Contracts off the internet and a leaking client base: a legal risk audit

Contracts off the internet and a leaking client base: a legal risk audit

A small business runs on contracts downloaded from the internet and finds out about the holes in them at the moment of a dispute. Below: what exactly gets checked in an audit like this, which four zones turn up almost every time, and what makes up the fee.

A small business runs on contracts downloaded from the internet and finds out about the holes in them at the moment of a dispute. Below: what exactly gets checked in an audit like this, which four zones turn up almost every time, and what makes up the fee.

The contract was downloaded, the name changed, three years of use

That is how most small companies work, and until the first contentious case it causes no trouble.

The client contract is a template off the internet with their own name inserted. The contractor agreements are the same, just a different template. There is no data processing consent, or a tick box with no text behind it. Staff work with the client base and nobody has signed anything about what may not be done with it. There are no procedures; everything rests on understandings.

It works — until one of three things happens: a client refuses to pay, a contractor misses a deadline, an employee leaves and takes the base.

And in each of the three cases it turns out the document does not protect you. Not because it is a bad document but because it was not written for your business.

Why a template off the internet does not work

The root cause: a contract protects whoever drafted it.

A template found online was written for somebody's situation — often the opposite of yours. A services contract downloaded from a site for clients protects the client. You sign it as the contractor and end up with a document working against you.

The misconception: "everybody works this way". Everybody does — until the first case. The cost of one lost dispute usually exceeds the cost of a whole year's legal work.

A second misconception: "we are small, this does not apply to us". Requirements for processing personal data do not depend on company size. Neither does liability for a leak.

And a systemic layer. Legal risks do not arrive one at a time. A company with a template client contract usually also has unaddressed staff undertakings, missing consents and unassigned rights to what contractors made for it. These are connected problems, and patching one is pointless.

What a legal audit checks

Six areas covering the bulk of a small company's risks.

1. Client contracts

What gets looked at: the subject matter — is it described so that it is clear when the work counts as delivered. The acceptance procedure and the deadlines for comments. Liability and its limits. What happens on withdrawal, on late payment, on endless revisions.

The most common finding: nowhere does it say what counts as delivered work. Because of that, any dispute over acceptance is lost in advance.

2. Contractor agreements

Here the risk is mirrored: you are the client, and something different should protect you.

The most common finding: rights to the deliverable were never transferred. A contractor made you a site, texts, a logo — and legally they remain his. This gets discovered at the moment you fall out with him.

3. Personal data

What you collect, where you store it, who you pass it to, whether there are consents and whether there are documents describing the processing.

The most common finding: data is collected in several places — a form on the site, a messenger, a spreadsheet, an accounting system — and not one of them is documented.

4. Staff and contractors: access to the base

Who has access to the client base and what has been signed about it. Whether there are confidentiality undertakings and whether they are properly drawn up.

The most common finding: everyone has access and nothing has been signed.

5. Rights to what was created

Texts, design, code, photographs, training material. Who owns them and on what basis.

6. Public documents

Terms of service, a privacy policy, refund rules. Whether they exist, whether they match reality and whether they contradict the contracts.

A frequent finding: the terms on the site say one thing and the contract another.

How the pipeline works

Step 1. Collection. Every existing document in one place — including the ones people forgot about.

Step 2. Analysing each. A legal assistant takes a document apart clause by clause: what it protects, what is missing, where the wording works against you. The work runs on the supplied text — that is, in the most reliable mode, where there is nothing to invent.

Step 3. A risk map. What was found is laid out on two axes: how likely and how expensive. That turns a list of comments into a queue: what to fix first.

Step 4. Correction. Reworking the documents for your business and your side of the deal.

Step 5. What is missing. Drafting what does not exist: consents, confidentiality undertakings, access procedures.

Step 6. A procedure. Who signs what and when, what to do with a new employee, a new contractor, a new channel for collecting data.

An obligatory caveat

No document goes out without a check by a live lawyer. AI speeds up the analysis and the drafting here, but responsibility for the wording lies with a person, and it must be checked against the law in force.

That is not a formality. A model confidently names non-existent provisions, and the error looks exactly like a correct answer. The rule is simple: everything verifiable is checked against the source, and final decisions with legal consequences are made by a specialist.

What genuinely speeds up several times over: analysing existing documents, finding contradictions between them, preparing drafts and the risk map.

Where to start if there is no budget for everything

A reasonable question: there are six areas and the money is limited. The order by risk per unit spent.

First — the client contract. It works every day and the money comes in through it. One clause on acceptance pays for the whole job.

Second — staff confidentiality undertakings. Cheap to put in place, catastrophic when absent. Somebody leaving with the base is the most common story among small companies.

Third — personal data. Here the risk comes not from a counterparty but from a regulator, and it does not depend on your size.

Fourth — rights to what contractors created. Discovered late and hard to fix, but it happens less often than the first three.

The rest as you grow. A company of three and a company of thirty have different priorities, and it does not all have to be done at once.

What the business gets

What changes in daily work after an audit

The result is not a folder of documents but a few habits that appear by themselves.

A new client signs your contract rather than the one he sent. The difference is that you now have something to offer and it protects your side.

A new employee gets a pack on day one. A confidentiality undertaking, an access procedure, a signature. It stops being a separate decision each time.

A new contractor transfers rights to the deliverable by default. The clause sits in the contract rather than being remembered after the fact.

There is somebody to go to with a contentious case. The documents have an owner and he knows what is written where.

It is those four habits, rather than the audit itself, that protect the business a year later.

What a legal risk audit costs

Work like this costs from $2 400. Honestly: that is the stated cost of the scenario by our methodology, not market statistics.

What makes it up: the number of documents, the number of areas of activity, whether missing documents have to be drafted from scratch, whether a procedure and staff training are required.

What to compare it against. The cost of one dispute: work that went unpaid, a base that left with an employee, rights that turned out not to be yours.

What a legal risk audit needs

AI assistants — over 200 across 14 categories, including the legal department: analysing documents, finding contradictions, preparing drafts. Chat access from the Basic plan.

Your own assistants for your specifics — Creator+. Automations for the document flow — Creator, Make, N8N and Full.

Registration is free and opens three days of Basic access — enough to run one of your own contracts through and see what turns up.

Do one thing today: open the contract you work under with clients and find the clause saying what counts as delivered work and how it is accepted. If there is no such clause, you have found the first risk, and it is the most expensive one.

What the platform offers for this

Thirteen lawyers in the catalogue. Assistants, Basic plan: the Corporate lawyer — transaction support and structure. The Tax lawyer — the burden within the law. The Employment lawyer — staff contracts, the very base that leaks. The Intellectual property lawyer — rights to developments and content. The Paralegal — across all areas. Plus specialists: insolvency, property, securities, succession.

For an owner that is a way of understanding the scale of the problem before going to a live lawyer on an hourly rate.

Where to process the documents. The Open Source section — solutions deployed on your own server: contracts and the client base do not leave the company perimeter. The catalogue is open to everyone, the links to repositories from the Creator plan.

The principle is simple and it is also the answer to the second half of this article: what went into somebody else's service stopped being yours the moment the button was pressed.

Tools for working with documents

An audit runs into volume: there are dozens of contracts and nobody to read them one after another.

The "Automator" course (Plus plan) has the lessons "Working with files. Contract analysis" and "Working with files. Report analysis" — taking any documentation apart. The model compares sections against each other, finds discrepancies between text and tables and contradictions between versions. It works reliably because it compares what was supplied rather than retrieving provisions from memory.

For document versions themselves there is the skill Draftable — document version comparison (an ordinary skill, files from Basic). For scans and schemes there are open tools: GLM-OCR recognises complex documents, Edit-Banana turns an image of a diagram into an editable DrawIO file, Documind pulls data out of a PDF into JSON. A scan of a deal structure or an organisational chart becomes a set of objects you can work with.

What that changes in the service. You take not ten contracts but the whole archive. The contradictions found are a specific, verifiable result people pay for.

And an obligatory caveat worth keeping in the proposal: nothing legally significant goes to the client without a check by a live lawyer. The tool speeds up the analysis; the responsibility lies with a person.

The "Automator" course — Plus. Open Source descriptions are open to everyone, repository links from Creator.

What to take on the platform for this task

What to read next

AI for lawyers — a contract checklist and the verification protocol.

Rights to a face in advertising — an adjacent risk zone for anyone making content.

Local models for sensitive data — if the documents must not leave the building.

A company knowledge base as a service — what to do with scattered internal procedures.

n8n and Make automation templates — the full guide to automations.

Also on AI SKILLS