A corporate lawyer receives a new revision of a long contract. The information system has already handled the routine: it knows the document number, the contract value, the responsible manager and the approval route. But the main work is still the specialist’s. They have to read through the changes, compare them with the previous revision and judge whether the text now hides new obligations or risks for the company.
This is exactly where generative AI is most useful in practice. A language model does not replace the person; it prepares the material for their decision.
The same principle works across very different enterprise systems:
- in a register of citizen or customer requests, the assistant sums up the letter and its attachments;
- in a case management system, it rebuilds the timeline of events from dozens of scattered documents;
- in an internal knowledge base, it finds the relevant clauses of regulations and explains how they apply to the situation at hand.
Adoption starts with a simple question: which routine task takes up most of an expensive expert’s time, and what exactly should they get as a result?
Split the work between code, model and person
To keep AI from becoming a black box, the functions in the system have to be clearly separated.
For a contract it works like this. Deterministic code finds the exact fragments of text that changed. The language model explains what the change means: the payment term is still 30 days, but it now runs from the signing of the acceptance certificate rather than from the signing of the contract. The interface shows both clauses side by side. The lawyer checks the explanation and decides within the usual business process.
Payment within 30 days of signing the contract.
Payment within 30 days of signing the acceptance certificate.
Build the assistant into the working screen
Do not create a separate chat with a bot where users paste context by hand. The assistant should work where the specialist already has the document open.
Choose sources by access rights. The server first checks the user’s rights, picks the current revisions of documents and builds the smallest context needed. The search index is filtered by access rights as well.
Set a strict response format. The model returns a conclusion, a link to the source and an explanation if data is missing. Code checks that the source really was part of the set it was given.
Tie the result to a document version. If the document has been updated, the interface shows which version the AI analysed. If the model service is temporarily unavailable, the specialist carries on manually.
Run every action through the product’s rules. Any conclusion or suggested comment goes through the standard validation and audit mechanisms. AI only prepares a draft, which a person must check.
Treat source text as data. A document or email may contain instructions intended to divert the assistant. The server defines the task and allowed actions. Saving changes or sending information requires the normal access checks and user confirmation. OWASP guidance on prompt injection.
Local or cloud model: the choice depends on data security
Which engine to use is decided by the security policy and the nature of the data.
A local model is needed when information may only be processed inside the organisation’s perimeter, for example when analysing internal investigations or HR documents. Here the whole chain matters: scan recognition, the search index, the load on the model, audit logs and secure storage of results. A pilot must measure quality on the organisation’s own data and response speed when the whole team uses the system at once.
A cloud model via API suits public or non-sensitive tasks, for example analysing tender documents from open sources. A security gateway strips unnecessary context and controls access to external APIs, while the team records the provider’s legal terms for data storage.
Modern platforms, including UnityBase, let you combine both approaches. A server method of the application applies the organisation’s rules to decide where a request goes: to the local environment or to an approved cloud service. The server applies the policy to the entire request, including the question, attachments, templates and notes. A public tender document accompanied by an internal bidding strategy must follow the rules for the most sensitive material.
inside the organisation’s perimeter
through a security gateway
Measure the benefit on the specialist’s real tasks
A good scenario for a first pilot is reviewing changes in contracts. Ask lawyers to identify material changes in advance, then compare ordinary review with assisted review on comparable contracts. Include the time spent correcting the draft and record false findings as well as omissions. Measure:
- the total time from receiving a document to a checked decision;
- the number of significant risks missed;
- the accuracy of source references and the number of corrections the specialist makes to the generated text.
The test of success is simple: the specialist spends less time hunting for routine details, can easily check every statement against its sources and gets enough verified information to make their own professional decision.