Human Verification Checklist for High-Severity Contract Flags

You just got a High/Medium flag list and nobody is named to verify it. Here is the named reviewer checklist for high severity contract flags: freeze the same packet — the file set the tool saw — name one human, treat every High as unverified, open the source clause, confirm party, number, and definition links, then log owner, decision, and evidence. Escalate what sits outside the playbook. Do not sign while any High is unowned.

In August 2026, Tom — UK SaaS ops, 18 people — uploads a 41-page US vendor MSA — a master services agreement, the frame vendors hang order forms on — plus two order forms. The first-pass — first machine pass before a human reads every page — returns three High flags, items scored high severity. He Slacks “three highs, looks market,” and plans to sign Friday. Typical mistake: he never opens Section 12. Affiliate in Section 1 pulls in the parent; the cap lives on a different PDF.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Why is a flag not a decision?

A flag list is a first-pass, not a decision. Silence on Highs is not a complete review. Missing exhibits — attached schedules or appendixes — and definition links often never get a card. Treat “no Highs” as “run the human gates anyway,” not as permission to countersign.

On 17 August 2026 the UK SRA warning notice said AI has no separate legal personality; solicitors remain accountable for outputs. Hallucinations — false citations — have already reached English courts in Ayinde (2025). LegalHalluLens (2026) ran 510 CUAD contracts and 249,252 clause instances. The ~52% aggregate rate hides a 38–40 point gap — obligation and numeric claims fail more than temporal ones. Research-model results, not a product score. US footnote: ABA Formal Opinion 512 (29 July 2024) — verify GAI; US Model Rules, not UK law. A first-pass highlighter is not automatically EU Annex III (2 December 2027).

• Do: treat every High as unverified until a human opens the source.
• Do not: treat a green dashboard as approval.

Why open the source clause, not only the summary?

The summary can invent a section number, drop a “subject to” carve-out, or quote the MSA while the order form wins. Open the source sentence — page plus section — before you accept or dismiss the card. If the tool cannot show the sentence, find the clause yourself.

Harvey’s citation note is blunt: a flag without a source is a guess. legalpdf.io’s 2026 write-up of the “94%” LegalNLP headline is a composite — 97% F1 on simple clauses versus 82% on “subject to” language. A 0.9 confidence score is the wrong filter. In practice, Tom’s cap card is useless until he opens carve-out and cap on the same PDF.

• Do: click through to the exact sentence, then decide.
• Do not: accept or dismiss from the card alone.

How do you confirm party, number, and definition links?

Affiliate, Fees, and Confidential Information in Section 1 can rewrite the High clause. Write the live defined term and the live number from the PDF. Watch split lines, tables, and the wrong legal entity. If the order form conflicts, apply order-of-precedence — do not trust the summary’s pick.

For example, “Customer” may mean the UK subsidiary you negotiated with, while Affiliates pulls in the US parent. A dollar cap can split across a line break. Pull every exhibit the clause incorporates.

• Do: write the live names, the live number, and the definition you jumped to.
• Do not: assume the number on the card matches the PDF.

How do you log owner, decision, and evidence?

Slack “looks fine” is not a record. If a flagged item does not have a name attached, it is a notification nobody reads. Write owner, accept / redline / escalate, and an evidence link before anyone moves the deal.

A playbook is a one-page list of default positions. Vaquill’s 2026 playbook puts it plainly: one named person owns it — shared ownership means no ownership. If the same exception happens three times, promote it into the playbook. Columns that survive Friday: flag → source pin → party/number/definitions → decision → owner → evidence.

• Do: name a person and a date on each High.
• Do not: treat a Slack thread as the trail when the indemnity fires.

When do you escalate a contract flag to counsel?

Do not dump every flag on counsel — a qualified lawyer, not the chatbot. Do not escalate nothing until after signature. Use a written walk-away list, not a mood. Name a person, not “legal leadership.” Escalate when you are uncertain.

Always-escalate: uncapped liability, one-way indemnity, unusual IP, or regulated data without a DPA — a data processing agreement. If unsure, escalate and state the question. One page: clause quote, fallback, deadline, named owner. In a UK regulated firm, SRA effective supervision (12 June 2026) still wants human review; an authorised individual retains ultimate responsibility.

• Do: escalate non-playbook and regulated risk with a one-page packet.
• Do not: wait for Friday, or copy every Low onto the GC.

What are the minimum gates before anyone signs?

No signature while any High is unowned, unverified, or missing evidence. “No High flags” still needs the definition and exhibit pass and a named human sign-off that the last mile is done. That is the success bar.

Spot-check so automation bias does not hide in the greens. Default: all Highs, at least one in three Mediums — and every Medium on liability, indemnity, data, IP, or renewal — plus a small sample of Lows. Success bar: a one-page log for every High, that Medium share checked, and a block if any High is unowned. How AI analysis speeds up document review is the speed of the first-pass. This page is the human gate after flags. Checkory can highlight; a named reviewer still opens the clause.

flag list → named reviewer → open source clause → party/number/definitions → accept/redline/escalate + log → gates green → then (and only then) signature path

• Do: block signature if any High is unowned.
• Do not: treat a green dashboard as the last mile.

If the packet is confidential, run the pre-paste privacy gate before any tool sees a page.