Risk Flagging (per Clause)
When to use this
Use as a first-pass risk scan on any commercial contract. This skill produces a clause-level risk register — every clause with a material issue is flagged with a severity rating, the nature of the risk, and a proposed fix. It is not a deep-dive review; for specific high-stakes clauses, escalate to the relevant specialist skill.
Run this skill:
- Before a full [[review-msa-deep-review]] to build a prioritized issues list
- As a standalone output for a time-pressured client who needs "what are the biggest risks?"
- As part of a due-diligence report where a risk register is a required deliverable
Inputs
| Input |
Why it matters |
Default |
| Contract text |
Full document; clause-by-clause scan |
Required |
| Document type |
Calibrates what is "market standard" — severity depends on contract type |
Infer from document; ask if unclear |
| Party perspective |
Which party's risk lens? (Client vs Provider, Landlord vs Tenant) |
Ask if unclear |
| Jurisdiction |
Affects enforceability rules and what constitutes a "critical" local risk |
From governing-law clause |
Severity Taxonomy
Critical — Always Surface
Issues in this category must be flagged even in a 15-minute review. They can result in regulatory violation, unlimited liability, permanent IP loss, or complete loss of deal value.
| Risk |
Trigger |
| Uncapped liability |
No general liability cap, or cap applies only to one party |
| Cap below 1× annual fees |
Cap is nominally present but set so low as to be meaningless |
| Indemnity asymmetry |
One party indemnifies broadly (any claim, any loss); other indemnifies narrowly or not at all |
| Termination for convenience without reasonable notice |
T4C available but notice is under 15 days; equivalent to immediate termination |
| IP assignment without carve-out for pre-existing IP |
Vendor's background tools get assigned inadvertently |
| Overbroad non-compete |
Scope (functional + geographic + temporal) so wide it is restraint of trade; may be void |
| Adverse governing law or forum |
Law or forum that is actively hostile to the user's position (e.g., counterparty's home courts with no arbitration) |
| No DPA where personal data is processed |
GDPR / KSA PDPL / UAE PDPL compliance breach; regulatory fine exposure |
| Auto-renewal with a notice window over 90 days |
Creates a trap — if deadline missed, locked in for another full term |
| Most-favored-customer clause with retroactive application |
Requires Provider to refund past payments if a better price was given to anyone |
| Audit rights that are unlimited or unbounded |
Effectively allows counterparty to conduct continuous interference with operations |
Medium — Surface in Standard Reviews
Issues that create material commercial risk but do not rise to immediate regulatory or unlimited-liability concern.
| Risk |
Trigger |
| Notice periods misaligned across termination provisions |
Termination for convenience requires 60 days; forfeiture requires 7 days — inconsistency creates ambiguity |
| Force majeure missing modern carve-outs |
Absent: pandemic, cyber incident, government-order closure, financial system disruption (Lebanon-relevant) |
| Insurance amounts unspecified |
Contract requires "adequate" insurance without naming minimum cover amounts |
| Survival clause omits key obligations |
Confidentiality, IP, indemnification do not survive termination — they should |
| Confidentiality term too short for trade secrets |
2-year confidentiality term on genuinely sensitive technology — should be longer or indefinite |
| Cure period absent for material breach |
No opportunity to remedy before termination right triggers |
| Penalty / liquidated damages clause |
In KSA and UAE onshore: courts have discretion to reduce; in DIFC/UK: enforceability requires genuine pre-estimate of loss |
| Assignment clause silent on change of control |
No restriction on counterparty being acquired — contract may transfer to a competitor |
| Most-favored-customer clause prospective-only but poorly scoped |
Applied to all customers rather than similarly-situated customers — creates unworkable obligation |
| Undefined "material breach" |
Each party will define it self-servingly; disputes inevitable |
| No transition assistance on termination |
IT/outsourcing contract ends without data return or migration assistance obligation |
Low — Note for Completeness
Issues that create minor risk or are best-practice gaps. Raise in a written report but do not hold up execution.
| Risk |
Trigger |
| Defined terms not capitalized consistently |
Minor drafting error; could create ambiguity in dispute |
| Boilerplate variations from standard |
e.g., no waiver clause absent; severability clause narrower than standard |
| Cosmetic style inconsistencies |
Cross-references to wrong clause numbers; defined term used before definition |
| Excessive recitals that create obligations |
Recitals are generally not operative; but "WHEREAS Party A agrees to…" language can bind |
Jurisdiction-Specific Flags
Always run these checks in addition to the general flags above:
UAE (onshore)
- Penalty clauses: UAE Civil Code allows courts to adjust penalties to reflect actual loss, regardless of what the contract says. A clause with a disproportionate penalty is enforceable but likely to be reduced judicially. Draft as indemnification for actual loss rather than pre-agreed penalties.
- IP assignment language: present-tense assignment is required; "agrees to assign" may be insufficient
- Stamp duty / registration: commercial property leases and certain IP assignments may need registration
KSA
- Arbitration clause adequacy: a clause saying only "disputes shall be resolved by arbitration" is inadequate. Must specify: institution (SCCA/ICC/DIAC preferred), seat, language, number of arbitrators. An incomplete clause may result in SCCA or general court jurisdiction by default.
- Penalty clauses: Saudi commercial courts apply Shariah principles on proportionality; penalties exceeding actual loss are routinely reduced
- Personal data: PDPL compliance is now actively enforced by SDAIA; missing DPA on Saudi personal data is a critical flag
Lebanon
- Currency denomination: for long-term contracts, USD denomination with Banque du Liban regulatory acknowledgment is essential. LBP-denominated contracts for meaningful amounts create significant risk given exchange rate instability.
- Force majeure: should expressly address banking system restrictions, port closures, and regulatory moratoriums as potential force majeure events, given Lebanon's recent history
- Arbitration: specifying ICC, DIFC-LCIA, or Paris arbitration (given Lebanon-France legal ties) is recommended; domestic courts are less predictable
DIFC / ADGM
- DIFC Data Protection Law / ADGM Data Protection Regulations: DPA required for any personal data processing; breach notification within 72 hours
- Unfair contract terms: DIFC Contract Law includes protections for unreasonable standard terms in B2B contracts
- Death and personal injury: caps on liability for death or personal injury caused by negligence are void
France / EU
- Gross negligence (faute lourde): liability limitation clauses may be ineffective for gross negligence under French law; do not rely on cap for deliberate or grossly negligent conduct
- GDPR: DPA with standard contractual clauses required for cross-border data transfers outside EEA
Output Structure
Per flagged clause, output:
{
"clause": "<section number and title>",
"severity": "critical|medium|low",
"issue": "<one sentence description of the risk>",
"rationale": "<one sentence explaining why this is a risk and for whom>",
"proposed_fix": "<one sentence redline recommendation or alternative approach>",
"jurisdiction_note": "<if the risk is jurisdiction-specific>"
}
At the end of the risk register, provide:
{
"overall_risk_level": "critical|high|medium|low",
"critical_count": <int>,
"medium_count": <int>,
"low_count": <int>,
"top_3_issues": ["<brief description>", ...]
}
Escalation Triggers
Escalate to a specialist skill when:
- More than 3 critical issues in the liability / indemnification cluster → use [[review-indemnification-balance]] + [[review-liability-cap-reasonableness]]
- IP ownership issues are critical → use [[review-ip-ownership-clarity]]
- Full MSA review is needed → use [[review-msa-deep-review]]
- Structural gaps (missing clauses) → use [[review-missing-clauses]]
- Atypical / non-standard clauses → use [[review-unusual-terms-detector]]
Common Mistakes in Risk Flagging
- Marking every clause as medium — dilutes the report; only flag actual risk, not theoretical risk
- Failing to distinguish between what is unenforceable (legal risk) vs what is commercially unfavorable (negotiation risk) — these require different remediation approaches
- Rating enforceability under US law when the governing law is UAE — always apply the actual governing jurisdiction's rules
- Omitting a proposed fix — a finding without a remedy is unhelpful; always provide a direction even if approximate
Related Skills
- [[review-msa-deep-review]]
- [[review-missing-clauses]]
- [[review-unusual-terms-detector]]
- [[review-indemnification-balance]]
- [[review-liability-cap-reasonableness]]
- [[review-nda-quick-check]]
1---2name: review-risk-flagging3description: Use when you need a structured, per-clause risk assessment of a contract. Categorizes each identified risk as critical, medium, or low, with a short rationale and proposed fix for each. Applies a consistent severity taxonomy across all contract types, with MENA-specific flags for penalty clause enforceability, arbitration clause adequacy, and data protection gaps. Produces machine-readable JSON output suitable for integration into review workflows.4license: MIT5---67# Risk Flagging (per Clause)89## When to use this1011Use as a first-pass risk scan on any commercial contract. This skill produces a clause-level risk register — every clause with a material issue is flagged with a severity rating, the nature of the risk, and a proposed fix. It is not a deep-dive review; for specific high-stakes clauses, escalate to the relevant specialist skill.1213Run this skill:14- Before a full [[review-msa-deep-review]] to build a prioritized issues list15- As a standalone output for a time-pressured client who needs "what are the biggest risks?"16- As part of a due-diligence report where a risk register is a required deliverable1718## Inputs1920| Input | Why it matters | Default |21|---|---|---|22| Contract text | Full document; clause-by-clause scan | Required |23| Document type | Calibrates what is "market standard" — severity depends on contract type | Infer from document; ask if unclear |24| Party perspective | Which party's risk lens? (Client vs Provider, Landlord vs Tenant) | Ask if unclear |25| Jurisdiction | Affects enforceability rules and what constitutes a "critical" local risk | From governing-law clause |2627## Severity Taxonomy2829### Critical — Always Surface3031Issues in this category must be flagged even in a 15-minute review. They can result in regulatory violation, unlimited liability, permanent IP loss, or complete loss of deal value.3233| Risk | Trigger |34|---|---|35| Uncapped liability | No general liability cap, or cap applies only to one party |36| Cap below 1× annual fees | Cap is nominally present but set so low as to be meaningless |37| Indemnity asymmetry | One party indemnifies broadly (any claim, any loss); other indemnifies narrowly or not at all |38| Termination for convenience without reasonable notice | T4C available but notice is under 15 days; equivalent to immediate termination |39| IP assignment without carve-out for pre-existing IP | Vendor's background tools get assigned inadvertently |40| Overbroad non-compete | Scope (functional + geographic + temporal) so wide it is restraint of trade; may be void |41| Adverse governing law or forum | Law or forum that is actively hostile to the user's position (e.g., counterparty's home courts with no arbitration) |42| No DPA where personal data is processed | GDPR / KSA PDPL / UAE PDPL compliance breach; regulatory fine exposure |43| Auto-renewal with a notice window over 90 days | Creates a trap — if deadline missed, locked in for another full term |44| Most-favored-customer clause with retroactive application | Requires Provider to refund past payments if a better price was given to anyone |45| Audit rights that are unlimited or unbounded | Effectively allows counterparty to conduct continuous interference with operations |4647### Medium — Surface in Standard Reviews4849Issues that create material commercial risk but do not rise to immediate regulatory or unlimited-liability concern.5051| Risk | Trigger |52|---|---|53| Notice periods misaligned across termination provisions | Termination for convenience requires 60 days; forfeiture requires 7 days — inconsistency creates ambiguity |54| Force majeure missing modern carve-outs | Absent: pandemic, cyber incident, government-order closure, financial system disruption (Lebanon-relevant) |55| Insurance amounts unspecified | Contract requires "adequate" insurance without naming minimum cover amounts |56| Survival clause omits key obligations | Confidentiality, IP, indemnification do not survive termination — they should |57| Confidentiality term too short for trade secrets | 2-year confidentiality term on genuinely sensitive technology — should be longer or indefinite |58| Cure period absent for material breach | No opportunity to remedy before termination right triggers |59| Penalty / liquidated damages clause | In KSA and UAE onshore: courts have discretion to reduce; in DIFC/UK: enforceability requires genuine pre-estimate of loss |60| Assignment clause silent on change of control | No restriction on counterparty being acquired — contract may transfer to a competitor |61| Most-favored-customer clause prospective-only but poorly scoped | Applied to all customers rather than similarly-situated customers — creates unworkable obligation |62| Undefined "material breach" | Each party will define it self-servingly; disputes inevitable |63| No transition assistance on termination | IT/outsourcing contract ends without data return or migration assistance obligation |6465### Low — Note for Completeness6667Issues that create minor risk or are best-practice gaps. Raise in a written report but do not hold up execution.6869| Risk | Trigger |70|---|---|71| Defined terms not capitalized consistently | Minor drafting error; could create ambiguity in dispute |72| Boilerplate variations from standard | e.g., no waiver clause absent; severability clause narrower than standard |73| Cosmetic style inconsistencies | Cross-references to wrong clause numbers; defined term used before definition |74| Excessive recitals that create obligations | Recitals are generally not operative; but "WHEREAS Party A agrees to…" language can bind |7576## Jurisdiction-Specific Flags7778Always run these checks in addition to the general flags above:7980### UAE (onshore)81- **Penalty clauses**: UAE Civil Code allows courts to adjust penalties to reflect actual loss, regardless of what the contract says. A clause with a disproportionate penalty is enforceable but likely to be reduced judicially. Draft as indemnification for actual loss rather than pre-agreed penalties.82- **IP assignment language**: present-tense assignment is required; "agrees to assign" may be insufficient83- **Stamp duty / registration**: commercial property leases and certain IP assignments may need registration8485### KSA86- **Arbitration clause adequacy**: a clause saying only "disputes shall be resolved by arbitration" is inadequate. Must specify: institution (SCCA/ICC/DIAC preferred), seat, language, number of arbitrators. An incomplete clause may result in SCCA or general court jurisdiction by default.87- **Penalty clauses**: Saudi commercial courts apply Shariah principles on proportionality; penalties exceeding actual loss are routinely reduced88- **Personal data**: PDPL compliance is now actively enforced by SDAIA; missing DPA on Saudi personal data is a critical flag8990### Lebanon91- **Currency denomination**: for long-term contracts, USD denomination with Banque du Liban regulatory acknowledgment is essential. LBP-denominated contracts for meaningful amounts create significant risk given exchange rate instability.92- **Force majeure**: should expressly address banking system restrictions, port closures, and regulatory moratoriums as potential force majeure events, given Lebanon's recent history93- **Arbitration**: specifying ICC, DIFC-LCIA, or Paris arbitration (given Lebanon-France legal ties) is recommended; domestic courts are less predictable9495### DIFC / ADGM96- **DIFC Data Protection Law / ADGM Data Protection Regulations**: DPA required for any personal data processing; breach notification within 72 hours97- **Unfair contract terms**: DIFC Contract Law includes protections for unreasonable standard terms in B2B contracts98- **Death and personal injury**: caps on liability for death or personal injury caused by negligence are void99100### France / EU101- **Gross negligence (faute lourde)**: liability limitation clauses may be ineffective for gross negligence under French law; do not rely on cap for deliberate or grossly negligent conduct102- **GDPR**: DPA with standard contractual clauses required for cross-border data transfers outside EEA103104## Output Structure105106Per flagged clause, output:107108```json109{110 "clause": "<section number and title>",111 "severity": "critical|medium|low",112 "issue": "<one sentence description of the risk>",113 "rationale": "<one sentence explaining why this is a risk and for whom>",114 "proposed_fix": "<one sentence redline recommendation or alternative approach>",115 "jurisdiction_note": "<if the risk is jurisdiction-specific>"116}117```118119At the end of the risk register, provide:120121```json122{123 "overall_risk_level": "critical|high|medium|low",124 "critical_count": <int>,125 "medium_count": <int>,126 "low_count": <int>,127 "top_3_issues": ["<brief description>", ...]128}129```130131## Escalation Triggers132133Escalate to a specialist skill when:134- More than 3 critical issues in the liability / indemnification cluster → use [[review-indemnification-balance]] + [[review-liability-cap-reasonableness]]135- IP ownership issues are critical → use [[review-ip-ownership-clarity]]136- Full MSA review is needed → use [[review-msa-deep-review]]137- Structural gaps (missing clauses) → use [[review-missing-clauses]]138- Atypical / non-standard clauses → use [[review-unusual-terms-detector]]139140## Common Mistakes in Risk Flagging141142- Marking every clause as medium — dilutes the report; only flag actual risk, not theoretical risk143- Failing to distinguish between what is unenforceable (legal risk) vs what is commercially unfavorable (negotiation risk) — these require different remediation approaches144- Rating enforceability under US law when the governing law is UAE — always apply the actual governing jurisdiction's rules145- Omitting a proposed fix — a finding without a remedy is unhelpful; always provide a direction even if approximate146147## Related Skills148149- [[review-msa-deep-review]]150- [[review-missing-clauses]]151- [[review-unusual-terms-detector]]152- [[review-indemnification-balance]]153- [[review-liability-cap-reasonableness]]154- [[review-nda-quick-check]]
sboghossian