How to review a contract without a lawyer: a 7-step process

There is a specific moment this guide is written for. It is 4pm, a vendor has sent over a 16-page agreement, your counterpart wants it signed before the end of the week, and the lawyer you'd normally send it to is quoting you next Tuesday and $600.

You are going to read it yourself. The question is not whether to — it's whether you read it in a useful order.

Most people read a contract front to back, which is the worst possible order. The first four pages of almost every commercial agreement are definitions and recitals, which is where attention is freshest and where almost nothing that can hurt you lives. By the time you reach the limitation of liability on page 11, you are skimming.

Here is the order we actually use, and the reasoning behind it.

Step 1: Find the money and the term first

Before reading a single clause, answer four questions by searching the document rather than reading it:

• What do I pay, and when? Fees, payment terms, late fees, and whether prices can increase mid-term.
• How long am I bound? The initial term.
• How does it end? Termination for convenience, termination for cause, and the notice period each requires.
• Does it renew by itself? And if so, by how long, and what is the notice window to stop it?

These four answers are the commercial shape of the deal. Everything else in the contract is a modifier on them. If the term is three years with a 90-day non-renewal window and no termination for convenience, you have just learned more about your risk than you would from reading forty clauses.

Auto-renewal in particular is worth its own pass — the notice windows are routinely designed to be missed. We wrote up the specific patterns in auto-renew traps.

Step 2: Read the liability section next

The limitation of liability clause is usually one paragraph and it sets the ceiling on everything that can go wrong. Read it second, while you are still sharp.

You are looking for three things stacked on top of each other: the cap (a dollar figure or a formula, typically 12 months of fees), the exclusions (categories of damages nobody can claim, usually indirect and consequential damages and lost profits), and the carve-outs (the liabilities that escape the cap entirely).

The carve-outs are where the asymmetry hides. A clause that caps your vendor at 12 months of fees while carving your own indemnity obligations out of the cap is not a mutual limitation — it is a one-way one wearing a mutual costume. The full breakdown is in limitation of liability, explained.

Step 3: Read the indemnities

Indemnification is where somebody else's lawsuit becomes your bill. Ask, for each indemnity in the document:

• Who is indemnifying whom?
• For what kinds of claims?
• Does the obligation include defending the claim as it happens, or only reimbursing losses afterwards?
• Who controls the defense and who can settle?

A vendor indemnifying you for its own IP infringement is normal and expected. You indemnifying a vendor for "any claim arising out of Customer's use of the Services" is very broad, and worth narrowing. See indemnification clauses for what the standard shapes look like.

Step 4: Follow the IP

Three questions, in this order:

1. What do I own at the end? For deliverables, custom work, or anything built for you specifically, the agreement should assign ownership to you in present-tense language, not promise a future assignment.
2. What licenses am I granting? Look specifically for a feedback license (usually broad and perpetual — often fine, but know it's there) and any license to your data or content beyond what's needed to deliver the service.
3. What am I bringing in that stays mine? Background IP should be carved out.

For contractor and agency agreements this is the single most consequential section, and the drafting failure is common enough that we gave it its own guide: the IP assignment clause founders get wrong.

Step 5: Check the data and compliance terms

If the counterparty will touch personal data belonging to your users, employees, or customers, there should be a Data Processing Addendum, and it should be attached rather than merely referenced by a URL that could change.

The eight things to verify in it are in the GDPR DPA checklist. The short version: named sub-processors with a right to object, a real transfer mechanism, a specific breach-notification window, and audit rights that survive being replaced by a SOC 2 report.

Step 6: Read the boring end of the document

The last two pages — governing law, venue, assignment, notices, entire agreement, order of precedence — get skipped almost universally, and two of them matter a great deal:

• Governing law and venue. A dispute under Delaware law heard in California is a different economic proposition from one heard where you operate. If venue is somewhere you have no presence, the practical cost of ever enforcing your rights may exceed what they are worth.
• Order of precedence. If the deal has both a master agreement and statements of work, this clause decides which one wins when they conflict. Without it, the answer is genuinely uncertain. See SOW vs MSA.

Also check assignment: many agreements let the counterparty assign the contract to an acquirer without your consent while requiring their consent for you to do the same.

Step 7: Write the three-column list

This is the step that converts reading into a negotiation. For each issue you found, write one line with three parts:

The "why" is not optional. "We'd like the liability cap raised" gets refused. "We'd like the cap set at 12 months of fees rather than 3, because the service is handling our customer records and a 3-month cap is well below our exposure in a breach" gets negotiated. We wrote about the structure in what plain-English redlines actually look like.

Send the list. Do not send a marked-up document on the first pass — a short list of specific, reasoned asks moves faster than a redline and reads as less adversarial.

When to stop and call a lawyer anyway

This process is a first pass, not a substitute for counsel. Stop and get a lawyer when any of these are true:

• The agreement transfers equity or ownership in your company.
• Liability is uncapped, or the cap is a number that would materially damage the business.
• It binds you for multiple years with no exit.
• It's an employment or separation agreement — those carry jurisdiction-specific rules that generalist reading will miss.
• It's governed by a jurisdiction you have never operated in.
• Something in it is unusual, and you can't work out why it's there.

That last one is the most reliable signal. Boilerplate is boilerplate because it is everywhere; a clause you have never seen before was drafted by someone for a reason, and the reason is worth an hour of a lawyer's time.

The goal of the seven steps is not to replace that hour. It's to make sure that when you buy it, you spend it on the four questions that actually matter instead of on a lawyer reading definitions.

How we use this

Every review in CheckMyDoc runs roughly this order automatically — commercial terms, liability, indemnity, IP, data, then the miscellaneous section — and returns each finding with the citing clause, a severity, and a proposed redline in the three-part format above. You can see the full review workflow here.

A disclaimer

This is a process for reading a contract, not legal advice, and nothing here creates a lawyer–client relationship. Contract law is jurisdiction-specific, your risk profile is specific to your business, and a clause that is standard in one market is aggressive in another. Use this to arrive at better questions — then take the live ones to a lawyer.