Before entering client information into an AI tool, M&A attorneys should check the proposed task, governing matter restrictions, sensitivity of every input, permission to use that tool and configuration, and who can receive or access the information. The responsible matter lawyer should resolve any required client communication or informed consent, approve the exact submission, and identify a human output reviewer. Firm-level tool approval is not enough: ABA Formal Opinion 512 describes a fact-driven assessment tied to the client, matter, task, and tool. Applicable jurisdictional duties must be checked separately. [1] If permissions or data handling remain unclear, hold the submission and use a non-client-data alternative.
Define the proposed submission before reviewing permission
Start with a concrete request, not an instruction to use AI for diligence. An illustrative task is extracting notice provisions from selected contract excerpts into a draft worksheet for lawyer review. State what the tool may do, what it must not decide, which source files it may receive, and where its output will go. Determining whether a notice provision has been triggered remains a legal judgment, not an extraction task.
Assign a preparer to assemble the proposed input and a responsible matter lawyer to authorize it. A technical reviewer can confirm settings and data handling, but should not decide whether the client has permitted disclosure. Name the output reviewer before submission, so a generated worksheet cannot become an unchecked diligence conclusion.
Treat the complete submission as the review unit: prompt, attachments, conversation history, retrieved documents, and any enabled application access. Record the selected file versions. A permission decision about a short excerpt should not silently expand to an entire data-room folder. This narrow approach follows the ABA opinion's emphasis on evaluating the specific task and tool, rather than assuming all AI uses carry the same risks. [1]
Check the matter's restrictions against source records
The preparer should locate the current engagement terms, outside-counsel guidelines, client AI instructions, relevant confidentiality agreements, and data-room access conditions. The matter lawyer should determine which provisions affect the proposed submission. Check the actual documents, not a colleague's recollection that the client generally accepts technology. California's 2026 practical guidance expressly addresses following applicable client instructions that restrict or limit AI use. That guidance concerns California obligations, not a nationwide permission rule. [2]
For a sell-side matter, ask whether the proposed input includes information supplied by a prospective buyer, another adviser, an employee, or a counterparty under separate restrictions. Client approval should not be treated as proof that every other affected obligation has been satisfied. Any uncertainty about a contract, applicable privacy requirements, or cross-border handling needs competent matter-specific review before input.
Keep the permission source with the decision record: the relevant document version, provision, instruction, or approved clarification. If two instructions appear inconsistent, pause and have the responsible lawyer resolve them. Do not ask the AI tool to decide which restriction controls, and do not characterize silence in an agreement as affirmative authorization.
Inspect sensitivity and reduce the input
Review the information itself, including filenames, comments, tracked changes, hidden worksheet content, and surrounding context. Flag legal advice, negotiation positions, personal information, trade secrets, nonpublic transaction plans, and information restricted to particular diligence recipients. Under the ABA Model Rules analysis in Opinion 512, confidentiality covers information relating to a representation regardless of source, not merely documents labeled confidential. Local rules and applicable obligations still need separate assessment. [1]
Ask whether the task can be completed with a synthetic example, a public source unrelated to the matter, or a smaller excerpt. For the illustrative notice-extraction task, unnecessary employee details and unrelated commercial schedules should not accompany the selected clause. Retain the unmodified original in the approved matter repository and have the preparer check that the reduced copy still contains the language necessary for accurate review.
Removing names is not a guarantee of anonymity. NIST's generative AI profile discusses systems inferring sensitive information by combining disparate sources. [3] Review unusual transaction details and combinations of facts as well as direct identifiers. Put potentially privileged or specially restricted material on hold until qualified counsel assesses the proposed handling; this checklist does not determine privilege or waiver.
Verify the authorized tool, account, and data path
Confirm the actual product, account type, workspace, feature, and configuration proposed for this submission. An approved firm workspace does not establish permission to use a personal account, a different feature, or an added connector. Ask the technical reviewer to verify the relevant settings against current official documentation and applicable contractual terms, then give the matter lawyer a comprehensible explanation of unresolved issues.
Check whether prompts, uploaded files, and outputs are used for model training or product improvement; how long they are retained; and which provider personnel or other service providers may access them. Also check storage locations, support access, sharing defaults, and the documented scope of deletion. A setting that disables training does not answer every question about retention or access. The ABA opinion calls for understanding terms and policies, with expert assistance where needed. [1]
California's guidance similarly warns against relying only on generalized marketing assurances and addresses collection, use, storage, and disclosure. [2] Record the evidence reviewed and its date. If the reviewer cannot determine a material aspect of the data path, hold the input rather than filling the gap with a vendor label such as private or enterprise.
Limit recipients and decide whether client consent is needed
Identify everyone who could receive the input or output, not just the person typing the prompt. Include workspace members, shared conversation viewers, connected applications, external processors, and recipients of any later export. Check matter access boundaries within the firm. Opinion 512 discusses inappropriate access both outside a firm and by people inside it, including cross-matter disclosure risks. [1]
The responsible lawyer must assess communication and informed-consent requirements under the applicable jurisdiction and facts. In its July 2024 analysis, Opinion 512 requires informed consent before entering representation information into the described self-learning tools whose outputs could disclose it. It also explains that generic engagement-letter boilerplate is insufficient when informed consent is required. This is not a statement that every AI task always requires consent. [1]
When consent is required, the lawyer should explain the intended use, information involved, relevant risks, and alternatives in terms the client can understand. Preserve the decision and any limitations in the approved matter record. Consent does not establish that every separate restriction or privilege issue has been resolved. Keep output in the authorized internal review location; later disclosure to a buyer or other recipient requires a separate human decision.
Test the task and set stopping conditions
Before proposing live client input for a new task, run a limited trial on synthetic material or public material cleared for that use. The matter lawyer should prepare the expected results from the source text, then compare the generated output. For the illustrative notice worksheet, check omitted exceptions, incorrect parties, invented deadlines, missing cross-references, and unsupported conclusions. Require a source location for each extracted item.
NIST recommends context-sensitive pre-deployment testing and explains that general benchmarks may not establish reliability in the actual use setting. [3] A successful synthetic trial is useful evidence about task behavior, but it does not prove confidentiality, legal permissibility, or accuracy on every contract. The ABA opinion also connects the degree of independent verification to the tool and task. [1]
Set stopping conditions before the trial: unexplained access to another matter, fabricated source references, missing material qualifications, an unexpected external transmission, or inability to verify a material result. Keep sending, negotiation, and approval actions outside this workflow. If a condition occurs, stop further inputs, restrict the affected output, and escalate to the matter lawyer and appropriate technical reviewer. Resume only after the issue is resolved and authorization is reconsidered.
Record an accountable decision for the exact input
Use a short authorization record in the firm's approved matter system. It should identify the matter, task, preparer, approving lawyer, output reviewer, source file versions, proposed prompt, included information, and exclusions. Add the exact tool and workspace, relevant settings evidence, permitted recipients, restriction review, consent determination, trial result, and stopping conditions. Keep the record itself access-controlled; it may contain sensitive information.
Give the decision a clear disposition: approved for the stated submission, revise before resubmission, or hold pending resolution. Approval should cover the specified input and use, not every future interaction with the tool. Require renewed review when the source materials, recipients, purpose, permissions, or material tool settings change.
After an authorized input, the named human reviewer should compare the output with the original matter documents, resolve discrepancies, and mark the reviewed version before it enters the work product. An AI-generated citation or confident explanation is not a substitute for checking the source. Lawyers retain responsibility for professional judgment and work performed with AI assistance under the ABA analysis and California guidance. [1] [2]
Keep the input gate separate from platform claims
Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.
Acquivo is user-operated software with no success fee. This pre-input checklist is a recommended matter workflow, not a claim about specific AI providers, integrations, access controls, or authorization features within Acquivo. Software does not represent clients, supply a privilege opinion, or replace the responsible lawyer's permission decision.
The implementation outcome is a matter-specific pre-input checklist and an accountable authorization record. Put the gate immediately before submission, where the preparer can stop rather than guess. This article provides general educational information, not individual legal advice. Obtain qualified counsel's assessment of unresolved jurisdictional, contractual, confidentiality, or privilege questions before entering the affected information.
Key Points
- Approve the exact prompt, files, source versions, configuration, and task, rather than treating general tool approval as matter permission.
- Check current engagement terms, client instructions, transaction restrictions, and third-party information obligations against the actual source records.
- Reduce unnecessary information, but do not assume name removal, disabled training, or an enterprise account settles confidentiality or privilege.
- Give the responsible matter lawyer the consent and authorization decision; give a named human reviewer responsibility for checking output against originals.
- Use a representative non-client-data trial, record stopping conditions, and hold submissions when material permissions or handling remain unresolved.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] ABA Formal Opinion 512: Generative Artificial Intelligence Tools, July 29, 2024 · Accessed
- [2] State Bar of California: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, 2026 update · Accessed
- [3] NIST AI 600-1: Artificial Intelligence Risk Management Framework, Generative Artificial Intelligence Profile, July 2024 · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.