Case study · OCT 2026
Contract review AI service for a supplier
2.5 min
to analyse a typical contract; the protocol takes seconds
₽10–20
per 20-page contract with Claude Sonnet, October 2026 prices
- Problem
- Buyers send the supplier contracts drawn up in their own favour: uncapped penalties, deductions from payment, the right to walk away without paying for goods already made. Each one has to be read and answered with a protocol of disagreements.
- Solution
- Built a web service: a manager uploads the contract, and AI finds the risks for the supplier, explains them in plain words and proposes new wording for the clauses.
- Result
- A contract is analysed in minutes, and the protocol of disagreements comes out in Word and PDF, with the signature and stamp, at the press of a button. From the brief to a working system on the server took about a week.
Risks show up at once, next to the contract text
At the top is the verdict: whether the contract can be signed as it stands and what to fix first. Below are the risks in order of weight: what each one threatens the supplier with, in plain words, and what wording the clause needs instead. The clause in question is highlighted in the contract text, so every finding is easy to check. Questions for a lawyer or a finance person are listed separately.
How it was donecollapse
The model answers against a strict JSON schema (structured outputs): risks, deal-breakers, new wording, obligations and deadlines, contradictions, missing annexes, questions for specialists. If an answer breaks the schema, the system asks the model once more and attaches the list of errors.
Every quote is checked against the contract text: first exactly, then fuzzily (rapidfuzz). Clause numbers and references to annexes are checked against the document’s markup. If a quote isn’t in the contract, the risk is flagged, so the model can’t quietly “invent” a clause.
To the model the contract is data, not instructions: the fixed part of the prompt says so, and the administrator’s prompt can’t change it.
— open full size
The protocol of disagreements is one click away
A protocol of disagreements is the supplier’s answer to the buyer: the buyer’s wording on the left, the supplier’s new wording on the right. It is built from the risks; the manager sees the document as the buyer will, edits the rows and their order, and the edits save themselves. The finished protocol downloads as Word or PDF, with or without the signature and stamp.
How it was donecollapse
The protocol is a proper business document: landscape A4, the table header repeats on every page, and the column widths are fixed so Word and PDF don’t drift apart. The wording comes from a template with placeholders that the administrator edits.
The signature and stamp are floating images above the signature line. A scan gets a transparent background instead of white, and the stamp is turned slightly and made translucent so the text under it stays readable.
LibreOffice builds the PDF from the same docx, and Liberation Serif has the same metrics as Times New Roman, so the PDF matches Word page for page.
— open full size
— open full size
Any contract goes in, even a scan
The manager uploads whatever the buyer sent: Word, RTF, PDF or a scan. The system finds the supplier’s side in the contract on its own and checks its details against the company card: tax and registration numbers, bank accounts, phone numbers, addresses. A typo in an account number won’t slip through, and this check needs no AI at all.
How it was donecollapse
A docx is parsed straight from its XML, with the automatic numbering restored the way Word shows it: otherwise the clause numbers in the analysis would drift from the document. LibreOffice converts doc and rtf to docx.
pdfplumber reads PDFs with a text layer, and Tesseract recognises scans. Tables with ruled lines are read cell by cell: the lines are found in the image and each cell is recognised separately, so the two parties’ columns of details don’t get mixed up.
The details check uses no AI: numbers are compared exactly, phone numbers by their last 10 digits, and addresses fuzzily, though every number in them must match.
— open full size
The same service works from a phone
There is no separate mobile version: the same interface rearranges itself for a narrow screen. The list of reviews, the risks with the contract text in a bottom sheet, and the protocol with Word and PDF buttons all work from a phone.
How it was donecollapse
Two width breakpoints, 768 and 992 px, switch the layout on top of the Ant Design grid. On a phone the protocol rows become cards, the contract text moves into a bottom sheet, and input fields use 16 px type — otherwise Safari on an iPhone would zoom the page.
— open full size
The company sets the review rules itself
The company decides what to look for in a contract: the administrator adds its positions to the prompt — deadlines, penalty caps, jurisdiction — with no developer involved. The quality of the analysis depends on those positions and on the model. The model is chosen in the same place: if contracts mustn’t leave the country, the analysis runs only on servers in Russia.
How it was donecollapse
The prompt has versions with an author and a comment, a line-by-line diff, rollback and a trial run of a draft on a contract before saving. The answer format is set by the fixed part of the prompt, so editing the prompt can’t break it.
Three kinds of connection. An OpenAI-compatible API: RouterAI with its “Russian servers only” mode for Russia’s personal data law (152-FZ), OpenRouter, OpenAI, local Ollama and vLLM. The Anthropic API: streamed answers, a strict schema, prompt caching. Codex CLI on a ChatGPT subscription, signed in with a device code straight from the admin panel.
The cost is known up front: at RouterAI’s prices of 16 October 2026, analysing a 20-page contract with Claude Sonnet costs ₽10–20, and the tokens and cost of every analysis go into the activity log.
Company details, the signature and stamp, the protocol template and limits are set in the admin panel too, and all the settings move to another machine as one file.
— open full size
Contracts don’t linger in the system
The contract file is deleted right after it is read, and the whole review 24 hours after the last action on it. Contract texts never reach the logs or the backups, so the commercial terms and the counterparties’ personal data don’t pile up on the server.
How it was donecollapse
A test runs a contract through the whole path with DEBUG logging and checks that none of its text reaches the logs; a run in Docker with a real model confirmed the same. Reviews aren’t in the backups at all.
Backups are encrypted with an age public key, and the private key stays with the owner; on the server the data sits on an encrypted disk (LUKS). Passwords are stored as Argon2 hashes and API keys encrypted, sign-in attempts are limited, every request that changes data is protected from CSRF, and the interface has a strict CSP.
How it was built
I worked with Claude Code: I kept the architecture and sign-off, the agent wrote the routine code, and every result went through automated tests and review. That is how one person covered the whole cycle — from the brief and questions to the client to deployment, server hardening and documentation — and the working system was on the server a week after the brief. The code is open under the MIT licence: github.com/
Got a similar problem? Describe it and I’ll suggest where to start.
Message me on Telegram