The people inside the data room

On April 28, Harvey and Ansarada announced that documents in Ansarada's virtual data rooms would flow directly into Harvey's legal AI for analysis, with no manual extraction.¹ Ten days later, Harvey and Docusign announced a separate partnership connecting Harvey's reasoning to Docusign's Intelligent Agreement Management platform, the system through which Docusign claims to process more than 1.5 billion agreements a year.² Read together, the two announcements describe a single continuous pipeline: deal documents land in the VDR, get parsed by Harvey, get drafted and negotiated through Harvey, and get executed through Docusign, without leaving the integrated stack.

The trade press read this as a consolidation story, which it is. Harvey is positioning itself as the connective tissue across the stages of a transaction, rather than a point tool for due diligence or contract drafting. Standalone contract-lifecycle vendors like Ironclad, last funded at a $3.2 billion valuation in 2021 and quiet since,³ are the obvious losers. The market analysts have a frame for that conversation. It is the frame the press releases were written to invite.

The frame I want to use is different. I want to talk about the people whose documents are in those data rooms.

Who is actually in a VDR. A virtual data room for an M&A transaction is one of the most sensitive document repositories in commercial life. It holds the target company's unredacted financial statements, its customer contracts, its supplier agreements, its IP filings, its outstanding litigation, its employment records, its compensation schedules, its severance arrangements, its sales pipelines.¹ The data room exists so that a prospective buyer can decide whether to acquire the company and at what price. Most of the human beings whose data appears in those documents — the engineers whose IP assignments are in the folder marked "intellectual property," the salespeople whose performance reviews sit in "human resources," the customers whose pricing terms are in "material contracts" — do not know the data room exists. They have not been told that a deal is in progress. They will find out when it closes, if then.

This is not Harvey's invention. It is how M&A has always worked. Commercial confidentiality is the whole point: a leaked deal kills the deal. The target's employees and customers cannot be informed in advance, because informing them in advance would, in many cases, end the transaction. The legal and economic architecture of M&A is built on the principle that the people most affected by a sale of the business they work for, or buy from, are the last to be consulted.

What is new is the AI layer on top.

The consent gap is structural, not incidental. Ansarada's permissioning system is designed to protect the seller's commercial interests. It decides which bidder sees which folder, which advisor gets which document, what gets watermarked, what gets redacted. It is a tool for managing information asymmetry in a negotiation. It is not, and was never designed to be, a privacy framework for the individuals whose records appear in the documents.

When the integration is described as "secure, AI-powered deal workflows,"¹ the security on offer is the security of the deal — that the buyer cannot see what they are not entitled to see, that the seller cannot leak what they should not leak. That is a real form of security. It is also not the form of security that matters for the engineer whose employment contract, complete with their name, their compensation, and the non-compete that will determine whether they can take another job, is now being read by a large language model whose training data, retention policy, and inference logging the press release does not describe.¹²

I have read both press releases carefully. Neither specifies what Harvey's models are trained on, whether deal data is used to improve those models, how data is segregated between deals, or how it is deleted when a deal closes or collapses.¹² These are not exotic questions. They are the questions any data protection officer would ask on day one. Their absence from the announcements is the announcement.

The defenders' case, taken seriously. I want to engage the strongest counter-argument before going further, because there is one and it is not stupid.

The argument goes: commercial contracts already pass through many hands. A law firm advising on an acquisition shares documents with junior associates, with paralegals, with external e-discovery vendors, with translation services, with valuation specialists. The employees and customers whose data appears in those documents do not consent to each of those processing steps. There is a longstanding structural exception in privacy law for legal services, and Harvey's AI processing is arguably continuous with that — a faster, more capable version of work that was always going to be done.⁴ On this view, adding an AI to the pipeline is a tooling change, not a categorical change.

It is true that the legal services exception is real and longstanding. It is true that data rooms have always been read by people who are not the data subjects. It is true that the productivity case is not invented: a Harvard and MIT field experiment in 2023 found AI tools cut time on legal tasks by around 25% with quality equal or better, which is a serious finding and not the kind of thing one waves away.⁵ Junior associates spend a lot of their early careers on document review that practitioners themselves describe as low in learning value. If that labour gets absorbed by tooling, there is at least a plausible story in which the profession restructures toward higher-value work rather than pure displacement.

I take all of that seriously. It is still not enough.

Why the tooling change is a categorical change. A junior associate reading a data room reads what they need to read, forgets most of it, and is bound by professional duties whose breach has career-ending consequences. The associate does not have a memory that can be queried by a third party years later. The associate cannot be subpoenaed for the latent representations they formed while reading. The associate is not a system whose weights might encode, in some lossy and unauditable form, the compensation structure of every target company in every deal Harvey has ever processed.

I am not claiming that Harvey is doing any of that. I am claiming we do not know, because the press releases do not say, and because the architecture of accountability that constrains a junior associate, professional regulation, malpractice insurance, fiduciary duty to a named client, has no obvious analogue for a model. The legal services exception evolved against a backdrop of human professionals embedded in regulatory regimes. Grafting it onto an inference pipeline run by a venture-backed platform, raising $300 million at a $3 billion valuation,⁶ is not a small extension. It is the assumption that an exception built for one set of agents applies automatically to a different set, because the new agents do tasks that look superficially similar.

The legal services exception evolved against a backdrop of human professionals embedded in regulatory regimes. Grafting it onto an inference pipeline is not a small extension.

Who is being optimised for. The way to read any platform consolidation is to ask whose problems are being solved. The Harvey–Docusign–Ansarada stack solves real problems for deal lawyers, for corporate development teams, for the partners who sign off on transactions. Faster due diligence. Cheaper contract review. Better drafting. Fewer late nights for the senior associate trying to find the indemnity clause across forty-three versions of the SPA. These are not fake benefits. They accrue to identifiable people who will, quite reasonably, welcome the tools.

The benefits do not accrue, in any direct way, to the engineer whose IP assignment is in the folder, or to the salesperson whose performance review is in HR, or to the customer whose pricing is in material contracts. For those people, the integration is a change in how their data is processed, by whom, with what retention, for what downstream uses, with what audit trail — and they are not party to the conversation in which any of this gets decided. They were not party to it before AI either. The difference now is the scale and persistence of what "processing" means.

This is what I mean when I say distributional questions are first-order. The deal economics get optimised. The lawyer's workflow gets optimised. The risk and the data exposure get redistributed downward, onto people who do not appear in any signature block.

The labour question, briefly. The other group with no voice in this announcement is the one doing the work today. Document review, due diligence checklists, first-pass contract markup — this is junior-associate and paralegal work. The integrations are being announced at the platform level, as productivity stories, which is the standard rhetorical move for absorbing labour without naming it. I am willing to believe that some of that work was unrewarding and that the profession could restructure usefully. I am also willing to notice that "restructure usefully" is what people say about every labour transition until the data comes in, and that the global legal AI market going from roughly $1.2 billion in 2024 to a projected $35 billion in a decade⁷ is not a number that suggests a small adjustment at the margins. Whether the restructuring lands well for junior lawyers depends on whether anyone is bargaining on their behalf about how the productivity gains get distributed. As far as I can tell, nobody is.

What to watch. A few things, specifically.

First, whether Harvey or its competitors publish meaningful data governance terms for the deal-flow use case — not generic enterprise security language, but specific commitments on training, retention, segregation, and deletion that a target company's data protection officer could enforce. The current press releases do not contain this. They could.

Second, whether any regulator, the ICO in the UK, the CNIL in France, the FTC's data-practices arm in the US, treats AI processing of M&A data rooms as something distinct from traditional legal services processing, or whether the exception simply absorbs the new technology by default. The path of least resistance is absorption. That is the path being taken absent anyone forcing the question.

Third, whether Docusign's IAM, which has been commercially soft since launch,² uses the Harvey integration to require customers to accept broader data-processing terms as a condition of access. Platform consolidations very often work this way: the integration is the carrot, the new terms are the stick, and the customer's counterparties, who never agreed to anything, are the ones whose data flows through the new arrangement.

I am not arguing that any of these deals should not happen, or that AI should not be applied to legal work, or that productivity gains are illegitimate. I am arguing that the people whose lives sit inside the data room — the workers, the customers, the third parties to a transaction they did not know was happening — are nowhere in the announcements, and they are nowhere in the integration architecture, and the press releases that describe this consolidation as a story about workflow are describing it accurately only if you accept that the people inside the documents are part of the workflow rather than people.

That is the part I do not accept.

Footnotes

¶