First map the risks – IP, data, liability. Then pull a lawyer in for a 24‑hour “fire‑line” review, not a full audit. Focus on a simple, standard contract, get a clear statement of use rights, and make sure any data handling meets privacy laws. If it’s a prototype, keep it in a sandbox environment and limit liability caps. Keep the legal side lean and fast; that’s the only way to avoid swallowing the whole project.