Contract Review SOP

A contract review SOP is the documented, repeatable procedure that decides what happens to every contract entering the legal queue: which tier it lands in, who reviews it, against which playbook positions, within what SLA, and who holds signature authority. It is a routing document first and a drafting guide second. Without one, every agreement is treated as bespoke — routine NDAs absorb senior-attorney hours while the MSAs carrying real liability get whatever time is left over.

An SOP is not a playbook. The playbook says a liability cap below 12 months of fees is unacceptable; the SOP says who is allowed to accept it anyway, at what deal size, and what happens when the counterparty refuses. Teams that write a playbook and file it as an SOP end up with defensible positions and no routing — which is the same queue they started with.

Why the tier line moved

CLOC’s 2026 State of the Industry Report (published 2 March 2026, drawn from 135 law departments with median revenue of $13B) puts numbers on the squeeze: 63% of departments report rising demand in regulatory compliance and 58% in cybersecurity, while only 47% expect inside legal spend to grow — down from 65% the year before — and 32% expect attorney headcount to grow. A further 85% now have dedicated AI oversight or resources.

Volume is climbing, reviewer capacity is flat, and governance overhead is new work of its own. The only lever left is the definition of what never reaches a reviewer at all. That definition is the tier 1 line, and moving it is the highest-yield edit you can make to this document.

The four-tier triage model

Sort by risk and deviation, not by contract label:

Tier 1 is defined by deviation count, not contract type. This is the single change that most teams have not made. “All NDAs are tier 1” breaks the first time a counterparty sends its own NDA with a five-year survival clause and a unilateral indemnity. “Any agreement with zero deviations from the playbook is tier 1, whatever it is called” scales, and it lets a clean order form and a clean DPA ride the same path.

The volume behind that line is real: Luminance’s March 2026 release puts NDAs at over 15% of all enterprise contracts — a vendor figure, and directionally consistent with what most in-house queues look like. Thresholds shift by industry: healthcare and financial services push contracts up-tier because of the compliance overlay, and companies selling on their own paper push a larger share down.

What goes in the document

A working SOP runs 6-15 pages:

1. Triage rules. Tier definitions, who assigns the tier, what overrides exist and who can invoke them.
2. Intake requirements by contract type. The minimum fields legal needs before the clock starts — counterparty, TCV, term, data categories touched, who owns the relationship. An incomplete intake is bounced, not queued.
3. Playbook positions per contract type. Acceptable, fallback, and walk-away on every material clause: liability cap, indemnity, IP ownership, data processing, governing law, term, auto-renewal, assignment on change of control.
4. Approval matrix. Who signs at which dollar threshold, risk threshold, and term length.
5. Escalation triggers. Numeric and explicit — “escalate to GC above $500K TCV, on any uncapped indemnity, or on any regulated-data term outside the DPA template.”
6. AI autonomy settings. Which contract types AI reviews autonomously, which it assists on, which stay fully human — see below.
7. Owner, version, and changelog. Named owner, version number, and a dated list of position changes.

The autonomy setting

Every contract type in the SOP gets one of three settings, and this is the section that did not exist in a 2024 SOP:

• Assistive — AI produces redlines and a risk summary; a human reads and sends. Default for tiers 2 and 3.
• Supervised-autonomous — AI negotiates turn by turn but a human approves each outbound draft. Where most tier 1 work should sit for the first two quarters.
• Autonomous — AI sends without a human in the loop. Luminance now ships this end-to-end for NDAs: the agent reads the draft, remediates risk against the playbook, sends the revision, tracks the response, and reacts to the counterparty’s own AI.

Whether to switch autonomous on is an SOP decision, not a procurement one. A defensible default: allow it only where all four of these hold — the agreement is your paper or a recognized mutual standard; it carries no data-processing or IP-assignment terms; the deviation set has been stable for at least six months; and any clause with no playbook position hard-routes to a human instead of being negotiated. Everything else stays supervised. Write the four conditions into the SOP before the feature is enabled, not after.

How to operationalize

1. Encode routing in the CLM. Intake form, tier assignment, and approval matrix live in Ironclad, Agiloft, or whichever CLM the team runs. A paper SOP with no system enforcement is decorative.
2. Load the same playbook into the review tool. LegalOn ships 50+ attorney-written playbooks as a starting set, BlackBoiler trains on your executed redlines and returns marked-up Word, Spellbook works in the Word add-in. Whichever you run, the tool’s positions and the SOP’s positions are one artifact with two renderings — they change together or they drift.
3. Audit weekly. Sample 10-20 closed contracts and verify tier, reviewer, and approver against the rules. Surface drift in the staff meeting, not in a quarterly review.
4. Measure cycle time from intake, not from legal’s start. The business experiences the wait from request submission to signature. An SOP that hits its SLA while requests sit three days in an inbox is measuring the wrong clock.
5. Re-verify the named tools every two quarters. The vendor row rots faster than the legal content.

Common pitfalls

• No real tier 1. Teams that never define “truly routine” review everything at attorney level. Guard: set the tier 1 definition by deviation count, then track what share of monthly volume clears it. If under 30% is landing there, the playbook is too narrow to auto-clear anything.
• Playbook positions that outside counsel does not hold. A contract escalates and outside counsel argues terms your team already conceded. Guard: send the playbook to outside counsel for redline once a quarter; treat their markup as a change request against a versioned document.
• The SOP names tools that no longer exist. This page previously routed tier 1 through LawGeex, whose enterprise product was dismantled in 2023 — assets to Robin AI, remaining clients to LegalSifter. An SOP that names a dead vendor teaches the business the document is stale, and they stop reading all of it. Guard: date the tool column and re-check it on the same two-quarter cycle as step 5.
• Autonomy set by what the tool can do rather than by what the risk allows. Guard: the four conditions above are written and approved before the switch is flipped, and reviewed after the first 50 autonomous contracts.
• AI configuration and SOP drift apart. The tool suggests positions A, B, C; the playbook says A, B, D. Lawyers learn to ignore the flags, and the recall number stops mattering — see evaluating AI contract review accuracy. Guard: treat tool configuration as part of the SOP itself, with the same owner and version.
• Escalation by comfort level. Without numeric triggers, escalation tracks reviewer seniority and mood. Guard: every escalation path names a threshold, not a feeling.

When this framework breaks down

Under roughly 200 contracts a year, four tiers cost more to maintain than they save — run two (standard and not standard) and skip the approval matrix until volume justifies it. It also assumes contracts are the unit of work: for departments whose load is litigation, regulatory filings, or advice, matter intake is the document to build first, and legal intake is the better starting point.

Related

• NDA playbook — the positions behind the most common tier 1 agreement
• MSA redlining rubric — tier 2-3 review depth
• Contract lifecycle management — the system that enforces the SOP
• How to evaluate AI contract review accuracy — before you trust a tier 1 auto-approve
• What is Legal Ops? — the function that owns SOP design