DealLawyers.com Blog

This Pillsbury alert discusses how controlling the use of AI in M&A is a key part of preventing the misuse of confidential business information during the course of a transaction. It argues:

AI can make confidential deal information easier to share, harder to control and more difficult to delete. NDAs, CTAs and deal protocols should expressly address how AI may be used in the context of an M&A transaction. Before diligence begins, legal teams on both sides should agree on permitted AI tools and uses, and then confirm with IT that the technical settings actually implement those restrictions.

Clarify Disclosure and Use. Many existing NDAs do not address AI at all. A company should update its form so that entering or uploading confidential information into an AI system or large language model operated by a third party is treated as a disclosure, which the recipient may make only as the NDA permits.

Limit AI Usage. The NDA should restrict how the recipient uses AI with confidential information. A disclosing party with especially sensitive information may prefer to prohibit AI use altogether, or for a defined subset of its information. Where AI use is allowed, it can be limited to tools that: (i) are enterprise deployments under a written contract, (ii) do not retain inputs or outputs containing or reflecting confidential information beyond the session, or delete them within a set period or on written request, (iii) do not use inputs to train or improve models, including the receiving party’s own models, and (iv) require the provider and its subprocessors to be bound by confidentiality obligations acceptable to the disclosing party. The major enterprise offerings generally commit not to train on business data by default and give administrators control over retention, but terms differ by product and subscription level and should be checked rather than assumed. A schedule of pre-approved AI tools can also be attached.

Summaries and Analyses. Summaries, analyses and other output generated by AI from confidential information should themselves be defined as confidential information.

“Residual” Clauses. A residuals clause lets the recipient use confidential information retained in the unaided memory of its personnel. If a company accepts a residuals clause, it should make clear that information stored in, retrieved from or processed by an AI tool is not “unaided memory.”

Return or Destruction. The return or destruction provision should require the recipient to delete confidential information from its AI tools as well, including prompt histories, chat logs, vector databases and other indexes, subject to negotiated exceptions for backups and legally required retention with appropriate safeguards. Once information has been used to train a model, removing it may be difficult or impossible. Researchers have pointed out that removing information from an AI model is fundamentally different from deleting a record from a database, which is one more reason to prohibit such training in the first place.