Who Should Own AI Rollout Decisions and Escalations in an M&A Practice?

Make a managerial lawyer accountable for practice policy

Put one accountable managerial lawyer on the rollout decision record, even if a committee advises that person. Accountability means owning the permitted-use policy, allocating review resources and resolving whether a workflow proceeds. It does not mean personally configuring every tool or reviewing every output. Name a deputy so an absence does not leave exceptions or stop decisions unresolved.

ABA Formal Opinion 512, issued in July 2024, says managerial lawyers must establish clear policies on permissible generative AI use and supervisory lawyers must make reasonable efforts to ensure professional obligations are met. It also addresses training for lawyers and nonlawyers. This is ABA Model Rules guidance, not a substitute for the rules and ethics guidance applicable to a particular practice. [1]

Keep this practice-level map separate from engagement scope and the transaction calendar. It governs which workflows the practice permits and how risk decisions escalate. It neither expands the firm’s engagement nor authorizes disclosure on a matter. Have a qualified professional-responsibility reviewer assess the proposed policy against applicable obligations before live client use.

Give each supporting owner a specific decision boundary

Appoint a legal workflow owner for each approved task. For contract indexing, that owner defines the fields to extract, documents which sources control and sets the review method. The responsible matter lawyer decides whether the task fits the representation and reviews legal significance. A lawyer’s accountability for client work is not transferred to software by selecting a review process. [1]

Operations should maintain the approved-workflow register, training records and requests for changes. IT or security should assess access restrictions, configuration, data handling and technical containment. A professional-responsibility reviewer should address confidentiality, supervision, client communication and any unresolved jurisdictional question. These are recommended assignments, not universal job titles or a determination of legal liability.

The record should identify an actual internal assignee and alternate for each role, alongside the decisions they can make. In a small practice, one person may hold several roles, but a technical pass should not silently count as a legal approval. Where an unresolved material issue falls outside available expertise, obtain qualified support or keep the workflow paused. NIST’s GOVERN categories support documented responsibilities, communication and personnel training. [2]

Approve a defined task, not unrestricted use of a tool

A permitted-use entry should state the task, approved input types, output destination, human reviewer and prohibited actions. For example, an illustrative trial might produce an internal index of assignment clauses from a controlled set of contracts. It would not decide whether consent is legally required, produce a final diligence conclusion or contact a counterparty.

Specify the source-of-truth records: executed agreements and relevant amendments held in the authorized matter repository, with identifiable versions and document references. The index is a working aid, not a replacement for those records. Require each extracted statement to point to a document and location. The reviewer checks parties, dates, quoted language, defined terms and amendment relationships against the originals, and distinguishes missing information from a negative finding.

Keep legal research outside that approval unless separately assessed. If a workflow generates legal propositions, the assigned lawyer should verify the cited authority, its current status and jurisdiction in authoritative sources before relying on it. The ABA opinion warns against uncritical reliance on AI output and explains that appropriate independent verification depends on the tool and task. [1] A permitted task should also identify what users must do when the available sources cannot support an answer.

Separate technical access from matter permission

Before a live matter enters the workflow, the responsible lawyer should check client instructions, applicable professional obligations and any relevant restrictions on handling the documents. Under the ABA opinion’s Model Rules analysis, confidentiality assessment is fact-specific and includes improper access inside and outside the firm. Whether disclosure or informed consent is required depends on the tool, information and circumstances; local rules require their own assessment. [1]

The security owner should document who can access prompts, uploaded files and outputs; whether inputs are used for training; retention and deletion arrangements; and relevant contractual terms. Record the evidence and unresolved questions rather than treating a vendor label as proof. The ABA opinion calls for understanding terms, privacy policies and related agreements, with knowledgeable technical help where needed. [1]

Choose the least sensitive adequate inputs for a trial, such as deliberately fictional documents. Do not assume removing a client’s name eliminates confidentiality concerns. Practice approval and available login credentials are not matter permission. Neither a contract term nor a technical setting should be presented as a guarantee of security, confidentiality or privilege.

Create an exception route that cannot override professional duties

Route requests outside an approved task to the workflow owner first. The request should identify what would change, why existing methods are insufficient, which information is involved and who would review the result. Operations can record the request but should not approve it merely because a transaction deadline is close.

Use a recommended approval rule that matches the changed risk. A request to add a new document category goes to the workflow owner and responsible matter lawyer. A request involving new access, retention or provider terms also goes to security. A confidentiality or client-communication question goes to professional-responsibility review. The accountable managerial lawyer resolves practice-policy exceptions after those reviews, without purporting to waive professional duties or client restrictions.

Record the permitted scope, conditions, expiry or completion point, and people authorizing the exception. Silence is not approval. If a material issue remains unresolved, use the non-AI workflow. An exception should not turn into a standing permission through repeated use; any permanent change belongs in a separately reviewed policy update. This implements the documented communication and risk-decision structure recommended by NIST. [2]

Give the pilot owner evidence and stopping criteria

The workflow owner should design a bounded pilot before wider use. In the illustrative contract-indexing trial, reviewers first create a reference answer set from the source documents. Include amendments, ambiguous language and incomplete files, not only clean examples. Compare outputs with that reference and record unsupported statements, omissions, incorrect document links and failures to flag uncertainty. These are suggested tests, not a report of measured product performance.

Set stop conditions in advance. Recommended triggers include suspected cross-matter access, an unexpected data destination, invented material contract language, failure to link findings to the correct source, or insufficient reviewer capacity. A recurring error in a material field should pause that part of the workflow rather than be dismissed because other fields look plausible. NIST’s MANAGE 2.4 supports assigned authority to disengage or deactivate systems whose performance is inconsistent with intended use. [3]

Give users permission to stop their own use and report a concern without waiting for a committee meeting. The workflow owner pauses the affected task, while security has defined authority to restrict access when containment is needed. Identify the manual fallback and responsible lawyer so stopping AI does not silently stop necessary matter work. Decide review intensity from actual task risk and evidence, not a promise of time savings.

Route incidents to containment and legal assessment together

Publish one internal reporting route with an alternate contact. The initial report should identify the affected workflow, matter reference, observed problem, time and output location, using the practice’s authorized channels. Do not ask staff to paste potentially sensitive material into an unrestricted ticket or another AI tool to diagnose the problem.

The reporting route should notify the workflow owner and security owner, with the responsible matter lawyer and professional-responsibility reviewer involved where client information or relied-on work may be affected. Security assesses containment and technical evidence. The matter lawyer identifies whether an output reached a work product, influenced a legal assessment or was disclosed. Operations tracks ownership and unresolved actions. Avoid assigning the entire incident to IT when the problem is an inaccurate legal conclusion.

Preserve relevant evidence through authorized processes and identify affected outputs before allowing reuse. NIST’s Manage guidance supports incident documentation, root-cause review, fallback arrangements and criteria for redeployment. [3] Decisions about client communication, correction, reporting obligations or privilege require qualified legal assessment under applicable rules and facts. The tool should not send notices, make disclosures or determine that no legal response is required.

Require a human decision to restart or expand

Restart should require a documented decision, not simply a restored login. The workflow owner supplies the cause analysis and retest evidence. Security confirms the relevant technical remediation, and the responsible lawyer assesses affected matter work. Professional-responsibility questions must be resolved through the designated reviewer. The accountable managerial lawyer authorizes practice-level restart within a stated scope or keeps the affected use stopped.

Treat expansion as a fresh decision when users, task, document types, provider terms or data flows change materially. Maintain an approved-workflow register with reviewers, versions, decision reasons and scheduled review points. NIST’s framework supports ongoing monitoring and planned retirement, while its Manage guidance includes feedback, change management and recovery. These are voluntary governance recommendations, not a certification that an implementation complies with law. [2] [3]

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

Acquivo is user-operated software with no success fee. This ownership framework is a recommended practice design, not a claim about built-in AI controls or integrations. People retain authority over permitted use, disclosures, legal review and deal decisions; the software does not represent clients or supply legal judgment.