Contracts off the internet and a leaking client base: a legal risk audit
A small business runs on contracts downloaded off the internet and finds out about their holes at the moment of a dispute. Below: what such an audit actually checks, the four zones it finds almost every time, and what makes up the fee.
A small business runs on contracts downloaded off the internet and finds out about their holes at the moment of a dispute. Below: what such an audit actually checks, the four zones it finds almost every time, and what makes up the fee.
---
The contract was downloaded, the name swapped in, and it has run for three years
That is how most small companies work, and until the first contentious case it causes no trouble.
The client contract is a template off the internet with your name typed in. The contractor contracts are the same, just a different template. There is no data-processing consent, or there is a tick box with no text behind it. Staff work with the client base and nobody has signed anything about what may not be done with it. There are no internal procedures; everything rests on informal agreement.
It works — until one of three things happens: a client refuses to pay, a contractor misses a deadline, an employee leaves and takes the base.
And in each of the three it turns out the document does not protect you. Not because it is a bad document but because it was written for a different business.
Why a template off the internet does not work
The root cause: a contract protects whoever drafted it.
A template found online was written for somebody's situation — often the opposite of yours. A services agreement downloaded from a site aimed at clients protects the client. You sign it as the contractor and end up with a document against yourself.
The misconception: "everybody works like this". Everybody does — until the first case. The cost of one lost dispute usually exceeds the cost of a year's legal work.
A second misconception: "we're small, this doesn't apply to us". Personal data requirements do not depend on the size of a company. Neither does liability for a leak.
And a systemic layer. Legal risks do not arrive one at a time. A company with a template client contract usually also has unsigned staff obligations, missing consents, and unassigned rights in what contractors made for it. These are connected problems and patching one is pointless.
What gets checked
Six areas that cover most of a small company's risk.
1. Client contracts
What gets looked at: the subject matter — is it described so it is clear when the work counts as delivered. The acceptance procedure and the window for comments. Liability and its limits. What happens on termination, on late payment, on endless revisions.
The most frequent finding: nowhere does it say what counts as completed work. Because of that, any dispute over acceptance is lost in advance.
2. Contractor contracts
Here the risk is mirrored: you are the client and something else has to protect you.
The most frequent finding: rights in the deliverable were never transferred. A contractor made you a website, copy, a logo — and legally they remain theirs. This gets discovered at the moment you fall out with them.
3. Personal data
What you collect, where you store it, who you pass it to, whether consents exist, and whether there are documents describing the processing.
The most frequent finding: data gets collected in several places — a website form, a messenger, a spreadsheet, an accounting system — and not one of them is documented.
4. Staff and contractors: access to the base
Who has access to the client base and what has been signed about it. Whether confidentiality obligations exist and whether they are properly executed.
The most frequent finding: everybody has access and nothing has been signed.
5. Rights in what was created
Copy, design, code, photographs, training material. Who owns it and on what basis.
6. Public-facing documents
Terms of sale, the privacy policy, the returns policy. Whether they exist, whether they match reality and whether they contradict the contracts.
A frequent finding: the terms on the website say one thing and the contract another.
How the pipeline works
Step 1. Collection. Every existing document in one place — including the ones people forgot about.
Step 2. Going through each one. A legal assistant works through a document clause by clause: what it protects, what is missing, where the wording works against you. It works from the text supplied — the most reliable mode, where there is nothing to invent.
Step 3. A risk map. What was found gets laid out on two axes: how likely and how expensive. That turns a list of comments into a queue: what gets fixed first.
Step 4. Fixing. Reworking the documents for your business and your side of the deal.
Step 5. The missing pieces. Drafting what does not exist: consents, confidentiality obligations, access procedures.
Step 6. A procedure. Who signs what and when, what to do with a new employee, a new contractor, a new channel for collecting data.
The compulsory caveat
No document goes out without review by a human lawyer. AI here speeds up the analysis and the drafting, but responsibility for the wording sits with a person, and it has to be checked against the rules in force.
That is not a formality. A model states non-existent rules confidently, and the mistake looks exactly like a correct answer. The rule is simple: everything verifiable gets checked against the source, and final decisions with legal consequences are made by a specialist.
What genuinely does speed up several times over: going through existing documents, finding contradictions between them, preparing drafts and mapping risks.
Where to start if there is no budget for everything
A reasonable question: there are six areas and the money is limited. The order by risk per unit spent.
First — the client contract. It works every day and the money comes in through it. One clause about acceptance pays for the whole job.
Second — staff confidentiality obligations. Cheap to put in place, catastrophic in their absence. Somebody leaving with the base is the most frequent story among small companies.
Third — personal data. Here the risk comes not from a counterparty but from a regulator, and it does not depend on your size.
Fourth — rights in what contractors created. Discovered late and hard to fix, but it happens less often than the first three.
The rest as you grow. A company of three and a company of thirty have different priorities, and doing everything at once is unnecessary.
What the business gets
- A register of documents — what exists, what does not
- Each one analysed clause by clause: what it protects, what it does not
- A risk map prioritised by likelihood and cost
- Reworked contracts for your side of the deal
- The missing documents — consents, obligations, procedures
- A signing procedure: who signs what and when
What changes in day-to-day work after an audit
The result is not a folder of documents but several habits that appear by themselves.
A new client signs your contract rather than the one they sent. The difference is that now you have something to offer and it protects your side.
A new employee gets a pack on day one. A confidentiality obligation, an access procedure, a signature. It stops being a separate decision each time.
A new contractor assigns rights in the deliverable by default. The clause is in the contract rather than remembered afterwards.
There is somebody to go to with a contentious case. The documents have an owner and they know what is written where.
It is those four habits, rather than the audit itself, that protect the business a year later.
What it costs
Work like this costs from $2 400. Honestly: that is the stated price of the scenario by our methodology, not market statistics.
What makes it up: the number of documents, the number of business areas, whether missing documents have to be drafted from scratch, whether a procedure and staff training are needed.
What to compare it against. The cost of one dispute: work nobody paid for, a base that left with an employee, rights you turned out not to have.
What is needed for this
AI assistants — more than 140 across 14 categories, including the legal section: going through documents, finding contradictions, preparing drafts. Chat access comes with the Basic plan.
Your own assistants for your specifics — Creator+. Document-flow automations — Plus and Full.
Registration is free and opens three days of Basic access — enough to run one of your own contracts through and see what turns up.
Do one thing today: open the contract you work under with clients and find the clause stating what counts as completed work and how it gets accepted. If there is no such clause, you have found your first risk, and it is the most expensive one.
---
Tools for working with documents
An audit runs into volume: there are dozens of contracts and nobody to read them one after another.
Module 5, the lesson "Analysing reports" — going through any documentation. The model compares sections against each other, finds discrepancies between text and tables and contradictions between versions. It works reliably because it compares what was supplied rather than retrieving rules from memory.
Qwen VLM for diagrams — a separate model turning an image of a diagram into structured data: nodes, links, directions. A scan of a deal structure or an org chart becomes a set of objects you can work with.
What that changes about the service. You take not ten contracts but the whole archive. The contradictions found are a concrete, verifiable result people pay for.
And the compulsory caveat, worth keeping in the proposal: nothing legally significant reaches the client without review by a human lawyer. The tool speeds up the analysis; a person carries the responsibility.
Module 5 is on Basic; Qwen VLM on N8N and Full.
---
What to read next
[AI for lawyers](/en/blog/ai-for-lawyer) — the contract checklist and the protocol.
[Face rights in AI advertising](/en/blog/face-rights-in-ai-ads) — an adjacent risk zone for anybody making content.
[Local AI models for sensitive data](/en/blog/local-models-sensitive-data) — if the documents cannot leave the building.
[A company knowledge base as a service](/en/blog/company-knowledge-base) — what to do with scattered internal rules.
[n8n and Make automation templates](/en/blog/n8n-automation-templates-guide) — the full guide to automations.