M&A attorneys should preserve enough evidence for another authorized reviewer to connect each material AI-assisted statement to the exact deal document version, the relevant page or clause, the task instructions, and the reviewing attorney's decision. Keep the output used and any material correction, not an indiscriminate archive of every conversation. Assign owners for source custody, reference checking, access permissions, and retention. Check whether cited text actually supports the statement and whether amendments or exceptions change its meaning. Trial the workflow on permitted documents and stop when references cannot be verified or confidentiality controls fail. This is a recommended evidence framework, not a universal recordkeeping rule; governing professional obligations and matter restrictions require qualified counsel's assessment. [1] [2]
Define the task and accountable reviewer before collecting evidence
Start with a bounded task, such as extracting assignment provisions from specified customer agreements for an attorney's diligence review. The supervising M&A attorney should define what the output may support, which materials are permitted, and who checks the result. The document custodian maintains the approved source set; the reviewing attorney checks the substantive conclusion. The records owner manages retention, while the IT or security owner evaluates the processing environment. These are responsibilities to assign, not necessarily separate people.
ABA Formal Opinion 512, issued July 29, 2024, interprets the ABA Model Rules and explains that independent verification depends on the tool and task. It also leaves professional judgment and responsibility with the lawyer. The opinion is not automatically the governing rule in every jurisdiction. Before using this framework, responsible counsel should assess applicable professional rules, client instructions, confidentiality terms, and the engagement's scope. Traceability should document the attorney's review, not turn an AI classification into legal advice or authorization to proceed. [1]
Anchor each statement to a stable source version
A filename alone is an inadequate identifier when revised agreements share similar names. Give each approved source a stable document identifier and record its version, origin, date received, and controlled storage location. Distinguish executed agreements from drafts and identify the amendments, schedules, or side letters included in the review. A claim record should point to the source as it existed when checked, rather than silently following a link to a later replacement.
Record both the file page and the printed page when they differ, together with the clause number or heading. For scanned documents, retain the authorized original and identify any text extraction used for processing. The reviewer should compare decisive wording with the image rather than trusting extracted text. A file fingerprint can help detect changed bytes, but it does not establish that an agreement is authoritative, complete, or legally effective. NIST's July 2024 Generative AI Profile recommends considering source and versioning information in AI inventories; this document-level design applies that voluntary guidance to deal review. [2]
Retain the instructions and input boundary that shaped the output
Save the task instruction that produced the work being relied upon, or a controlled template plus the matter-specific changes needed to reconstruct it. Include the question asked, the permitted document set, relevant exclusions, and any instruction to quote rather than infer. Identify the output format and how missing information should be reported. An instruction to find an assignment clause is different from an instruction to decide whether a proposed transaction requires consent.
Where the tool exposes them, record the application and model version, processing date, and material settings. If it retrieves passages, keep the returned source identifiers and relevant excerpts within the approved evidence environment. Do not pretend inaccessible system instructions or unavailable model details are known. NIST recommends documenting provenance limitations and human oversight roles. A useful record states those gaps directly. It also distinguishes a full-document review from a review of selected excerpts, so later users do not mistake a limited input boundary for complete diligence. [2]
Verify that references support meaning, not just location
Treat a generated citation as a lead until a reviewer opens the identified source version and checks the passage. NIST specifically recommends reviewing and verifying output sources and citations during testing and ongoing monitoring, and warns that generated explanations and citations can themselves be false. A working link therefore does not prove that the cited text supports the associated statement. The reviewing attorney should check quotations, definitions, qualifications, and cross-references in context. [2]
For illustration, an AI output might label an agreement as requiring consent for any sale of the business. The referenced assignment clause may instead contain a defined exception, while an amendment changes the relevant wording. Preserve the original output, the checked clause and amendment references, and the attorney's narrower conclusion or unresolved question. Do not treat this illustration as an interpretation of any actual agreement. A statement that no consent provision was found also needs a defined search boundary and a completeness check; it should not silently become a conclusion that no consent obligation exists.
Connect corrections to the human review decision
Use a statement identifier to connect the AI output version, supporting source references, and reviewer disposition. A practical disposition is checked and accepted, corrected, rejected, or unresolved. Record the reviewer and review date inside the restricted matter record, not in public content. Explain material corrections briefly: wrong document version, omitted exception, unsupported inference, or text extraction error. Link the corrected wording to the destination memo or issue-list version that actually uses it.
Keep legal judgment separate from extraction. A checked quotation may establish what the document says without establishing its effect on the proposed transaction. Reserve that interpretation for the responsible attorney and retain any assumption or outstanding question that limits it. California's State Bar practical guidance calls for critical review, validation, and correction of both AI inputs and outputs, beyond merely removing false results. That is California-specific guidance, not a blanket jurisdiction rule. This correction record is a recommended way to make such review visible. [3]
Apply confidentiality controls to the evidence trail itself
Prompts, retrieved passages, rejected outputs, and review comments can contain sensitive matter information even when the finished summary is brief. Keep the evidence trail in an approved, restricted matter environment. Prefer controlled references over unnecessary duplicate documents. Give an authorized reviewer enough access to verify the claim without granting unrelated teams access to the whole matter. Do not export the review log to a shared support channel merely because a tool produced an error.
ABA Opinion 512 calls for a fact-specific evaluation of access and disclosure risks and review of terms, privacy policies, and contractual conditions. Assess provider retention, reuse, access, and deletion arrangements before processing permitted information; involve appropriate technical expertise. Determine any client consent or communication requirement under the governing rules and actual tool behavior rather than assuming boilerplate permission is sufficient. California guidance separately emphasizes confidentiality and data-retention protocols. Labels, redaction, or a traceable log do not themselves guarantee security or preserve privilege. [1] [3]
Set proportionate retention without promising exact reproduction
Retain the evidence needed to explain material relied-upon statements: authorized source versions, relevant instructions, the output used, reference checks, and material corrections or unresolved issues. Extra attempts may matter if they expose a defect that affects the final work; repetitive abandoned chats may add little beyond sensitive data. The records owner and responsible counsel should decide what belongs in the matter record, what belongs in restricted testing records, and what may be deleted under the applicable policy. Do not prescribe one duration for every firm or transaction.
NIST recommends a document-retention policy for testing and verification history and digital-content transparency methods. It does not impose a legal schedule for deal files. Any disposal decision must be assessed against applicable preservation duties, client arrangements, and matter restrictions. [2] Distinguish reconstructing the evidence and human decision from reproducing identical model wording. If the relevant model version or processing conditions cannot be preserved, record that limitation. Keeping every prompt is not a substitute for retaining the source and review evidence that actually explains the conclusion.
Trial the evidence workflow and define stopping conditions
Begin with synthetic, public, or otherwise expressly permitted documents that reflect the intended task. The supervising attorney should establish expected answers through manual review and include difficult cases: amendments, ambiguous language, scanned pages, conflicting versions, and missing schedules. Test whether an authorized reviewer can move from a material output statement to the correct source and understand the recorded decision. Check both incorrect statements and significant omissions. Preserve defects and corrections as testing evidence, rather than reporting only examples that worked.
Stop use of affected outputs when references are invented or mismatched, decisive documents are missing, extraction errors alter meaning, matter boundaries fail, or required review cannot be completed. Suspend the pilot and investigate any unauthorized exposure through the firm's approved incident process. Require the accountable attorney's decision before resuming or expanding the task. Retest relevant source checks after material tool or workflow changes. ABA guidance supports task-specific testing, while NIST cautions against extrapolating capabilities from narrow or anecdotal assessments. Neither supports assuming a successful trial guarantees future accuracy. [1] [2]
Carry checked evidence into handover without automating approval
Before a diligence statement enters a client memo, disclosure draft, or negotiation issue list, the responsible attorney should confirm its status and source version. Later source changes should trigger an impact review of linked statements, not silent replacement of their evidence. Separate internal drafts from material cleared for its intended use. AI assistance should not autonomously contact counterparties, negotiate, approve documents, or disclose information. At handover, the next authorized reviewer needs checked references and unresolved questions, not an unexplained transcript archive.
Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. The software is user-operated, with no success fee. This evidence framework is a recommendation, not a claim that Acquivo provides particular logging features, integrations, or guarantees. Software does not represent clients or replace legal judgment. The implementation outcome is a reviewable chain connecting checked outputs to source versions and accountable human decisions.
Key Points
- Tie material statements to the source version actually reviewed, including clause references and relevant amendments.
- Keep the relied-upon output and material instructions, corrections, and reviewer decisions; do not default to retaining every conversation.
- Check whether a reference supports the statement in context, not merely whether its link opens.
- Apply matter permissions and confidentiality choices to prompts, excerpts, and review records as well as final documents.
- Trial the workflow on permitted sources and stop affected use when evidence, confidentiality, or human review fails.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] ABA Formal Opinion 512: Generative Artificial Intelligence Tools · Accessed
- [2] NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile · Accessed
- [3] State Bar of California: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.