AI, Confidentiality and Legal Privilege in Deal Work

The Evolving Landscape of AI in M&A

Artificial intelligence, particularly in the form of large language models (LLMs), is increasingly integrated into M&A processes, promising efficiencies in due diligence, document review, and data analysis. However, this integration introduces a new set of considerations regarding confidentiality and legal privilege, fundamental tenets of M&A deal making. The core concern revolves around whether the act of submitting confidential or privileged information to an LLM, often a third-party service, constitutes a waiver of that privilege or a breach of confidentiality.

Jurisdictional Perspectives on Privilege Waiver

Navigating the legal implications requires a review of relevant jurisdictions.

United Kingdom

In the UK, legal professional privilege (LPP) is robust, comprising legal advice privilege and litigation privilege. Disclosure to a third party can potentially waive LPP. The critical question for AI use is whether the LLM provider, and the underlying AI system, can be considered an agent of the client or legal advisor for the purpose of maintaining privilege. If the information is deemed to be shared with a third party not maintaining the confidential relationship, privilege could be lost. Furthermore, the ‘confidentiality’ aspect is crucial; if data submitted is used to train models or is otherwise accessible, the confidential nature may be compromised, undermining LPP.

United States

US privilege law, including attorney-client privilege and work-product doctrine, operates on similar principles. Disclosure to a third party generally waives privilege unless that third party is necessary to facilitate privileged communications (e.g., a translator) or is working under the direct supervision of an attorney. The argument for AI use would likely hinge on whether the LLM is acting as a mere conduit or processing agent under strict control, without independent use or retention of the data. Clear contractual agreements and robust security protocols are paramount in illustrating an intent to maintain privilege.

European Union

Across the EU, the concept of legal professional privilege exists, though its application can vary by member state. The General Data Protection Regulation (GDPR) adds a significant layer of complexity, particularly concerning the processing of personal data, which can often be intertwined with confidential M&A information. The transfer of data to an LLM provider, especially if located outside the EU/EEA, triggers GDPR compliance obligations, including lawful basis for processing, sufficient safeguards for international transfers, and data minimisation. A breach of GDPR could have significant financial penalties and reputational damage, independent of privilege concerns.

Practical Guardrails for AI Integration

Mitigating the risks associated with AI in M&A requires a multi-faceted approach.

Contractual Assurances and Data Protocols

Engaging with AI providers necessitates stringent contractual terms. Agreements should explicitly state that data submitted remains the property of the client, is not used for model training, and is subject to robust deletion policies. Data residency, encryption standards, and access controls are critical. For instance, platforms like Lens, an AI-powered data room, are designed with these principles in mind, ensuring data security and respecting confidentiality. Deal teams should seek assurances that the AI operates in a 'zero-retention' or 'ephemeral' mode, where prompts and outputs are not stored beyond immediate processing or are securely deleted.

Internal Policies and Training

Organizations must develop clear internal policies governing the use of AI in M&A. This includes guidelines on what types of information can be submitted to LLMs, particularly distinguishing between publicly available data, confidential information, and legally privileged material. Staff training is essential to ensure adherence to these policies, fostering an understanding of the risks of improper AI use and the importance of data anonymisation or pseudonymisation where appropriate.

Technical Safeguards and Vendor Selection

Prioritise AI tools and platforms that offer advanced security features, such as end-to-end encryption, regular security audits, and compliance certifications (e.g., ISO 27001). The architecture of the AI service, whether it operates within a private cloud or on-premise environment where data never leaves the client's control, can significantly reduce risk. Conducting thorough technology due diligence on AI vendors is no longer optional; it is fundamental to safeguarding sensitive deal information.

The Future of Confidentiality with AI

The integration of AI into M&A will continue. Maintaining confidentiality and privilege in this evolving environment requires vigilance and proactive measures. It is imperative that legal and deal teams collaborate closely with technology specialists to implement robust frameworks for AI use. While AI offers substantial benefits, its application must not inadvertently compromise the protections afforded by confidentiality agreements and legal privilege. Striking this balance is key to responsible innovation in deal making.