ChatGPT for contracts can explain clauses, extract information, compare versions and prepare drafting. A useful result requires more than a first prompt: define the task, apply the right data rules, require source clauses and have a person verify the answer in the agreement.
This guide gives legal teams a practical workflow and ten questions to resolve before using a real contract.
Useful contract tasks for ChatGPT
Start with outputs that can be checked against the source. Ask for termination periods with clause numbers, a comparison of two liability clauses, or a revision based on an approved template.
"Is this contract safe?" is too broad. Without instructions, ChatGPT does not know your party, negotiation goal, risk tolerance or controlling legal sources. A fluent answer may still omit an exception, source or consequential amendment.
A controlled six-step workflow
Define the output: Request a clause table, deviation list or drafting proposal.
Prepare the material: Supply only the documents needed and remove unnecessary personal or confidential information where the task permits.
State the perspective and standard: Identify the party, goal, jurisdiction and approved comparison text. Tell ChatGPT to leave gaps open.
Require sources: Every contract claim should cite a clause or passage and, for a document set, the file.
Verify the output: Compare material claims with the original and check legal claims against current primary sources.
Transfer changes carefully: Review definitions, cross-references, numbering and consequential changes, and record human approval.
Example: reviewing an employment agreement
Ask ChatGPT to extract probation, role, workplace, hours, compensation, bonus, overtime, leave, termination, post-termination restrictions and governing law with clause references. Compare the result with an approved template and current law.
The output is a structured reading aid. It is not individual legal advice or proof that a clause is enforceable or favourable. Mandatory law, collective agreements, incentive plans and restrictive covenants need the specific context.
The second pass should narrow the task. Instead of reviewing the whole document again, address only the open issues, such as an unclear bonus condition, the treatment of overtime or the scope of a post-termination restriction. Ask ChatGPT to separate the wording, source clause, missing facts and possible readings.
Verify legal questions outside the chat against the law in force at the relevant place and date. Draft only after that step. This preserves the distinction between content extracted from the agreement, conclusions supported by legal sources and negotiation decisions made by the team.
ChatGPT is not a single product context
Personal accounts, ChatGPT Business, Enterprise and the API have different contracts, administration and retention behaviour.
OpenAI says that data from ChatGPT Business, Enterprise and the API are not used for model training by default unless the customer explicitly opts in. Managed workspaces provide additional administration and retention controls. Under the published retention rules, chats are generally retained until deleted; after deletion, permanent removal is scheduled within 30 days unless security or legal obligations require longer retention. API use and qualifying organisations have separate retention options.
These published statements do not replace a review of the actual contract and configuration. "No training" alone does not answer storage, permissions, subprocessors or international transfer questions.
Three controlled starting cases
A useful first case is extraction from an already approved template. The expected answers are known, so clause references and completeness are easy to test. Comparing two versions also works where both documents are supplied and every change must be tied to a paragraph or clause.
A third case uses an anonymised agreement and one bounded question. For example, ChatGPT can identify every termination mechanism without evaluating the whole agreement. This quickly reveals whether length, tables, schedules or formatting cause omissions.
Unknown client files with high confidentiality, open legal questions without supplied sources, and tasks where the answer would be sent directly to a counterparty are poor starting points. Data approval and quality controls have not yet been established for those cases.
The 10 questions before a real contract
Which product and contract apply? Do not treat a personal account, Business, Enterprise and the API as equivalent.
Which content is approved? Define data classes and allowed use cases centrally.
Is there an appropriate DPA? Check roles, services, subprocessors, transfers, assistance, deletion and audit evidence.
How long do chats and files remain? Include projects, libraries, backups, logs and connected systems.
Where are data processed and stored? A user's location or a broad compliance statement is insufficient.
Who can access and administer data? Review roles, exports, shared links and offboarding.
Which apps and connectors are enabled? Each connection may introduce additional data sources, recipients and actions.
How are privilege and professional secrecy protected? Data protection and professional duties require separate analysis.
How is quality controlled? Define mandatory citations, second review and tasks that must not be automated.
How is use documented? Record the product, settings, sources, instruction, output and approval where required.
The answers need to become workspace controls rather than remain in a policy: enabled apps, roles, retention, approved document types and a clear escalation path. A person facing an uncertain confidential schedule should know whom to ask instead of guessing that an upload is probably acceptable.
A better contract-review prompt
"Use only the attached agreement. Review it from the customer's perspective. Create a table with topic, clause, short wording, deviation from our attached standard and one open question. If no source is present, write 'not found in the document'. Do not invent legal sources or give final approval."
A good prompt limits the task and makes gaps visible. It does not solve an unresolved data approval or replace verification.
When a contract workflow may fit better
For repeat contract work, the path back into the document matters. CASUS Risk Review structures findings for review, while CASUS Chat Actions prepare and apply specific changes in the document. The CASUS security page explains the technical basis.
Compare tools using the same contract and instruction. Measure source accuracy, completeness, correction effort and time to a reviewed document. To make a direct comparison, try CASUS.
FAQ
Can ChatGPT review a contract?
It can extract terms, explain clauses, compare versions and prepare drafting. A qualified person remains responsible for complete legal and commercial review.
Can I upload confidential contracts to ChatGPT?
That depends on the product, contract, configuration, data and your legal or professional duties. Resolve these points before upload and use only approved workspaces.
Does OpenAI train on ChatGPT Business or Enterprise data?
OpenAI says business and enterprise content is not used for model training by default unless the customer explicitly opts in. Storage and retention are separate questions.
Can ChatGPT give final approval to an employment contract?
No. It can structure the document, but enforceability, mandatory law, collective agreements and the person's circumstances require professional review.
What should I verify in every answer?
Check the source clause, completeness, jurisdiction, effective date and consequential amendments. A plausible sentence without evidence is not a verified result.
