Risk Flagging (per Clause)

Use when you need a structured, per-clause risk assessment of a contract. Categorizes each identified risk as critical, medium, or low, with a short rationale and proposed fix for each. Applies a consistent severity taxonomy across all contract types, with MENA-specific flags for penalty clause enforceability, arbitration clause adequacy, and data protection gaps. Produces machine-readable JSON output suitable for integration into review workflows.

Risk Flagging (per Clause)

When to use this

Use as a first-pass risk scan on any commercial contract. This skill produces a clause-level risk register — every clause with a material issue is flagged with a severity rating, the nature of the risk, and a proposed fix. It is not a deep-dive review; for specific high-stakes clauses, escalate to the relevant specialist skill.

Run this skill:

Before a full [[review-msa-deep-review]] to build a prioritized issues list
As a standalone output for a time-pressured client who needs "what are the biggest risks?"
As part of a due-diligence report where a risk register is a required deliverable

Inputs

Input	Why it matters	Default
Contract text	Full document; clause-by-clause scan	Required
Document type	Calibrates what is "market standard" — severity depends on contract type	Infer from document; ask if unclear
Party perspective	Which party's risk lens? (Client vs Provider, Landlord vs Tenant)	Ask if unclear
Jurisdiction	Affects enforceability rules and what constitutes a "critical" local risk	From governing-law clause

Severity Taxonomy

Critical — Always Surface

Issues in this category must be flagged even in a 15-minute review. They can result in regulatory violation, unlimited liability, permanent IP loss, or complete loss of deal value.

Risk	Trigger
Uncapped liability	No general liability cap, or cap applies only to one party
Cap below 1× annual fees	Cap is nominally present but set so low as to be meaningless
Indemnity asymmetry	One party indemnifies broadly (any claim, any loss); other indemnifies narrowly or not at all
Termination for convenience without reasonable notice	T4C available but notice is under 15 days; equivalent to immediate termination
IP assignment without carve-out for pre-existing IP	Vendor's background tools get assigned inadvertently
Overbroad non-compete	Scope (functional + geographic + temporal) so wide it is restraint of trade; may be void
Adverse governing law or forum	Law or forum that is actively hostile to the user's position (e.g., counterparty's home courts with no arbitration)
No DPA where personal data is processed	GDPR / KSA PDPL / UAE PDPL compliance breach; regulatory fine exposure
Auto-renewal with a notice window over 90 days	Creates a trap — if deadline missed, locked in for another full term
Most-favored-customer clause with retroactive application	Requires Provider to refund past payments if a better price was given to anyone
Audit rights that are unlimited or unbounded	Effectively allows counterparty to conduct continuous interference with operations

Medium — Surface in Standard Reviews

Issues that create material commercial risk but do not rise to immediate regulatory or unlimited-liability concern.

Risk	Trigger
Notice periods misaligned across termination provisions	Termination for convenience requires 60 days; forfeiture requires 7 days — inconsistency creates ambiguity
Force majeure missing modern carve-outs	Absent: pandemic, cyber incident, government-order closure, financial system disruption (Lebanon-relevant)
Insurance amounts unspecified	Contract requires "adequate" insurance without naming minimum cover amounts
Survival clause omits key obligations	Confidentiality, IP, indemnification do not survive termination — they should
Confidentiality term too short for trade secrets	2-year confidentiality term on genuinely sensitive technology — should be longer or indefinite
Cure period absent for material breach	No opportunity to remedy before termination right triggers
Penalty / liquidated damages clause	In KSA and UAE onshore: courts have discretion to reduce; in DIFC/UK: enforceability requires genuine pre-estimate of loss
Assignment clause silent on change of control	No restriction on counterparty being acquired — contract may transfer to a competitor
Most-favored-customer clause prospective-only but poorly scoped	Applied to all customers rather than similarly-situated customers — creates unworkable obligation
Undefined "material breach"	Each party will define it self-servingly; disputes inevitable
No transition assistance on termination	IT/outsourcing contract ends without data return or migration assistance obligation

Low — Note for Completeness

Issues that create minor risk or are best-practice gaps. Raise in a written report but do not hold up execution.

Risk	Trigger
Defined terms not capitalized consistently	Minor drafting error; could create ambiguity in dispute
Boilerplate variations from standard	e.g., no waiver clause absent; severability clause narrower than standard
Cosmetic style inconsistencies	Cross-references to wrong clause numbers; defined term used before definition
Excessive recitals that create obligations	Recitals are generally not operative; but "WHEREAS Party A agrees to…" language can bind

Jurisdiction-Specific Flags

Always run these checks in addition to the general flags above:

UAE (onshore)

Penalty clauses: UAE Civil Code allows courts to adjust penalties to reflect actual loss, regardless of what the contract says. A clause with a disproportionate penalty is enforceable but likely to be reduced judicially. Draft as indemnification for actual loss rather than pre-agreed penalties.
IP assignment language: present-tense assignment is required; "agrees to assign" may be insufficient
Stamp duty / registration: commercial property leases and certain IP assignments may need registration

KSA

Arbitration clause adequacy: a clause saying only "disputes shall be resolved by arbitration" is inadequate. Must specify: institution (SCCA/ICC/DIAC preferred), seat, language, number of arbitrators. An incomplete clause may result in SCCA or general court jurisdiction by default.
Penalty clauses: Saudi commercial courts apply Shariah principles on proportionality; penalties exceeding actual loss are routinely reduced
Personal data: PDPL compliance is now actively enforced by SDAIA; missing DPA on Saudi personal data is a critical flag

Lebanon

Currency denomination: for long-term contracts, USD denomination with Banque du Liban regulatory acknowledgment is essential. LBP-denominated contracts for meaningful amounts create significant risk given exchange rate instability.
Force majeure: should expressly address banking system restrictions, port closures, and regulatory moratoriums as potential force majeure events, given Lebanon's recent history
Arbitration: specifying ICC, DIFC-LCIA, or Paris arbitration (given Lebanon-France legal ties) is recommended; domestic courts are less predictable

DIFC / ADGM

DIFC Data Protection Law / ADGM Data Protection Regulations: DPA required for any personal data processing; breach notification within 72 hours
Unfair contract terms: DIFC Contract Law includes protections for unreasonable standard terms in B2B contracts
Death and personal injury: caps on liability for death or personal injury caused by negligence are void

France / EU

Gross negligence (faute lourde): liability limitation clauses may be ineffective for gross negligence under French law; do not rely on cap for deliberate or grossly negligent conduct
GDPR: DPA with standard contractual clauses required for cross-border data transfers outside EEA

Output Structure

Per flagged clause, output:

{
  "clause": "<section number and title>",
  "severity": "critical|medium|low",
  "issue": "<one sentence description of the risk>",
  "rationale": "<one sentence explaining why this is a risk and for whom>",
  "proposed_fix": "<one sentence redline recommendation or alternative approach>",
  "jurisdiction_note": "<if the risk is jurisdiction-specific>"
}

At the end of the risk register, provide:

{
  "overall_risk_level": "critical|high|medium|low",
  "critical_count": <int>,
  "medium_count": <int>,
  "low_count": <int>,
  "top_3_issues": ["<brief description>", ...]
}

Escalation Triggers

Escalate to a specialist skill when:

More than 3 critical issues in the liability / indemnification cluster → use [[review-indemnification-balance]] + [[review-liability-cap-reasonableness]]
IP ownership issues are critical → use [[review-ip-ownership-clarity]]
Full MSA review is needed → use [[review-msa-deep-review]]
Structural gaps (missing clauses) → use [[review-missing-clauses]]
Atypical / non-standard clauses → use [[review-unusual-terms-detector]]

Common Mistakes in Risk Flagging

Marking every clause as medium — dilutes the report; only flag actual risk, not theoretical risk
Failing to distinguish between what is unenforceable (legal risk) vs what is commercially unfavorable (negotiation risk) — these require different remediation approaches
Rating enforceability under US law when the governing law is UAE — always apply the actual governing jurisdiction's rules
Omitting a proposed fix — a finding without a remedy is unhelpful; always provide a direction even if approximate