Author: Robby Reggers

by Robby Reggers

What Is the GDPR? A Practical Guide for Business Contracts

Everyone who works with contracts has seen it. A deal is moving nicely, and then someone mentions the GDPR or that data privacy wording needs to be added in the contract. Suddenly there are extra documents like DPAs, including new questions and delays. Most people on the deal have never had a plain explanation of what this law actually is.

So, what is the GDPR, why does it matter for business contracts and how can you prevent these issues? This practical guide gives sales, procurement, founders and lawyers the essential GDPR basics, plus the relatively simple steps that can keep privacy questions from delaying signature. It is written for an international audience, reflecting the contracts I work on between European companies and businesses in the US, Middle-East and Asia. The next articles in this series go deeper into DPAs and SCCs.

The good news is that many of the problems are relatively easy to prevent. In this article we will do more than explain the GDPR. We cover the basics you need to know and the practical steps to take in this article ‘What Is the GDPR? A Practical Guide for Business Contracts’.

What Is the GDPR? The Short Version

In short, here are the six points to remember:

• The GDPR is the EU’s general rulebook for personal data. One regulation, every EU country, across sectors. The UK has kept its own very similar version.
• The GDPR can also bind companies outside the EU when they offer goods or services to people in the EU, or monitor their behaviour. The UK GDPR has a similar reach.
• Personal data is much broader than you may think. A work email address counts. An IP address counts. Even harmless-looking pieces of information count once they can be combined to point to one person.
• For contracts, the key concepts are personal data, processing, and the two roles, controller and processor. Understand these and every privacy document in your deal starts making sense.
• Fines can reach 20 million euros or 4 percent of worldwide turnover. But the everyday reason to care is simpler. Deals do not sign until the privacy paperwork is right.
• The practical fix: identify the data and the parties’ roles early, use approved DPA and SCC documents, and complete the required information before final negotiations. Most avoidable GDPR delays are process problems, and process problems can be fixed.

GDPR for Business: Key Terms for Contracts

You will run into these terms in almost every deal. Here is what they mean, without the legal language.

• GDPR: the General Data Protection Regulation. The EU’s law on personal data, in force since 2018.
• UK GDPR: the UK’s own version, kept after Brexit. Very similar rules and principles.
• Personal data: any information about an identified or identifiable person. Much broader than most people expect.
• Data subject: the person the data is about. An employee, a customer, a user.
• Processing: almost anything you do with personal data. Collecting, storing, viewing, sharing, deleting.
• Controller: the party that decides why and how personal data is used. Usually the customer in a vendor deal.
• Processor: the party that handles the data on the controller’s instructions. Usually the vendor.
• Privacy notice: the public explanation a controller must give to the people whose data it uses. Sometimes called a privacy statement or privacy policy.
• Lawful basis: the legal reason you are allowed to process personal data at all. The law lists six.

What Is the GDPR and When Does It Apply?

The GDPR is the General Data Protection Regulation. It is a European Union regulation, in force since 2018, and the word regulation matters. An EU regulation applies directly in every EU country. No country needs to pass its own version first. Individual countries can add specific rules on certain topics, but the GDPR provides the shared framework across the EU.

A side note on geography: the EU GDPR also extends across the European Economic Area, which includes Iceland, Liechtenstein and Norway. After Brexit, the UK kept its own very similar version, the UK GDPR. So in this article, references to Europe generally mean the EEA and the UK unless stated otherwise.

Two more things make the GDPR different from what many US readers are used to.

First, it is one cross-sector rulebook. The US regulates privacy largely sector by sector: one law for health data, another for financial data, plus a growing patchwork of state laws. The GDPR applies across industries. There is no general “we are not a regulated industry” exit.

When Does the GDPR Apply Outside the EU?

The GDPR can apply to organisations outside the EU when they offer goods or services to people in the EU, or monitor their behaviour there. No European office is required. Mere website accessibility is not enough, but actively targeting EU customers can bring a company within scope. The UK GDPR uses a similar test for people in the UK.

This is why the GDPR matters even to companies that see themselves as purely American. A US company that targets European customers or monitors people in Europe may have to comply. That is often the moment the GDPR lands on its contracts.

And the law has teeth. Fines can reach 20 million euros or 4 percent of a company’s worldwide annual turnover, whichever is higher. But in daily practice the pressure is more direct: European counterparties simply will not sign until the privacy side of the deal is in order.

Want the source? Articles 1 to 3 GDPR cover what the law is and where it applies.

What is Personal Data Under the GDPR?

Here is the single biggest misunderstanding we see, especially from US teams.

Personal data is any information about an identified or identifiable person. Not just sensitive records. Not just consumer data. Any information about a person.

10 Everyday Examples of Personal Data Under the GDPR

These examples appear in ordinary business tools and contracts more often than most teams expect:

1. Work email addresses, such as jane.smith@company.com.
2. Names and job titles in contact lists and email signatures.
3. IP addresses and device IDs in website logs and app telemetry.
4. User accounts and login records, including account IDs and access history.
5. Support tickets and chat messages tied to a customer or user.
6. Meeting recordings and transcripts containing voices, faces or written conversations.
7. CVs and employee records, including applications, payroll information and reviews.
8. Customer and supplier contacts, including names, roles and direct numbers.
9. Location and product-usage data showing where and how a service is used.
10. Details that identify someone when combined, such as a postcode, date of birth and job title.

Here is the part almost everyone misses: information can also become personal data in combination. One piece on its own may point to nobody. A postcode alone covers many people. But a postcode plus a date of birth plus a job title can point to exactly one person. Once pieces of information can be put together to identify someone, they are personal data. So the question is never “is this one field sensitive?” but “could this information, combined, point to a person?”

What matters is whether someone, in practice, could use that combination to single out one specific individual. Even three ordinary-looking fields, on their own harmless, can together point to one person.

One more thing: it does not matter how the data reaches you. If you can see it, if you receive it, if it simply sits on your servers, you are dealing with personal data and the rules apply to you.

So the honest rule of thumb is this: if you think your deal does not touch personal data, you are almost certainly wrong.

Want the source? Article 4(1) GDPR defines personal data.

What Does Processing Mean Under the GDPR?

Processing is one of the most important concepts to understand when you deal with data privacy, globally, and especially under the GDPR. The reason is simple: every duty in this law attaches to processing. Who is responsible, who must protect the data, who must answer when something goes wrong. It all starts with the question of who processes what. When we get to responsibilities in the next articles, this is the concept everything builds on.

The definition is deliberately wide. Processing means almost anything you do with personal data, and the law itself lists the examples: collecting it, recording it, storing it, retrieving it, using it, sharing it, deleting it.

Yes, storing is on the list. This matters in deals because of one common objection: “we only store the data, we never look at it.” Under the GDPR, storage is processing. A vendor that only hosts files, and never opens a single one, is still processing personal data, and the rules still apply to it.

Put the two broad concepts together and you see why the GDPR reaches into almost every contract. Almost everything is personal data, and almost everything you do with it is processing.

Want the source? Article 4(2) GDPR defines processing, storage included.

GDPR Controller vs Processor: Who Decides and Who Executes?

Two quick questions.

Is Netflix the controller or the processor of your viewing history? Controller. You never instructed Netflix to do anything. Netflix decides what to collect, how to use it, and what to recommend you next.

Now your salary. Your employer runs payroll through an external payroll provider. Who is responsible for your salary data? Your employer decides what you earn, when you are paid, and how long the records are kept. The payroll company just executes. Your employer is the controller. The payroll provider is the processor. The same goes for Zoom storing your company’s meeting recordings: your company decided to record and how long to keep them, Zoom executes.

That is the whole concept, and it always comes down to one question: who decides? The party that decides why and how data is used is the controller. The party that executes on instructions is the processor.

Can the Same Company Be Both Controller and Processor?

Yes. That is the reason even people who work with this daily still find it hard. Take Gmail. Your private Gmail account: Google decides how the service works, so Google is the controller. Your work email on Google Workspace: your employer decides, Google executes, so Google is the processor for that service. Same company, similar product, different role. The role depends on who decides the purposes and means of the specific processing.

And the role matters, because under the GDPR the roles decide who is responsible for what. For example:

• Who must answer when a person asks about their data.
• Which company is responsible to report a data breach.
• Who is on the hook when something goes wrong. Every privacy document in your deal is built on this split.

What Do the GDPR Roles Mean in a Business Contract?

Think of a company, Acme Inc. They hold information about its employees and its customers. Acme decides to buy software:

• Salesforce for its customer data,
• Microsoft 365 for email, and
• an approved business version of ChatGPT for its teams.

Acme decides why these tools are used and which data goes in. That makes Acme the controller. The software providers handle Acme’s data to deliver their service, as agreed in the contract. That makes them processors for that processing.

That is the whole idea. The controller decides. The processor executes, on the controller’s instructions.

One warning, even in a basics article: the label in the contract does not decide the role. What a company actually does decides it. A vendor that starts using customer data for its own purposes, for example to train its AI models, is no longer just a processor for that activity. Remember this one. It becomes important in the next articles, especially where AI is involved.

And one side note: most deals look like the Acme example, one controller and one processor. Sometimes two companies each decide for themselves what they do with shared data. Then you have two controllers, a controller-to-controller relationship, with different paperwork. We will not go into that here.

Want the source? Articles 4(7) and 4(8) GDPR define controller and processor. The European Data Protection Board also provides a practical explanation.

GDPR Privacy Notices and DPAs: What Is the Difference?

Why did you never sign a DPA with Netflix?

Here is a question the roles immediately answer. You use Netflix, Spotify, maybe the free version of ChatGPT. You never signed a data processing agreement with any of them. Why not?

Because a DPA belongs to the controller-processor relationship. It is the contract a company signs when it asks another company to process data on its behalf. As a consumer, you are not instructing anyone. Netflix is the controller, and you are simply the person the data is about. No controller-processor relationship, so no DPA.

What you get instead is the privacy notice. The privacy notice is the controller’s duty: every controller must explain to the people whose data it uses what it collects, why, for how long, and who it shares it with. That is why every consumer service has one, and why it is written to you.

And this duty has teeth. The Dutch privacy regulator fined Netflix 4.75 million euros because its privacy statement did not explain clearly enough what it did with customer data. Netflix objected to the fine, but the message to every controller is the same: the notice is not decoration.

A processor works differently. It does not owe you a notice for the data it handles on behalf of its customer. Its duties run to the controller, through a contract. That contract is the DPA. (The vendor is still a controller for its own things, its website, its billing, its own staff, and has a privacy notice for those.)

So here is the simple map. Consumer products: the company is the controller, you get a privacy notice, and there is no DPA. Business tools: the vendor is the processor, the two companies sign a DPA, and your employer owes you the notice. And one handy trick: want to know a company’s role? Open its privacy notice. The controller must name itself there. Netflix’s names Netflix, and for European customers, its Dutch entity in Amsterdam.

Want the source? Articles 12 to 14 GDPR cover privacy notices. Article 28 covers the DPA. Both come back in the next article in this series.

What Is a Lawful Basis Under the GDPR?

One more foundation, and then you have the full picture.

Under the GDPR, you cannot process personal data just because you want to. You need a legal reason, a lawful basis. The law lists six. Three matter in daily business:

• Contract: you may use the data you need to deliver what was agreed. Order something at Amazon, and Amazon may use your name and address to deliver your package. Without that data, no delivery.
• Legitimate interests: you may also use data for closely related things a customer would reasonably expect. Amazon checking your order for fraud, for example. What this basis does not allow is going much further than what people would expect. It is the everyday workhorse in B2B, and also the most misused.
• Consent: the person agreed. Consent feels like the safe choice, especially to US readers. In business settings it is usually the weakest one, because it can be withdrawn at any time.

Now the point for commercial teams. When you are selling, your customer will assume there is a proper legal basis behind everything your product does with data, so make sure that question has been discussed with your legal or data privacy team before it comes up in the deal. When you are buying, the homework is yours: a vendor cannot supply your lawful basis for you. Either way, this is a question for legal early in the process, not after signature.

Want the source? Article 6 GDPR lists the six lawful bases.

What Does the GDPR Mean for Business Contracts?

Now the pieces come together.

GDPR Compliance for Business Contracts: Five Practical Steps

You do not need to turn every salesperson, procurement manager or founder into a privacy specialist. A small number of repeatable steps will prevent many of the problems that slow deals down:

1. Identify the personal data. Ask what information the service collects, stores, accesses or generates. Do this before someone assumes that a deal has no privacy impact.
2. Confirm the parties’ real roles. Decide who determines why and how the data is used, and who acts on instructions. Do not rely only on the labels in the contract.
3. Raise the paperwork early. If a DPA or international transfer mechanism may be needed, put it on the deal checklist at the start rather than introducing it just before signature.
4. Use approved documents and complete the details. Standard DPA and SCC documents solve only half the problem. The annexes still need an accurate description of the data, purpose, duration, security measures and sub-processors.
5. Create a clear route for exceptions. Let the commercial team handle recurring questions with approved guidance, while legal or privacy specialists focus on unusual data uses, high-risk information and non-standard transfers.

These steps will not remove every privacy question, but they take away much of the avoidable friction. The goal is to help commercial teams recognise the recurring issues, follow a workable process and know when specialist advice is actually needed.

The DPA and SCC Basics

Because personal data is defined broadly and many services process it, European law requires specific privacy paperwork in many commercial deals. Two documents appear particularly often:

• The DPA, the Data Processing Agreement: the contract Article 28 GDPR requires when a processor handles personal data on a controller’s behalf.
• The SCCs, the Standard Contractual Clauses: standard clauses that can provide a legal safeguard for sending personal data outside the EEA, for example to a US parent company or US cloud provider, when the applicable requirements are met.

These two documents are where deals slow down in practice, and they are each worth their own plain explanation. That is exactly what the next two articles in this series do: what a DPA is and why every deal has one, and what SCCs are and why you should never try to negotiate them.

This was the very basics, on purpose. If you understand personal data, processing, controller versus processor and lawful basis, the rest of this series will feel much easier.

At AMST Legal we help US and European companies get this right: understanding what the GDPR requires in their contracts, and building templates and processes so the privacy paperwork stops delaying deals. If the GDPR keeps showing up in your contracts and nobody has ever explained it properly, this series is for you, and we are happy to help with the rest.

Frequently Asked Questions: What Is the GDPR and How Does It Affect Business?

What Is the GDPR in Simple Terms?

The GDPR is the EU’s general law on how organisations may collect, use, store, share and delete personal data. It also gives individuals rights over their data and assigns responsibilities to controllers and processors.

Does the GDPR Apply to US Companies?

It can. The GDPR may apply to a US company that offers goods or services to people in the EU or monitors their behaviour there. A company does not always need an EU office to fall within its scope.

What Counts as Personal Data Under the GDPR?

Personal data is any information relating to an identified or identifiable person. It includes obvious details such as names and email addresses, but can also include IP addresses, user IDs, support tickets and information that identifies someone when combined.

What Is the Difference Between a Controller and a Processor?

The controller decides why and how personal data is used. The processor handles that data on the controller’s instructions. The real activity determines the role, not the label in the contract.

When Is a DPA Required Under the GDPR?

A DPA is required when a controller appoints a processor to process personal data on its behalf. Article 28 GDPR requires that relationship to be governed by a written contract containing specific terms.

Why Does the GDPR Matter for Business Contracts?

The GDPR determines which privacy documents, security obligations, data-use restrictions and international transfer terms a deal may need. If those points are raised late or described incorrectly, they can delay signature and create compliance risk.

by Robby Reggers

Ultimate Guide how ChatGPT, Perplexity and Claude use Your Data

AI Data use is at an all-time high and data privacy & confidentiality is incredibly important when using AI models. Before you add text or documents to AI Models, read below how and when these platforms might use your content. We also list what content to avoid adding to the models and why AI Policies can be incredibly helpful.

Recently, I had a discussion with a lawyer who shared full client documents, including detailed confidential information, with an AI tool. He was completely unaware that the data we feed into AI systems can be used by the model. That conversation made me realize something important: Not everyone knows how large language models (LLMs) like ChatGPT, Claude and Perplexity actually handle the content we provide.

This is why I wrote this article “Ultimate Guide how ChatGPT, Perplexity and Claude use Your Data”, showing when ChatGPT, Perplexity and Claude uses (or does not use) Your Data.

1. What we will cover:

• Why businesses, law firms, and other organizations need comprehensive AI policies
• How free and paid versions of ChatGPT differ
• How Claude and Perplexity compare in terms of data handling
• Why you should never share private or proprietary content

The below is an ongoing research project, comparing AI models. Please do not treat the below as legal advice. Always verify current policies to ensure compliance with your (organization’s) requirements – carefully review relevant documentation to understand if and how they might use your input to refine their algorithms.

2. What Are AI Models Learning From? Our Data!

It’s common knowledge that AI models, including ChatGPT, Claude, and Perplexity, are initially trained on large datasets (e.g., internet text, books, articles). However, many people don’t realize that these models can also learn from the additional content we submit. This includes for example when we’re asking them to:

• Analyze or summarize data (e.g., uploading sections of a contract)
• Write or edit an article (e.g., pasting confidential notes)
• Generate ideas or code (e.g., providing business-critical snippets)

Whenever you input text into these systems, it may be used – depending on the model and the plan you’re on – to further refine or train the AI. In this article, we’ll dig deeper into how various well-known models handle (or don’t handle) your content, so you can make more informed decisions when you’re working with sensitive data.

3. ChatGPT: Paid vs. Non-Paid Tiers

ChatGPT is currently the most widely used AI model – focusing on Chatbots / Generative AI. It is important to understand the difference between the paid and free models of OpenAI when focusing on data privacy, confidentiality and to answer the question whether Open AI uses your data to train their model.

Note: ChatGPT updated its terms in January 2026. Click the link to see our detailed article covering the changes of these terms: ChatGPT Terms of Service Explained for Businesses: Updated Terms

ChatGPT (Free)

Data Usage

Under the free model, OpenAI may use the content you provide to further train or refine the model. This means if you share potentially sensitive information, it could (in theory) be included in the AI’s training data. See the Terms of Use for OpenAI (Free) on this point – I add the relevant part relating to whether it will be able to use your Input in the image below.

Key Takeaway:

Be mindful of what you enter into the model. If it’s something you wouldn’t want to become part of the broader AI model or if it’s private, proprietary or personal, do not include it in your prompts. Also remember that it can be against the law to add certain content.

ChatGPT (Paid: Enterprise, API, and Other Business Solutions)

More Privacy

According to OpenAI’s Enterprise Terms of Use, customer content is not used to develop or improve the service. See the Business Terms for OpenAI (Paid) on this point. See image below – I add the relevant part whether it will be able to use your data.

Stronger Security

Enterprise clients typically get enhanced security measures, better data handling policies, and the option to opt out of data usage altogether.

Who Should Consider This: Those handling confidential documents, proprietary business processes, or sensitive client data. Lawyers, for instance, might prefer the enterprise offering if they frequently need to process large volumes of privileged information. However, we should note that it is not certain that this Input & Content is secure. Currently, until further notice we would still advice everyone – especially lawyers, doctors, government employees and other that have access to sensitive information not to add such information in the AI models.

-> Link to Opt-out

If you do not want your data contributing to AI model improvements, go to the following link to opt-out: https://lnkd.in/dVPcMfH8

4. Comparing Other AI Models: Claude and Perplexity

Next to ChatGPT there are many other AI models that are used. As we will handle Gemini next time, we will go into the details on Claude and Perplexity in this Article. The most popular AI model after ChatGPT is now Claude AI.

Claude (by Anthropic)

Focus on Safety

Claude is well-known for its emphasis on AI safety and ethical guidelines. However, terms regarding data usage can still allow the model to analyze or store user inputs for system improvement unless otherwise specified. See the Consumer Terms of Service of Claude on this point. See image below – I add the relevant part whether it will be able to use your data.

Paid Services

Anthropic offers enterprise solutions as well, which comes with a separate set of Commercial Terms containing stricter confidentiality and privacy protections. They have also added the following text in the Commercial Terms of Service: “Anthropic may not train models on Customer Content from paid Services“. Always check the most recent Terms of Service for precise details.

Update September 2025: Claude does train on all your data

From September 2025, Claude will train on all your data except if you opt out and in case you have a business account.

For more details, see the article here: Anthropic’s Claude AI Updates – Impact on Privacy & Confidentiality

Perplexity

• Research-Oriented: Perplexity is built around providing concise, sourced answers. It has been explained to me as more the “Google” way of searching in AI models. It has been said that Perplexity may not store or use data exactly like ChatGPT. However, the Terms of Service seem to indicate that Perplexity will use your Content – amongst others – for training purposes. See relevant part of Art. 6.4 (b) here: “Accordingly, by using the Service and uploading Your Content, you grant us a license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify Your Content to operate, improve, promote and provide the Services, including to reproduce, transmit, display, publish and distribute Output based on your Input. “ See image below – I add the relevant part whether it will be able to use your data.
• Enterprise Terms of Service: See these specific terms here. Enterprise customers do provide a license to Perplexity regarding their content. However, the following important wording is added: “Notwithstanding the foregoing, Perplexity does not and will not use Customer Content to train, retrain or improve Perplexity’s foundation models that generate Output.”

5. What Not to Upload to AI Tools

Whether you’re using ChatGPT, Claude, Perplexity, or any other AI platform, apply common sense and caution. Avoid sharing for example:

1. Confidential details (client, business or family member names, private letters, contracts & strategies).
2. Personally identifiable information (PII) (addresses, phone numbers, medical records).
3. Proprietary or business-critical data (unreleased products, prices, financials).
4. Sensitive materials (health info, internal memos, or business & personal).
5. Data protected by Applicable Law (copyright, illegal data, government data).

If you must work with potentially sensitive text, consider (a) anonymizing the data first, (b) using an enterprise-level AI solution where the Terms of Use prohibit using your content for model training or (ii) an ‘on-premise’ AI model that anonymizes data.

6. Why Organizations Need AI Policies

Many organizations still lack formal guidelines for using AI tools, leaving employees to guess what’s permissible. It is our understanding – and our worry also – that most employees don’t even realize or understand which data they should or should not add to the AI models. This is why we advocate for the wide use and deployment of AI Policies in companies.

Here’s why AI policies matter:

• Education & Awareness: Ensures everyone in your organization understands the risks and best practices when interacting with AI.
• Risk Management: A solid policy helps prevent data leaks and breaches of confidentiality.
• Compliance: Aligns your company or legal practice with industry regulations and local laws—a must for highly regulated sectors.
• Consistency: Establish uniform standards so that everyone, from interns to senior partners, uses AI responsibly and avoids costly mistakes.

Stay tuned: We’ll be writing a longer article soon detailing the key components of an effective AI policy, with real-world examples to guide your organization’s strategy.

7. Real-World AI Policy Examples

There has been a lot of discussion on whether it should be forbidden to use AI models for work – in some countries it is even forbidden for everyone. I believe that this is the wrong way of dealing with this technology that we will not be able to stop. We should embrace AI technology but be very mindful how to use it. See below two examples of courts and lawyer organizations that believe you should not ban AI, but embrace it with correct guardrails.

Florida Bar’s AI Policy

The Florida Bar issued Ethics Opinion 24-1 on January 19, 2024, providing guidance on the use of generative AI by Florida attorneys (source link: 16).

Key points include (source: 1) :

1. Lawyers may use generative AI in their practice, but must:
   • Protect client confidentiality
   • Provide accurate and competent services
   • Avoid improper billing practices
   • Comply with lawyer advertising restrictions
2. Attorneys must research AI programs’ policies on data retention, data sharing, and self-learning to maintain client confidentiality
3. Lawyers are responsible for their work product and must verify that AI use aligns with ethical obligations.
4. Informed client consent is recommended when using third-party AI programs that involve disclosure of confidential information.

Delaware Supreme Court’s AI Policy

The Delaware Supreme Court adopted an interim policy on October 21, 2024, governing the use of generative AI by judicial officers and court personnel (see full text here: 7). Key aspects (source: 11) include:

1. The policy allows the use of approved generative AI tools by judicial branch officers, employees, law clerks, interns, externs, and volunteers.
2. Users of AI remain responsible for the output and must ensure accuracy.
3. Training on AI capabilities and limitations is required before use.
4. AI should not influence judicial decisions or replace human judgment.
5. AI use must comply with existing laws and judicial branch policies.
6. Only approved AI tools are permitted on state technology resources.

Both policies aim to balance the benefits of AI in legal practice with ethical considerations and safeguards to protect client interests and maintain the integrity of the legal system. More and more courses are being offered for lawyers & judges explaining the risks and how to avoid them.

The above examples contains external information gathered from Perplexity – mentioning all sources used for the information shared. We have not verified the AI policies or the (latest information relating thereto) in detail at this moment.

8. Embrace AI—Responsibly

From streamlining legal tasks, writing articles to supporting creative brainstorming, generative AI offers enormous advantages. However, that conversation with the lawyer who unknowingly uploaded full client files to a free-tier AI tool reminds us that we to improve our understanding how AI models handle our data.

1. Read the Terms: Familiarize yourself with the data usage policies of each AI platform you use.
2. Choose Wisely: If data sensitivity is high, consider enterprise solutions or what we at this time advise most legal professionals: do not share sensitive data.
3. Use Caution: Always think twice before uploading potentially sensitive content.
4. Establish AI Policies: Protect your organization, employees, and clients by setting clear, enforceable guidelines.

Final Thoughts

AI is transforming the way we work – but it’s also transforming how data can move beyond our control. Actively keep track of how your content is used, whether you’re on the free or paid version of ChatGPT, Claude or Perplexity

The lesson? We need to stay informed, be cautious and be proactive. That way, you can use the power of AI without compromising your most sensitive information. Keep an eye out for our upcoming in-depth article on building AI policies that can guide you and your team toward ethical and secure usage of these exciting new technologies.

Disclaimer: This article is a research project, provides general information about AI data usage and does not constitute legal advice.

I wrote this article further to my post on LinkedIn on this subject. If you have any further questions about the above, contact me via lowa@amstlegal.com or set up a meeting directly here .

Here are more articles on this topic Anthropic’s Claude AI Updates – Impact on Privacy & Confidentiality, Italy fines OpenAI over ChatGPT privacy rules breach, User Privacy and Large Language Models: An Analysis of Frontier Developers’ Privacy Policies, Perplexity API Platform Privacy & Security

About AMST Legal

At AMST Legal, we specialize in helping businesses navigate the world of AI and SaaS contracts. We move beyond simple legal reviews to provide strategic advice on data privacy, sales & vendor negotiations and internal governance frameworks. Whether you need an emergency audit following a policy change, help securing enterprise-grade protections from AI vendors, or a fractional General Counsel to oversee your legal operations, we provide the expertise needed to enable responsible AI adoption. Contact us at info@amstlegal.com or book a meeting here to ensure your organization’s data remains a private commercial asset, not a public training set.

Author: Robby Reggers, Founder of AMST Legal (amstlegal.com), recognized by Legal Geek as a LinkedIn Top Voice for contracting, negotiation and interim GC work. Nominated for Dutch Independent Legal Award (DILA) in 2025 and 2026.

AMST Legal supports clients per contract/project or on an interim basis (set hours/week) for larger projects.

by Robby Reggers

The Best Way to Efficient Contract Redlining in Negotiations

Lately, there has been a discussions about the best way to redline a contract during negotiations. When redlining a contract, should you simply send an amended redlined Word document and move on? Answer: yes! Or should you adopt a more elaborate 6-step plan (including a pdf compare), as highlighted in various legal circles?

In this article ‘The Ultimate Guide to Efficient Contract Redlining in Negotiations’, you will find an in-depth look at how each contract redlining approach works. When we talk about contract redlining, we mean ‘𝘵𝘩𝘦 𝘱𝘳𝘰𝘤𝘦𝘴𝘴 𝘰𝘧 𝘦𝘥𝘪𝘵𝘪𝘯𝘨 𝘢 𝘤𝘰𝘯𝘵𝘳𝘢𝘤𝘵 𝘸𝘩𝘦𝘯 𝘯𝘦𝘨𝘰𝘵𝘪𝘢𝘵𝘪𝘯𝘨’.

I will also explain why we at AMST Legal believe continuing in one evolving redlined document (with occasional compares) is usually the most efficient, transparent and client-friendly method. We will also explore Nada Alnajafi’s (writer of the book Contract Redlining Etiquette) 10-step process so you can see precisely how an experienced contracts professional handles redlining from start to finish.

1. What We Will Cover

• Why the Debate? The origins of the 6-step approach vs. a single redlined doc
• Key Principles: Why you should use one document including all redlines.
• When (and How) to Use Compares: there is a good and not so good way to send out compare documents. See below what we recommend.
• When (and Why) to Avoid Extra PDFs: Why separate PDFs often add confusion. It also comes over as an aggressive negotiation tactic.
• Nada Alnajafi’s 10 Steps (Quoted in Full): A data-backed method for efficient redlining
• Final Takeaways: The balanced approach that works for most teams

2. Understanding the Debate

The Six-Step Approach vs. a Single Redline Document

As mentioned in my post on Linkedin on this subject, we noticed that in some legal circles, lawyers have embraced a 6-step process to handle contract edits. After they receive the new draft from the counterparty, they take the following steps:

1. Accept all changes in the document you receive from the counterparty you are negotiating with (your new “clean” version).
2. Compare old vs. this new draft to ensure that all changes compared to the previous version are visible.
3. Amend the new “clean” version (can be amended by one or multiple people in the same organization).
4. When finalized with adding comments & amendments, Compare again to show new changes to counterparty and to make the final check.
5. Save the fresh comparison as a PDF.
6. Send both the new “clean” doc (as amended) + the compare PDF.

For the avoidance of doubt, at AMST Legal we do not recommend this approach, except where agreed or desired by your client, customer or counterparty.

Advocates of this 6 step approach argue it helps manage large, complex deals – especially when multiple stakeholders are involved – by producing a neat record of only the latest changes.

Critics see it as time-consuming overkill that can inflate billable hours, make negotiations overly complicated and confuse counterparties who want to see comments and explanations in one place.

We have found that most:

In general, most legal professionals seem to prefer to stick with one progressive redlined document, continuously layering edits and resolving comments as issues are settled. This single-document approach is often more efficient for commercial & smaller deals or simpler contracts, and it preserves the full negotiation trail.

Origins of the 6-Step Approach

The more traditional “clean + PDF compare” method likely emerged when Microsoft Word’s Track Changes was buggy or unreliable in large documents. Many practitioners still worry about hidden edits or formatting issues – concerns that, at one time, were quite valid. Others claim that by resetting to a “clean” version each time, you reduce the clutter of multiple layers of color-coded changes and make it simpler for executives to see only newly introduced edits.

However, Word has significantly improved in comparing documents and most commercial legal professionals do not believe that separate software like Litera and Deltaview) is still necessary. Additionally, best practices between legal professionals have been developed and are widely in use that mitigate most of these issues. That’s why many in-house counsel and lean legal teams opt to remain in a single track-changed doc for efficiency.

3. Key Principles of Effective Contract Redlining

Efficiency

As also advocated by Nada Alnajafi here, in a commercial setting, it’s typically best to redline a single version of the contract. Next to adding explanatory comments, you accept or reject changes as you reach agreement, and layer any new edits into the same tracked document.

This approach:

• Reduces confusion by keeping one “source of truth.”
• Retains comments in context, showing how and why each change evolved.
• Saves time for your counterparties, who don’t have to juggle multiple files.

Transparency

Continuous redlining gives all parties a full view of the agreement’s evolution. Rather than delivering a “clean” Word doc that erases prior edits, you preserve the document’s story. This makes it easier for anyone (clients, internal teams, or external counsel) to see what has changed over time. Inline or ‘balloon’ (our preferred method) comments further ensure each party can understand the rationale behind edits.

Clarity

One of the top goals in contract negotiations should be clarity. When you present the counterparty (or internal stakeholders) with a single redlined version:

• They immediately identify recent changes.
• They can refer back to older, accepted edits if needed.
• They see important comments and open questions without having to hunt through separate documents.
• You can ask your internal stakeholders specific questions, which they can resolve in the same document.

4. When (and How) to Use Compares

Validate Your Changes Internally

Even if you prefer to continue in the same redlined doc, a document compare can still be incredibly valuable for quality control – especially in multi-stakeholder negotiations. What happens often in negotiations is that two lawyers lead the negotiation, but they ask input from various specialists like experts in data privacy, tax, data security, product, intellectual property etc.

Before circulating a “new” version externally, run a compare on your own to ensure you haven’t accidentally skipped anything or misapplied a request from the other side. This step helps catch:

• Missed revisions or hidden text changes.
• Accidental deletions or additions that no one noticed.
• Formatting or numbering issues that might cause confusion later.

Provide a Compare Alongside the Redline in Complex Deals

In more complicated deals where multiple stakeholders (e.g., finance, technical, local counsel in different jurisdictions) are editing the same draft:

1. Stick to One Master Redline – Everyone tracks changes in the central Word document.
2. Create a Compare Version (at Key Milestones) – If your CFO, the counterpart or external counsel only wants to see what’s new since the last milestone, you can provide a compare word file or PDF (as a matter of exception) in addition to the main redline.

Tip: Communicate why you take this extra step.

5. When (and Why) to Use or Avoid Extra PDFs

At first glance, PDF redlines can seem like old-school overkill. Why not stick to Word track changes? But in certain cases, like when working with large law firms or complex finance and corporate deals, PDFs are not only accepted but often expected.

Let’s dive into the “mobile-viewing” and “Locked Compare Can’t Be Accidentally Edited” rationale driving PDFs.

The Mobile-Viewing Argument

Some lawyers say they send PDFs because executives often review contracts on smartphones – and a PDF might be easier to read on mobile. While there’s some truth to that, it usually doesn’t justify an entire multi-step PDF approach for each iteration. Instead:

• Ask your client or opposing counsel if they truly need a PDF on every turn.
• If necessary, just export your tracked Word doc to PDF, maintaining comments and highlights.

A Locked Compare Can’t Be Accidentally Edited

Another reason some teams stick to PDFs is that a PDF compare can’t be inadvertently altered, unlike a Word-based compare that might be changed by mistake. To be honest, I have seen this happen more than once in a large negotiation with many parties involved.

This “locked” snapshot can be reassuring for large finance or corporate transactions—especially when multiple parties are scrutinizing each version. However, even this benefit doesn’t mean you need a separate PDF for every round of edits.

In most commercial negotiations, a single redlined Word doc plus occasional internal compares is enough. Extra PDF compares can be saved for big milestones or final checks.

Potential Downsides of Separate PDFs

We would not recommend this approach. There are simply to many reasons not to send out pdf compares. However, to bring this all together, hereby a list of potential downsides:

• Loss of Comments: Often, inline comments are not as interactive in PDFs. They do not work as well as comments in Word.
• Extra Steps: You spend more time saving, comparing, and formatting multiple files.
• Reduced Collaboration: PDFs limit the recipient’s ability to directly edit or reply in real time.
• Confusion: especially legal and business people (sales, executives, procurement, etc.) might be confused why separate documents are sent and questions arise which document to review or amend.

6. How Legal Tech and AI Can Simplify Redlining

A straightforward way to tackle many redlining headaches is to turn to Legal Tech – particularly Contract Lifecycle Management (CLM) platforms and AI-powered solutions. See our article about the use of CLM here (E-Signature Policy and Signing Authority Matrix: Why is That Important?).

See below a quick list how these tools can streamline your negotiation process:

Key Benefits of Modern Legal Tech

• Centralized Dashboard
  Keep contracts, edits, and comments in one place. No more searching for scattered files or wondering which version is current.
• Automated Workflows
  Easily ping the right teammates or approvers when it’s their turn. Once they’re done, their feedback is automatically saved and organized, cutting down on email clutter.
• Smart Document Comparison
  AI can quickly scan and highlight every edit between drafts, minimizing the risk of missing hidden changes or problematic clauses. This frees you to focus on actual deal issues rather than manual proofreading.

Bottom Line: by integrating CLM and AI into your redlining workflow, you’ll reduce manual effort, eliminate confusion, and speed up contract negotiations. This brings the team together to focus on what truly matters: reaching a solid, mutually beneficial agreement.

7. Nada Alnajafi’s 10 Steps for Transparent, Efficient Redlining

Nada Alnajafi (Founder of Contract Nerds), even wrote a book about this. I highly recommend reading the book ‘Contract Redlining Etiquette‘ about this subject.

She has identified the 10 key steps of redlining in this LinkedIn post. This framework is backed by data from thousands of contract professionals, not just personal preference:

Key Points

1. Start in Word: Open the counterparty’s redlines in Microsoft Word to keep everything in one editable format.
2. Get the Big Picture: Skim the draft from start to finish for an overview of the level of disagreement and the other side’s negotiation style.
3. Dive Deeper: Review the document thoroughly to identify areas needing attention, extra discussion, or stakeholder input.
4. Accept & Resolve: Accept any edits you agree with and resolve closed comment threads to keep the document uncluttered.
5. Reject & Propose: For edits you disagree with, reject the changes, propose new language, and add comments explaining your stance.
6. Ask Questions: Seek clarification for any unclear edits—better to ask now than to assume incorrectly.
7. Consult Stakeholders: For business or commercial changes, loop in your internal teams or relevant departments.
8. Summarize Top Issues: When sending your redlines back, highlight the most critical (no more than three) items in a short cover email.
9. Request a Call if Needed: If major disagreements persist or time is short, a quick conversation can resolve more than endless markup rounds.
10. Verify Before Signing: Run a single doc compare of the original draft vs. the final draft to confirm no hidden changes. Doing it more than once often adds unnecessary friction—especially in an in-house environment.

Nada’s final reminder is that one thorough compare is usually enough. If you repeatedly scrub redlines or generate “clean” versions out of fear or distrust, you risk delaying the process and frustrating everyone involved. For more contract redlining efficiency tips, be sure to check out her book Contract Redlining Etiquette and follow her on LinkedIn.

8. Final Takeaways

The Balanced Approach

1. Keep a Single Redline: Work in one main track-changed document, accepting or rejecting changes as deals progress.
2. Add Comments: Use inline comments to clarify reasoning or ask questions; this preserves context.
3. Run Your Own Compare: Internally verify major new versions against the prior version before sending.
4. Consider Sending a Compare: For complicated multi-stakeholder deals, provide a separate compare doc at key milestones, but don’t make it your default for every tweak.
5. Avoid Unnecessary PDFs: Unless it’s truly required or requested, do not to use the PDF-based workflow.
6. Use Legal Tech & AI: If you’re dealing with many contracts or looking to scale your process, consider specialized tools that streamline workflows.
7. Meet in Person: For overly complex or stalled negotiations, a face-to-face (or online) meeting often resolves issues faster than endless redlining.

Why It Matters

• Client-Focused: Clients want clarity, results, and efficiency. They do not want to pay for avoidable drafting detours.
• Reduces Errors: A single doc plus strategic compares minimizes the risk of losing track of changes.
• Saves Time: Keeping everyone focused on one version speeds up reviews and shortens negotiation cycles.

Next Steps

• Move away from the complicated 6-step approach and adopt a single, continuously updated redline with occasional compares.
• For more complex deals, use a hybrid approach: keep a master redline, but generate compare outputs or lists of last outstanding high level issues at critical moments in the negotiation.
• Invest in training: Ensure your team is comfortable with Word’s Track Changes, Comments, and Compare features so that everyone contributes to a smooth, transparent workflow.

9. Ready to Streamline Your Redlining?

Contract negotiations do not have to be a complicated (e.g. by using multiple PDFs and “clean” Word files).

By adopting a continuous redline strategy – with optional compares as needed – and communicating expectations from the start, you will improve transparency, reduce costly errors and keep your clients or business stakeholders happy. Whether it’s an NDA, SaaS agreement or a complex M&A transaction, focusing on one document as your “source of truth” can make all the difference.

Need help? Contact me here or send an email to info@amstlegal.com to discuss better ways to redline and negotiate your contracts.

by Robby Reggers

Unlock Contract Efficiency with a Simple Audit of Your Templates

Introduction

Companies often wonder why they should regularly audit their contract templates. This practice, which we implement regularly, often reveals a goldmine of opportunities for streamlining and improving efficiency of contract flows.

When a client approached us to improve its template customer contract, our first step was to conduct a thorough audit of all the contract templates in use. For instance, in one case, we were able to merge 12 separate templates into a single, standardized template applicable across all countries. In other cases, we’ve found multiple templates for different products or specific templates for government-funded versus non-subsidized projects. These findings underscore a crucial step: before improving your templates, it’s essential to first inventory what templates are in use. Only then can you effectively create or refine your templates for maximum efficiency.

1. The Necessity of Regular Contract Template Audits

Contract templates form the foundation of your business agreements, defining the terms and conditions of your relationships with customers, vendors, and partners. Over time, without regular oversight, these templates will (i) be amended in the organisation – often new templates emerge – without knowledge of management and Legal and (ii) be incomplete due to change in laws and products sold, leading to inconsistencies and legal vulnerabilities. A regular audit helps you:

• Risk mitigation and compliance updates
• Maintaining legal efficiency
• Identifying and eliminating redundancies
• Ensuring consistency across all agreements
• Enhancing negotiation speed and effectiveness
• Reducing legal disputes and misunderstandings
• Standardizing terms and conditions
• Keeping templates up-to-date with current laws and regulations
• Uncovering unauthorized or outdated templates
• Improving overall business relationships through clear and fair agreements

2. Steps to Conduct an Effective Contract Template Inventory

a. Gather Information from All Departments

Your legal department might not be aware of every template in use. Engage with various business units—such as Sales, Partnerships, Procurement, and HR—to gather a comprehensive list. Ask them to provide the exact templates they use daily to ensure accuracy.

b. Categorize Templates

Once collected, categorize the templates by:

• Type of Agreement: Customer, vendor, or partner agreements.
• Product/Service: Specific templates for different offerings.
• Geography: Templates used in different countries or regions.
• Language: Versions in different languages.
• Department: Templates specific to various business units.
• Special Conditions: Templates for specific situations, like government-funded projects versus non-subsidized ones.

c. Evaluate and Standardize

Review each template to identify discrepancies and outdated clauses. Standardize the language and format to ensure consistency across all agreements. This process not only reduces errors but also improves the clarity and enforceability of your contracts.

3. Addressing Common Issues in Customer, Vendor, and Partner Agreements

a. Customer Agreements

• Scope of Services: Ensure a clear description of the services or products provided.
• Payment Terms: Standardize payment schedules and terms.
• Liability Clauses: Update liability and warranty clauses to reflect current business practices and legal standards.

b. Vendor/Procurement Contracts

• Quality and Delivery Terms: Standardize terms related to quality control and delivery schedules.
• Compliance: Ensure all vendor contracts comply with relevant laws and regulations.
• Payment Terms: Regularize payment structures and terms to avoid discrepancies.

c. Partner Agreements

• Roles and Responsibilities: Clearly define the roles and responsibilities of each party.
• Profit Sharing: Standardize profit-sharing mechanisms.
• Exit Strategies: Include clear exit strategies to handle potential dissolution scenarios.

4. Uncovering Unauthorized Templates

During your audit, it’s not uncommon to discover templates in use that the legal or management teams were unaware of. These unauthorized templates, often created without prior approval, can pose significant risks. Identifying and rectifying these situations is crucial to maintaining legal and operational integrity. Ensure that all templates are vetted and approved to align with your company’s standards and legal requirements.

5. Benefits of a Well-Organized Contract Template Inventory

Maintaining an organized inventory of your contract templates offers several benefits:

• Improved Negotiation Speed: With standardized templates, negotiations become quicker and more efficient.
• Reduced Legal Risks: Consistent templates minimize the risk of legal disputes.
• Enhanced Business Relationships: Clear and fair agreements foster stronger business relationships.

Conclusion

Regularly auditing and organizing your contract templates is a crucial step in enhancing your business’s legal efficiency. By taking the time to inventory, evaluate, and standardize your agreements, you can streamline your processes, reduce risks, and build stronger, more transparent business relationships.

For more detailed insights and personalized advice, feel free to contact us or schedule a consultation.

by Robby Reggers

How to Improve Your Negotiation – 7 Best Negotiation Books

7 Great Books to start with when you want to improve your Negotiation style. You will absolutely see that you will be a better negotiator if you apply the lessons mentioned in these books.

by Robby Reggers

Förklaring av NDAs – Vad du behöver veta (del 1) 

Förklaring av NDAs – Vad du behöver veta (del 1)

I den konkurrenskraftiga affärsvärlden där idéer, innovationer, finansiell information och hemligheter är framgångsnycklarna, spelar Non-Disclosure Agreements (NDAs) ofta en viktig roll i att skydda ett företags konfidentiella information. NDA säkerställer att den konfidentiella informationen endast används för det specificerade ändamålet som parterna i en affärsrelation avtalat om. Denna artikel kommer att ge en omfattande översikt av NDA i sammanhanget Business to Business (B2B). 

Vad är ett NDA? 

Ett NDA, även kallat sekretessavtal, är ett juridiskt bindande avtal mellan två eller flera parter med syfte att skydda konfidentiell information som kan komma att delas under tiden av deras affärsrelation. Mer specifikt är företags konfidentiella information icke-offentlig information som skulle kunna skada företaget om det skulle offentliggöras. Vanligtvis inkluderas en lista över den konfidentiella informationen i avtalet. Det kan innehålla exempelvis affärshemligheter, know-how, produkt- och teknikrelaterad information, rabatter, kundlistor, försäljnings- och finansiell information, affärsplaner etc. 

Varför och när behöver vi ett NDA? 

I B2B-sammanhang kan NDA vara ett väsentligt verktyg för att skydda affärshemligheter och annan konfidentiell information som är viktig för ett företag för att bibehålla dess konkurrensfördelar. Denna känsliga information bör därför definieras tydligt och noggrant i NDA. Var däremot försiktig med att inte definiera det för snävt för att säkerställa att du inte har missat en viktig kategori. Genom användande av ett korrekt utformat NDA kan ditt företag skydda värdefull information från konkurrenter eller tredjeparter som kan dra nytta av att sådan information avslöjas. 

Primärt syfte 

Det primära syftet med ett NDA är att säkerställa att den avslöjade känsliga informationen används och hanteras säkert, vilket förhindrar en avslöjande part att använda eller röja informationen utan vederbörligt tillstånd och behörighet. Ett NDA undertecknas ofta i början av en affärsrelation innan man går in i affärsrelationen. 

Exempel 

Vanligt exempel: Ett teknikföretag planerar att sälja och erbjuda specialiserade programvarulösningar till en företagskund. Företagen börjar med att diskutera hur man integrerar programvaran i kundens system för att fastställa priset för integrationen och användningen av programvaran. För detta kan teknikföretaget dela insyn om sin prissättning, SLA, policys och programvara, och kunden kan i sin tur förklara sina utmaningar och dela affärsplaner. När företagen gör detta planerar de således att dela dokument, inklusive icke-offentliga sådana, det vill säga konfidentiell information. Därför rekommenderas det att sådana företag skriver under ett NDA innan de delar sådan konfidentiell information sinsemellan. Ett sådant NDA kan sägas upp när parterna undertecknar ett slutligt kundavtal, vilket också bör inkludera sekretessvillkor. 

Hur skyddar ett NDA din konfidentiella information? 

Precis som för vilket annat juridiskt avtal som helst, medför avtalsbrott av ett NDA rättsliga konsekvenser. Beroende på avtalsbrottets allvar kan konsekvenserna sträcka sig från rättsprocesser och ekonomiska påföljder till åtal i extremfall. Avtalsbrott avseende ett NDA kan också skada en parts renommé, vilket kan leda till andra långvariga konsekvenser för dess affärsverksamhet, särskilt i affärsrelationer och i branscher där förtroende och sekretess är avgörande. Rättsliga anspråk och stämningar rörande avtalsbrott av ett NDA hör inte till vanligheten, men det händer definitivt att ett företag behöver betala vite för avtalsbrott. Vi har även gett rådgivning några gånger tidigare i denna fråga. 

Vilken slags NDA behöver du? 

Det finns olika typer av NDA som kan användas baserat på de specifika omständigheterna och de involverade parternas behov. Nedan listas de tre vanligaste typerna: 

1. Unilateralt NDA (Ensidigt NDA): I ett ensidigt NDA ålägger en part, vanligtvis säljaren, den andra parten skyldigheten att säkra informationen och inte avslöja eller använda informationen för något annat syfte än det som specificerats i avtalet. I ett B2B-sammanhang, används ensidiga NDA ofta mellan köpare och säljare. Exempelvis kan ett bioteknikföretag (säljare) använda ett ensidigt NDA för att förhindra köparen från att avslöja känslig information de har fått vid köp av produkter eller tjänster såsom immateriella rättigheter och datorteknologi. Det är även vanligt i offentliga upphandlingar och för RFI (Request for information) vid RFP (Request for Price) situationer.   

2. Gemensamt NDA (tvåsidigt eller ömsesidigt NDA): Ett ömsesidigt NDA involverar två parter där båda parter kommer att dela känslig information med varandra och kommer ömsesidigt överens om att båda parter blir bundna av tystnadsplikt. Ömsesidiga NDA används ofta när parter behöver utbyta betydande mängder av konfidentiell information under sina förhandlingar eller affärsrelationer. Sådana situationer kan vara joint ventures, leverantörsavtal eller företagsförvärv. 

3. Multilateralt NDA (tre- eller flerparts NDA): Ett multilateralt NDA inkluderar tre eller fler parter, där åtminstone en part delar känslig information med andra parter och genomdriver tystnadsplikt. Den här typen av NDA förenklar pappersarbetet och administrationen för parterna på så sätt att parterna inte behöver ingå flertalet ensidiga eller bilaterala NDA med varandra. I en affärsrelation som involverar tre parter, där alla förväntar sig att avslöja konfidentiell information, kan ett enda multilateralt NDA ersätta behovet av tre olika bilaterala NDA mellan varje partspar. Sådana situationer kan vara partnerskap, regeringskontrakt (såsom försvars- och rymdfartskontrakt) och konsortieavtal. 

by Robby Reggers

NDA’s Explained – What You Need to Know (Part 2)

Four Key Components of NDAs

by Robby Reggers

Contract Management: Two Simple Tips to Optimize Your Contract Templates

Introduction: Understanding Contract Optimization

In today’s business environment, efficiency and clarity in contract management are more crucial than ever. One question we frequently encounter is, “What exactly is Contract Optimization Advice?” This concept might seem intricate at first glance, but it’s fundamentally about streamlining your contract processes to save time, reduce errors, and ensure legal compliance. Let me illustrate this with a straightforward example from our recent advisory work.

The Challenge: Streamlining Contract Processes for Enhanced Efficiency

A client approached us with a common yet complex challenge. They had two separate (fairly long) customer contracts in use, signed approximately 100 times each year. These contracts were:

1. A standard customer contract for clients not receiving subsidies or government funding.
2. A standard customer contract for clients that do receive such financial support.

They asked us to improve the wording of the contract, ensuring that companies signing the contracts understood the contracts sufficiently, avoiding legal jargon where possible. Additionally, they asked to advise them how to amend the contract in such a way that processes would be more efficient. Most importantly, we would of course focus on lowering the risks for the company, where reasonably possible.

Both contracts included a pricing annex, which was subject to regular updates.

Our Approach: Simplification and Innovation

After a brief introductory call with the client and a review of the contracts, we proposed a straightforward yet innovative solution. Our advice focused on two initial key changes which we already proposed without going into the details of the full contracts.

• Consolidation into One Contract: We recommended merging the two contracts into a single document with a distinct annex for subsidy or funding conditions. This approach not only simplifies the contract management process but also ensures that all customers are subject to the same core terms and conditions, promoting fairness and transparency.
• Digital Pricing Updates: To address the challenge of the frequently updated pricing annex, we suggested adding a link to the pricing information on the company’s website. This allows for real-time updates to be made accessible immediately after notifying customers, thereby significantly reducing administrative burdens and enhancing operational efficiency.

The Impact: A Smoother Path to Business Success

Our client implemented these changes and observed a noticeable improvement in their contract negotiation times and overall legal process efficiency. More importantly, this optimization made their business operations smoother and their customers happier by providing clearer, more accessible contract terms.

Conclusion: Let Us Simplify Your Contractual Challenges

Contract optimization is more than a service; it’s a pathway to enhancing your business’s operational efficiency and customer satisfaction. By embracing simplicity and leveraging technology, we can help you navigate the complexities of contract management with ease.

Are you ready to streamline your contract processes and make your business life easier? Contact us for tailored contract optimization advice. Book an appointment with us to discuss possibilities for your company.

Tags: #AMSTLegal #ImproveYourContracts #ImproveYourTemplates #Negotiation #ContractLaw #LegalEfficiency #Legal #CommercialContracts

by Robby Reggers

How to improve your Contract Processes with Better Cooperation

Legal should focus on Better Cross-Departmental Cooperation

As we have highlighted in previous posts, it takes leadership and a team to improve your contract templates. Once Legal has taken the lead and the centralized responsibility to improve the contract templates, the next step is to involve and work together on this goal with other departments. The creation and use alone of contract templates will only offer limited benefits This is not only essential to receive all required input for the contract templates, but also for a successful implementation of the contract templates.

Legal professionals often limit their interactions to their Legal colleagues or senior management when creating and implementing contract templates or negotiating contracts. This limitation, while understandable, can lead to contract templates and agreed contracts that are legally sound but are missing critical business insights.

Additionally, as mentioned above, the complexity, inaccuracy and lack of processes will lead to the use of unauthorized or outdated templates and excessive Legal Review due to lack of internal processes and support from other departments.

Insight Integration: A Collective Approach on Template Creation

Therefore, aligning contract templates with the practical realities of the business is essential. Departments such as Sales, Products, Finance and Compliance offer invaluable insights on commercial and financial risks, practical considerations and the specificities of products or services offered by the company.

This input ensures that the contract templates are not only legally robust, but also fit in the commercial roadmap of the company and cover all other company risks (e.g. technical, compliance, operational and financial).

Another important reason to involve these departments in the drafting process of the templates is to create a sense of ownership and support from these stakeholders. When departments contribute in the development of the standardized contract templates of a company, they are more likely to endorse and actually use the templates. This collaborative approach not only enhances the quality and relevance of the contract templates but also ensures their acceptance and utilization across the organization, ultimately leading to smoother operations and reduced risks.

Enhancing Cross-Departmental Collaboration – Improve Communication & Cooperation

Legal´s role in improving the communication and cooperation with the rest of the company cannot be understated. Regular, strategic meetings between Legal and other departments are essential to set the stage for a more integrated and efficient approach to contract management of the company.

These discussions should focus on:

a) Strategic Alignment

First, Legal needs to clearly communicate its short and long term intended contract optimization strategy to all departments. Secondly, these departments should share their strategy and specific requirements and contributions to the contract process and templates. This will give Legal the opportunity to create and roll-out the best strategy to improve the Company´s contract processes and templates.

b) Issue Identification and Resolution

Facilitating an open dialogue where Legal and all other departments can highlight challenges encountered with current templates and collaboratively develop solutions to streamline cooperation and reduce operational burdens.

c) Training and Involvement

Initiating internal workshops to educate teams on optimal contract template usage, Legal engagement policies, while encouraging feedback and suggestions for improvements to ensure templates remain relevant and effective.

d) Proactive Communication

Discussing the optimization of the empowerment of the commercial teams, meaning that all relevant contract-related documents and information are proactively shared with customers and partners by the Sales, Partnerships and Procurement teams.

Results Better Cooperation and Communication

This will greatly minimize the workload of Legal and maximize their output due to a decreased need of Legal clarifications and Legal involvement in negotiations. The importance of regular, inclusive meetings and training sessions cannot be overstated. When planning, it is essential to engage every layer of the organization, from grassroots employees to top management, in strategic discussions and trainings.

These sessions serve as a cornerstone for aligning strategies, creating an environment where all team members are equipped with the knowledge and skills to navigate the complexities of the contract optimization process and their roles effectively.

By maintaining a consistent schedule of these critical discussions and training, organizations can avoid the pitfalls of reactionary measures during peak periods of activity. Instead, a well-informed and strategically aligned team will be ready to handle the demands of the business efficiently, ensuring continuity and resilience in the face of challenges.

by Robby Reggers

Contract Negotiations: How to Avoid Negative Reactions in Redlines and Mark-ups

𝗤𝘂𝗶𝗰𝗸 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁 𝗡𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻 𝗧𝗶𝗽 𝗼𝗳 𝘁𝗵𝗲 𝗗𝗮𝘆: When reacting to a comment or suggested wording by a counterparty that is commenting on your contract, 𝘢𝘷𝘰𝘪𝘥 using negative language like:

“Adding this wording in the Article is incorrect because it has already been covered in Art. 12.”

Instead, try saying:

“Thank you for your comment. I agree with your addition. Please note that we have already covered this in Art. 12.”

Additionally, for important subjects, you can add:

“If you do not agree with this wording, please let me know”; and/or

“Please let me know if you would like to discuss this topic during our next meeting”.

As we know, during contract negotiations, it’s important to maintain a cooperative relationship with the other party. Remember, the counterparty is also just doing their job and you are working together to reach a mutually advantageous outcome.

By using positive language in your reactions to comments, you can help keep negotiations running smoothly and maintain a good relationship with the counterparty.

For a bit more background on The Importance of a Relationship in Negotiations, please see the following article on the Harvard website.

See our original post on this subject on LinkedIn

#ContractNegotiations #HowtoNegotiateBetter #ContractLaw #AMSTLegal #contracts #negotiation #negotiationskills #relationshipbuilding