation of Liability: [LIABILITY_RISK_DEFINITION]
- Termination: [TERMINATION_RISK_DEFINITION]
- Data Privacy & Security: [DATA_PRIVACY_RISK_DEFINITION]
- Payment & Penalties: [PAYMENT_RISK_DEFINITION]

[OUTPUT_SCHEMA]
Return a valid JSON array of risk findings. Do not include any text outside the JSON structure. Each object must have the following keys:
- "risk_category": string (must match one of the provided categories)
- "severity": string (LOW, MEDIUM, HIGH, or CRITICAL)
- "finding_summary": string (a one-sentence summary of the risk)
- "source_clause_text": string (the verbatim text from [RETRIEVED_CLAUSES] that supports this finding)
- "market_standard_comparison": string (a brief note on how this deviates from standard market positions)
- "suggested_fallback": string (a concise suggested fallback position for negotiation)

[CONSTRAINTS]
1. If no risk is found for a category, do not include it in the output array.
2. Do not infer risks from clauses not present in [RETRIEVED_CLAUSES].
3. If the retrieved context is insufficient to assess a category confidently, output a finding with severity "UNCLEAR" and state what information is missing in the finding_summary.
4. Do not provide legal advice. The suggested_fallback is a commercial negotiation starting point, not a legal recommendation.

To adapt this template, start by replacing the [RISK_CATEGORIES] with your organization's specific risk taxonomy. The definitions for each category should be precise enough that a non-lawyer can understand the boundary between MEDIUM and HIGH severity. If your retrieval system returns metadata like clause headings or section numbers, inject them into the [RETRIEVED_CLAUSES] block to improve citation accuracy. The [OUTPUT_SCHEMA] is designed for direct ingestion by a downstream risk dashboard; if your application expects a different shape, modify the JSON schema but preserve the source_clause_text field as a non-negotiable grounding mechanism. For high-stakes reviews, always route findings with CRITICAL or UNCLEAR severity to a human review queue before they reach end users.

The Legal Contract Risk Review RAG Prompt is designed to operate inside a retrieval-augmented generation pipeline, not as a standalone chat interaction. The application layer is responsible for assembling the prompt with retrieved contract clauses, market-standard references, and the target contract text before sending it to the model. This prompt expects structured inputs: the full contract text or extracted clauses in [CONTRACT_TEXT], a set of retrieved reference materials in [RETRIEVED_CONTEXT] that may include market-standard clauses, regulatory guidance, and prior risk assessments, and a [RISK_CATEGORIES] list defining which risk types to scan for. The application must handle chunking and retrieval before prompt assembly—this prompt does not perform its own search.

Wire the prompt into a pipeline with these stages: (1) Contract ingestion and clause segmentation using a document parser that preserves section numbering and clause boundaries. (2) Retrieval against a vector store or hybrid search index containing market-standard clauses, regulatory texts, and historical risk findings. (3) Prompt assembly where [CONTRACT_TEXT] receives the target clause or full contract, [RETRIEVED_CONTEXT] receives the top-k retrieved references with metadata, and [RISK_CATEGORIES] receives the configured risk taxonomy. (4) Model call with structured output constraints—use response_format with a JSON schema matching the expected risk finding structure including risk_id, clause_reference, risk_category, severity, finding, market_comparison, and suggested_fallback. (5) Post-processing validation that checks every clause_reference actually exists in the source contract, every severity value matches the allowed enum, and no finding lacks a supporting citation. (6) Human review routing where findings above a severity threshold or flagged with low confidence are queued for attorney review before appearing in the final report.

For model choice, prefer models with strong structured output support and long-context handling—GPT-4o, Claude 3.5 Sonnet, or equivalent. Set temperature to 0 or near-zero to maximize consistency across repeated reviews of the same contract. Implement retry logic with exponential backoff for schema validation failures: if the output fails JSON schema validation, retry up to 2 times with the validation error message appended to the prompt as a correction hint. Log every model call with the contract identifier, retrieval query, prompt version, model response, validation result, and human review outcome. This audit trail is critical for legal workflows where every risk flag must be traceable. Never skip human review for high-severity findings or findings in regulated contract types—this prompt identifies patterns, it does not make legal determinations.