How Should an M&A Legal Team Plan Its First 90 Days of AI Implementation?

Days 1-10: assign owners and define one permitted task

Appoint a practice sponsor who can approve scope, a supervising M&A lawyer who owns work quality, a professional-responsibility reviewer, and a technical or security reviewer. A smaller practice may combine roles, but the plan should identify who approves data use, who checks outputs, and who can suspend access. ABA Formal Opinion 512, issued in July 2024 under the ABA Model Rules, addresses managerial policies, supervision, and training. Applicable jurisdictional rules must be checked separately. [1]

Choose one narrow task, such as preparing an internal extraction worksheet of assignment and change-of-control language from an approved contract set. The worksheet should identify document versions and clause locations, not decide whether consent is legally required or a transaction can proceed. The supervising lawyer retains those judgments.

Write a pilot charter naming the task, permitted users, excluded documents, output destination, reviewer, and manual fallback. Exclude autonomous outreach, negotiation, disclosure, and approvals. Reserve reviewer capacity before setting the launch date. A pilot without an available reviewer should not begin merely because the tool is available.

Days 1-20: resolve legal, ethics, and data permissions

Before any client-data trial, have the professional-responsibility reviewer assess the applicable jurisdiction's rules, engagement terms, client instructions, and proposed information flows. ABA Opinion 512 treats confidentiality risks as dependent on the client, matter, task, and tool. Its analysis of informed consent for certain self-learning tools should not be converted into a universal rule for every AI product. Client communication can also be a separate obligation under applicable rules and engagement arrangements. [1] This framework is implementation guidance, not advice about a particular representation; qualified counsel should resolve legal and ethics questions for the practice.

Ask the technical reviewer to verify the actual account configuration and contractual terms. Identify whether inputs or outputs are used for training, who can access them, where they are stored, what retention applies, and what happens when service ends. Review matter access boundaries, sharing permissions, and available deletion controls. Opinion 512 recommends understanding terms of use, privacy policies, and related contractual terms, with expert assistance where needed. [1]

The approval record should state which data categories may enter which environment and who authorized that use. Begin with purpose-created fictional documents if client-data permission is unresolved. Removing names alone is not an adequate basis for approval: the reviewer must assess the remaining information and context. Neither a vendor label nor a firm policy establishes privilege protection or eliminates security risk.

Days 11-30: prepare source records and a reference answer

Build the test set around the chosen task. For the illustrative contract worksheet, include an original agreement, an amendment, a missing schedule, an unclear scan, and a provision that refers to another section. Use fictional versions initially; use actual matter documents only within the permissions already approved. These variations test whether the tool acknowledges uncertainty instead of producing a complete-looking answer from incomplete records.

The supervising lawyer should prepare a reference answer directly from the documents. Record the controlling version, exact clause language, page or section location, exceptions, and unresolved questions. Preserve the original records separately from AI-generated notes. A generated summary is a draft aid, not the source of truth.

Fix the test instructions and output format before comparing results. Require the tool to identify supporting text and say when information is absent or unreadable. Reviewers must open the cited records, not accept a citation because it looks plausible. NIST's July 2024 Generative AI Profile recommends checking sources and citations during pre-deployment measurement and ongoing monitoring. [2]

Days 21-30: rehearse the workflow and approve pilot entry

Train permitted users on the approved task, prohibited inputs, uncertainty labels, review handoff, and incident reporting. Have each user demonstrate the complete workflow with the test set, including an example that should be rejected. Under the Model Rules analysis in ABA Opinion 512, supervision includes training lawyers and nonlawyers in relevant practical and ethical AI risks; local obligations require separate review. [1]

Set acceptance criteria before examining the pilot results. For this task, require correct document identification, traceable quotations, appropriate treatment of amendments, and explicit flags for missing information. Treat a wrong controlling document or omitted exception as material, even if the worksheet is otherwise well written.

At the entry gate, the sponsor should receive the permissions record, test results, unresolved defects, reviewer assignment, and fallback procedure. NIST recommends minimum performance or assurance thresholds within go/no-go deployment processes. Here that means an affirmative, documented decision for the specific task, not general approval to use AI throughout the practice. [2]

Days 31-60: run a limited pilot alongside the existing process

Limit participation to trained users and the approved document type. Start in shadow mode: the existing human process remains operative, and the AI worksheet cannot become a client deliverable or trigger a transaction action. Where actual matter records are permitted, the matter lawyer should confirm that the particular documents and intended use remain within the authorization.

For each run, keep a permission-appropriate record of the source versions, tool version where identifiable, instructions, output, reviewer corrections, and disposition. Store that record under the practice's approved access and retention rules. Do not create a second uncontrolled collection of confidential prompts merely to document the pilot.

The reviewing lawyer should compare each pilot worksheet with its source records, checking quotations, cross-references, amendment effects, exclusions, and unresolved questions. A mismatch requires correction before reliance. ABA Opinion 512 makes the degree of independent verification task-dependent while retaining lawyer responsibility for client work. Full worksheet review is a recommended control for this initial bounded trial, not a claim that the same review method fits every legal AI use. [1]

Review quality and workload throughout the pilot

Hold a recurring pilot review led by the supervising lawyer. Separate unsupported statements, omissions, wrong-version errors, access problems, and failures to flag uncertainty. Record the type of defect and its consequence rather than relying on an overall impression of accuracy. A fluent summary that misses a consent exception can be more consequential than an obvious formatting error.

Track actual reviewer effort, rejected outputs, unresolved questions, and the ability to maintain ordinary matter deadlines. These are observations to collect, not assumed productivity gains. If lawyers cannot perform the agreed review, reduce volume or pause the trial rather than quietly weakening the control.

Use the findings to evaluate this task in its actual working conditions. NIST recommends documented measurements in conditions similar to deployment and warns against extrapolating from narrow, anecdotal assessments. A successful demonstration on clean sample documents does not establish reliability for an unfamiliar matter, another document type, or broader professional judgment. [2]

Use explicit stop triggers and a restart gate

Write stop triggers into the charter. Pause the affected workflow for suspected unauthorized disclosure, access outside the permitted matter group, unexplained retention or training changes, untraceable material statements, repeated missed exceptions, or loss of reviewer capacity. Also stop if users begin using the worksheet to approve disclosures or make legal conclusions outside the pilot scope.

Specify the response owner. A user reports the concern to the supervising lawyer; that lawyer suspends reliance on affected output and uses the manual process. The technical reviewer assesses access and configuration issues, while qualified counsel assesses any legal response or notification duties under the applicable circumstances. Preserve necessary records using the practice's incident procedures rather than improvising deletion or external communications.

NIST's profile recommends assigned responsibilities for disengagement, escalation, remediation, and deactivation criteria. Restart should require a documented cause assessment, corrective action, repeated relevant tests, and approval by the owners responsible for the failed gate. A corrected individual answer does not by itself resolve a recurring workflow defect. [2]

Days 61-75: test corrections without silently expanding scope

Use the next phase to examine failure patterns and test changes. If a prompt adjustment improves treatment of amendments, rerun the original test set and the examples that failed. Keep those results distinct from the earlier run so the sponsor can see whether a correction introduced another problem.

Treat a new model, changed provider terms, different document category, broader user group, or additional data connection as a change requiring review. Revisit the relevant permissions and test cases before use. NIST recommends ongoing guardrail review and reassessment for third-party models used in contexts not evaluated initially. [2]

Avoid bundling a promising extraction pilot with contract drafting, buyer communication, or legal research. Each introduces different source checks and professional decisions. If a second task is worth considering, give it a separate proposed charter and approval gate. The current pilot should produce evidence for its own defined use, not implied permission for adjacent activities.

Days 76-90: record a stop, extension, or expansion decision

Prepare a decision packet containing the original charter, current permissions, test evidence, material defects, reviewer capacity, incidents, and remaining limitations. The sponsor should decide among stopping, extending the same trial, or approving one defined expansion. State who authorized the decision and what evidence would require it to be reconsidered.

Stop when risks remain outside agreed limits or the workflow cannot be reviewed reliably. Extend when evidence is incomplete but the bounded trial remains acceptable. Expand only with defined users, data, tasks, controls, and a new review date. None of these outcomes needs to be characterized as failure or success based on elapsed days alone.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

The software is user-operated and has no success fee. This rollout framework does not assert particular AI features, integrations, security guarantees, or review capabilities in Acquivo. Lawyers retain responsibility for professional judgments; software does not represent clients or replace their counsel. The useful day-90 deliverable is an approved operating boundary with accountable owners, not a promise that the practice or any tool is compliant.