When Your eDiscovery Vendor Gets Sold: The UnitedLex Lesson

On September 28, 2026, Legal IT Insider reported that UnitedLex — one of the largest alternative legal service providers (ALSPs) in the world, handling document review, eDiscovery, and legal operations for law firms and corporate legal departments across dozens of jurisdictions — is being acquired from private equity giant CVC by eDiscovery provider Repario Data. No client of UnitedLex voted on this. No managing partner signed off on it. The infrastructure processing potentially millions of privileged documents simply changed owners, the way infrastructure does when private equity decides it's time to exit a position.

This is not a scandal. It's Tuesday in legal tech M&A. But it is worth pausing on, because it exposes a structural risk that most firms have priced into their vendor contracts as boilerplate and almost never as strategy: when you outsource document review, eDiscovery, or AI-assisted legal ops to a third party, you are also outsourcing the future ownership of that infrastructure to whoever buys the vendor next.

The Deal in Brief — and Why It's Not an Isolated Event

UnitedLex was built over two decades into a global ALSP with a footprint spanning eDiscovery, managed review, contract lifecycle management, and increasingly, AI-assisted legal analytics — precisely the workflows firms are being told to "outsource to specialists" rather than build in-house. CVC, a private equity firm with roughly $200 billion in assets under management globally, held UnitedLex as a portfolio company. Now it's exiting to Repario Data, an eDiscovery consolidator, in a transaction that — like most PE-to-strategic-buyer deals — was negotiated privately, priced on EBITDA multiples and synergy assumptions, and disclosed to the market only once terms were largely settled.

The firms and corporate legal departments whose documents sit inside UnitedLex's systems learned about their vendor's change of ownership the same way the rest of the industry did: through a trade publication.

This isn't UnitedLex's first ownership transition, and it won't be the last one in the sector. Consilio has cycled through private equity ownership (Shamrock Capital took a majority stake in 2021). Epiq has been owned by OMERS Private Equity since 2016. Thomson Reuters' Institute has estimated the global ALSP market at roughly $24 billion, growing double digits annually as law firms and corporate legal departments push more document-intensive, AI-adjacent work to third parties to control cost. Every dollar of that growth is also a dollar of client data sitting inside infrastructure whose ownership is, structurally, up for sale.

The Pattern Behind the Headline: PE Consolidation Doesn't Ask Permission

Private equity ownership of legal infrastructure follows a predictable lifecycle: acquire, professionalize, bolt on adjacent capabilities through add-on acquisitions, hold for four to seven years, and exit — either to another PE fund, a strategic buyer, or occasionally an IPO. CVC's exit from UnitedLex to Repario Data fits this pattern precisely. It is not evidence of distress. It's evidence that the business worked exactly as designed for its financial sponsor.

The problem for law firms is that this lifecycle is optimized for investor returns, not for client confidentiality continuity. A few mechanics worth understanding:

• Change-of-control clauses rarely require client consent. Most ALSP master service agreements give firms a notification right, not an approval right, when ownership changes. The data processing continues uninterrupted — which is exactly the point, contractually, but also exactly the risk.
• Personnel churn accompanies ownership churn. Acquisitions typically trigger reorganizations, and reorganizations move the people who understood a firm's specific data handling requirements, review protocols, and privilege logs onto other accounts, out the door, or into new roles entirely.
• Security and compliance postures get re-baselined, not necessarily improved. A new owner inherits infrastructure and often takes 12-24 months to fully audit, harmonize, and in some cases migrate systems onto its own stack — a period during which the buyer is, by definition, still learning what it bought.
• Sub-processor chains lengthen. Acquirers frequently integrate acquired platforms with existing tooling, adding new fourth- and fifth-party vendors to a data supply chain that a law firm's original engagement letter never contemplated.

None of this means Repario Data will mishandle UnitedLex's client data. It means the firms relying on that infrastructure had zero input into whether this transition should happen, on what timeline, or under what security terms — and that's true of every firm using a third-party ALSP, eDiscovery platform, or shared-cloud legal AI tool, regardless of which vendor eventually goes through this cycle.

The 2026 Instability Pattern: It's Not Just Ownership, It's Talent Too

The UnitedLex transaction lands amid a broader reshuffling of who controls legal AI capability. Through 2026, dozens of BigLaw attorneys — including experienced litigators and knowledge management leads — left established firms for AI vendors including Harvey, Anthropic, and OpenAI, drawn by equity upside and the chance to build tooling rather than practice under the billable hour model. That talent migration matters for the same underlying reason the UnitedLex sale matters: the people and infrastructure managing a firm's institutional knowledge, workflows, and increasingly its AI capability are, more often than firms realize, employed by or housed inside someone else's balance sheet.

A firm that trains an outside vendor's model on its playbooks, or routes its document review through an ALSP's proprietary AI layer, is building institutional memory into infrastructure it doesn't own and can't retain when that infrastructure — or the people running it — moves elsewhere. The UnitedLex/Repario Data deal is the ownership version of that same exposure; the BigLaw-to-vendor talent exodus is the human capital version. Both point to the same conclusion: dependency on third-party stacks for sensitive legal work carries risk that doesn't show up on the invoice.

Vendor-Dependency Risk vs. Firm-Controlled Architecture

The distinction that matters isn't "cloud AI is dangerous, on-prem AI is safe" — that's too simplistic and not the honest version of this argument. RAGbase Legal's own architecture still uses frontier LLM providers when firms choose to. The real distinction is what layer of the stack sits under whose control, and what data actually leaves the building when a query runs.

The critical row here is the fourth one. When a firm uses a properly architected private AI deployment, the full client corpus, the vector store, the retrieval index, the permissioning logic, and the workflow history never leave firm-controlled infrastructure. What travels to an LLM provider — whether that's Anthropic, OpenAI, or another model — is the minimal set of retrieved passages required to answer a specific question, transmitted under API terms the firm itself negotiates and can change independently of who owns the underlying model company. That's a fundamentally different exposure profile than routing entire matters through a vendor's proprietary review platform, where the firm has limited visibility into how documents flow internally, let alone what happens to that flow when the platform's parent company changes hands.

What This Means for Privilege, Not Just Security

Data sovereignty conversations tend to default to security language — encryption, SOC 2, breach notification. But the more precise legal exposure in ALSP ownership transitions is privilege continuity. Under ABA Model Rule 1.6 and its state analogues, attorneys retain an obligation of confidentiality that doesn't pause because a vendor changed hands. When an ALSP is acquired, the question isn't just "is the new owner secure enough" — it's "has privilege been preserved through every access point, sub-processor, and internal system migration that accompanies an acquisition of this scale, and can outside counsel demonstrate that chain if privilege is ever challenged in litigation."

That's a substantially harder question to answer for infrastructure a firm doesn't control than for infrastructure it does. Firms evaluating any AI-assisted case search or document review tooling should be asking not just what the vendor's current security posture is, but what contractual and architectural guarantees survive a change of ownership — because 2026 has made clear that ownership changes are a when, not an if, in this market.

What Firms Should Ask Before the Next M&A Headline

The UnitedLex/Repario Data transaction is a useful forcing function for a vendor audit most firms have been deferring. Concrete questions worth raising with every ALSP, eDiscovery platform, and AI vendor currently touching client data:

• Who owns you today, and what does your change-of-control clause actually require of us versus notify us about?
• If you were acquired tomorrow, does our document corpus move, get migrated, or get re-indexed onto new infrastructure — and who controls that timeline?
• What percentage of our data footprint with you is full documents versus minimized, task-specific extracts?
• Can we retain our own copy of the retrieval index, prompt library, and workflow logic independent of your platform, or does that institutional knowledge live entirely inside your stack?
• What sub-processors do you currently use, and does an acquisition typically add new ones without a fresh client review?

Firms that can't get clean answers to these questions are, functionally, betting client confidentiality on a vendor's future cap table.

The UnitedLex sale isn't a reason to panic about every ALSP relationship a firm maintains — outsourced document review and eDiscovery remain legitimate, often necessary, parts of legal operations at scale. It's a reason to be precise about which workloads justify that dependency and which ones warrant infrastructure the firm actually controls. For matters where privilege exposure, regulatory sensitivity, or competitive differentiation make vendor continuity non-negotiable, architecture that keeps the corpus, index, and workflow layer on firm-owned infrastructure — while still using best-in-class models for the actual reasoning — is worth the evaluation. Our AI for law firms guide walks through how to map that decision workload by workload, before the next trade headline forces the conversation.