Contracts
Contracts capture what a vendor has actually committed to. SolveGRC records each agreement, uses AI to pull its obligations into a structured list, and grades those obligations against the baseline you require, so a missing breach-notification clause or a weak SLA becomes a visible gap that feeds the vendor's risk.
Add a contract and its file
Contracts are added from the Contracts item in a vendor's sidebar. Click Add Contract and enter a Title, a Type, and an optional Expiration date, then attach the signed file. SolveGRC runs the file through its document pipeline so the text is searchable and ready for the AI steps below. The row shows "Indexing…" and then RAG ready when it's ready.
The org-wide Contracts hub and a contract's detail page are for browsing. The buttons that do the work, attach a file, extract obligations, and check coverage, live on the vendor's own Contracts item.
Extract the obligations
Once the file is indexed, click Extract obligations. The AI reads the contract and pulls out its security, breach-notification, SLA, privacy, and compliance obligations into a structured list, keeping the verbatim contract text for each one so every obligation traces back to the exact language. Obligations it judges important are flagged as critical.
Check coverage against your baseline
Check coverage appears once obligations have been extracted. Click it to grade the contract against your organization's required clause baseline. Each obligation then shows Met, Gap, or Not evaluated, and the AI records the policy minimum next to what the contract actually says. Every gap on a required item becomes a contractual risk signal and feeds the vendor's inherent risk, so a weak contract shows up in the vendor's score, not just in a report.
The coverage check compares the contract to your clause library. There is no screen in SolveGRC for authoring the required-clause baseline. If your organization has none, the check fails with "No clause-library baseline configured for this org."
Keep an eye on deadlines
Every Monday, SolveGRC recalculates the deadlines for active contracts: an expiration warning 30 days before the contract ends, a renewal or auto-renew notice when the notice period starts, and the next verification date for each recurring obligation. They appear under Upcoming deadlines on the contract's detail page and under Upcoming Obligations & Deadlines on the vendor's Contracts item. SolveGRC does not email them, and past dates stay listed, so check them regularly.
Contracts and findings are point-in-time. Vendors change after you sign, so the last piece is watching them. Continue to Monitor continuously.