Counsel should treat a competitor bidder's diligence requests as a separate disclosure-risk assessment, not simply grant access after an NDA. Identify sensitive pricing, customer, cost, and strategy records; establish a legitimate transaction purpose; and limit each release by stage and recipient. Consider counsel-vetted clean teams, redaction, and aggregation, but test whether combined materials still reveal protected information. U.S. FTC staff guidance emphasizes independent operations and fact-specific safeguards before closing. [1] For AI-assisted work, supervising counsel should approve inputs, verify access boundaries, review derived outputs, and retain release authority. Applicable competition law and professional rules require jurisdiction-specific assessment; neither client consent nor automated processing settles those questions. [2]
Identify the competitive overlap before opening diligence access
Begin with how the bidder competes, or could compete, with the seller. Product lines, territories, customer groups, and purchasing relationships help counsel understand which records could influence competitive decisions. In its March 2018 U.S. guidance, FTC staff identifies current and future pricing, strategic plans, costs, and customer-specific information as potential concerns. The assessment is contextual, not a rule that every business record is equally sensitive. [1] A seller's proposed price increase may warrant different treatment from a broad description of its facilities.
Have the seller's finance and commercial owners explain what each requested record reveals. Counsel can then prepare a disclosure matrix recording the diligence purpose, relevant period, sensitivity, permitted recipients, and release conditions. Flag customer-level discounts, margins, renewal terms, capacity plans, and planned market entry for assessment rather than assuming an NDA answers the competition question. This matrix is a recommended process record, not a legal safe harbor. Engage competition counsel for material overlap or uncertainty, including cross-border issues, before approving access.
Require a specific purpose and stage each disclosure
Ask the bidder to explain the decision the requested information supports. Evaluating revenue concentration is not necessarily the same task as examining customer-by-customer pricing. FTC staff recommends sharing the least information needed for effective diligence, narrowly tailored to a specific diligence or integration-planning issue. It also distinguishes earlier bidding stages from later, more detailed review that may require stronger safeguards. [1] The bidder's request list should therefore be the start of discussion, not an automatic release instruction.
An illustrative sequence might begin with a counsel-approved concentration summary, proceed to blinded analysis for vetted recipients, and reserve detailed underlying schedules for a clean team if justified. This is not a prescribed legal sequence. Counsel should decide whether withholding, postponing, or narrowing a particular disclosure adequately serves the transaction. Record exceptions and their reasons, and review supplemental schedules before upload. A later request for more detail should receive a fresh sensitivity assessment rather than inherit approval from the first release.
Design the clean team around roles and onward reporting
A clean team is a restricted group permitted to examine sensitive transaction information under a defined protocol. It is not simply a renamed buyer diligence team. FTC staff recommends scrutinizing members' business roles and excluding personnel responsible for competitive planning, pricing, or strategy. It also calls for outside counsel to vet later additions and for separate protocols governing treatment and onward sharing. [1] Depending on the facts, third-party consultants may be considered alongside appropriately screened individuals.
The protocol should identify who may access raw records, what work they may perform, and which reports may leave the restricted group. Specify permitted recipients and require counsel review before releasing reports to business personnel. FTC staff recommends blinded, aggregated versions of sensitive information for such reporting. [1] Address a member's role change, substitute reviewers, local copies, and consultant access before they arise. If available staffing or technology cannot support the proposed separation, counsel should reconsider the arrangement or disclosure rather than treating the clean-team label as sufficient protection.
Test redactions and aggregates against the full disclosure set
Removing customer names is not the end of review. FTC staff warns that bidders may piece documents together to reveal information intended to be concealed, particularly where a market has few well-known participants. It recommends examining all materials made available, including later data-room schedules. [1] The relevant review unit is therefore the information a recipient can see together, not just one apparently redacted file. Aggregation also needs context-specific assessment; it does not automatically eliminate competition-law concerns.
For an illustrative wholesaler, a blinded sales schedule might be combined with shipment locations and a contract summary to identify a customer. A narrow product category could reveal a specific account even without its name. Counsel should consider whether to broaden categories, omit fields, delay release, or restrict the recipient group. The document owner should also check hidden spreadsheet tabs, comments, metadata, and whether redacted text remains recoverable. These are recommended disclosure checks, not guarantees of anonymity. Keep the unredacted source separate from the approved release version so reviewers know which they are handling.
Keep diligence and integration planning separate from operations
Under the U.S. framework discussed by FTC staff, merger parties remain independent businesses until consummation. Information-sharing concerns are distinct from, but can accompany, unlawful pre-closing operational coordination or acquisition of beneficial ownership under the Hart-Scott-Rodino regime. The applicable duties depend on the transaction and law; an NDA or signing does not itself authorize operational control. [1] Counsel should assess proposed coordination separately from whether particular information may be reviewed for diligence.
Scrutinize requests to approve the seller's ordinary-course pricing, align discounts, allocate customers, or act on competitively sensitive plans before closing. Integration-planning meetings need an agenda, appropriate attendance, and boundaries on information and action. A software-generated action list should not turn hypothetical post-closing plans into current instructions. Route questionable proposals to competition counsel and keep operational decisions with the appropriate independent business. This article provides a review framework, not a conclusion that a particular covenant or planning activity is lawful or unlawful.
Approve AI tasks and information access before uploading records
Define the proposed AI task narrowly, such as drafting an internal sensitivity index from already approved excerpts. Supervising transaction counsel should own the decision to permit the task, obtain competition-law input where needed, and involve a security administrator to assess access and configuration. The seller-approved originals, disclosure matrix, and clean-team protocol remain the source of truth. Client instructions and any necessary permissions must be checked before use. Do not upload raw customer pricing merely to ask a tool whether it is sensitive.
ABA Formal Opinion 512, issued in July 2024, addresses tool-specific confidentiality assessment, independent verification, communication, and supervision under the ABA Model Rules. It discusses cross-matter disclosure risks with self-learning tools and calls for understanding provider terms and policies. Governing local rules and the actual tool determine the relevant obligations. [2] Counsel should assess training use, retention, provider access, retrieval permissions, and deletion terms rather than infer protection from a product label. Where required confidentiality arrangements or informed consent cannot be established, keep the information out of the tool. Consent does not resolve competition-law restrictions.
Treat derived AI outputs as new disclosure candidates
Summaries, extracted tables, prompts, and generated comparisons can carry the sensitivity of their inputs. A summary may omit names yet preserve discount patterns or strategic timing that a competitor can use. Apply the disclosure matrix to each proposed output and to its combination with material previously released. This extends FTC staff's warning about piecing documents together; it is not a claim that automated aggregation creates a lawful exchange. [1] NIST's July 2024 generative AI profile separately describes risks of inferring sensitive personal information from disparate sources. [3]
Before any release, the human reviewer should compare the output with identified source pages, spreadsheet ranges, or approved extracts. Check factual accuracy, missing qualifications, invented figures, customer re-identification, and unintended strategic inferences. Verify that source links do not grant access to restricted originals. A source citation supports checking; it is not disclosure permission. For competitor-sensitive outputs, require counsel review of the complete release package, not just the latest paragraph. ABA guidance makes clear that AI cannot replace lawyers' professional judgment or responsibility for their work. [2]
Run a bounded trial with explicit stopping conditions
Start with synthetic or nonconfidential records to test the proposed workflow. Use a small, manually reviewed set with known sensitivity labels, source references, and deliberately omitted fields. Supervising counsel should compare AI classifications and summaries against that baseline. Test authorized roles to see whether one workspace can retrieve another matter's records or restricted originals. NIST recommends structured testing to probe inaccurate outputs and confidential or proprietary information exposure; such testing informs risk decisions rather than certifying safety. [3]
Set stopping criteria before the trial: an unauthorized record appears, restricted details survive redaction, a material figure lacks support, combined outputs identify a protected customer, or provider terms leave retention unresolved. On a failure, pause the task and withhold the output. Counsel and the administrator should investigate scope and remediation, then decide whether a narrower task can be retested or manual work is preferable. A successful trial does not authorize broader inputs or recipients. Keep human approval mandatory and prohibit autonomous buyer outreach, negotiation, disclosure, or operational instructions.
Monitor access and close out original and derivative material
The protocol needs continuing oversight, not only initial approval. Recheck new uploads, new recipients, and changes to AI settings or provider terms. FTC staff recommends monitoring adherence and stopping problematic exchanges or coordination when discovered. It also emphasizes agreed destruction requirements, including independent analysis based on confidential material. [1] At withdrawal or process completion, counsel should reconcile access revocation and contractual return or destruction obligations with applicable preservation duties. Include prompts, summaries, exports, and retained copies in that assessment, without promising that software can erase every copy.
Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. It is user-operated software with no success fee. The workflow described here is a recommended framework, not a statement that particular controls or AI features are built into Acquivo. Counsel retains legal assessment and disclosure-review responsibility; authorized users operate the process. Acquivo does not represent clients, provide legal advice, or replace the professional review needed for a competitor bidder.
Key Points
- Assess competitive overlap and the purpose of each disclosure before granting access, rather than relying on an NDA alone.
- Vet clean-team members by business role and review onward reports; restricted access must extend to derived material. [1]
- Check redactions and aggregates against everything a recipient can combine, including later schedules and AI summaries. [1]
- Approve AI tasks, provider terms, matter permissions, and source checks before processing sensitive inputs. Governing professional rules remain jurisdiction-specific. [2]
- Use bounded trials with explicit failure criteria, retain human release authority, and address original and derivative records when access ends.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.