Contract playbooks describe the position a company wants: the liability cap it prefers, the indemnity scope it will give, the payment terms it expects, the data protection language it requires. Real negotiations depart from those positions constantly, and correctly so, because a playbook that is never departed from is a playbook set too loosely. The problem is not deviation. The problem is that most companies have no record of what they deviated on, who agreed to it, or why.
Without that record, three costs accumulate quietly. The same term gets re-analysed from scratch every time a counterparty pushes on it, because nobody can find the last decision. Concession patterns stay invisible, so a company never notices that it has accepted uncapped data breach liability in a quarter of its vendor agreements. And renewal negotiations start from the current paper rather than from a deliberate view of which concessions to claw back, because nobody knows which terms were concessions. The same data-quality problem shows up in contract data migration into a new CLM, where undocumented concessions arrive as plain contract text.
A contract exception register fixes all three at once, and it is one of the cheaper governance artefacts to build. It requires no new approval workflow, only that the approval already happening gets written down in a structured place. The discipline is in the fields and the review cadence, not in the tooling.
What belongs in the register
A register with too few fields is unusable and one with too many never gets filled in. The set below is the practical minimum that supports both the precedent lookup and the portfolio view, and it can be captured in under two minutes per exception when it is part of the approval step rather than a separate task.
- The standard position, the playbook clause or parameter that was departed from, referenced by identifier so the register survives playbook revisions.
- The accepted language, the actual text agreed, not a summary, because precedent value depends on the exact wording.
- The approver and date, the named person with authority for that deviation class, which is what turns the entry into evidence.
- The business justification, one or two sentences on why the departure was accepted, such as strategic account, regulatory requirement or no viable alternative supplier.
- Scope and expiry, the contracts and entities affected, and whether the exception is one-time, term-limited or standing.
Those fields are only useful if they are searchable by clause type and counterparty, which is why the register belongs in the contract system rather than in a spreadsheet. A reviewer facing a pushback on limitation of liability should be able to see every prior deviation on that clause, the approvers, and the outcomes, in the same place they are drafting, alongside the approved clause library their team trusts.
The most valuable output of an exception register is not the audit trail, it is the frequency count. When a fallback position is approved in the large majority of negotiations, the playbook standard has become aspirational and every negotiation is paying an approval tax for a predetermined outcome. Move the fallback to standard and reserve escalation for genuine outliers.
Design decisions that determine whether the register gets used
Registers fail for predictable reasons, almost all of them about friction and ownership rather than data model. These are the choices worth making deliberately at the start.
- Capture at approval, never afterwards. If the register is populated in a weekly catch-up, it will be incomplete within a month. The entry has to be the approval record itself, created when the approver signs off.
- Define exception classes and authority levels. Not every deviation needs a general counsel. Mapping clause types to approval levels is what makes the register a control rather than a bottleneck.
- Link entries to the contract, both ways. From a contract you should see its exceptions; from an exception you should see every contract carrying it. One-directional links decay into uselessness.
- Set an explicit review cadence. Quarterly review by clause type, looking at frequency, approver distribution and aggregate exposure. Without a scheduled review the register becomes a write-only log.
- Distinguish accepted risk from mistakes. Some entries record a deliberate commercial trade, others record a term that slipped through. Tagging them differently keeps the renegotiation list honest.
A five-step roadmap to stand up a deviation register
Step 1, Inventory your playbook positions
You cannot record departures from a standard you have not written down. Convert the playbook into identified positions per clause type, each with a standard and one or two named fallbacks. Positions that exist only in a senior reviewer’s head are the first thing to document.
Step 2, Map clause types to approval authority
Decide who can approve a departure for each clause type and each severity band. Publish the map so negotiators know where an escalation goes before they need it, which removes most of the delay people blame on governance.
Step 3, Add the register fields to the approval step
Make the approver record the standard position, the accepted language, the justification and the scope as part of signing off. Pre-populate everything the system already knows so the human input is the justification and the scope.
Step 4, Backfill the highest-risk clause types
Do not attempt a full historical backfill. Pick two or three clause types where exposure aggregates, typically liability caps, indemnities and data protection terms, and populate those from executed agreements using AI extraction with human review.
Step 5, Run the quarterly review and act on it
Review frequency and aggregate exposure by clause type. Promote habitual fallbacks to standard, add genuine outliers to the renewal claw-back list, and retire exception classes that no longer occur.
Turn deviation approvals into reusable precedent
Aavenir records every off-playbook term with its approver, rationale and scope, searchable beside the clause it departed from.
What the register gives you at renewal
Renewal is where an exception register pays for itself most visibly. Approaching a renewal without one, a team reads the current agreement and negotiates from it, which silently ratifies every concession embedded in the last round. With a register, the team opens the renewal knowing exactly which terms were departures from standard, why each was accepted, and whether the original justification still holds. A concession granted to win a strategic logo in a competitive process looks different three years later when the relationship is entrenched and switching costs run the other way. That is a specific, arguable renegotiation position rather than a general wish to improve terms, and specific positions are the ones that get conceded. Manufacturers running contract lifecycle management for manufacturing use the same register to track which supplier concessions to reverse when volumes recover.
Exception classes and how to treat them
Not all deviations deserve the same handling. The table below is a workable starting taxonomy, which most teams adapt within a quarter once they see their own frequency distribution.
| Exception class | Typical approver | Review trigger | Renewal treatment |
|---|---|---|---|
| Liability cap above standard multiple | General counsel or risk committee | Any occurrence | Claw back unless leverage has worsened |
| Indemnity scope broadened | Senior legal | Any occurrence | Narrow to standard, offer cap trade |
| Data protection terms below policy | Privacy lead plus legal | Any occurrence | Bring to policy or add compensating control |
| Payment terms extended | Finance and category owner | Quarterly aggregate | Renegotiate if working capital impact is material |
| Auto-renewal accepted without notice carve-out | Category owner | Quarterly aggregate | Add notice window and rate cap |
A deviation register is unglamorous infrastructure that changes how a legal and procurement function accumulates knowledge. Without it, every negotiation starts near zero and every concession is permanent by default. With it, decisions compound: precedent is findable, exposure is countable, the playbook corrects itself against reality, and renewals begin from a deliberate position. The build is small. The fields are five. The discipline is capturing them at the moment of approval and actually reading the register once a quarter.
For related guidance, see Contract notice delivery requirements, a control gap, How to build a contract metadata model for AI search and What agentic AI contract management actually changes.
