NDA triage with AI: how a small firm sorts contracts fast

A nine-lawyer firm gets forty NDAs a month. Nobody has time to read all forty the same way. The fix isn't hiring more people. It's sorting the pile before anyone opens a document, and Canadian AI tools now do that sorting well enough to trust with a first pass.

This piece is a workflow, not a pitch. Here's how a small firm actually runs NDA triage with AI, step by step, and where a human still has to look.

What does "triage" mean for an NDA, exactly?

Triage means sorting before reading closely. Most NDAs a small firm sees are boilerplate — mutual confidentiality, two-year term, standard carve-outs for public information. Maybe one in five has something that needs a lawyer's eye: an unusual non-compete tacked on, a one-way obligation dressed up as mutual, a governing-law clause pointing somewhere odd.

Triage sorts the boilerplate from the outlier before a partner or associate spends real time on it. Get the easy 80% moving fast, and put a human on the hard 20%.

What does the actual workflow look like?

Here's the five-step version most small firms land on once they've tried it a few times:

• Intake: NDAs come in by email or upload, get dropped into a shared folder or knowledge base
• First pass: AI extracts key terms — term length, mutuality, jurisdiction, carve-outs, non-compete language
• Flagging: anything outside the firm's standard template gets flagged with a plain-language note on what's different
• Human review: a lawyer or paralegal looks only at flagged documents, not the whole batch
• Sign-off: standard NDAs get a quick confirm-and-send; flagged ones go through normal review

The time savings sit almost entirely in steps two and three. A paralegal who used to open every document now only opens the flagged ones.

One firm running this workflow saw its weekly NDA backlog drop from a two-day task to a same-day task, once AI handled first-pass sorting and a lawyer only touched the exceptions.

Why does it matter that the AI is Canadian?

Because NDAs carry client information, and where that information sits matters under Canadian privacy law. Quebec's privacy law and PIPEDA, the federal privacy law, both care about where personal data goes and who can reach it.

Most AI chat tools on the market are American. That means American parent companies, American investors, and in some cases the CLOUD Act — a US law letting American authorities request data from US-controlled providers, wherever the servers physically sit. If your NDAs pass through a US company's AI tool, that risk sits with your client's information, not just your own.

Augure is a Canadian company, with no US corporate parent and no US investors. Customer conversations, documents, and AI inference run on Canadian infrastructure or with vetted EU partners under zero-data-retention agreements — never through US-jurisdiction providers. That means the CLOUD Act's reach over US-controlled providers doesn't extend to what a firm puts into it. Some model tiers run in the EU rather than Canada as their primary path, not just as backup, and payment processing and email delivery do involve some US infrastructure. That's disclosed, not hidden, and it's worth asking any vendor to be equally specific.

For a small firm doing client intake, that's the whole point. Not a feature. A question with a real answer.

A US company's AI tool can be reached by US law even when its servers sit in Canada.

What should a human always double-check?

Three things, every time, no exceptions:

Governing law and jurisdiction clauses. AI can flag when these look unusual, but confirming they're enforceable in the relevant province is a lawyer's job.

Non-compete and non-solicit language stapled onto an NDA. These sometimes hide inside confidentiality agreements and carry real enforceability questions under provincial law.

Anything the AI marks as "unclear" rather than flagging outright. A tool that says "I'm not confident about this clause" is being honest. Treat that as a request for human eyes, not a false alarm.

The Law Society of Ontario and the Barreau du Québec have both published guidance on AI use in legal practice. The common thread is simple: AI can assist, but a lawyer remains responsible for the advice given and the work product delivered. Triage tools support that responsibility. They don't replace it.

What does this cost a small firm?

Less than most firms expect. Augure Legal runs C$149 a month for a solo practitioner doing contract review, NDA triage, and clause extraction, with Law 25 and PIPEDA compliance checks built in. A firm with several people working the same files pays C$399 a month for shared workflows and assignments.

Compare that to the billable hours saved on a forty-NDA month. If triage cuts even ten minutes off each document's first read, that's close to seven hours a month back. More than the subscription costs, before counting fewer missed clauses.

Augure's general chat product, separate from the legal tool, starts free at C$0 a month with 50 messages a day and five documents. Enough to test the idea on a handful of NDAs before committing to a subscription.

What to do this week

Pull last month's NDA folder and sort it by hand into "standard" and "needs a look." Note how long that sort takes you — that's your baseline.

Ask any AI vendor you're considering, in writing, where inference runs and whether any part of the pipeline touches a US-jurisdiction provider. If they can't answer plainly, that's your answer.

Run five real NDAs through a trial account — Augure's free tier or Augure Legal's solo plan — and check the AI's flags against what a lawyer would have caught unaided.

Where this comes from: Quebec's privacy law addresses cross-border data transfers in section 17; PIPEDA governs personal information handling for federally regulated and interprovincial businesses.