How Can M&A Attorneys Check an AI-Assisted Teaser for Identifying or Sensitive Details?

1. Establish the permitted disclosure boundary and its owners

Before inspecting the teaser, write down what this version may disclose, to whom, and at which sale-process stage. A document intended for initial interest should not inherit permissions from a later confidential information memorandum. Record whether sector, geography, financial bands, customer concentration, and transaction rationale are permitted, require further approval, or must remain withheld. Identify the person authorized to approve the seller's disclosures rather than assuming any team member can do so.

Assign counsel responsibility for the legal and professional-responsibility review, the seller's financial lead responsibility for figures, and a process coordinator responsibility for preparing the exact approved file. ABA Formal Opinion 512, issued in July 2024, addresses competence, confidentiality, and review of generative AI work under the ABA Model Rules. Counsel must check the rules and guidance applicable in the relevant jurisdiction rather than treating the opinion as a universal rule. [1] This article supplies a general review framework, not an opinion on a particular disclosure or a substitute for jurisdiction-specific counsel.

2. Check input permissions before another AI review

An AI-assisted review can itself expose information if the reviewer uploads an unrestricted source pack. Separate permission to disclose facts in the teaser from permission to process those facts through a tool. Have counsel and the responsible technology reviewer examine the applicable service terms, retention settings, training use, access permissions, and deletion arrangements. If those questions cannot be resolved, use manual review or synthetic material instead of submitting transaction information.

Formal Opinion 512 advises understanding a tool's terms and privacy policies, with expert help where necessary. It discusses informed consent before inputting representation information into certain self-learning tools that may disclose it directly or indirectly; this is not a statement that every AI use requires the same consent. Local rules and the particular tool matter. [1] Limit any authorized input to the information needed for the inspection. Keep the seller identity mapping outside the AI input where feasible, and do not assume a project code makes otherwise identifying facts safe to upload.

3. Inspect visible identifiers beyond the company name

Perform a manual pass for legal and trading names, domains, email addresses, telephone numbers, addresses, customer names, and supplier references. Search likely abbreviations and previous names using an approved internal identifier list. Check logos, product labels, website screenshots, document captions, and photographs as well as the main narrative. For this workflow, an AI flag list supplements the human reading; it does not decide which identifiers are acceptable.

Look at the teaser's surrounding presentation too. A neutral project name can be undermined by an identifying filename, hyperlink destination, contact block, or image caption. Review the release message and attachment names when they are prepared, without authorizing the model to send anything. For an illustrative manufacturing teaser, removing the company name while retaining a distinctive branded machine photograph would leave a clue that merits separate review. This is a hypothetical review example, not an account of a client transaction.

4. Test combinations of clues from a recipient's perspective

A name-free teaser may still be recognizable to someone who knows the market. Review facts together: a narrow service niche, a specific locality, a distinctive facility, and a recent expansion announcement may create an identifying combination. Ask a second reviewer to explain how an intended recipient could connect the disclosed facts with public information or existing sector knowledge. Avoid uploading the unreleased teaser to public search tools; use only search terms counsel has cleared for that purpose.

The UK Information Commissioner's Office discusses singling out, linkability, and a motivated intruder's access to public information when assessing identification of people. Its guidance concerns personal information and is currently under review following changes made by the Data Use and Access Act. [2] These concepts are useful prompts for a corporate clue review, not a legal certification that a seller is anonymous. An illustrative response to a risky combination is to broaden geography or omit a distinctive milestone, then verify that the remaining description is still accurate. Do not replace the clue with a fictional fact.

5. Review restricted facts even when they do not identify the seller

Identity risk and disclosure permission are separate review questions. A paragraph can conceal the seller's name while revealing customer-level margins, contract expiry dates, employee details, pricing methods, security arrangements, or planned operational changes. Compare each such statement with the disclosure boundary and relevant source record. Counsel should examine any contractual restriction or personal-information issue under the applicable law and circumstances before the seller approves inclusion.

Mark unresolved material for removal or later-stage review rather than treating a prospective recipient's confidentiality agreement as permission to include everything. Have the authorized decision-maker distinguish information approved for this teaser from information approved only for a controlled later release. Also keep legal analysis, reviewer comments, and advice out of the marketing artifact unless counsel expressly determines otherwise. Do not assume AI processing preserves privilege, or that deleting a name resolves the underlying confidentiality question. The tool-specific disclosure risks described in Formal Opinion 512 remain relevant to the review process. [1]

6. Reconcile financial statements and detect unsupported additions

Require a source locator for each factual statement, whether it came from AI or a person. For financial content, record the approved financial statement or management schedule, reporting period, currency, units, and whether the figure is historical, forecast, or adjusted. The financial reviewer should check the actual record and any approved reconciliation. Generalizing a figure must not silently change the period, metric, or accounting basis. If a financial band is approved, verify that it contains the supported figure without exposing a restricted exact amount.

Compare the AI-assisted version with its approved input sentence by sentence. Flag invented market leadership, buyer interest, growth claims, licenses, or performance descriptions. An AI-generated source reference is not evidence until a reviewer opens the underlying record and checks the claim. NIST's July 2024 Generative AI Profile describes confabulation as confidently presented erroneous or false content, including output that diverges from its input. It also recommends verifying sources and citations in generated output. [3] Remove unsupported additions or hold them for verification; persuasive wording is not a reason to retain them.

7. Inspect residual content in the file that will leave the team

Work on a separate release copy while retaining the source draft internally. Inspect tracked revisions, comments, document properties, headers, footers, hidden text, and embedded material. Microsoft documents that Word's Document Inspector can find several such categories and recommends using a copy because removal may not be reversible. It also notes limits: the inspector cannot detect white text on a white background or objects covered by other objects. [4] A clean inspection report therefore does not replace visual and text review.

For a PDF release, inspect the saved PDF rather than relying on the editable source's appearance. Adobe documents sanitization options for hidden information such as metadata, comments, and hidden layers. [5] Treat visible redaction and hidden-content inspection as separate checks. Reopen the saved output, search for restricted terms, copy its available text into an approved local review environment, and inspect links, attachments, and captions. A drawn rectangle should not be accepted as evidence that the underlying text was removed. Have a technically competent reviewer resolve anything the chosen tools cannot reliably inspect.

8. Run a bounded trial with explicit stopping conditions

Test the review procedure first with a synthetic teaser containing deliberately planted issues: a direct name, an identifying clue combination, a restricted fact, an unsupported claim, and a comment or property. Have counsel define the expected findings and a technology reviewer prepare the test artifact. Give the AI a narrow task: identify candidate risks and point to the relevant text, without inferring the seller's identity, rewriting source facts, or issuing a release decision.

Compare the flags with the planted issues and the manual review. Stop the pilot if the model misses a planted restricted detail, invents a fact, cannot support a source reference, or operates outside the approved input permissions. Stop a live release for an unresolved clue combination, unexplained financial change, uninspectable file component, or missing approval. NIST recommends context-sensitive testing and warns against extrapolating capability from narrow anecdotal assessments. [3] Passing this trial supports a limited workflow decision, not a promise that later teasers will be anonymous, accurate, or compliant.

9. Define a human-reviewed teaser release checklist

Create a release record tied to the exact file version. Counsel records the resolved legal and confidentiality questions and any limits on audience or use. The financial reviewer records the approved sources and corrections. The seller's authorized decision-maker approves the permitted disclosure. The coordinator confirms that the final artifact matches those decisions and that recipients fall within the approved audience. If anyone edits the file afterward, reopen the affected checks rather than relying on an earlier approval.

The checklist should answer concrete questions: Have direct identifiers and combined clues been reviewed? Is every sensitive statement permitted at this stage? Does every factual claim trace to an approved source? Has the actual release file been inspected for residual content? Are input permissions and human approvals recorded? A missing answer means hold, not presumed approval. Keep the review record separate from the outward-facing file. Any subsequent distribution remains a deliberate human action within the agreed permissions, never an autonomous AI approval or outreach step.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

The software is user-operated, with no success fee. The checklist above is a recommended working framework, not a claim that Acquivo automatically performs these inspections, supplies legal advice, or represents a client. Counsel and the seller retain their respective professional and disclosure decisions.