Attorney-Controlled AI for Transactions: A Framework for Contract Review and Due Diligence

The AI may read, classify, and propose. The attorney decides.

Contract review and due diligence are adopting AI faster than the controls around them. In litigation, AI-assisted review matured under adversarial pressure: methodology could be challenged, validation was expected, and a lawyer’s certification attached to the result. Deal work has no equivalent forcing function. No opposing party tests the diligence methodology, and no court reviews the markup before it goes out.

The consequences of an error in deal work still arrive, only later. A change-of-control provision missed in a data room, or a limitation of liability that does not say what the client believes it says, surfaces after signing or after closing, when the cost of correction is highest and falls on the client.

This paper argues that transactional AI should be held to litigation-grade controls regardless, and sets out a framework for doing so. The framework rests on one principle: the AI may read, classify, and propose; the attorney decides, and the record shows that the attorney decided. It has four parts:

• A professional-responsibility baseline drawn from ABA Formal Opinion 512 and the Model Rules on competence, communication, fees, confidentiality, and supervision.
• Nine controls for contract review, from scope and instructions through tracked-change authorship, recorded dismissals, audit trail, and data handling.
• A due diligence workflow for data rooms: deal questions, bulk classification, validation by sampling, exception handling, privilege and confidentiality, and handoff into negotiation.
• A vendor checklist and an implementation plan in which the team, not the vendor, defines what success means.

Sections 1 through 6 are vendor-neutral. A clearly labeled sidebar describes how one platform, DecoverAI, implements the controls.

Why transactional AI needs litigation-grade controls

Litigation document review developed its discipline because someone was always prepared to attack it. Transactional review has fewer external checks, which means the controls have to be built in rather than imposed from outside. Five features of deal work make this especially important.

Position determines meaning

An indemnity basket, an exclusivity period, or an assignment restriction is favorable or unfavorable only relative to the party you represent. A tool that does not know whose side it is on can describe a clause, but it cannot tell you whether the clause is a problem. Generic output pushes the most important judgment, whether this term is acceptable for this client in this deal, back onto the reviewer without saying so.

The most consequential issues are often absences

A summary of what a contract says is silent about what it omits. A missing cap on liability, a missing termination right, or a missing data-protection clause will not appear in an extraction of existing language. Review that reports only on text that is present creates false comfort.

A redline is a communication

A markup sent to the other side states the client’s position. The attorney who sends it is responsible for every change in it. If a tool can alter the document directly, or if the record does not show who made a change, the line between the lawyer’s work and the machine’s proposal disappears.

Diligence errors are systematic

In a data room, the risk shifts from individual mistakes to criteria applied wrongly across a collection. If the classification of “contains a change-of-control provision” is miscalibrated, it is miscalibrated for every agreement it touches. Systematic risk calls for systematic validation.

Confidentiality obligations run in two directions

Deal documents include the client’s confidential information and, frequently, the counterparty’s, held under a nondisclosure agreement or data-room terms. Where documents go, who can see them, and whether they are retained or used to improve a model are questions the firm must be able to answer before the first upload.

The professional-responsibility baseline

On July 29, 2024, the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, its first formal opinion on lawyers’ use of generative AI tools. The opinion does not create new rules. It explains how existing Model Rules of Professional Conduct apply when lawyers use these tools. ABA opinions are advisory, and the rules that bind a lawyer are those adopted in the lawyer’s jurisdiction, so teams should confirm the position where they practice. The opinion nonetheless provides a common baseline for designing controls.

Competence (Model Rule 1.1)

Opinion 512 indicates that lawyers need a reasonable understanding of the capabilities and limitations of the specific AI tools they use, though not expertise in the underlying technology, and should keep that understanding current. It also indicates that a lawyer may not rely uncritically on AI output; the appropriate degree of independent verification depends on the tool and the task. For transactional work, competence includes knowing whether a tool reviews against the client’s position, how it handles language that is absent, and what it does when a document falls outside its expected patterns.

Confidentiality (Model Rule 1.6)

The opinion directs lawyers to evaluate the risk that information relating to a representation will be disclosed or accessed, inside or outside the firm, through a generative AI tool. It gives particular attention to self-learning tools, meaning tools that may use inputs to improve or train the system. Before inputting information relating to a representation into such a tool, the opinion indicates that the client’s informed consent is required, and that generic boilerplate in an engagement letter is not sufficient to provide it. A tool that does not use client inputs for training changes this analysis, which is why the training question belongs at the top of any vendor review.

Communication (Model Rule 1.4)

The opinion explains that in some circumstances a lawyer must tell the client about the use of AI tools: when the client asks, when the informed-consent analysis above applies, and when the use of the tool bears on decisions the client needs to make about the representation. Many clients now address AI in outside counsel guidelines. A firm should be able to explain to a client, in plain terms, what the tool did and what the lawyer did.

Candor and meritorious positions

The opinion also addresses duties of candor and the obligation to advance only meritorious claims and contentions, a concern illustrated most often in litigation filings. The underlying point applies equally to transactions: output must be verified before it is presented as the lawyer’s work, whether in a brief, a diligence memorandum, or a markup.

Supervision (Model Rules 5.1 and 5.3)

Lawyers with managerial authority are responsible for reasonable measures, such as clear policies, that give assurance the firm’s use of AI conforms to the rules. Supervisory lawyers are responsible for the conduct of the lawyers and nonlawyers they supervise, which includes training on the tools and their risks. The opinion treats AI providers as a form of outside assistance and points to diligence on the vendor: its confidentiality protections, security, and treatment of data.

Reasonable fees (Model Rule 1.5)

The opinion indicates that a lawyer billing hourly should bill for the time actually spent, which can include time spent prompting a tool and reviewing its output, and should not bill for time not spent. It also indicates that time spent learning a tool the lawyer will use generally in practice is ordinarily not billable to the client, and that any charge for the tool itself must be reasonable and consistent with what the client has agreed. For flat-fee and value-billed deal work, the same principle applies: the fee must remain reasonable in light of how the work was actually done.

A control framework for contract review

The nine controls below translate the baseline into requirements for a contract-review workflow. Each describes the control and what a team should require from any tool it adopts.

Due diligence at scale

Diligence turns contract review from a single-document exercise into a collection-level one. The controls above still apply to any agreement that is read closely, but the collection needs its own workflow.

Define the deal questions first

Before any classification runs, the deal team should agree on the questions the review must answer and the criteria for each: which agreements contain change-of-control or anti-assignment provisions, which grant exclusivity, which carry uncapped indemnities, which involve personal data. Criteria written in advance are criteria that can be validated and explained later.

Classify in bulk, then inspect

Bulk classification sorts the collection against those criteria so attorney time goes to the documents that matter. Classification is a prioritization step, not a conclusion. Each call should come with reasoning the reviewer can inspect against the underlying document, and attorneys must be able to override it.

Validate by sampling

Because diligence errors are systematic, validation should be too. A practical protocol:

1. Draw a sample from each classification category, including documents classified as not relevant to a question.
2. Have attorneys review the sample without seeing the AI’s call, then compare.
3. Record each disagreement and its cause: an ambiguous criterion, an unusual document, or a misreading.
4. Revise the criteria where the cause is the criteria, re-run, and sample again.
5. Set tolerance by question. A team may accept more variance on a low-stakes question than on change of control, where it may decide that every agreement gets attorney review regardless.

The team, not the vendor, should set the acceptable tolerance for each question, and the validation record should be kept with the matter file.

Handle the exceptions

Every data room contains documents that resist classification: scanned images, partial drafts, foreign-language agreements, amendments separated from the agreements they amend. Route these to attorneys explicitly rather than letting them fall into a default category, and track them to resolution.

Privilege and confidentiality in the data room

Data rooms raise their own sensitivity questions. On the sell side, privileged material placed in a data room may put privilege at risk, and competitively sensitive information may need to be restricted. On the buy side, the team is holding the counterparty’s confidential information under contractual limits. Privilege and confidentiality analysis should be part of the review itself, so the team can assess sensitive material before deciding how to share or use it.

Hand off into negotiation

Diligence findings feed the purchase agreement, disclosure schedules, and the next round of negotiation. Agreements identified for close review should move into the contract-review workflow in Section 3, with the deal team’s position and instructions carried forward, so the work done in the data room is not re-done in the draft.

Evaluating vendors: questions to ask

The checklist below is organized around the controls in this paper. Ask for answers in writing, and for documentation where it exists.

Data and training

• Are our documents, prompts, or outputs used to train, fine-tune, or improve any model? Is that commitment in the contract and the data processing agreement?
• Where is data processed and stored, and how is it isolated from other customers?
• What are the retention and deletion terms, and can we configure them?

Deployment and security

• Which deployment options are available: shared cloud, single-tenant, private cloud, on-premise?
• Which independent attestations does the vendor hold, and can we review the reports?
• How are access controls set: by role, by matter, through our identity provider?

Evaluation evidence

• What evidence supports the tool’s performance on transactional documents specifically, as distinct from other kinds of legal work?
• Will the vendor support a pilot on our own documents, with success criteria we define?
• How does the tool behave when language is missing, or when a document is outside its expected patterns?

Authorship and control

• Who authors the redlines? Do changes appear as ordinary tracked changes under the attorney’s name?
• Can anything change in the document without an attorney’s action?
• Can the tool review from a selected party’s side, and accept deal-specific instructions?

Logging and supervision

• What is logged: access, findings, insertions, dismissals and their reasons?
• Can a supervising lawyer review that record for a matter?
• Can we export the record if a client or auditor asks for it?

Commercial terms

• Is pricing published? How is AI usage charged, and how will that affect what we bill clients?
• Are the word processor integration and diligence capabilities included, or separately licensed?

An implementation plan

Design the pilot

Choose one contract-review use case and one diligence use case that the team performs often and knows well, for example a recurring agreement type reviewed from a consistent side, and a representative set of documents from a completed transaction. Before using documents from a prior matter, confirm that doing so is consistent with the firm’s confidentiality obligations to that client and with any data-room or nondisclosure terms.

Establish an attorney baseline first: how the team reviewed the same material, what it found, and how long it took. Then run the tool on the same material, with attorneys reviewing the output under the controls in Sections 3 and 4. Keep the pilot small enough that every finding can be checked.

Let the team define success

The criteria should come from the attorneys who will rely on the tool, written down before the pilot starts. Useful dimensions include:

• Coverage: did the tool surface the issues the attorney baseline identified, particularly the ones the team rates as critical?
• Missing language: did it flag the protections that were absent?
• Fidelity: did each finding quote the source accurately and point to the right place?
• Usefulness of proposals: how often did attorneys use a suggested fix as written, revise it, or dismiss it, and for what reasons?
• Diligence accuracy: how did classification compare with attorney review in the validation sample, question by question?
• Effort: how did attorney time compare with the baseline, measured by the team?

Decide in advance what result on each dimension would justify broader use, and what result would end the pilot.

Roll out with the obligations in view

• Policy (Model Rules 5.1, 5.3): a written policy on approved tools, permitted uses, verification expectations, and who may use what.
• Training (Model Rules 1.1, 5.1, 5.3): instruction on the tool’s capabilities and limitations, and on the review controls, before access is granted.
• Client communication (Model Rules 1.4, 1.6): a review of engagement terms and outside counsel guidelines, and a plain-language description of how AI is used on the client’s matters.
• Billing (Model Rule 1.5): guidance on recording time and on whether and how tool costs are charged.
• Ongoing validation: periodic sampling on live matters, and a named owner who reviews logs, dismissal patterns, and exceptions.

Expand use by agreement type and practice group as each clears the criteria the team set, rather than all at once.

Control is the feature

The question for transactional teams is not whether AI can read a contract. It is whether the team can show, for any deal, what the tool proposed, what the attorney decided, and why. ABA Formal Opinion 512 frames that obligation in familiar terms: understand the tool, protect the client’s information, communicate with the client, supervise the work, and charge a reasonable fee. The controls in this paper turn those duties into requirements a team can test before it buys and verify after it deploys.

Tools that keep the attorney’s position at the center, quote their sources, surface what is missing, change nothing without the lawyer’s action, and record the lawyer’s decisions are tools a firm can stand behind. For the companion paper on litigation review, see Defensible AI Document Review.

Published by DecoverAI, October 2026. This white paper is for general information and is not legal advice. Confirm the rules of professional conduct that apply in your jurisdiction.