AI contract review in Australia, what it can do, where it falls short and how to use it safely

Your supplier has sent through a forty-page service agreement, and the renewal date on the NDA you signed three years ago is creeping up. Running both through an AI tool for a quick read is tempting, and for routine contracts that instinct is not wrong. But what the tool hands back is a starting point, not a review, and in Australia the gap between the two is where the risk lives: personal information in the document, an indemnity that interacts badly with the liability cap, or a term that the Australian Consumer Law will not enforce no matter how clearly it was drafted.

What AI contract review actually does

AI contract review tools use software, often built on large language models, to scan a contract and pull out the terms that matter: fees and payment timing, renewal and termination dates, notice periods, liability caps, indemnities and confidentiality obligations. Most let you upload a PDF or Word document and return a summary plus a list of flags, sometimes mapped against your own preferences such as "no auto-renewal" or "30-day payment terms". Some tools compare the counterparty's draft against your preferred position or against an earlier version, and highlight wording that was added or removed between drafts.

That makes AI a genuinely useful triage layer. What it is not is a substitute for advice about what a clause means for your business and whether it will hold up in Australia.

Where AI genuinely helps, and where it falls short

The honest position is that AI is excellent at reading and sorting, and weak at judgement. The strengths are real:

Speed on repetitive extraction: pulling fees, dates and notice periods out of a contract is where AI is fastest and most reliable.
Consistent checklist application: the same house rules get checked against every agreement, which removes the human tendency to skim.
First-pass summaries: useful when you are working through several supplier agreements or NDAs in a day.
Version comparison: spotting changes between drafts, including clauses that appear only in the latest version.

The limitations matter just as much:

Context and strategy: AI does not know your risk appetite, your bargaining power or the commercial trade-offs you are prepared to make.
Australian legal nuance: Australian Consumer Law concepts such as unfair contract terms, and state-based rules, can be misread or missed entirely by a tool trained largely on other jurisdictions.
Clause interactions: a liability cap can look benign on its own and become dangerous when combined with an indemnity, an exclusion of consequential loss and an insurance obligation.
Negotiation judgement: AI can propose edits, but it cannot anticipate the counterparty's counter-proposal or weigh the relationship cost of pushing a point.

The short version: AI reads and sorts, and the judgement calls belong to you and your lawyer.

The legal risks of uploading a contract to an AI tool

The risks are manageable, but only if you know what they are before you click upload.

Privacy and confidentiality

Contracts are full of personal information, sometimes without it being obvious: employee names in an employment contract, customer details in a distribution agreement, individual guarantors in a lease. Under APP 11 of the Privacy Act 1988 (Cth), an organisation that holds personal information must take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify it once it is no longer needed. If the AI provider suffers a breach, the Notifiable Data Breaches scheme in Part IIIC of the Act can require affected individuals and the Office of the Australian Information Commissioner to be told, and that obligation sits with the APP entity, which may be you.

The OAIC has published specific guidance on privacy and commercially available AI products, including the questions to ask before you upload data: whether the provider trains its models on your documents, where the data is stored, who can access it and how it is deleted. Before handing a third party's contract to any tool or consultant, have a non-disclosure agreement in place, and de-identify documents where you can.

Accuracy and hallucinations

Generative AI can sound confident and be wrong. A hallucinated reading of a termination clause, or a missed cap on an indemnity, only becomes a problem after you sign. Treat the tool's output as a prompt for manual checking rather than an answer, particularly for complex provisions about indemnities, IP ownership and limitation of liability.

Unfair contract terms and the Australian Consumer Law

This is where an Australian-specific review earns its keep. Under Part 2-3 of the Australian Consumer Law, which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), a term of a standard form consumer or small business contract is void if it is unfair: it causes a significant imbalance in the parties' rights and obligations, it is not reasonably necessary to protect the legitimate interests of the party relying on it, and it would cause detriment if it were applied. The court must also consider whether the term is transparent and look at the contract as a whole, and a term is presumed not to be reasonably necessary unless the relying party proves otherwise.

The scope is broader than many businesses assume. A contract is a small business contract if at least one party employs fewer than 100 people or had a turnover of less than $10 million in its last income year, and a contract is presumed to be standard form unless proven otherwise, based on factors such as unequal bargaining power and whether it was offered on a take-it-or-leave-it basis. Since November 2023, courts can also impose penalties for proposing or relying on an unfair term: for a body corporate, the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover, and $2.5 million for an individual, for each unfair term.

AI can flag a clause that looks one-sided, such as unilateral variation rights or a broad termination for convenience. Whether the ACL applies to that particular contract, and how to fix the clause without unravelling the deal, is a judgement call. And the rules cut both ways: your own standard terms of trade are exactly the kind of document that can breach the ACL, which is a point most AI reviews of inbound contracts will not raise.

Vendor security and supplier risk

Choosing an AI vendor is choosing a business system. Check what data retention and deletion actually mean in the vendor's terms, who has access to your documents, what the incident response looks like and what happens if the tool is unavailable or the vendor is acquired. Keep a manual fallback so a tool outage does not stall a deal, and confirm you have a right to delete your documents on request.

A safe workflow for AI-assisted contract review

Used in the right order, AI and human review each do what they are best at:

Set your house rules: write down the positions you prefer for common clauses, for example payment within 14 to 30 days and no pay-when-paid, no auto-renewal without notice, liability capped at the contract value, ownership of the IP you pay for, mutual confidentiality and clear data breach notification expectations.
Triage with AI, then prioritise: use the tool to extract key terms and produce a red, amber and green list against your house rules, then spend your time on the red items that matter most.
Review the high-risk clauses manually: indemnities and warranties, IP ownership and licence scope, confidentiality and data handling, termination rights and exit costs, dispute resolution and governing law, and liability caps and exclusions all deserve human eyes.
Draft pragmatic changes: let AI propose clean edits for simple issues such as formatting, duplication and typos, and draft the substantive changes yourself from your house rules and the deal reality. When the language gets complex, this is the point to bring in a lawyer.
Negotiate with purpose: send a tidy mark-up with a short rationale for each major change, and focus on the outcomes you need to protect rather than legal theory.
Confirm execution requirements: for companies, a document is validly executed under s 127 of the Corporations Act 2001 (Cth) if it is signed by two directors, or a director and a company secretary, or, for a proprietary company with a sole director who is also the sole secretary or has no secretary, that director. Electronic signing is permitted, and counterparties can rely on assumptions that the document was duly executed. Check the entity's exact name, that the signatories have authority, and that every schedule and annexure is complete.
Track obligations after signing: use the tool to extract dates, notice windows and renewal terms, then set reminders. Good drafting does not help you if you miss the notice period to exit a contract that has quietly auto-renewed.

Which contracts should still be lawyer-led?

AI triage plus a light-touch human read may be enough for routine NDAs, simple purchase orders and low-value supplier terms. These situations usually justify a lawyer leading the review and the strategy:

Strategic relationships: major suppliers, key customers, distributors or partners where the stakes are high.
Complex risk allocation: indemnities, IP ownership carve-outs, data protection addenda and cross-border issues.
Counterparty standard terms: paper drafted to protect the other side, which will need a strategy to rebalance.
Heavily negotiated deals: where trade-offs matter and the wording has to reflect the commercial position precisely.
Regulatory exposure: health, financial services, NDIS, privacy and security obligations, and government contracts.
New templates: your own standard terms of trade or services agreements should be designed properly at the baseline, because they will be reused across every customer you sign.

The clauses and documents that deserve your attention

Whether you are reviewing the other side's paper or building your own templates, the same documents and clauses carry most of the risk:

Terms of trade: your standard terms for selling goods or services, covering price, delivery, IP, liability and payment.
Privacy policy: how you collect, use and store personal information, which you are required to have if you handle customer data.
Non-disclosure agreement: protects confidential information when you collaborate or share proposals.
Employment contracts: duties, IP ownership, confidentiality and termination terms for staff.
Shareholders agreement: decision-making, share transfers and founder exits in a company structure.

The clauses that commonly trigger issues are liability and indemnities, where caps and exclusions of indirect loss are rarely one size fits all; IP ownership and licence scope, so you own what you pay for and can use it as intended; renewal and termination, where auto-renewals and short notice periods leave you exposed; payment and set-off, which affects your cash flow; confidentiality and data, which needs to align with your privacy practices; and dispute resolution and governing law, where the wrong choice drives up cost.

When to bring in a lawyer, and how Artificer Legal can help

A lawyer's value in this workflow is the judgement AI cannot provide: reading a flag in the context of your risk profile, deciding whether the ACL applies to a specific contract, drafting fixes that are enforceable, and setting the negotiation strategy. A second opinion on an AI output is a cheap way to test whether you are about to sign something that will cost more than the review itself. At Artificer Legal we review contracts, build and update your standard templates, explain what a flagged clause means for your business and what a realistic fix looks like, and take over negotiation or drafting where the stakes justify it.

Why "the AI said it was fine" is not a defence

The sharpest point from all of this is that an AI flag is a question, not an answer. The tool can tell you a clause is unusual; it cannot tell you whether the clause is enforceable in Australia, whether your own template is the one exposing you to a penalty under the unfair contract terms regime, or whether the indemnity and the liability cap work against each other once a dispute actually happens. The most expensive mistake is not using AI, it is treating its output as a completed review and signing on the strength of it.

To put the workflow in one place: use AI to triage, extract and compare, and keep the judgement with humans. Protect personal information before you upload anything, with regard to APP 11 of the Privacy Act 1988 (Cth) and the OAIC's AI guidance, and use a non-disclosure agreement when sharing third-party contracts. Adopt house rules, review high-risk clauses manually, confirm execution under s 127 of the Corporations Act 2001 (Cth) and track obligations after signing. Keep high-stakes, complex and heavily negotiated contracts lawyer-led, and remember that the unfair contract term rules in the Australian Consumer Law apply to the terms you propose just as much as to the terms you are asked to accept.