Use Legal Risk Assessment safely

Legal Risk Assessment is a skill from the Knowledge Work Plugins that Anthropic publishes openly on GitHub under anthropics/knowledge-work-plugins. The skill belongs to the legal plugin and targets in-house legal teams who want to use Claude as an assistant to structure the evaluation of contracts, disputes, or regulatory questions. According to the provider, this is explicitly not legal advice: the skill assists with legal workflows, but every risk assessment should be reviewed by qualified legal professionals, and the bundled framework is meant as a starting point that organizations need to adapt to their own risk appetite and industry context.

The assessment grid: severity times likelihood

At the core sits a classic two-dimensional risk matrix. Severity ranges from negligible through low, moderate, and high to critical, describing the impact if the risk materializes, for example measured against the share of the affected contract or deal value. Likelihood ranges from remote through unlikely, possible, likely, to almost certain, describing how realistic an event is based on precedent and triggering circumstances. Multiplying both values on a one-to-five scale yields a risk score between one and twenty-five, which is automatically mapped to one of four color bands: green for low risk, yellow for medium, orange for high, and red for critical risk. This color logic is easy to reuse in presentations, risk registers, or management reporting.

From classification to concrete recommended action

Every color band comes with clear recommended actions. For green risks, the skill states it is enough to accept the issue, document it in the risk register, and monitor it in periodic, relatively infrequent reviews without any escalation being necessary. At the opposite end, red, critical risks demand immediate escalation to leadership and, where appropriate, the board, engaging outside specialist counsel, standing up a dedicated response team, checking whether an insurance notification is required, and reviewing the matter daily or more often until it is resolved. In between sit graduated recommendations for medium and high risks that call for closer monitoring or involving specialist departments.

Documentation standard for formal risk assessments

The skill also prescribes a fixed structure for formal risk assessment memos, covering date, assessor, the matter at hand, and a note on possible attorney-client privilege, followed by a risk description, background, the actual severity and likelihood analysis with rationale, contributing and mitigating factors, a table of mitigation options with their effectiveness and cost, the recommended approach, the residual risk expected after implementing mitigations, and a monitoring plan with concrete next steps including owners and deadlines. In addition, the skill defines criteria for when outside counsel should be mandatory, strongly recommended, or merely worth considering, for example in active litigation, government investigations, matters with potential criminal exposure, or complex multi-jurisdictional questions.

Requirements and integration

The skill is used inside Claude Cowork or Claude Code by installing the legal plugin from the Knowledge Work Plugins marketplace; a SKILL.md file with a name and description ensures Claude pulls it in automatically whenever a user asks about contract risk, deal exposure, or whether a matter needs escalation to senior counsel. No external credentials are required, but access to the relevant contract or fact documents is needed so Claude can derive the assessment from real content.

Security, practical value, and limitations

The main security consideration is that risk assessments often fall under attorney-client privilege and should therefore be marked as privileged and access-restricted, which the memo format already anticipates. The practical value lies in a consistent, traceable assessment language across teams and locations that speeds up escalation decisions and simplifies board reporting. The limitation is unambiguous: the framework does not replace qualified legal review, provides no legally binding determination, and must be contextualized and checked by actual professionals before decisions with financial or regulatory consequences are based on it.