Review the teaser as a combination of clues, not as a document that becomes anonymous merely because names and addresses were removed. Start with the approved source schedules, identify every detail that could single out the business, then test whether several ordinary details together create a recognizable pattern. Ask what a motivated recipient could link to public or sector knowledge. Use AI only for a bounded first-pass comparison or issue list, with the permitted information and tool setting documented. A banker who knows the transaction, source figures, and disclosure context must reconcile every number, decide each redaction, record unresolved risk, and approve or stop release. The checklist reduces avoidable disclosure risk, but it cannot guarantee anonymity.
Start with the approved source of truth
An anonymity review should begin with the version of the teaser that is actually proposed for release and the schedules that support it. Preserve the file name, version, date, preparer, and approval state. Build a simple evidence map from each material statement to its source schedule, management representation, or other authorized record. The objective is not to prove that the teaser is anonymous. It is to find statements that are unnecessary, inconsistent, or unusually identifying before an authorized person decides whether they belong in the release version.
Use the source schedules as the control record for revenue bands, customer concentration, geography, employee counts, dates, margins, and operating metrics. The reviewer should compare the teaser against those records rather than asking an AI system to decide which number is correct. If the teaser contains an aggregate that cannot be reconciled, mark it for human resolution and pause the release decision. A polished sentence is not evidence of a correct figure.
Separate direct identifiers from identifying combinations
Remove obvious identifiers first, including the company name, trade names, exact address, domain, named executives, and customer names. Then conduct a second pass for indirect identifiers. The ICO explains that identifiability is broader than a name and can depend on location, distinguishing characteristics, or information that can be combined with other sources. Its guidance also distinguishes pseudonymisation from anonymisation: replacing a name with a code does not remove the underlying identification risk if additional information can reconnect the record to a person or organization. [1]
For a teaser, ask whether the business can be singled out through a combination such as a narrow region, a distinctive customer type, a rare certification, a precise founding year, a facility description, and a recognizable financial profile. Each detail may look ordinary alone. Together they may point to one seller. Record the combination, the likely outside knowledge needed to recognize it, and whether the detail is necessary at this stage of the process.
Run a recipient-aware linkability test
Do not test anonymity only from the banker’s desk. Consider the intended recipient and what that recipient may already know. The ICO describes linkability as a mosaic or jigsaw effect, where separate data sources can be combined to identify a person or group. It recommends considering the information itself, who may access it, reasonably likely means of identification, and the risk of unauthorized access. [2]
Use a short challenge set. Could a buyer who knows the local market identify the only operator with that footprint? Could an industry participant match the customer mix to a public contract, trade article, or job posting? Could a former employee recognize the facility, headcount, or unusual product description? Could public filings, procurement records, maps, or social posts complete the picture? The answers are not automatic legal conclusions. They are prompts for a fact-specific risk assessment and, where needed, qualified privacy or transaction counsel.
Use AI for bounded issue spotting, not release authority
An AI review can compare the draft with an approved issue list, flag repeated proper nouns, find unusually precise details, or propose a table of fields that need human attention. Define the task narrowly. For example: identify details that could distinguish the seller when combined with geography, customers, dates, or niche operations. Require the output to quote the relevant draft text, name the suspected combination, and state what source record or public context would be needed to verify the concern. Do not ask the system to declare the teaser anonymous or to approve distribution.
Before using any tool, the workflow owner should document the confidentiality choice, permitted inputs, retention setting if known, access list, and whether the source material may be processed in that environment. The ICO notes that AI can complicate security, that data movements should be recorded, and that unnecessary intermediate files should be deleted when no longer required. [3] Do not treat a provider’s generic security statement as a transaction-specific permission. If the permission, retention, or data-handling position is unclear, use a non-sensitive sample or stop the AI step and complete the review manually.
Reconcile every aggregate before redacting or releasing
Anonymity and accuracy are connected. A rounded revenue range may be appropriate, but it can still identify a seller when paired with a narrow region and customer concentration. A customer percentage may be identifying even when no customer is named. A facility count, employee range, or unusually specific year can narrow the field. For each proposed disclosure, record the source value, the teaser expression, the permitted rounding or range rule, and the reason the detail is needed now.
Have the responsible deal team member reconcile the teaser to the source schedule and record the result as confirmed, revised, omitted, or unresolved. If figures were transformed, retain the method and the approver. Never let an AI-generated rewrite silently change a period, unit, denominator, or level of aggregation. If the draft cannot be reconciled, stop the release version until the authorized reviewer resolves it.
Create a redaction record with stopping conditions
The implementation outcome should be a checklist plus a redaction record, not a vague statement that the teaser was screened. Useful fields include section and page, original text, proposed replacement, risk type, source reference, reviewer, decision, reason, unresolved question, and approval state. Risk types might include direct identifier, unique combination, customer exposure, location clue, financial fingerprint, personal information, or unsupported claim.
Set stopping conditions before the AI or manual review begins. Stop when the output invents a source, changes a number, misses a known clue, exposes confidential input, or recommends a release decision outside its task. Stop when the human reviewer cannot explain a redaction or reconcile its replacement. NIST’s AI RMF materials describe documenting task scope and limitations, defining human oversight, monitoring risks, and having mechanisms to disengage or deactivate systems when outputs are inconsistent with intended use. The framework and playbook are voluntary resources, not certifications or legal safe harbors. [4] [5]
Test the near-final version from outside the deal team
After edits, run a fresh review on the near-final teaser rather than assuming that removing one clue solved the problem. A reviewer who knows the transaction should compare the document with the source schedules. A separate authorized reviewer can perform the recipient-aware challenge using only the information that the intended recipient is expected to receive. Keep the test controlled and do not circulate the teaser merely to test whether it can be recognized.
Ask the reviewer to list the shortest plausible path from the teaser to a seller identity. If the path depends on a detail that is not needed for the current stage, generalize or remove it. If the path depends on a combination that is essential to the business description, escalate the disclosure choice rather than claiming that redaction solved the issue. The ICO notes that identifiability can change as technology, public information, and access conditions change, so repeat the review when the audience, version, or release stage changes. [2]
Keep the human release decision explicit
The final record should name a role, not delegate accountability to a model. The accountable banker or other authorized human should confirm the source reconciliation, review the redaction log, consider recipient and jurisdiction-specific confidentiality obligations, and document whether the teaser is approved, revised, withheld, or escalated. This article does not determine whether a particular disclosure is lawful, privileged, or contractually permitted. Those questions depend on the facts, governing documents, recipients, and applicable jurisdictions, and may require qualified counsel.
Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. In this workflow, the platform is user-operated software: the deal team supplies the permitted records, reviews suggested issues, controls disclosure choices, and keeps the release decision with authorized humans. A documented checklist makes that responsibility visible without promising anonymity, confidentiality, compliance, or a transaction outcome.
Key Points
- Test combinations of ordinary details, not only names and addresses.
- Tie every teaser figure and proposed range to an approved source schedule.
- Use AI for bounded issue spotting with documented inputs and stopping criteria, never for release approval.
- Record each redaction, replacement, unresolved risk, and human decision.
- Repeat the review when the teaser version, audience, or disclosure stage changes.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] Introduction to anonymisation · Accessed
- [2] How do we ensure anonymisation is effective? · Accessed
- [3] How should we assess security and data minimisation in AI? · Accessed
- [4] AI Risk Management Framework · Accessed
- [5] NIST AI RMF Playbook · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.