How to Evaluate Order Processing Contracts With AI

Basics of order processing contracts

Definition and legal background

Within the framework of the GDPR, an order processing contract (AVV) is a contract that regulates the relationship between a person responsible (e.g. a company) and a processor (e.g. an external service provider). This contract determines how personal data may be processed and ensures that the processor protects the data in accordance with legal requirements. The GDPR requires that controllers may only commission contract processors who offer sufficient guarantees that appropriate technical and organizational measures are implemented to ensure data protection.

Typical content and requirements of AVVs

A typical AVV contains a number of important elements to ensure that the personal data of data subjects is adequately protected. Key content includes:

Subject matter and duration of processing: The contract must clearly define which data is to be processed and how long the processing should take.
Nature and purpose of processing: It must be determined for what purpose the data is processed and which processing activities are carried out.
Rights and obligations of the person responsible: The controller has primary responsibility for protecting personal data and must ensure that the processor processes the data in accordance with legal requirements.
Obligations of the order processor: The processor is obliged to process the data only as directed by the person responsible and to take appropriate technical and organizational measures to protect the data.
subcontractors: The use of subcontractors by the processor must be contractually regulated and approved by the person responsible.

‍

What does an AVV have to contain in accordance with Article 28 of the General Data Protection Regulation (GDPR)?

According to Article 28 of the General Data Protection Regulation (GDPR), an order processing contract (AVV) must meet certain minimum requirements to ensure the protection of personal data. The essential components of an AVV include:

Processing description: The contract must describe in detail which personal data is processed, for what purposes and for what duration.
The person responsible's right to issue instructions: The person responsible must retain full control over the processing and has the right to give the processor instructions on how to process the data.
confidentiality: The processor must ensure that all persons who have access to personal data are bound to confidentiality.
Safety measures: Appropriate technical and organizational measures must be defined to ensure the security of processing and prevent risks such as data loss or unauthorized access.
Support for the person responsible: The processor must support the controller in carrying out its duties, in particular when it comes to inquiries from data subjects and carrying out data protection impact assessments.
Deletion and return of data: After processing has been completed, the processor must either delete the data or return it to the person responsible, depending on what has been contractually agreed.
Evidence requirements and audits: The processor must provide the person responsible with all necessary information to prove compliance with legal requirements and enable audits by the person responsible.

These requirements are critical to ensure that data protection is always guaranteed when personal data is processed by third parties.

Roles and Responsibilities

Within the framework of an AVV, there are clear roles between the person responsible and the order processor. The controller determines how and for what purposes personal data is processed, while the processor processes the data on behalf of the person responsible. It is important that the person responsible monitors compliance with data protection requirements by the processor and ensures that the processor complies with all contractual and legal requirements.

In practice, this means that the controller should carry out regular reviews and audits to ensure that the processor complies with the AVV requirements. The processor, in turn, must inform the person responsible about all relevant processes involving the processing of personal data and ensure that all employees who have access to the data are trained accordingly.

AVV evaluation challenges

Manual review — effort and risks

The manual review of order processing contracts (AVVs) requires considerable time, especially for large and complex contracts. Experience has shown that many AVVs are prone to errors, as companies often use model contracts or do not adapt certain clauses. This creates potential gaps that pose risks to compliance with data protection regulations. A study by Veritas Technologies shows that up to 60% of data breaches are due to human error. (Veritas Technologies, “The Truth in Cloud Report,” 2023) This shows how error-prone and risky manual testing can be.

For example, many AVVs lack appropriate consideration of technical and organizational measures (TOM). Instead of listing specific security measures such as encryption or firewalls, they often contain only vague phrases such as: “We guarantee data protection through our technical and organizational measures.” This lack of precision makes it difficult to assess the actual security measures, which jeopardizes compliance.

Typical problem areas in AVVs

In many cases, there is a lack of clear regulations or sufficient guarantees, which increases risks. According to a study by the Ponemon Institute, 59% of companies are struggling to ensure that their subcontractors comply with data protection regulations. (Ponemon Institute, “Data Risk in the Third-Party Ecosystem,” 2023) Typical problem areas include:

Inadequate technical and organizational measures (TOM)

TOM are often not tailored to the respective data processing situation or lack basic measures, such as securing physical servers or encrypting data during transmission.

Unclear rules on liability and involvement of subcontractors

Subcontractors often have access to personal data without clear rules on responsibility or liability. This leads to uncertainties as to how to proceed in the event of a data protection breach.

Missing information about the deletion of data

Once data processing has been completed, there is often a lack of clear regulations for the secure deletion or return of data, which can lead to legal and security problems.

Data transfers to third countries

Another risk results from the transfer of data to third countries. The GDPR states that data may only be transferred to countries outside the EU if there is an adequate level of data protection or appropriate security measures such as standard contractual clauses (SCC) or corporate binding rules have been implemented. Depending on the sensitivity of the data, additional measures must be taken to ensure that the data is protected.

The importance of these additional security measures is often neglected in day-to-day business. Companies should therefore carefully examine which protection mechanisms are implemented in contracts with processors in third countries and whether these have been adequately documented and contractually defined.

Manual testing of AVVs

The manual review of order processing contracts (AVV) is an essential process to ensure that all data protection and contractual requirements when handling personal data are met. Regardless of whether your company is heavily focused on technical security, data confidentiality, or information availability, a thorough audit of AVVs is necessary to ensure compliance with the GDPR and internal policies.

Here is a detailed guide to manually reviewing AVVs, which focuses on creating a checklist, setting up a database, and regularly reviewing contracts.

A guide in 3 easy steps

1. Create a checklist

The first step to manually testing an AVV is to use a checklist to create that is tailored to the specific needs and risks of your company. This checklist should include key requirements that are relevant to your data processing and security. Depending on the industry and the type of data processed, the focus of the audit may differ.

Important points when creating the checklist:

Technical safety: If technical security is a high priority, check in detail how the systems are connected between you and the order processor. Make sure encryption methods, firewalls, and access controls are implemented.

instance: If your company processes sensitive financial data, you should state in the checklist that the data may only be transmitted via encrypted channels (e.g. SSL/TLS).

Confidentiality of data: If particularly sensitive data is processed, you must ensure that strict confidentiality measures are in place. These should be listed in the checklist, such as confidentiality agreements with the contract processor's employees or data protection training.

instance: In the healthcare industry, this could mean that medical data is protected by advanced access controls and is only made available to authorized employees.

Loss-free safekeeping: When ensuring the lossless storage of data, you should indicate in the checklist that the order processor is using redundant systems. These ensure that data is not lost even in the event of a technical failure.

instance: A cloud service provider must be able to store data in multiple data centers to avoid outages and provide reliable recovery.

Complementing the checklist with scenarios:

It's helpful to review your checklist Case studies and scenarios to supplement that are acceptable to your company. Consider what could happen in the worst case if the processor fails to comply with its obligations and define which measures are necessary for you.

instance: If data is stored abroad, determine which data security standards apply and which countries are considered permitted.

2. Setting up a database to manage AVVs

In order to keep track of all order processing contracts, it is essential to have a central database or a Excel sheet set up, in which all relevant AVVs are stored and managed. This database helps to quickly access contract information and ensure that all relevant clauses and requirements are recorded.

Contents of the database:

Contracting partner: Indicate who the processor is and which service he provides.
Date of conclusion of contract and duration: Record the date on which the contract was concluded and when it must be renewed or terminated.
Important clauses: Write down the main contractual clauses relating to technical and organizational measures (TOM), subcontractor regulation and data deletion.
Risk analysis: Include an evaluation of the contract that assesses the risk of data breaches or security issues

Benefits of the database:

Access during exams: If an external audit (e.g. by supervisory authorities) takes place, you can quickly and efficiently access all relevant AVVs and prove that the necessary measures have been taken.
Overview of contracts: With the database, you can keep track of which contracts need to be reviewed or updated regularly and thus avoid contractual gaps or the expiry of contract deadlines.

3. Regular review of the checklist and the evaluated data

Data protection requirements are constantly changing, and it is important to regularly review your checklist and the evaluated data in the database. This regular review helps to ensure that the order processor always complies with the latest legal and security requirements.

Periodic review steps:

Checklist update: Check at least once a year whether new legal requirements or technological changes change the requirements in your checklist. Adjust the checklist accordingly.
Contract review: Check the AVVs recorded in the database regularly to ensure that all contracts are up to date and relevant. If the type of data processing changes or new risks arise, renegotiations must be conducted with the processor.
Documentation of changes: Record any changes or adjustments to the contracts in writing and add them to the database. This can be important when it comes to audits or audits.

Other important points for manual verification

Review of technical and organizational measures

Quick win: Check the contract processor's technical and organizational measures (TOM) for specific information. Make sure that the TOM is adapted to the type of processing and that basic security measures such as firewalls and access controls are explicitly mentioned.

TOM are the backbone of every AVV, as they ensure that the processor protects personal data in accordance with the GDPR. However, vague phrases such as “We guarantee data protection through technical and organizational measures” are often used without giving precise details. A common mistake is that contract processors use general patterns that are not adapted to their specific processes. Here are basic points to pay attention to:

Technical measures: Are encryption, access controls, firewalls, and other IT security measures specifically described?
Organizational measures: Is there training for employees, guidelines on data usage, and clear responsibilities?
External certifications: Are independent certifications such as ISO 27001, SOC 2 or audits cited by data protection officers?

By examining these aspects, you can quickly determine whether the contract processor really offers adequate data security guarantees.

Subcontractor of the order processor

Quick win: Check whether the processor uses subcontractors and ensure that there are clear rules for involving these subcontractors. Pay particular attention to whether subcontractors operate in third countries and how their data security is ensured.

The involvement of subcontractors often entails significant risks, as they may also have access to personal data. A common shortcoming in AVVs is that there is no transparency as to which subcontractors are being used and whether they meet the same security requirements as the main processor. When testing, you should consider the following points:

Identity of subcontractors: Are the names of the subcontractors listed in the AVV? If this information is missing, it is important to inquire and clarify.
Contractual transfer of guarantees: Are the agreed guarantees under the AVV also passed on to subcontractors?
third countries: If subcontractors operate in third countries, additional protective measures and standard contractual clauses (SCC) are necessary.

The legal and data protection protection of subcontractors is crucial to ensure that personal data remains protected across the entire processing chain.

Standard contractual clauses and additional security measures

Quick win: Check whether the transfer of personal data to third countries is secured by standard contractual clauses (SCC) or other mechanisms, and whether additional security measures are set out in the contract.

When personal data is transferred to third countries outside the European Economic Area (EEA), it must be ensured that an adequate level of data protection is guaranteed. In many cases, standard contractual clauses are used to legally secure these transfers. But standard contractual clauses alone are often not enough. Additional security measures must be implemented, which should be explicitly mentioned in the AVV. Key aspects include:

Standard Contractual Clauses (SCC): Are they included in the contract and are they being used correctly?
Additional safety measures: For example, are encryption mentioned during transmission or other security measures to ensure the protection of data in a third country as well?

This step is of great importance as data transmission to countries with an insufficient level of data protection entails significant risks. A close review of these clauses ensures that personal data is secure even when transferred across national borders.

Use of artificial intelligence for contract evaluation

Basics of Machine Learning and NLP (Natural Language Processing)

Machine learning is a branch of artificial intelligence that uses algorithms and statistical models so that systems can learn from data and recognize patterns without being explicitly programmed. Natural language processing (NLP) is another key technology that enables machines to understand, interpret and respond to human language. NLP is used in particular for processing natural language in texts, such as contracts. In contract evaluation, machine learning and NLP come together to enable automated analysis and interpretation of contract content.

AI opportunities in contract recognition and evaluation

Artificial intelligence has the potential to significantly improve contract recognition and evaluation. NLP can be used to automatically identify and categorize relevant clauses in contracts. This makes it easier to assess compliance with data protection requirements or other legal requirements. Machine learning can help predict contract risks by learning patterns from historical data that point to potential problem areas. This combination of technologies enables faster and more accurate identification of risks and helps to make regulatory compliance more efficient.

Advantages of automation over manual processes

Automating contract evaluation through AI offers numerous advantages compared to manual review. First, it saves time and significantly reduces effort, as contracts can be analyzed faster and more consistently. Second, automation minimizes the risk of human error, which is particularly high when it comes to long and complex contracts. Third, the use of AI technologies enables better scalability, so that even a large number of contracts can be reviewed in a short period of time. Finally, automation through AI leads to increased transparency and traceability of the evaluation, as the decision-making processes of the algorithms can be understood and documented.

Further benefits of AVV's AI-based evaluation

Saving time and efficiency: Contracts are analyzed faster and with less effort, resulting in a significant reduction in processing time.
Minimize human errors: Human errors can occur frequently, particularly with large and complex contracts. AI significantly reduces this risk through more accurate and consistent analyses.
scalability: AI systems are able to process large volumes of contracts simultaneously, which increases efficiency when processing contracts on a large scale.
Increased transparency and traceability: AI algorithms offer clear, documented decision-making processes that make the assessment steps comprehensible and auditable.
Consistency in analysis: The automated review guarantees that all contracts are reviewed according to the same criteria, which ensures a consistent quality of contract evaluation.

Setting up the automated analysis of AVVs using AI

Existing AI tools for contract analysis

There are already a variety of AI tools developed specifically for contract analysis. These are often based on large language models such as Gemini, ChatGPT or Anthropic. They use machine learning and natural language processing (NLP) to analyze contracts, identify relevant clauses, and assess potential risks. Such tools have proven helpful in increasing contract analysis efficiency and reducing manual errors.

Process for evaluating order processing contracts using AI

The evaluation of AVVs using AI tools such as ChatGPT is usually carried out in several consecutive steps. Particular attention should be paid to the structure and organization of the contracts to be reviewed to ensure that all relevant data protection clauses are reviewed. Here is a guide to using AI effectively:

1. Create relevant prompts for evaluating contracts

The first step in using AI tools such as ChatGPT for contract evaluation is to use the relevant Prompts to create. Prompts are instructions given to AI to extract specific information from a contract. These prompts should be carefully formulated to ensure that the correct clauses and information are found in the contract.

For example, a prompt for identifying the duration of the contract could read as follows:
“Identify and extract the clause that describes the duration of the contract or data processing. ”

It is recommended that you include these prompts in a Excel sheet or Word document to save so that they can be used systematically to evaluate various contracts. Each prompt should be assigned a specific clause (e.g. data protection regulations, subcontractor agreements, data deletion obligations).

2. Apply prompts to an uploaded document

After the prompts have been defined, they are set to the uploaded contract document applied. In most AI tools, such as ChatGPT, it is possible to upload the contract in machine-readable form (e.g. as a text file, PDF or Word document).

This is where the actual analysis starts: The AI searches the document for prompts defined by the user. It is important to review the results and ensure that all relevant information, such as the subject matter of the contract, processing activities, sub-contractor regulations and data security measures, has been extracted.

3. Improve prompts — if the desired result is not achieved

In some cases, the initial prompts may not produce the desired result. This is often due to the fact that contracts are formulated differently or legal terms are used in different contexts.

If this is the case, the prompts must be revised and clarified. An example would be to search more specifically for “start and end of data processing” or “contract extension clauses” instead of just asking about “contract duration.” The use of synonyms and alternative formulations also helps to improve the accuracy of AI.

It may be useful to use the Manually check AI output and possibly incorporate new findings into improving prompts.

4. Enter the evaluated parameters or results in an Excel sheet

After the relevant information has been extracted from the contract, the results should be in a Excel sheet be recorded in a structured manner. This makes it easy to track and compare different contracts.

The Excel sheet could contain the following columns:

Contract clause (e.g. data deletion, subcontractor use, encryption)
Extracted clause (text from contract)
GDPR compliance (yes/no)
Comments/recommendations for action

Structured documentation of the results not only helps to monitor the compliance status of the contract, but also facilitates future contract reviews and audits.

5. Applying the other prompts

As soon as the first results are available and documented, additional Prompts can be used to gain deeper insights. For example, you could ask AI to look for problematic clauses or to check whether all technical and organizational measures required by the GDPR are described in the contract.

Examples of further prompts could include:

“Are there clauses that regulate data deletion after the end of the contract? ”
“Describe which data security measures are mentioned in the contract. ”

With each subsequent step, the analysis is refined and the AI provides an increasingly detailed assessment of the content of the contract.

Increasing efficiency when using simple language models

The use of AI tools and simple language models such as ChatGPT offers companies the opportunity to significantly speed up the evaluation of order processing contracts (AVVs). Language models are trained to understand natural language and to analyze complex legal documents. Even without specialized, expensive software, significant efficiency increases in contract evaluation can already be achieved by using available AI models.

Faster editing through simple language models

Simple language models make it possible to analyze contracts in a very short time without having to manually read and interpret every clause. By using prompts (targeted instructions to AI), specific contract clauses such as regulations on data deletion, subcontractor use or data security measures can be quickly identified. This significantly reduces the amount of time that would traditionally be required to manually review a contract.

For example, a language model such as ChatGPT can provide answers to the following questions within seconds:

“Which clauses govern data processing under the contract? ”
“Are there regulations on the use of subcontractors? ”
“Are data encryption measures included in the contract? ”

With these simple prompts, an initial analysis of the relevant clauses can be carried out in a very short time. Instead of hours of manual work, the language model provides a comprehensive overview of the most important contract points within a few minutes.

Continue to record results in a structured way

Despite the speed and accuracy that language models offer, it is important to continue to systematically document the knowledge gained. This means that the extracted results are still in databases or Excel spreadsheets must be registered. This structured recording of results is essential to ensure clear tracking and comparability.

For example, the following information can be systematically collected in an Excel spreadsheet:

Contract clauses for data processing (extracted text)
Risk assessments (compliance with GDPR, potential vulnerabilities)
Necessary measures (e.g. adjustments or renegotiations)

By manually recording the results in Excel or a contract database, it is ensured that the reports created are comprehensible at any time and can be accessed quickly when required.

Continuous improvement and adjustment

Another advantage of using language models is the ability to continuously improve the efficiency of the analysis process. If the initial prompts don't produce the desired results, they can be easily adjusted and refined to ensure that all relevant information is extracted correctly. This flexibility leads to continuous optimization of the workflow, which in turn further increases the efficiency of contract evaluation in the long term.

Advantages and disadvantages of a full-fledged CLM system compared to simple AI models

While the use of language models such as ChatGPT enables significant increases in efficiency when evaluating contracts, full-fledged Contract Lifecycle Management (CLM) systems offer even more comprehensive functions. These systems are specifically designed to manage the entire life cycle of a contract — from creation and negotiation to automated evaluation, storage and analysis of contract data. Here, the advantages and disadvantages of a full-fledged CLM system compared to simple AI models such as ChatGPT are examined.

Benefits of a full-fledged CLM system

Automated storage of evaluated data in a database A full-fledged CLM system offers the option of saving the evaluated contract data directly and seamlessly in a database. While simple language models require the results to be transferred manually to Excel or other tools, this step is automated with a CLM system. This results in a higher accuracy and also saves time.
Centralized data management A CLM system enables centralized storage and management of all contracts and associated metadata. All contract information, such as subcontractor clauses or data protection measures, is easily accessible and searchable at any time. This not only makes administration easier, but also provides the basis for further analyses.
Optimized and sophisticated prompts While simple AI models such as ChatGPT rely on user-defined prompts to extract relevant contract clauses, CLM systems can provide optimized and standardized prompts. These specialize in various types of contracts and industries and enable a more precise evaluation of contracts. In CLM systems, these prompts are often already integrated into templates and workflows, which makes the evaluation of contracts even more efficient.
Analysis of evaluated data One of the biggest benefits of a full-fledged CLM system is the ability to advanced analytics to be carried out on the evaluated data. Companies can track specific trends in their contracts, identify risks, or identify weaknesses in specific clauses. Simple AI models offer quick evaluations, but the in-depth analysis and visualization The data via dashboards and reports is much more advanced in a CLM system.
Compliance and risk management A CLM system can automatically trigger notifications when contracts violate certain compliance guidelines or when risky clauses are identified. In addition, based on the stored data, the system can automated reports create for audits or internal controls. This makes it a powerful tool in risk management and regulatory compliance.

Disadvantages of a full-fledged CLM system

costs: Perhaps the biggest disadvantage of a full-fledged CLM system is the expenses. Such systems often require significant investments in licenses, implementation, and training. Companies must consider whether the added value of automation and centralized administration justifies the high costs, particularly for smaller companies.
Complexity of implementation: Implementing a CLM system can be complex and time-consuming. It must integrations are carried out with existing IT systems, such as document management systems or CRM tools. In addition, the introduction of a CLM system often requires comprehensive training of employees in order to be able to use the functions of the system effectively.
Adjustment costs: Although CLM systems often offer standardized prompts and workflows, they often need to be sent to specific needs be adapted by the company. This may require additional development effort, particularly if the company has specific requirements for contract types or analyses.
Maintenance and regular updates: A CLM system must regularly maintained and updated to ensure that it meets current legal and regulatory requirements. This can require additional resources, as not only the software but also the underlying data and processes must be constantly monitored and optimized.

A full-fledged CLM system offers significant benefits in terms of efficiency, data management, and analysis that simple AI models such as ChatGPT cannot offer. In particular, large companies with extensive contract volumes and high compliance requirements can benefit from automation, who centralized management and the Analytical features benefit from a CLM system. However, for smaller companies or for specific, one-off contract analyses, the use of simple AI models can be a more cost-effective and efficient solution.

The choice between a CLM system and a simple AI model depends heavily on resources, the requisitions and the Contract volume from the respective company.

Practical checklist for evaluating AVV using language models

initiation

Regardless of whether you use a full-fledged CLM system, a manual audit, or a simple language model, careful review of order processing contracts (AVVs) is essential to ensure that data protection requirements are met. A thorough analysis of these contracts not only protects sensitive data, but also ensures compliance with the GDPR.

In this section, we offer you a Checklist with the 10 most important factors, which you should consider when testing AVVs. Each factor includes instructions for manual verification, as well as specifically formulated Prompts for using AI tools if you're considering automating contract analysis using a language model. These prompts help you to efficiently filter out relevant clauses and information from contracts and thus speed up the review process.

checklist

You will also receive a checklist with the 10 most important factors that you should consider when reviewing order processing contracts (AVVs). A complete list as an Excel sheet can also be obtained from top.legal. Each factor is explained why it is important, and an AI prompt in German and the relevant legal reference (in particular GDPR) are provided.