Privilege

When allegations of corporate misconduct surface, one of the first questions companies may face is who should oversee the response. In some circumstances, an investigation led by management or in-house counsel may be appropriate. But allegations involving senior executives or directors, mission-critical compliance risks, or questions about management’s independence may require the board — often through an independent committee — to take a more active role.

In a new article for Reuters Practical Law, Sidley partner Holly J. Gregory examines when a board-driven investigation may be warranted and how boards can structure those investigations to withstand scrutiny from regulators, prosecutors, shareholders, and courts.

The article also considers recent Delaware decisions addressing directors’ responses to compliance red flags and highlights practical considerations for board-led investigations, including committee independence, investigative scope, preservation, privilege, documentation, whistleblower protections, self-disclosure, reporting, and remediation.

In Fortis Advisors v. Krafton, the Delaware Court of Chancery awarded a striking equitable remedy: it ordered the reinstatement of a CEO who was wrongfully terminated using a strategy developed with ChatGPT, and extended the earnout period by the full duration of his improper exclusion. The buyer had used AI to strategize avoidance of a US$250 million earnout, but because that advice was generated outside the attorney-client relationship, it was not privileged and became damning evidence at trial. The decision puts buyers on notice that depriving seller-managers of bargained-for post-closing operational control may result in not just damages, but equitable remedies that restore control and reset the earnout clock.

Two February 2026 federal court decisions addressed how existing privilege and work product doctrines apply to generative AI, with one court (in United States v. Heppner) denying privilege and work product protection where an executive used an AI platform without adequate confidentiality safeguards and without counsel’s direction, and another (in Warner v. Gilbarco) holding that a pro se litigant’s AI-assisted analysis via a public AI platform was protected work product. These decisions signal that courts may apply existing doctrines to new technology in the legal context. Key considerations include whether the AI platform’s terms and privacy policies preserve confidentiality, the extent of attorney involvement in the AI-assisted work, and whether the materials were prepared in anticipation of litigation. Organizations should inventory AI tools and review their confidentiality terms, establish guardrails against AI use for legal analysis, and consider updating litigation hold protocols to account for AI-generated materials such as prompts and outputs.

Whether a company is gearing up for an acquisition, a growth equity financing, or an IPO, a due diligence review will be an inevitable part of that transaction, and that review will test not only the current business but also the integrity of a company’s historical records. Readiness for that review is critical, as once a diligence process begins, gaps in corporate approvals, equity records, contract management, intellectual property ownership, and regulatory compliance can quickly become leverage for purchase price adjustments, closing conditions, and/or special indemnities. At best, diligence gaps can consume management attention at a time when a company has little bandwidth to spare. At worst, they can detract from a company’s credibility and can have a meaningful impact on deal speed and certainty. Most issues are fixable, but the available solutions often narrow after a deal is already on the table. This article provides an overview of actionable steps leadership at mid- to late-stage private companies can take to make transaction readiness an ongoing discipline rather than a pre-signing scramble.

Set Up and Maintain a Virtual Data Room

Rather than waiting until a letter of intent is signed, companies should stand up and maintain a virtual data room (VDR) early, using records they already keep locally, and treat it as a living repository of critical corporate documents. Management teams that prepare to address anticipated diligence focus areas and maintain organized virtual records early are better positioned when a process launches than teams that start flat-footed. Companies can get a head start by asking outside counsel for a standard due diligence request list, which serves as an organizational and gap-identification tool, as well as an organized table of contents for their VDR. This ensures that documents are comprehensive and indexed by categories prospective investors and acquirers will expect.

The VDR should contain current, fully executed, and dated documents together with all amendments, statements of work, and side letters. Superseded and terminated agreements should be archived, not deleted or mixed with operative versions. One small but time-saving step in setting up a VDR is using a consistent and intuitive naming convention as documents are uploaded, which will help not only management but also third-party reviewers quickly navigate the VDR’s contents. Once a diligence process begins, access should be staged and subject to tiered permissions, with additional controls for competitively sensitive information, compensation data, and litigation files; privileged materials should be withheld or handled through a process designed to preserve privilege. Particularly when a potential buyer is a competitor, or when the underlying material is subject to confidentiality restrictions that do not permit sharing with a potential acquirer or investor, counsel should advise prior to upload and contemplate redactions, clean-team arrangements, and restrictions on downloading or printing. When in doubt, leave it out; it is easier to pause early and evaluate permissions and other protections than to pull back a document after it has been shared.

A word of caution: prospective investors now run AI review tools that can scan an entire data room in minutes, and while that process can generate false positives, it can also magnify every internal inconsistency across the VDR, including in the cap table, contracts, and other materials. As a best practice, keeping the VDR updated quarterly helps identify issues early and positions the company and management to earn credibility from the moment that transaction diligence begins.

Maintain a Corporate Record Book and Organizational Documents

M&A buyers and growth equity investors will expect clean and current corporate governance records. This means prospective investors will review: current versions of the certificate of incorporation (including all amendments) and bylaws; board and stockholder minutes; and fully executed, dated written consents. An improperly compiled consent with a missing signature page or date can cost the company meaningful time and resources to track down or, worse, require corrective action to cure. Every material corporate action should tie out to a corresponding board and/or stockholder approval, including equity issuances, option grants, director and officer elections, and subsidiary formations.

Companies should also at least annually confirm good standing in their state of incorporation and in every jurisdiction in which they are qualified to do business. Outside counsel can obtain verbal good standing confirmations from third-party service providers, often for a nominal or no cost to the company. Good standing lapses can trigger fees, taxes, and penalties and, in many states, can bar the company from bringing suit in local courts until the lapse is cured, although a lapse does not typically invalidate contracts executed while the company was not in good standing. For an additional layer of caution, companies can consider ordering lien and litigation searches from third-party service providers in the same set of jurisdictions.

Ensure Vigilant Capitalization Table Hygiene

The company should expect buyers or investors to request a current copy of the capitalization table and, in the case of an equity financing, a pro forma cap table reflecting the completed round. Most cap table hygiene issues exist well before a contemplated transaction and surface in the diligence process. Common hiccups include unsigned option grants, undocumented stock issuances, unrecorded convertible note draws, and inconsistencies between vesting schedules and employment terms. Cap table accuracy is key: a company’s representations about its capitalization are often treated as fundamental representations, giving buyers or investors the ability to claim breach even for minor discrepancies. Moreover, a messy cap table can be perceived as poor ownership discipline by the company or its management.

With assistance from outside counsel, the company should reconcile the cap table against the stock ledger and equity grant documentation, ensuring that every stock and option issuance is supported by board resolutions, grant agreements, evidence of payment of the exercise or purchase price, and, if applicable, an approved, unexpired equity incentive plan. Each option grant should also be supported by a current 409A valuation that supports the board’s determination of the fair market value of the underlying shares.

Importantly, companies should develop a clear understanding of how antidilution provisions operate and how change-of-control acceleration clauses (single-trigger and double-trigger) may affect the equity/distribution waterfall in a transaction. Modeling these scenarios in advance allows management to communicate the deal economics clearly to all stockholders and avoids last-minute surprises that can derail negotiations.

Understand Key Provisions in Material Contracts

Counsel for buyers and investors will expect the opportunity to review each contract that is material to the business. These typically include: contracts with key customers and suppliers above certain revenue or expense thresholds; license agreements; leases; employment and severance agreements with key personnel; and other contracts that are important to the business. These contracts often contain change-of-control consent triggers, rights of first refusal, out-licensing restrictions, most favored nation provisions, exclusivity, non-solicit, non-compete, and other restrictive covenants. In certain circumstances, a counterparty may have a notice, consent, or termination right in connection with a transaction. Accordingly, with the help of outside counsel, a company should be generally aware of which key agreements contain those provisions and should have a plan for obtaining consents or providing timely notice in advance of entering into a transaction process. Seeking consent late in the process can give leverage to the counterparty, which can increase overall costs and decrease deal certainty.

Confirm Intellectual Property Ownership and Assignment of IP

Depending on the company’s core business, clean IP title is often a significant driver of the diligence process. One consideration that comes up time and again is whether every founder, employee, and contractor who contributed to the company’s IP portfolio has executed an invention assignment agreement that assigns all intellectual property rights to the company. It isn’t uncommon for advisors and early contributors in early-stage companies, often compensated in equity, to miss the assignment paperwork altogether, or to execute, but not date, the assignment. Any gaps in assignment should be addressed ahead of the buyer or investor diligence process, which can be done with the help of outside IP counsel. Companies should also routinely conduct an audit of open-source software usage to confirm compliance with applicable license terms.

Maintain Compliance with Industry-Specific Regulatory Requirements

Companies operating in regulated industries, such as healthcare, financial services, energy, and government contracting, should confirm that all material licenses, permits, and registrations are current and in good standing. Identifying regulatory approvals or notices that would be required in connection with a change-of-control or assignment of a license can avoid an additional layer of investor diligence caused when gaps are identified later in the deal negotiation process. Regulatory non-compliance discovered during diligence can significantly delay closing or reduce deal certainty.

Hong Kong’s securities regulator is taking a harder line on claims that documents are shielded by legal professional privilege. Speaking in late August 2026, the Securities and Futures Commission’s head of enforcement said the agency is prepared to push back against over-broad privilege claims, echoing a recent court ruling. In that case, a broker hired outside lawyers after concerns arose about the handling of confidential information around a block trade, and the resulting internal investigation report was given to the SFC under a limited waiver. When a hedge fund manager sought the report, interview notes, and underlying communications, the broker claimed privilege and lost. The court applied the dominant purpose test: a document is privileged only if it was created mainly to obtain legal advice or for litigation, and here the main purpose was satisfying regulatory reporting obligations. Involving a lawyer or labeling a document does not by itself create privilege, although genuine privilege survives a limited waiver.

Attorney-client privilege is a cornerstone of effective legal risk management, but its application is nuanced — especially for in-house counsel. The privilege protects confidential communications between an attorney and a client made for the purpose of obtaining or providing legal advice. However, courts scrutinize claims of privilege, particularly when in-house counsel are involved or when communications comprise of both legal and business advice. The law governing privilege can vary significantly by jurisdiction; thus, it is important to seek the advice of counsel prior to any communications.

Key Considerations for In-House Counsel:

To maximize protection and avoid inadvertent waiver, legal teams and senior executives should keep the following in mind:

In-house counsel face extra scrutiny

Courts recognize that in-house counsel often wear multiple hats. Privilege will apply only where the primary purpose of the communication was to obtain or provide legal — not business — advice.

Privilege applies only to legal — not business — advice

Privilege attaches only to communications where the predominant purpose is legal advice, such as internal investigations to assess whether employees breached a contractual obligation, reviewing marketing materials for compliance with applicable law, or drafting and analyzing contractual language. Clearly distinguish legal analysis from business discussions, particularly in writing.

Confidentiality underpins privilege

Limit distribution of privileged communications to those who “need to know” and avoid including third parties unless necessary and protected by a recognized exception. This is especially important to keep in mind when discussing privileged information while working remotely. There are no exceptions for spouses, family, roommates, or neighbors.

Common-Interest Exception

For example, in California, generally the common-interest exception extends the privilege to communications between parties and their counsel relating to potential civil litigation provided that:

• The parties have some common litigation interest (a purely personal or business-oriented interest is insufficient); and
• The communications are made to further that shared legal interest.

This exception may also apply where parties maintain separate counsel but coordinate through a joint defense or litigation strategy.

Where it applies, the common-interest exception typically only protects communications involving counsel.

‍

Do not assume privilege exists

Even if you believe a communication is privileged, write with the expectation that it could be reviewed by a court. Privilege does not necessarily extend automatically to subsidiaries or affiliates. Ensure formal retention and clear documentation when representing multiple entities or working with advisors. Additionally, the law governing privilege can vary significantly by jurisdiction; thus, it is important to seek the advice of counsel prior to any communications.

Labels help but don’t control

Mark emails or memos as “Attorney-Client Privileged” and “Confidential,” but remember: substance, not form, determines privilege. Where possible, clearly reference the legal advice sought or provided.

Be explicit in requests for legal advice

Directly address in-house or outside counsel, specify the legal issue, and avoid copying attorneys merely to shield a document.

Separate legal from business content

When communications blend legal and business matters, separate them or document the legal purpose clearly.

By proactively managing privilege, in-house counsel and executives can strengthen the protection of sensitive communications, preserve confidentiality, and reduce litigation risk.