How Can M&A Attorneys Assess Readiness Before Introducing AI Into Deal Workflows?

Define the exact task before assessing readiness

Start with a narrow work product. For example, an illustrative candidate task is extracting assignment and change-of-control wording from an authorized set of contracts into an internal worksheet. Specify that the tool proposes text and document references. A designated M&A attorney decides what the provisions mean for the contemplated transaction. An extraction task is not permission to determine consent obligations, advise the client, or communicate with counterparties.

Write down the inputs, intended output, responsible reviewer, and decisions excluded from the task. If the team cannot describe how it would verify the output manually, its verification process needs work before AI enters it. ABA Formal Opinion 512, issued in July 2024 and based on the ABA Model Rules, says lawyers need a reasonable understanding of the specific technology and remain responsible for work performed for clients. It does not replace the professional rules applicable in a lawyer's jurisdiction. [1]

Resolve matter restrictions before using deal information

Have the matter-responsible attorney check the engagement terms, client instructions, relevant confidentiality agreements, and data-room access conditions. Identify whether the proposed use requires further authorization or is prohibited. Review restrictions on onward sharing, external processing, and use of information received from another party. An account approved by the firm does not resolve every matter's restrictions. Treat uncertainty as a prerequisite requiring a decision, not as implied permission.

Under its Model Rules analysis, ABA Opinion 512 treats confidentiality risk as dependent on the client, matter, task, and tool. Its discussion of informed consent for certain self-learning tools reflects the capabilities and risks considered when the opinion was issued. It also explains that generic engagement-letter language is insufficient when informed consent is required. Responsible counsel should assess the actual configuration and applicable local obligations rather than assume all AI uses require the same consent. [1]

Separately assess privilege and any relevant privacy or cross-border data obligations. Do not assume that confidentiality controls alone settle those questions. California's practical guidance calls for reviewing client AI restrictions and analyzing relevant laws; that guidance is jurisdiction-specific, not a blanket rule for every deal team. [2]

Confirm the permitted tool and its data handling

Assign the firm's technology or security lead to document how the proposed account handles prompts, uploaded documents, outputs, and retained conversation history. Ask who can access them, whether inputs may be used for training or other provider purposes, what deletion means, and what happens when service ends. Include enabled connections and shared workspaces in that assessment. The matter attorney should review the resulting facts against the proposed use, with specialist assistance where needed.

ABA Opinion 512 recommends understanding terms, privacy policies, retention arrangements, and security measures. California's guidance likewise addresses reviewing provider use of inputs and consulting IT or cybersecurity professionals before using confidential information. Neither source establishes that a product label or paid subscription proves adequate protection. [1] [2]

Record the permitted environment and allowed information categories. Where authorization is unresolved, use synthetic documents or material independently confirmed as suitable for testing. Removing names is not a substitute for assessing whether the remaining facts identify a client or transaction. If the team cannot establish acceptable data handling, the readiness result should exclude live matter information from the proposed pilot.

Repair the document set before testing extraction

Make a source manifest: a record of each document's identifier, version, status, and relationship to amendments or schedules. The legal operations owner can prepare it, but an attorney should resolve questions about which records belong in the review. Distinguish executed agreements from drafts and superseded copies. List missing attachments instead of allowing an apparently complete folder to stand in for a complete contractual record.

Inspect representative pages after optical character recognition, which converts scanned text into searchable text. Check that clause numbering, negations, signature pages, and table contents remain readable. A missing 'not' can change an extraction's meaning. Where a file is unreadable or a governing amendment is absent, obtain a better source or keep the affected document outside the task until the gap is resolved.

The proposed readiness condition is traceable, usable input, not a perfectly formatted archive. NIST's July 2024 Generative AI Profile recommends grounded retrieval data and source verification. It is a voluntary risk-management resource, not a legal standard or certification. A document manifest and page checks are practical ways to apply those recommendations to deal work. [3]

Reserve reviewer capacity and an escalation route

Name the attorney who can review the candidate output and confirm that the attorney can access the underlying records. Assign a backup for absence and an escalation owner for ambiguous provisions. The readiness question is not whether someone is willing to supervise. It is whether a qualified reviewer can perform the required source checks before anyone relies on the work product. Narrow the proposed scope if review capacity is insufficient.

ABA Opinion 512 ties the appropriate degree of independent verification to the tool and task while preserving the lawyer's responsibility. Its supervisory discussion calls for permissible-use policies and training for lawyers and nonlawyers. [1] A recommended initial trial should therefore require source review of every proposed finding, rather than treating a fluent worksheet as verified work.

Training should rehearse the actual failure modes: a provision attributed to the wrong agreement, a missed amendment, a quotation without its exception, or an invented citation. Reviewers should know how to reject an answer and continue manually. Do not let a deadline turn missing supervision into assumed readiness.

Decide how evidence and corrections will be retained

Before testing, define a finding record that identifies the source version, page or clause, quoted wording, proposed extraction, and reviewer disposition. Preserve distinctions between model output, attorney correction, and accepted work product. The original contract remains the source of truth; a generated summary is a proposed interpretation or extraction, not a replacement record.

Agree where the trial record will be stored, who may access it, and which retention or preservation requirements govern it. Avoid assuming that keeping every prompt indefinitely is appropriate. The matter attorney and records owner should reconcile useful traceability with confidentiality and applicable matter requirements.

NIST recommends checking output sources and citations during pre-deployment evaluation and ongoing monitoring. [3] Apply that to each claimed provision: open the referenced document, confirm that the wording exists, and examine its surrounding text. If an output cites the correct document but omits a material exception, record the failure rather than accepting the citation as proof of accuracy.

Use a controlled trial to expose unresolved prerequisites

Once the test materials and environment are authorized, assemble a limited evaluation set representing the proposed task. An illustrative set could contain a clean contract, a poor scan, an amendment changing the relevant wording, and an agreement without the requested clause. Prepare attorney-checked reference answers before running the test. This lets the team distinguish a correct extraction from an unsupported guess.

Compare the output against those references and source records. Check omitted documents, incorrect clause locations, invented wording, missed exceptions, and failure to state that the available information is insufficient. Track whether reviewers can reproduce the source checks. Record actual findings without turning this small trial into a claim about accuracy across all deal documents.

NIST cautions against extrapolating capabilities from narrow or anecdotal assessments and recommends minimum performance or assurance criteria for deployment decisions. [3] Set task-specific acceptance criteria before inspecting results. Recommended stopping conditions include unauthorized information entering the environment, citations that cannot be verified, unresolved material extraction errors, or review work exceeding available capacity. Suspend testing if account settings or tool behavior change in a way that invalidates the prior assessment. Passing this trial supports only the defined scope.

Produce a prerequisite register, not a rollout promise

The assessment should end with a short register linking each gap to an accountable owner and evidence needed for closure. Examples include an unanswered client restriction for the matter attorney, an incomplete contract family for legal operations, uncertain input retention for the technology lead, and unavailable review coverage for the supervising attorney. Describe what must be resolved before the deal pilot starts, rather than assigning a launch date that assumes resolution.

Use decisions such as 'ready for this bounded task,' 'restricted to synthetic testing,' or 'not ready pending specified prerequisites.' A favorable document-quality result cannot compensate for missing permission. Keep manual review available and require a human decision before expanding the scope or releasing a work product.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

Acquivo is user-operated software with no success fee. This readiness framework is a recommended process, not a claim that the platform supplies every control described here. Software does not represent clients or replace counsel's legal judgment. Matter-specific legal, ethical, and confidentiality questions belong with qualified counsel and relevant specialists before live deal information is used.