This spring, Wandsworth County Court delivered a verdict that lawyers are still talking about. Garfield AI, an SRA-regulated AI law firm, won a contested trial against a human opponent. It was the first courtroom win of its kind in the UK.
The case itself was small, just a debt claim, nowhere near the size of an M&A deal. But it proved something deal lawyers had already started to suspect. AI has moved past admin work and into real legal reasoning, and clients are starting to trust it with real money on the line.
AI is showing up in deal work faster than most firms can build rules around it. The real question isn’t whether to use it. It’s knowing exactly where to draw the line.
Not All AI Use Is Equal
Using AI to research a market or summarize public information is low risk. Ask it to explain a trend, draft a routine email, or map out a standard process, and you lose nothing. It saves time.
The moment sensitive deal data goes into that prompt, everything changes. A cap table, a draft term sheet, or a client’s disclosure schedule is not the same thing as a market overview, and it should never be treated like one.
Once that data is typed into an AI tool, the deal team no longer controls it. It’s the same loss of control as sharing a document through any unsecured, general customer-grade app. Nobody can say for certain whether that input gets used to train the model, or whether its content and structure quietly resurfaces in someone else’s answer down the line.
Most deal teams don’t cross this line on purpose. They cross it because nobody drew it clearly before a deadline forced someone’s hand.
Why Sensitive M&A Data Deserves a Higher Bar
A term sheet, a valuation model, an undisclosed synergy number: these aren’t just confidential. The moment they exist, they’re price-moving information. Regulators already treat this kind of material as inside information, long before any deal is announced.
M&A deals pull in more people than most corporate matters: buy-side counsel, sell-side counsel, bankers, auditors, sometimes regulators too. Every extra person is one more chance that someone pastes a clause into a consumer AI tool to save twenty minutes, with zero visibility into where that data goes or how long it sits there.
One exposed cap table can shift negotiating leverage before anyone even notices it happened. That’s not a risk you get to price in after the fact.
The Right Environment for Sensitive Data
You can’t rely on people to remember which documents are too sensitive to touch. The safer path is building the confidentiality into the software itself. Strong end-to-end encryption should be the baseline, so data stays unreadable to anyone outside the deal, including the platform hosting it.
This doesn’t remove human judgment from the picture. What it does remove is the biggest structural risk: sensitive data sitting in general-purpose tools that were never built to hold it. When a deal team already has what they need inside a properly encrypted environment, they have far less reason to go looking for an outside AI tool in the first place.
Private Deal Rooms: Built for Lawyers, Not Just Storage
Traditional VDR’s (Virtual Data Rooms) solve one problem: secure storage. They’re a repository, not a workspace. Everything else, the negotiation, the notes, the daily back-and-forth, has always lived somewhere else.
Qaxa’s private deal room closes that gap. Instead of a repository with a login screen, it’s a full working environment for an active deal: encrypted chat instead of email threads, a shared notes and file space, and task management with delegation built in.
Most shadow AI risk doesn’t come from the formal disclosure schedule sitting safely in a VDR. It comes from the informal layer around it: a WhatsApp message, a draft sitting in someone’s personal cloud, an attachment sent to the wrong address. A private deal room brings that whole layer inside the same encrypted environment as the documents.
Eliminating Shadow AI Where It Matters Most
None of this is an argument for banning AI. Used on the right material, it’s a real productivity gain, and there’s no point pretending otherwise.
What it does mean is drawing a hard line around sensitive deal data, and backing that line with infrastructure, not a policy document nobody opens once deadlines hit. Shadow AI isn’t a hypothetical for deal teams. It’s already happening, quietly, on live transactions.
Firms that build sensitive data handling via private deal room will spend a lot less time explaining a leak to a client later.
Platforms like Qaxa.com are already built around that principle, with encryption as the starting point rather than an afterthought.
