Build an NDA risk summary with Box AI Extract

mkdir nda-risk-summary && cd nda-risk-summary

python3 -m venv .venv
source .venv/bin/activate

pip install boxsdk python-dotenv

BOX_CLIENT_ID=your_client_id
BOX_CLIENT_SECRET=your_client_secret
BOX_ENTERPRISE_ID=your_enterprise_id
NDA_FILE_ID=your_file_id
OUTPUT_FOLDER_ID=your_folder_id

import os
from dotenv import load_dotenv
from box_sdk_gen import BoxClient, BoxCCGAuth, CCGConfig

load_dotenv()

def get_box_client() -> BoxClient:
    config = CCGConfig(
        client_id=os.getenv("BOX_CLIENT_ID"),
        client_secret=os.getenv("BOX_CLIENT_SECRET"),
        enterprise_id=os.getenv("BOX_ENTERPRISE_ID"),
    )
    auth = BoxCCGAuth(config=config)
    return BoxClient(auth=auth)

from box_sdk_gen import CreateAiExtractStructuredFields

EXTRACTION_FIELDS = [
    CreateAiExtractStructuredFields(
        key="governing_law",
        display_name="Governing law",
        type="string",
        prompt="The governing law or jurisdiction that applies to the agreement.",
    ),
    CreateAiExtractStructuredFields(
        key="term",
        display_name="Term",
        type="string",
        prompt="The overall duration of the agreement, including any renewal terms.",
    ),
    CreateAiExtractStructuredFields(
        key="termination",
        display_name="Termination",
        type="string",
        prompt="The termination conditions, including any required notice period.",
    ),
    CreateAiExtractStructuredFields(
        key="confidentiality_period",
        display_name="Confidentiality period",
        type="string",
        prompt="How long confidentiality obligations remain in effect after termination.",
    ),
    CreateAiExtractStructuredFields(
        key="liability_cap",
        display_name="Liability cap",
        type="string",
        prompt="The limitation of liability or liability cap, including any amount and currency.",
    ),
]

from box_sdk_gen import AiItemBase

from box_client import get_box_client
from schema import EXTRACTION_FIELDS

def extract_clauses(file_id: str) -> dict:
    client = get_box_client()

    response = client.ai.create_ai_extract_structured(
        items=[AiItemBase(id=file_id)],
        fields=EXTRACTION_FIELDS,
        include_confidence_score=True,
        include_reference=True,
    )

    return {
        "answer": response.answer or {},
        "confidence_score": response.confidence_score or {},
        "reference": response.reference or {},
    }

CLAUSES = [
    "governing_law",
    "term",
    "termination",
    "confidentiality_period",
    "liability_cap",
]

APPROVED_JURISDICTIONS = ["delaware", "new york", "california", "england"]

SEVERITY_ORDER = {"none": 0, "low": 1, "medium": 2, "high": 3}

def assess_clause(key: str, value, confidence: dict):
    # A missing clause is the highest risk: it could not be located in the document.
    if not value:
        return "high", "Clause not found. Review the document manually."

    severity, note = "low", "Clause found."

    if key == "liability_cap" and any(
        term in value.lower() for term in ["unlimited", "no cap", "not limited"]
    ):
        severity, note = "high", "Liability appears to be uncapped."
    elif key == "governing_law" and not any(
        j in value.lower() for j in APPROVED_JURISDICTIONS
    ):
        severity, note = "medium", "Governing law is outside the approved list."

    # A low-confidence extraction is never treated as better than medium risk.
    score = (confidence or {}).get("score", 1)
    if score < 0.7 and SEVERITY_ORDER[severity] < SEVERITY_ORDER["medium"]:
        severity = "medium"
        note = f"{note} Low extraction confidence ({score:.2f}); verify against the source."

    return severity, note

def build_risk_summary(extraction: dict, document: str) -> dict:
    answer = extraction["answer"]
    scores = extraction["confidence_score"]
    references = extraction["reference"]

    findings = []
    for key in CLAUSES:
        value = answer.get(key)
        confidence = scores.get(key)
        severity, note = assess_clause(key, value, confidence)
        findings.append({
            "clause": key,
            "value": value,
            "severity": severity,
            "note": note,
            "confidence": confidence,
            "source": references.get(key),
        })

    overall = max(findings, key=lambda f: SEVERITY_ORDER[f["severity"]])["severity"]
    return {"document": document, "overall_risk": overall, "findings": findings}

def to_markdown(summary: dict) -> str:
    lines = [
        f"# Deal Risk Summary: {summary['document']}",
        "",
        f"**Overall risk:** {summary['overall_risk'].upper()}",
        "",
        "> Generated automatically for triage only. This is not legal advice.",
        "",
        "| Clause | Value | Risk | Confidence | Notes |",
        "| --- | --- | --- | --- | --- |",
    ]
    for f in summary["findings"]:
        level = f["confidence"]["level"] if f["confidence"] else "N/A"
        value = f["value"] or "_Not found_"
        clause = f["clause"].replace("_", " ").title()
        lines.append(
            f"| {clause} | {value} | {f['severity'].upper()} | {level} | {f['note']} |"
        )
    return "\n".join(lines)

import io
import json
import os

from dotenv import load_dotenv
from box_sdk_gen import UploadFileAttributes, UploadFileAttributesParentField

from box_client import get_box_client
from extract import extract_clauses
from risk import build_risk_summary, to_markdown

load_dotenv()

def upload_companion_file(client, folder_id: str, name: str, content: str) -> str:
    files = client.uploads.upload_file(
        attributes=UploadFileAttributes(
            name=name,
            parent=UploadFileAttributesParentField(id=folder_id),
        ),
        file=io.BytesIO(content.encode("utf-8")),
    )
    return files.entries[0].id

if __name__ == "__main__":
    file_id = os.getenv("NDA_FILE_ID")
    folder_id = os.getenv("OUTPUT_FOLDER_ID")

    extraction = extract_clauses(file_id)
    print("Raw extraction:")
    print(json.dumps(extraction, indent=2))

    summary = build_risk_summary(extraction, document=f"NDA-{file_id}")
    markdown = to_markdown(summary)

    print("\nDeal Risk Summary:")
    print(markdown)

    client = get_box_client()
    json_id = upload_companion_file(
        client, folder_id, f"{summary['document']}-risk-summary.json",
        json.dumps(summary, indent=2),
    )
    md_id = upload_companion_file(
        client, folder_id, f"{summary['document']}-risk-summary.md", markdown,
    )

    print(f"\nUploaded JSON summary (file ID {json_id}) and markdown summary (file ID {md_id}).")

nda-risk-summary/
├── .env
├── .venv/
├── app.py
├── box_client.py
├── extract.py
├── risk.py
└── schema.py

python3 app.py

{
  "answer": {
    "governing_law": "State of New York",
    "term": "Two years from the Effective Date",
    "termination": "Either party may terminate with 30 days written notice.",
    "confidentiality_period": "Three years after termination",
    "liability_cap": "Fees paid in the 12 months preceding the claim"
  },
  "confidence_score": {
    "governing_law": { "level": "HIGH", "score": 0.95 },
    "term": { "level": "HIGH", "score": 0.92 },
    "termination": { "level": "MEDIUM", "score": 0.81 },
    "confidentiality_period": { "level": "MEDIUM", "score": 0.78 },
    "liability_cap": { "level": "LOW", "score": 0.64 }
  }
}

# Deal Risk Summary: NDA-123456789

**Overall risk:** MEDIUM

> Generated automatically for triage only. This is not legal advice.

| Clause | Value | Risk | Confidence | Notes |
| --- | --- | --- | --- | --- |
| Governing Law | State of New York | LOW | HIGH | Clause found. |
| Term | Two years from the Effective Date | LOW | HIGH | Clause found. |
| Termination | Either party may terminate with 30 days written notice. | LOW | MEDIUM | Clause found. |
| Confidentiality Period | Three years after termination | LOW | MEDIUM | Clause found. |
| Liability Cap | Fees paid in the 12 months preceding the claim | MEDIUM | LOW | Clause found. Low extraction confidence (0.64); verify against the source. |