AI due diligence: what software can review in a deal, and what it cannot

Due diligence has always been a reading problem. A mid-market sale can put 20,000 pages in front of a buyer, and the team has a few weeks to find the handful of clauses, liabilities and numbers that change the price. AI tools promise to read faster than any associate. Some of that promise is real.

This guide looks at AI due diligence from the reviewer’s side: which tasks it handles, which it only assists with, how to supervise it, and how the data room fits in. If you want the provider view, our guide to AI in virtual data rooms lists which rooms in our directory include AI features.

What is AI due diligence?

AI due diligence is the use of software that reads documents, not just stores them, to speed up the review of a company before a transaction. The tools fall into two families. Some live inside the data room and work on what has been uploaded. Others are separate review platforms that a law firm or accounting firm uses on documents exported from the room.

Both rely on the same core abilities: optical character recognition to turn scans into text, classification to decide what a document is, extraction to pull out fields such as parties, dates and amounts, and language models to summarize or answer questions about the text.

What none of them do is form a view. A tool can tell you that 140 customer contracts contain a change-of-control clause. It cannot tell you which three customers would actually walk.

Which due diligence tasks can AI handle today?

The split above is our editorial view after looking at how deal teams use these tools. In table form, by workstream:

Lease abstraction and contract inventories are where the gains are clearest. These are structured questions asked hundreds of times, and a reviewer can check a sample of the output quickly.

Where does AI due diligence go wrong?

The failure modes are well known by now, and they matter more in a deal than elsewhere because findings feed a price and a contract.

Omission. A summary that leaves out an exception, a side letter or an amendment is worse than no summary, because it looks complete. Amendments filed separately from the main contract are a classic gap.

Misreading numbers. Poor scans, tables split across pages and currency symbols confuse extraction. A rent of 120,000 can become 12,000.

Confident invention. Language models sometimes produce plausible text that is not in the source. On a deal, an invented clause in a summary can lead to a wrong negotiating position.

Context blindness. The tool sees each document. It does not know that the supplier with the exclusivity clause is the founder’s brother, or that the dispute in the board minutes was settled last month.

Scope creep. A reviewer asks a general question and gets an answer drawn from folders they should not see. That is a permissions failure, and it can breach a clean team arrangement.

How should a deal team supervise AI review?

Treat the software like a large team of new reviewers: fast, tireless, and not yet trusted. The supervision model most firms land on has three parts.

First, define the questions. AI does best with a fixed list: “extract governing law, term, renewal, termination for convenience, change of control, assignment”. Open questions such as “what are the risks in this contract?” produce vaguer output that is hard to check.

Second, sample and verify. Check a share of every batch against the source, more for high-value documents. Record who checked what.

Third, separate findings from evidence. Every finding in the diligence report should cite the document and page, not the AI summary. If the summary is wrong, the citation makes the error visible.

Professional guidance is moving the same way. Frameworks such as the NIST AI Risk Management Framework and the management-system standard ISO/IEC 42001 both stress human oversight, documented controls and knowing what a system was tested for.

Should AI run inside the data room or in a separate tool?

Both models work. The choice is mostly about where the documents go.

The export question is the one teams forget. Many NDAs and click-through room terms restrict copying documents into other systems. Uploading a seller’s contracts into an outside AI platform may need consent. Our guide to click-through NDAs in a data room explains what those terms usually cover.

In our directory, five of sixteen providers list AI features: Ellty, Datasite, Ansarada, Drooms and Box. Ellty and Datasite pair them with a complete diligence toolkit, including Q&A, permissions, watermarking and an audit trail. Use the provider directory to filter by AI features alongside the controls a live deal needs.

Does AI change how long due diligence takes?

It changes where the time goes more than the total. Indexing and first-pass review shrink. Verification, follow-up questions and negotiation stay the same length, and sometimes grow because the tool surfaces more issues that someone has to assess.

The practical effect for most deals is earlier issue spotting. If change-of-control consents are identified in week one rather than week four, the consent strategy starts sooner, and that can save real time at the end. It also reduces how long the room stays open; see how long a data room stays open for how duration drives the bill.

What should sellers do differently when buyers use AI?

Assume buyers will run software across everything you upload. That has a few consequences.

• Clean the room. Duplicates, drafts and outdated versions confuse extraction and generate questions. Upload final, signed versions and keep drafts out.
• Make scans readable. Poor scans produce poor text. Re-scan key contracts at a decent resolution rather than uploading a faxed copy.
• Keep amendments with their contracts. Name and file them so that a machine and a person can both see the link.
• Expect sharper questions. Buyers with good tools will ask about every contract with a change-of-control clause, not just the big ones. Prepare a consents schedule early.
• Decide what AI may touch. If you do not want bidders running AI over certain folders, say so in the process letter and check whether the room lets you restrict it.

How to run an AI-assisted due diligence review

1. Agree the rules with the seller

   Confirm whether documents may be processed by AI tools, inside or outside the room, and record it in the NDA or process letter.

2. Fix the extraction questions

   For each workstream, write the fields you need from each document type, such as term, renewal and change of control for contracts.

3. Run a pilot folder

   Process one folder, then check 30 to 50 documents by hand. Adjust the questions or limit AI to triage where accuracy falls short.

4. Process the room in batches

   Run extraction folder by folder, with a named reviewer for each batch and a sample check recorded in the review log.

5. Escalate findings to specialists

   Send flagged items to the lawyer, accountant or specialist who owns that workstream. They decide materiality.

6. Cite sources in the report

   Every finding in the diligence report references the document and page in the room, never just an AI summary.

What does AI due diligence cost?

Inside a data room, AI is often part of a plan tier rather than a separate line. In the market model behind our VDR pricing calculator, asking for AI features adds around 10% to a typical monthly or per-user budget. Separate review platforms are usually priced per document, per page or per matter, and are bought by the adviser, not the deal principal.

The bigger number is adviser time. If AI takes a week of junior review off a legal workstream, the saving can be several times the software cost. If it creates a second round of checking because output cannot be trusted, it saves nothing. The pilot folder step above is how you find out which case you are in.

Is AI due diligence safe for confidential documents?

It can be, with the same questions you would ask of any processor. Where are documents processed? Is content used to train models? How long are prompts and outputs kept? Do answers respect folder permissions? Are AI actions logged? If personal data is in scope, privacy law applies to AI processing as to any other; our guide to privacy laws that touch deal data covers the main regimes.

The one setup we would avoid is a reviewer pasting deal documents into a consumer chatbot on a personal account. That moves confidential material outside every control the room provides.