# Legal Adjacent Writing > Reference for drafting legal-adjacent prose that will go to counsel: contracts, disclaimers, privacy notices, breach disclosures, and regulator-facing statements. This skill is craft for drafts, not l Parent: [Writing and Documentation](https://llms-explorer.com/tree/writing-and-documentation/) · 14 facets · 54 facts · page: https://llms-explorer.com/tree/legal-adjacent-writing/ ## Legal-Adjacent Writing - Reference for drafting legal-adjacent prose that will go to counsel: contracts, disclaimers, privacy notices, breach disclosures, and regulator-facing statements. This skill is craft for drafts, not legal advice. Every output should carry a "counsel must review before execution" footer. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#legal-adjacent-writing) ## The five-point legal-adjacent writing test - Is the risk-allocating verb correct? "Shall," "will," "must," and "may" are not synonyms. Modern drafting prefers "must" over "shall" because "shall" has been litigated into ambiguity. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#the-five-point-legal-adjacent-writing-test) - Are the defined terms actually defined? Every Capitalized Term should appear once in a Definitions section. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#the-five-point-legal-adjacent-writing-test) - Does the carve-out language survive a hostile read? "Except for" should be paired with a non-exhaustive list ("including but not limited to") only when you want breadth. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#the-five-point-legal-adjacent-writing-test) - Is the temporal scope explicit? "In the 12 months preceding the event giving rise to the claim" is unambiguous. "In the prior year" is ambiguous. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#the-five-point-legal-adjacent-writing-test) - Is the notice-and-cure mechanism workable? If a clause requires "written notice," specify the delivery channel, the recipient, and the cure window. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#the-five-point-legal-adjacent-writing-test) ## 2. The limitation-of-liability triangle - Cap amount. Most common SaaS form: "fees paid by Customer in the 12 months preceding the event." — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#2-the-limitation-of-liability-triangle) - Damages exclusion. "No indirect, incidental, special, consequential, or punitive damages, including lost profits." — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#2-the-limitation-of-liability-triangle) - Carve-outs. Standard market carve-outs: breach of confidentiality, breach of IP indemnification, payment obligations, gross negligence, willful misconduct, death or personal injury. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#2-the-limitation-of-liability-triangle) ## 3. The "AS IS" warranty disclaimer - The standard pattern: — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#3-the-as-is-warranty-disclaimer) - The all-caps formatting is not stylistic. It is a UCC § 2-316 "conspicuousness" requirement. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#3-the-as-is-warranty-disclaimer) ## 4. The 8-K Item 1.05 cyber disclosure - The SEC's 2023 cybersecurity rules require public companies to file a Form 8-K within four business days of determining that a cybersecurity incident is material. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#4-the-8-k-item-105-cyber-disclosure) - What must be disclosed: — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#4-the-8-k-item-105-cyber-disclosure) - The material aspects of the nature, scope, and timing of the incident — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#4-the-8-k-item-105-cyber-disclosure) - The material impact or reasonably likely material impact on the registrant — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#4-the-8-k-item-105-cyber-disclosure) - What is NOT required: specific technical detail about the attack vector, specific detail about cybersecurity systems, or any detail that would impede ongoing remediation. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#4-the-8-k-item-105-cyber-disclosure) ## 5. GDPR Article 33 — the 72-hour clock - GDPR Article 33 requires controllers to notify the supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it." — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) - Phased notification is explicitly permitted. Article 33(4) allows you to provide information "in phases without undue further delay." — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) - The notification must include: — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) - Name and contact details of the DPO — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) - Likely consequences of the breach — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) - Measures taken or proposed — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#5-gdpr-article-33-the-72-hour-clock) ## 6. Privacy notice architecture (GDPR / CCPA / CPRA) - Required components under GDPR Article 13/14: — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) - Identity and contact details of the controller — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) - Purposes of processing and legal basis for each — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) - Recipients or categories of recipients — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) - Storage period or criteria — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) - Right to lodge a complaint with a supervisory authority — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#6-privacy-notice-architecture-gdpr-ccpa-cpra) ## Anti-Patterns - Mixing "shall" and "must" within the same document. Pick one register. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#anti-patterns) - The "reasonable" undefined. "Commercially reasonable" should be defined or paired with a benchmark. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#anti-patterns) - Non-conspicuous warranty disclaimers. A disclaimer that is not in all caps may be ignored under UCC § 2-316. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#anti-patterns) - Promising what you can't deliver in a privacy notice. "We will never share your data with anyone" creates a contractual representation. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#anti-patterns) - Stuffing technical detail into an 8-K cyber disclosure. Describe impact, not mechanism. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#anti-patterns) ## Final reminder - > This is draft language only. It is not legal advice. Qualified counsel must review before execution, filing, or public release. — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#final-reminder) ## References - SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Form 8-K Item 1.05 final rule, effective Dec 18, 2023) — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#references) - UK ICO, Personal data breaches: A guide — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#references) - GDPR Article 33 and 34 — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#references) - UCC § 2-316 (conspicuous disclaimer of implied warranties) — [source](https://llms-explorer.com/sources/mdb-context-hub/legal-adjacent-writing/#references) ## Where this helps - Drafting a SaaS limitation-of-liability clause or warranty disclaimer that needs to survive both a hostile legal read and a UCC conspicuousness requirement before it goes to counsel. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Writing a breach-notification statement under a tight regulatory clock — the GDPR 72-hour window or an 8-K Item 1.05 four-business-day filing deadline — where imprecise language creates real exposure. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Building or revising a privacy notice that needs to satisfy overlapping GDPR Article 13/14 and CCPA/CPRA disclosure requirements without over-promising. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Reviewing a contract draft for the specific ambiguity patterns — mixed "shall"/"must", undefined "reasonable", non-exhaustive carve-outs — that counsel will flag on first pass. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## How to apply this - Run every clause through the five-point test before sending it to counsel: correct risk-allocating verb, defined terms actually defined, carve-outs that survive a hostile read, explicit temporal scope, and a workable notice-and-cure mechanism. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Pick one modal-verb register ("must," not "shall") and hold it consistently across the whole document instead of mixing them. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - When drafting a breach or incident disclosure, describe material impact and timing, not attack-vector or system-level technical detail — that is what 8-K Item 1.05 explicitly does not require. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Attach the "counsel must review before execution" footer to every draft as a default habit, not an afterthought, since this craft produces drafts, not legal advice. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Common mistakes - Formatting a warranty disclaimer in normal case instead of all caps — under UCC § 2-316, a disclaimer that is not conspicuous can be disregarded regardless of what it says. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Leaving "commercially reasonable" or similar terms undefined instead of pairing them with a benchmark or definition, which invites exactly the ambiguity dispute the drafting is trying to avoid. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Writing an absolute privacy promise like "we will never share your data with anyone," which creates a binding representation that becomes a liability the moment an exception (a subprocessor, a legal request) arises. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Padding an 8-K cyber disclosure with technical detail about the attack vector or security systems instead of sticking to material impact and scope, which the SEC rule explicitly warns against. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Limitations - This craft produces drafts for counsel review, not legal advice — none of the patterns here substitute for jurisdiction-specific review before execution, filing, or public release. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - The GDPR 72-hour clock and the 8-K four-business-day window are both triggered by "awareness" or "materiality" determinations that themselves require legal and technical judgment this reference does not make for you. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Market-standard limitation-of-liability carve-outs (confidentiality, IP indemnification, gross negligence) shift over time and by jurisdiction, so a pattern that was standard when this pack was written can drift out of step with current market terms. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - "Shall" being litigated into ambiguity is a documented drafting concern, not a universal rule — some jurisdictions and document types still treat "shall" as controlling, so the "must" preference needs to be checked against governing law and house style. — [source](https://llms-explorer.com/tree/legal-adjacent-writing/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Context files - [Legal Adjacent Writing](https://llms-explorer.com/downloads/sources/mdb-context-hub/legal-adjacent-writing.md)