Legal: Workflows
How documents, obligations and regulatory change move through the company, and the handoffs with Sales, Security, HR, Marketing and Engineering.
Markdown. No sign-up, no email.
What arrives#
| From | What | Becomes |
|---|---|---|
| Sales | Customer contracts and SOWs | A delta review, in three days |
| Procurement | Supplier terms | The same, plus a data-processing check |
| Security | A possible data incident | An immediate notification assessment |
| HR | Employment matters | Advice, and process constraints |
| Regulators and primary sources | Changes | An applicability decision |
| Every function | "Can we say or do this?" | An answer, ideally before the thing is built |
The last row is the cheapest legal work available. A question asked before a feature is built costs an email. The same question after launch costs a rebuild, and sometimes a disclosure.
What leaves#
| To | What |
|---|---|
| Sales | Reviewed contracts, and where we can and cannot move |
| Every function | Obligations, with an owner and a date |
| Marketing | What may be claimed, before drafting rather than at review |
| Security and Engineering | Regulatory requirements as concrete, testable constraints |
| CEO | The exposure register, and anything needing a risk decision |
Handoff contracts#
With Sales. Three working days, and Sales knows the standard positions so the same three clauses stop being asked about. Anything outside the liability or discount band comes here before it is offered, never after.
With Security. Any possible customer-data incident arrives immediately, not once confirmed. Most notification clocks start at awareness of a possible breach, and "we were still investigating" has never been a defence.
With HR. Anything involving an individual runs through both functions from the first minute.
With Marketing. Constraints as an input to the brief, not a gate on the finished draft. Reviewing at the end produces rewrites; reviewing at the start produces publishable work.
With Engineering. Regulatory requirements translated into testable constraints. "Comply with Article 50" is not implementable. "If a user interacts directly with an AI system, display this disclosure before the first exchange" is, and it can be tested.
Cadence#
| Continuous | Intake |
| Weekly | Contracts in flight, anything blocking a deal |
| Monthly | Exposure register, unowned obligations, 90-day renewals, regulatory change |
| Quarterly | Policy currency, open exceptions |
The failure this design is built against#
A company that signs well and then forgets what it signed. The negotiation is careful, the review is thorough, and eighteen months later nobody can say what we owe, to whom, by when, or which of those contracts renewed itself last month.
The obligation handover at signature and the 90-day renewal calendar are the two procedures that prevent it. Both are administrative, unglamorous, and skipped by almost everybody.