Articles · October 23, 2026

What sits in a deal room: licensing M&A records for AI without breaching confidentiality

A completed deal leaves a trail: the data room, the NDA, the quality-of-earnings file, the disclosure schedules, the emails that closed the point. Those records exist because someone needed them to evaluate or finish a transaction. They were not written for the public web, and most of the legal work around them is about keeping them that way.

This is not a claim that any buyer is asking for M&A files, or what they would pay. It covers the confidentiality, privilege and privacy questions to settle first. General information, not legal advice.

Why these files are not like a public archive

Large language models have been trained mostly on text that was already public. In its investigation of OpenAI, the Office of the Privacy Commissioner of Canada found that more than 99% of the information OpenAI used to pre-train its models was crawled from publicly accessible sources, and the rest came from licensed third-party datasets [1]. Deal-room files sit on the other side of that line: they are compiled so a buyer, lender or advisor can look, under contract, and then stop looking if the deal dies.

Canadian private-M&A practice treats a confidentiality agreement as a prerequisite to sharing information for due diligence. Osler describes it as preventing the purchaser from disclosing the existence of the negotiations and from using the information for any purpose other than evaluating the transaction [2]. If a later licence would let an AI lab use a copy of those files to train a model, that is a different purpose than the one the NDA (and, usually, the client) contemplated.

What a typical deal room holds

• financials, quality-of-earnings work and tax files;
• customer, supplier and employee lists, and the personal information in them;
• material contracts, disclosure schedules and board minutes;
• legal opinions, privilege logs and counsel emails.

A wholesale export is rarely something you can clear in one step.

Start with the contracts that created the room

NDAs and process letters. In general, they limit use to evaluating that transaction and require return or destruction if it does not close [2]. Read whether they allow any later use, sublicence or sharing with a third party that is not a deal advisor. If they are silent, do not assume a training licence is allowed.

Client and target consent. An advisory firm often holds the room as agent for a client. The client's engagement letter and the target's process rules decide who can authorise a later use. Get that authority in writing before anything leaves your systems.

Public-company files and "need to know". For reporting issuers, Canadian securities guidance treats selective disclosure of undisclosed material information as tipping, unless it is in the "necessary course of business". National Policy 51-201 says that exception exists "so as not to unduly interfere with a company's ordinary business activities", and it lists "parties to negotiations" among the usual examples [3]. A later training licence is not on that list. If your archive includes that kind of material, get securities advice before you treat it as licensable.

Privilege and a lawyer's duty of confidentiality

If you are a law firm, or you hold counsel's files from a deal, two separate duties apply.

Ontario lawyers must hold in strict confidence all information concerning the business and affairs of the client acquired in the course of the professional relationship (rule 3.3-1). The commentary says the duty is owed to every client, continues after the lawyer has ceased to act, and also covers anyone seeking advice even if no formal retainer follows [4]. Solicitor-client privilege is a separate evidentiary rule: it covers confidential communications for legal advice [5]. The privilege belongs to the client, not the lawyer [6].

A training licence that copies a deal file is a disclosure. In general, it needs the client's informed authority, and privileged communications should stay out unless the client has waived privilege for that use. Other provinces and US state bars have their own rules; do not rely on this summary for them.

Personal information is its own gate

Deal rooms almost always include personal information. PIPEDA's business-transaction rule (s. 7.2) lets parties to a prospective deal use and disclose personal information without the individual's consent only if they already have an agreement that the recipient will use it solely for that transaction, protect it, and return or destroy it if the deal does not proceed — and only if the information is necessary to decide whether to proceed and to complete it [7]. The same section does not apply to a transaction whose primary purpose is buying or selling the personal information itself [7].

A later licence to an AI lab is a different use than the deal s. 7.2 describes. Whether s. 7.2, including the completed-deal rule in s. 7.2(2), could apply is a question for privacy counsel. Canada's Privacy Commissioner also says organisations should limit collection to what is necessary and use anonymised or de-identified data where possible [8]. Sharing personal information with a third party can require consent, so get privacy advice before you share any.

A short checklist before you say yes

• Which rooms do you still hold, and for which client?
• What does each NDA and engagement letter allow after the deal closed or died?
• Which files are privileged, and has the client waived that privilege for this use?
• What personal information is in the room, and can it be removed?
• Who must approve: the client, the target, your partners, and counsel?

If you cannot answer those from documents you have read, do not licence the room.

Where to start

Inventory the rooms you hold, the NDAs that cover them and the clients they belong to. Then get legal and privacy advice before you talk to any buyer.

Our free Data Check takes about two minutes. You enter your company's website and a few details, and it shows an estimated range of how many business records you hold, a data-readiness score, and how you match what buyers look for. You don't upload any files. It can't tell you what your data is worth and isn't an offer: any offer comes from the buyer after they review your data, and some companies are not accepted.

Frontenac Labs is an independent referrer. We do not act for any buyer. If your company licenses data to a buyer we introduce, that buyer may pay us a referral fee. You pay us nothing. The buyer alone decides whether to accept your company and on what terms; we cannot promise any price, payout or acceptance. Full disclosure

Before licensing any data, your company must confirm that it has the legal and contractual right to do so, including under privacy law, confidentiality agreements and client contracts. Frontenac Labs does not give legal advice on this; please get your own. This article is general information, not legal advice.

Sources

1. Office of the Privacy Commissioner of Canada, PIPEDA Findings #2026-002: Overview of the Joint Investigation of OpenAI OpCo, LLC. https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/
2. Gorka and Anderson, Osler, Hoskin & Harcourt LLP, "Preliminary documentation," in Acquisitions of private businesses in Canada, 9 July 2025. https://www.osler.com/en/insights/reports/acquisitions-of-private-businesses-in-canada/preliminary-documentation/
3. Canadian Securities Administrators, National Policy 51-201 Disclosure Standards, ss. 3.1 and 3.3 (quoted: "ordinary business activities"; "parties to negotiations"). https://www.osc.ca/en/securities-law/instruments-rules-policies/5/51-201/national-policy-np-51-201-disclosure-standards
4. Law Society of Ontario, Rules of Professional Conduct, r. 3.3-1 and commentary [3]–[4]. https://lso.ca/about-lso/legislation-rules/rules-of-professional-conduct/chapter-3
5. Law Society of Ontario, Rules of Professional Conduct, commentary [2] to r. 3.3-1 (privilege is distinct from the ethical confidentiality rule). https://lso.ca/about-lso/legislation-rules/rules-of-professional-conduct/chapter-3
6. Law Society of Ontario, "Solicitor-client privilege" ("the privilege belongs to the client and not the lawyer"). https://lso.ca/lawyers/practice-supports-and-resources/topics/the-lawyer-client-relationship/solicitor-client-privilege
7. Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7.2 (including s. 7.2(2) on completed transactions). https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-7.2.html
8. Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/