Due diligence is a race against the clock under strict confidentiality. In a matter of weeks, an investment team and its advisers must read hundreds of documents, spot what matters, ask the right questions, obtain the answers and draw from them a conclusion on which an investment decision rests. The volume of documents keeps growing, timetables are tightening, and a good part of the time goes into reading, filing and searching rather than into analysis.
Artificial intelligence (AI) seems made for this problem. A tool capable of reading a data room, extracting the clauses of a contract or summarising a report promises to give the team back the time it spends sorting. But due diligence is also the exercise in which an omission costs the most: a missed change of control clause, a misread dispute, an off-balance-sheet commitment that goes unnoticed. And the documents are covered by non-disclosure agreements (NDAs) that strictly govern what can be done with them.
This guide is intended for investment teams at private equity and venture capital funds, mergers and acquisitions (M&A) advisers, corporate development teams and transaction teams. It describes where AI can help at each stage, what remains the responsibility of the team and its advisers, the confidentiality rules to observe and how to organise sign-offs. The examples are generic: they name no transaction, company, person or tool.
What due diligence is and why it lends itself to AI#
Due diligence is the set of checks carried out before a transaction to confirm what the seller presents and to uncover what it does not. It covers several workstreams: financial, legal, tax, employment, commercial, operational, technical and environmental. Each workstream has its own specialists, documents and questions, but they all share the same mechanics: read, compare, question, conclude.
These mechanics lend themselves to AI for a simple reason. Much of the work consists of finding a specific piece of information in a large volume of text, or checking that it is not there. Language models are effective at reading, classifying and extracting. They are far less effective at judging the significance of a piece of information in the context of an investment thesis, and they can be wrong with complete confidence. The way the work is organised must take both of these realities into account.
The stages of a due diligence#
A due diligence generally follows a recognisable sequence. The preparatory phase sets the scope, the workstreams to be covered, the advisers engaged and the timetable. The opening of the data room gives access to the documents, often in several waves. The document review divides the reading between the teams. Question lists (Q&A lists) are sent to the seller, who answers them as the process goes on. Management sessions supplement the documents. The advisers' reports summarise the findings. Finally, the decision incorporates these findings into the valuation, the structure and the legal documentation of the transaction.
At each stage, the useful question is not ‘can AI do it?’ but ‘how much of this stage is reading and sorting, and how much is judgement?’ It is the first of these that can be entrusted, under supervision, to a tool.
Where AI can help#
The uses below are possibilities to be assessed in the context of each transaction, and always provided that the tool is compatible with the confidentiality undertakings.
Reading and classifying documents#
When a data room opens, a tool can classify the documents by type, identify duplicates and successive versions, flag illegible or incomplete documents and produce a table of contents that is easier to work with than the folder structure provided. This work, often given to the most junior team members, determines the quality of everything that follows.
Targeted search and extraction#
A tool can search across all the documents for every occurrence of a given type of information: change of control clauses, guarantees given, exclusivity commitments, disputes mentioned, expiry dates of major contracts. It can present these extracts in a table, with a reference to the document and the passage they come from. This reference is essential: without it, the extract cannot be verified.
Identifying gaps#
The absence of a document is often as telling as its presence. By comparing the contents of the data room with a request list or with a list of documents expected for this type of business, a tool can flag what is missing and prepare follow-up requests. It does not know why the document is missing; the team, for its part, must ask.
Question lists and tracking answers#
A tool can suggest questions based on points identified in the documents, avoid duplicates between workstreams, track the status of answers and match each answer to the question asked. When the seller answers only partially or refers to a document, the tool can flag that the question remains open.
Contract review#
For large numbers of similar contracts, such as customer contracts, supplier contracts or leases, a tool can extract the standard clauses and flag those that depart from the usual template. For the transaction documents themselves, it can compare successive versions of a share purchase agreement and flag the changes. Legal interpretation and risk assessment remain the lawyers' responsibility.
Summary and report preparation#
At the end of the review, a tool can bring together the findings from the various workstreams, propose a structure for the summary and produce a first draft based on the team's notes. As with any drafting, it must rely only on verified findings, and every statement must refer back to its source.
What remains the responsibility of the team and its advisers#
Several things cannot be delegated. Assessing the significance of a finding in light of the investment thesis is one of them: a clause that is routine in one transaction can be decisive in another. Conducting the management sessions, in which the people are assessed as much as the answers, is another. The advisers' responsibility for their reports, governed by their engagement letters and their professional rules, does not pass to a tool. And the decision to invest, like its terms, belongs to the investment committee.
It is worth putting this in black and white at the launch of the transaction. This clarity protects the team against a common drift: growing reliance on summaries produced by a tool, at the expense of reading the decisive documents.
Confidentiality: the agreement, the data room and the tool#
Every due diligence begins with a non-disclosure agreement (NDA). This agreement defines who may access the information, for what purpose and sometimes by what means. Some agreements explicitly prohibit transferring the documents outside the data room or entrusting them to third parties. An AI tool hosted by a provider may be regarded as a third party. Before using a tool, you must therefore reread the agreement and, if in doubt, put the question to the seller or its adviser.
Beyond the agreement, several technical questions arise. Where does the tool process the data? Does the provider retain the documents or the queries, and for how long? Is the data used to train models? Who at the provider can access it? The answers are generally set out in the contractual terms of the service; they must be checked before the transaction, not during it.
Some data rooms offer their own AI features, running within their own environment. They can simplify the confidentiality question, but they do not remove the need to check what they do with the data and to validate their outputs.
Inside information and personal data#
When the target or the acquirer is listed, the information exchanged during a due diligence may constitute inside information within the meaning of the EU Market Abuse Regulation. This requires keeping a list of the people who have access to it and controlling how it circulates. Using a tool must not widen this circle without control.
A data room also almost always contains personal data: employment contracts, remuneration, information about senior executives, disputes with employees or customers. The General Data Protection Regulation (GDPR) applies to its processing, including by an AI tool. The data minimisation principle calls for submitting to the tool only what is necessary and, where possible, preferring documents in which personal data has been redacted.
Output quality: cite the source, flag the absence#
Two requirements make the difference between a useful tool and a dangerous one in due diligence. The first is to cite the source: every extract and every statement in a summary must refer to the document and the passage it comes from, so that the team can check it in an instant. The second is to flag absence: when the tool cannot find a piece of information, it must say so, rather than produce a plausible answer.
These requirements must be tested before the transaction, on documents whose content is known. A simple test set, made up of a few contracts and questions whose answers are known, shows whether the tool finds what it should find, whether it invents, and whether it flags what it cannot find. This test is worth more than any sales demonstration.
The sell side: preparing a readable data room#
AI is also of interest to the seller and its advisers. Preparing a data room involves gathering, classifying and checking scattered documents, often under time pressure. A tool can help identify missing documents against a standard list, pick out the most recent versions, redact personal data that does not need to be disclosed and prepare factual summaries. A well-organised data room shortens the due diligence and reduces the number of questions, which serves both parties.
The same precautions apply: the tool does not decide what must be disclosed, and the seller is answerable for any summary provided to the buyer.
Organising the team and sign-offs#
The use of AI in due diligence is prepared before the transaction, not during it. You need to decide which tools are authorised, for which uses, with which documents, and who validates their outputs. Roles must also be allocated: who configures the tool, who formulates the searches, who checks the extracts and who incorporates the findings into the report.
A simple rule helps to stay in control: any finding that appears in a report or influences a decision must have been checked in the source document by a member of the team. The tool speeds up the search; it does not replace verification. Junior team members, who are often the heaviest users of these tools, must understand that this verification is part of their job and not an optional step.
Measuring what AI changes in a due diligence#
Measuring the benefit of a tool in due diligence is tricky, because every transaction is different. A few indicators remain useful: the time between the opening of the data room and the first question list, the number of documents reviewed per person, the number of redundant questions sent to the seller and, above all, the number of significant findings discovered late. This last indicator measures quality, which matters more than speed.
The most honest comparison is between comparable transactions, with and without a tool, taking into account the time spent checking the outputs. A written lessons-learned review after each transaction, covering what the tool did well and what it missed, gradually builds knowledge that is more reliable than impressions.
Pitfalls to avoid#
The first pitfall is using a tool without having reread the non-disclosure agreement. The second is trusting a summary without going back to the decisive documents. The third is believing that a search with no results proves the absence of a risk, when it may merely reveal a limitation of the tool. The fourth is submitting to the tool personal data that was not necessary. Finally, the fifth is measuring the benefit in terms of speed alone, without looking at the findings that were missed.
Glossary#
- Due diligence: the set of checks carried out before a transaction to confirm the information presented by the seller and to uncover risks.
- Data room: a secure space in which the seller makes the company's documents available to potential acquirers and their advisers.
- Non-disclosure agreement (NDA): a contract that governs access to the information exchanged, its use and its circulation.
- Change of control clause: a clause that allows a counterparty to amend or terminate a contract if the controlling shareholder changes.
- Question list (Q&A list): the set of information requests sent to the seller during the due diligence, together with the tracking of the answers.
- Investment thesis: the reasoning that justifies the transaction and against which the significance of each finding is assessed.
- Inside information: precise, non-public information which, if it were made public, would be likely to have a significant effect on the price of a financial instrument.
- Test set: a set of documents and questions whose answers are known, used to assess a tool before relying on it.
Printable checklist#
This list helps you prepare for the use of AI in a due diligence. It does not replace the advice of a lawyer or the professional rules of your advisers.
Before the transaction#
- The authorised tools, their uses and the documents they may receive are defined.
- Where the data is processed, how long it is retained and how the provider uses it are known.
- The tool has been tested on a set of documents whose answers are known.
- Roles are allocated: configuration, searches, verification, incorporation into the report.
When the data room opens#
- The non-disclosure agreement permits the intended use of the tool, or the seller has confirmed it.
- The list of people with access to the information is maintained if a listed company is involved.
- Personal data that is not needed is excluded or redacted.
During the review#
- Each extract refers to the document and the passage it comes from.
- Searches with no results are reported as such, and not as an absence of risk.
- Every finding included in a report has been checked in the source document.
After the transaction#
- A written lessons-learned review describes what the tool did well and what it missed.
- The documents provided to the tool are deleted in line with the undertakings given.
Frequently asked questions#
Can AI replace part of the advisers' work in due diligence?#
It can speed up reading, classifying and searching, but it replaces neither the expertise nor the responsibility of the advisers. Their reports rest on their professional judgement and engage their liability; a tool carries neither.
Can an AI tool be used on a confidential data room?#
Only if the non-disclosure agreement allows it and the tool offers compatible guarantees as to where the data is processed, how long it is retained and how it is used. If in doubt, the question should be put to the seller or its adviser before starting.
How can you prevent the tool from inventing information?#
By requiring it to cite the source of every extract, by testing it on known documents before the transaction, and by checking in the source document any finding included in a report.
Does a search with no results prove that a clause is absent?#
No. It shows that the tool found nothing, which may be due to how the search was worded, the quality of the document or the limitations of the tool. Decisive points are verified by a human reader.
Is AI useful to the seller too?#
Yes. It can help prepare a complete and readable data room, redact personal data that does not need to be disclosed and anticipate questions. A well-prepared data room shortens the transaction for everyone.
Conclusion#
AI can give a due diligence team back some of the time it spends reading, classifying and searching, so that it can reinvest that time in analysis and in discussions with management. It only does this well within a clear framework: an NDA that is respected, a tool tested before the transaction, outputs that cite their sources, and a simple rule under which every decisive finding is checked by a person. Judgement, responsibility and the decision remain with the team, its advisers and the investment committee.