Before You Point an AI Assistant at Your Contracts: The Seven Fields to Structure First (and the Guardrails)
Enterprise blogs say contracts should be the "source of truth" for AI agents. For an Indian SME the question is simpler: which contract fields to structure first so an AI assistant can send renewal reminders, check vendor payments and flag deviations without inventing anything. A practical guide with governance points.
An AI assistant can read a contract and tell you when it renews. It can also read a contract and confidently tell you the wrong date. The difference is whether the facts the assistant acts on come from structured, reviewed data or from its reading of a PDF at the moment you asked. This guide sets out the minimum structure an Indian mid-market company should put in place before using AI for contract tasks, the tasks that then become safe, and the governance that applies. Position as of October 2026.
The seven fields
Extract these for every live contract, review them once, and store them as data:
- Parties and signatories, with the counterparty's legal name and, where relevant, its MSE registration number.
- Term and renewal: start date, expiry, auto-renewal flag, notice window, price-revision mechanism.
- Payment terms: due days, milestones, the MSMED 45-day cap where the counterparty is a micro or small enterprise (section 15, MSMED Act, 2006), and the 180-day GST input-credit rule (second proviso to section 16(2), CGST Act, 2017).
- Obligations and SLAs: dated or measurable duties with the internal owner.
- Risk clauses: limitation of liability (cap and carve-outs), indemnities, termination rights, exclusivity, non-compete (and whether it runs post-term, which section 27 of the Indian Contract Act, 1872 generally voids).
- Data processing: whether personal data is processed, by whom, where it is hosted, breach-notification window, erasure duty (sections 8(2), 8(5), 8(7), DPDP Act, 2023).
- Approval and deviation history: who approved what, and which clauses deviate from your template.
Tasks that become safe once the fields exist
- Renewal reminders at notice-window minus 45 days, to the owner and a backup.
- Vendor payment checks: flag invoices from MSE suppliers approaching day 45, and any supplier unpaid at day 150 (before the 180-day GST reversal).
- Deviation flags on incoming drafts: "this MSA caps liability at three months' fees; our standard is twelve".
- Portfolio questions: "which contracts contain a data-processing clause", "which expire in Q1", "which customers have termination for convenience".
- Drafting from templates with variables filled from intake data, for human review.
Tasks that stay with a human
- Deciding whether to accept a deviation.
- Signing anything.
- Sending a legal notice or a termination.
- Interpreting an ambiguous clause for a dispute.
The rule: the assistant proposes, the owner disposes, and the structured field, not the assistant's reading, is the system of record.
Governance points that apply in India
Personal data. If the assistant processes contracts containing personal data (employee contracts, customer agreements with individuals), the AI vendor is your Data Processor under section 8(2) of the DPDP Act, 2023; you need a processing contract with the safeguards in rule 6 of the DPDP Rules, 2025, and the vendor must support your 72-hour breach report under rule 7 (from 13 May 2027). Check where prompts and documents are stored and whether they are used to train models.
Security. The assistant's provider is within scope of CERT-In's 2022 Directions if it provides services in India (six-hour incident reporting, 180-day logs). Confirm in the contract.
Regulated entities. For banks and NBFCs, an AI contract tool is an IT outsourcing arrangement under RBI's 2025 outsourcing Directions, with the agreement-content requirements of paragraph 69 (audit rights, data storage in India where applicable, incident reporting, exit). The RBI has also signalled expectations on AI governance for regulated entities through its 2025 committee work on a framework for responsible AI in the financial sector. ****
National guidance. MeitY released the India AI Governance Guidelines on 5 November 2025 as "a foundational reference for policymakers, researchers, and industry", built around seven guiding principles including "Do No Harm", with the stated approach of using existing legislation where possible. They are a reference, not a licensing regime; the obligations that bind you are the DPDP Act, the IT Act and sector directions.
A 30-day starting plan
- Week 1: pick the 25 highest-value live contracts; extract the seven fields; review.
- Week 2: set up renewal and payment alerts from the fields.
- Week 3: run deviation checks on the next five incoming drafts; compare the assistant's flags with legal's view.
- Week 4: decide what to extend, and paper the AI vendor as a processor.
Where Legatio fits. Legatio captures the seven fields at intake and signature, holds them as structured data against each contract, and runs the reminder and deviation tasks on that data rather than on free-text reading. Which tasks to automate, and the governance, are your decisions.
Position stated as of October 2026. General information, not legal advice.