AI in M&A: Confidential Information

Confidentiality Agreements/NDAs:

• Clarify Disclosure and Use. Many existing NDAs do not address AI at all. A company should update its form so that entering or uploading confidential information into an AI system or large language model operated by a third party is treated as a disclosure, which the recipient may make only as the NDA permits.
• Limit AI Usage. The NDA should restrict how the recipient uses AI with confidential information. A disclosing party with especially sensitive information may prefer to prohibit AI use altogether, or for a defined subset of its information. Where AI use is allowed, it can be limited to tools that: (i) are enterprise deployments under a written contract, (ii) do not retain inputs or outputs containing or reflecting confidential information beyond the session, or delete them within a set period or on written request, (iii) do not use inputs to train or improve models, including the receiving party’s own models, and (iv) require the provider and its subprocessors to be bound by confidentiality obligations acceptable to the disclosing party. The major enterprise offerings generally commit not to train on business data by default and give administrators control over retention, but terms differ by product and subscription level and should be checked rather than assumed. A schedule of pre-approved AI tools can also be attached.
• Summaries and Analyses. Summaries, analyses and other output generated by AI from confidential information should themselves be defined as confidential information.
• “Residual” Clauses. A residuals clause lets the recipient use confidential information retained in the unaided memory of its personnel. If a company accepts a residuals clause, it should make clear that information stored in, retrieved from or processed by an AI tool is not “unaided memory.”
• Return or Destruction. The return or destruction provision should require the recipient to delete confidential information from its AI tools as well, including prompt histories, chat logs, vector databases and other indexes, subject to negotiated exceptions for backups and legally required retention with appropriate safeguards. Once information has been used to train a model, removing it may be difficult or impossible. Researchers have pointed out that removing information from an AI model is fundamentally different from deleting a record from a database, which is one more reason to prohibit such training in the first place.
• Notice of Unauthorized Use. If confidential information is entered into a tool that the NDA does not permit, the recipient could be required to notify the disclosing party promptly and take reasonable steps to have the information deleted.
• Mutuality. Many NDAs are mutual, with both sides exchanging confidential information. A company that asks for AI restrictions should be ready to accept them and to apply the same policies and controls to its own employees and representatives.
• Representatives. Bankers, accountants, consultants and outside counsel often do much of the diligence work, and many use their own AI platforms. The NDA’s AI restrictions should extend to representatives, with the recipient remaining responsible for their compliance.
• Trade Secrets. Under the federal Defend Trade Secrets Act, information qualifies as a trade secret only if its owner has taken “reasonable measures” to keep it secret, and confidentiality agreements are a standard part of that showing. At least one federal court has dismissed a trade secret claim where the plaintiff had developed the information by sharing it with a public AI chatbot. An NDA that is silent on AI can leave a gap in that record.

Clean Team Agreements:

• Limited Access. AI can carry competitively sensitive information across a clean team wall without anyone intending it. The FTC has advised that clean teams should not include personnel responsible for competitive planning, pricing or strategy, and an enterprise AI assistant that indexes shared drives or email can undercut that separation. Any shared AI platform must effectively isolate clean team information. In practice, that may mean turning off shared prompt libraries and organization-wide knowledge features for any AI tool that handles competitively sensitive information. Some enterprise assistants surface any content a user has permission to view, so file permissions need to be correct before the tool is switched on.
• Aggregated Analyses. AI-generated summaries and analyses of competitively sensitive information should stay within the clean team by default. Properly aggregated or redacted reports can be released more broadly under agreed protocols after review by antitrust counsel.
• Disaggregation. Recipients should be prohibited from using AI tools to reverse engineer or break aggregated reports back down into the underlying detailed data.
• Data Rooms. The data room’s AI features should follow clean team protocols. For example, an AI search function should not draw answers from folders the requesting user is not authorized to open.
• Personal Acknowledgments. Where clean team members sign individual acknowledgments, consider expressly prohibiting personal or consumer AI accounts and unapproved AI notetakers.
• Enforcement Risk. The stakes are not only contractual. Improper exchanges of competitively sensitive information before closing can support gun-jumping claims under the Hart-Scott-Rodino Act or claims under Section 1 of the Sherman Act. In January 2025, the FTC announced a record $5.6 million civil penalty against merging crude oil producers whose violations included sharing customer, pricing and production information outside a clean team.

Negotiation Process:

• Recording and Summaries. Recording laws vary by state. Federal law and most states require the consent of only one party to a conversation, but several states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, generally require the consent of all parties. AI notetaker providers are also defending class actions under state wiretap laws. The confidentiality agreement is an opportunity to set rules between the parties, although it does not replace any consent the law requires from participants. AI notes and transcripts can also create discoverable records, attribute statements to the wrong person, mischaracterize tentative proposals and send sensitive content to people who were never meant to see it. Consider prohibiting AI transcription and recording tools in meetings and on calls unless an authorized person at the company has consented in advance in writing.
• Privilege and Discovery. Deal teams should not assume their AI chats are private. In February 2026, in United States v. Heppner, the U.S. District Court for the Southern District of New York held that a defendant’s exchanges with a publicly available AI platform were protected by neither the attorney-client privilege nor the work product doctrine. Another federal court reached a different result on different facts, so the law is still developing, but courts are already treating AI prompts and outputs as electronically stored information subject to preservation and discovery. If a deal ends up in litigation, prompts about negotiating positions could be produced.

Contact the authors or your regular Pillsbury contact with any questions or if you are interested in a form review.