AI Due Diligence: Where It Works and Where It Fails

2026-10-07 · Tommaso Maria Ricci

Most acquirers now say they run some form of AI due diligence. Far fewer can explain what it actually checked. In Deloitte's 2025 survey of 1,000 corporate and private equity leaders, 86% said they had integrated generative AI into their M&A workflows. In Bain's survey of 307 M&A practitioners, only 21% were actually using it in their deal work. The gap between those two numbers is where most of the risk in AI due diligence lives.

This guide is for the people who have to sign off on a deal: CEOs and CFOs running acquisitions, corporate development teams, family offices, independent sponsors and the operators who inherit what diligence missed. It covers where AI genuinely speeds up due diligence, where it fails quietly, how to structure the work so the output can be trusted, and a 90-day plan to put it into practice.

The short version: AI due diligence works when the machine reads and the humans judge. It fails when the team confuses a fast summary with a verified finding.

What AI due diligence actually means

Due diligence is the investigation a buyer or investor runs before committing capital: financial, tax, legal, commercial, technology, HR and operational review of the target. AI due diligence is the use of machine learning and large language models inside that investigation to read, classify, extract and compare information faster than a team of analysts can.

In practice, three families of tools show up:

1. Virtual data room platforms with built-in AI. They auto-index uploaded documents, flag missing items and offer question answering over the data room.
2. Contract analysis tools. They extract clauses from hundreds of agreements into a structured table: change of control, assignment, exclusivity, termination, liability caps.
3. General-purpose language models deployed in a controlled environment. Used for summarization, drafting diligence questions, comparing documents and building first drafts of report sections.

Underneath all three is the same capability: turning a large pile of unstructured documents into structured, searchable, comparable data. That is the part of diligence that historically consumed junior associates for weeks.

What it is not

AI due diligence is not an automated verdict on whether to buy. No tool tells you whether a customer relationship will survive the change of ownership, whether the founder's numbers are optimistic, or whether the culture will hold. Those calls still belong to experienced people asking hard questions in the room.

The numbers: how fast adoption is really moving

The data is uneven, and it is worth reading carefully before building a business case.

Deloitte's 2025 GenAI in M&A survey, conducted in the first half of 2025 among 1,000 senior corporate and private equity leaders in the US, found:

• 86% of organizations had integrated generative AI into M&A workflows, and 65% of those had adopted it within the past year;
• 83% had invested at least $1 million in the technology specifically for M&A teams (88% of private equity respondents, 77% of corporates);
• among adopters, 35% were applying it to due diligence, 35% to target identification and screening, and 40% to M&A strategy and market assessment;
• the top barriers were data security (67%) and data quality and availability (65%).

Bain's 2025 M&A report paints a more cautious picture from 307 practitioners. 21% were using generative AI for M&A, up from 16% in 2023, and more than half expected to integrate it into dealmaking by 2027. Among the most active acquirers the figure rose to 36%. Early adopters reported spending about one day summarizing diligence data instead of a week, and nearly 80% of companies using generative AI in M&A said they benefited from reduced manual effort.

Why 86% and 21% are both true

The surveys ask different people different questions. Deloitte asked large organizations whether AI had been integrated into their M&A workflows; at that scale, someone has bought a platform. Bain asked practitioners whether they use it in their own deal work. The honest reading: the tools have been purchased, but day-to-day usage by the people doing the diligence is still the minority case.

That matters for anyone building a business case. Buying the software is the easy part. Changing how a diligence team works takes far longer.

Where AI genuinely accelerates due diligence

AI earns its place in diligence work that shares three traits: high volume, repetitive structure, and output a human can verify quickly. Here are the seven areas where it delivers today.

1. Data room indexing and gap analysis

Data rooms rarely arrive clean. Files have meaningless names, scans have no text layer, duplicates multiply. An AI layer can classify every document by type (customer contract, board minutes, lease, insurance policy, employment agreement), build an index, and compare it to the request list to show what is missing.

The time saving is obvious. The quality gain is less obvious and more important: the team starts the review with a complete map instead of discovering in week three that a whole category of documents was never uploaded.

2. Contract clause extraction at scale

This is the most mature use case. The team defines the clauses that matter for the deal thesis, and the system extracts them from every agreement:

• change of control and consent to assignment;
• exclusivity, non-compete and most-favored-customer terms;
• term, auto-renewal and notice periods;
• termination for convenience;
• liability caps, indemnities and penalties;
• governing law and dispute resolution.

The output is a table: contract, counterparty, clause, extracted text, page reference. Counsel stops reading 400 contracts cover to cover and starts with the 30 that carry real exposure. More importantly, the review can cover 100% of the contracts rather than a sample of the largest ones.

3. Financial anomaly detection

On ledger and transaction data, AI helps analysts ask questions that used to take days of spreadsheet work: revenue concentration by customer over time, days sales outstanding by account, invoices booked at quarter end and reversed early next quarter, unusual credit notes, vendors paid without contracts.

The system does not find fraud on its own. It narrows the field so that an analyst can investigate the twenty items that need explanation instead of sampling blindly. The same logic applies to AI in financial reporting: the model flags, the controller decides.

4. Quality of earnings support

Quality of earnings work depends on reconciling management accounts, audited statements and the underlying ledger, and on identifying one-off items that inflate EBITDA. AI can accelerate the reconciliation, propose candidate adjustments based on transaction descriptions, and draft the narrative. The adjustments themselves still require judgment, because the difference between a "one-off" and a recurring cost is often the most contested number in the deal.

5. Cross-document consistency checks

The management presentation says one thing, the board minutes another, the HR file a third. A system that reads everything together can flag the contradictions: a customer described as strategic in the plan that appears in litigation in the minutes, a headcount number that differs between the financials and the employee census, a product launch date that moves between documents.

6. Commercial diligence from public signals

Customer reviews, job postings, press releases, regulatory filings, competitor positioning, web traffic signals: public data a model can read and synthesize to test the seller's narrative. If the target claims low churn and its review profile shows a wave of complaints about support, that becomes a management interview question.

7. Drafting questions and report sections

AI can propose diligence questions from missing or inconsistent documents, deduplicate the question log, link each answer to its supporting evidence, and draft the descriptive sections of the report. The conclusions are written by people. That division of labor is the cleanest way to use the technology without outsourcing the judgment.

Where AI fails in due diligence

In most business uses, an AI error costs time. In diligence, an AI error can cost the purchase price. These are the failure modes every deal team should plan for.

Hallucinations persist in specialized tools

The most relevant evidence comes from a May 2024 study by Stanford HAI and RegLab on AI legal research tools. Testing more than 200 legal queries, the researchers found that Lexis+ AI and Ask Practical Law AI produced incorrect information more than 17% of the time, and Westlaw AI-Assisted Research more than 34% of the time. These were purpose-built products from major legal publishers, and they still erred at a material rate.

The operational consequence is non-negotiable: every extracted finding that enters the diligence report must carry a citation to the source document and page, and a human must have checked it.

The silent miss is worse than the wrong answer

The most dangerous failure is a clause the system never found, worse than any wrong extraction. Ask "do any contracts contain change of control provisions?" and receive "no", and you cannot tell whether none exist or whether the tool missed them in a badly scanned schedule. That is why sampling is mandatory: humans read a set of documents independently and compare their findings to the machine's.

Poor inputs produce confident garbage

Mid-market data rooms are full of scanned PDFs, handwritten annotations, stamps over text and documents in multiple languages. Optical character recognition fails on exactly the pages that matter most, such as signed amendments and side letters. If the text layer is wrong, the analysis built on it will be wrong with full confidence.

Confidentiality and data handling

A data room contains the target's trade secrets and personal data about employees and customers. Uploading it to a consumer AI tool can breach the non-disclosure agreement with the seller and privacy obligations in several jurisdictions. Deloitte's respondents ranked data security as the top barrier for a reason.

Minimum requirements: an enterprise contract, no use of deal data for model training, known data residency, access logging, workspace separation by deal, and deletion at project end. Read the NDA before uploading anything; some explicitly restrict processing by third-party tools.

How to use AI in due diligence: structuring the work

The wrong approach is to buy a tool and point it at the data room. The right approach is to design the process first and pick tools that serve it.

The three-layer model

A clear division of responsibility keeps AI output trustworthy:

1. Machine layer. Classification, extraction, reconciliation, anomaly flags, first-draft summaries. No conclusions.
2. Analyst layer. Sample verification, investigation of flagged items, drafting questions for the seller, writing findings with citations.
3. Decision layer. Risk assessment, price impact, deal structure, contractual protections. AI does not operate here.

Every output that moves up a layer carries its source reference. No reference, no entry in the report.

Controls that make the output defensible

• Verification sample: at least 10% of machine-reviewed documents read in full by a human, prioritizing the highest-value contracts. For the first live deal, raise it to 20%.
• Full human review of the top tier: the top 20 customer and top 20 supplier agreements by value are always read end to end.
• Prompt and query log: who asked the system what, when, against which documents. If a finding is challenged after closing, the trail matters.
• Separation of duties: the person who configures the extraction is not the person who signs off the findings.

Teams that already run a segregation of duties matrix in finance will recognize the principle: whoever produces the data does not approve it.

Build, buy or configure: choosing the tool stack

There are three routes, and the right one depends on deal volume more than on technology preference.

Selection criteria in order of weight

1. Data handling terms. Training exclusion, residency, retention, deletion, subcontractors. If these are unclear, stop.
2. Citation quality. Does every answer point to a document and page? Can a reviewer click through to the source?
3. Accuracy on your documents. Test on a closed deal where you know the answers. Vendor benchmarks are not your data room.
4. Handling of scans and languages. Run the ugliest documents you have through it.
5. Workflow fit. Does it plug into your question log, your report template, your review process?
6. Total cost. Licenses plus the hours your team needs to configure, test and supervise it.

A worked example: what diligence should test after AI-driven growth

Increasingly, buyers are acquiring companies whose recent growth came from technology, including AI. That changes what diligence has to test.

I have worked as a founder and operator with businesses that would make interesting acquisition targets precisely because they used technology well. A hotel I worked with grew revenue from 9 million to 10 million. A sports distribution company increased sales by 30% after applying AI to its marketing. A medical center expanded capacity by 20%. Each of those numbers would look attractive in a seller's deck. Each raises the same three diligence questions.

1. Is the growth engine transferable? If the gain depends on systems, processes and skills that stay with the company, it is structural. If it depends on one person who leaves the day after closing, the buyer is paying for something it will not receive.
2. Who owns the assets? Software licenses, model configurations, marketing accounts, historical customer data. They must belong to the company, not to an agency, a contractor or a shareholder.
3. Is the data usable after the deal? A buyer who wants to keep the engine running needs the historical data in an accessible format, with the consents that allow continued use.

Technology diligence used to be a box ticked by an IT generalist. For targets whose performance depends on data and automation, it belongs next to the financial review.

AI due diligence in M&A versus venture and private equity

The process shifts with the type of transaction, and so does where AI adds value.

Corporate M&A

Strategic acquirers care most about integration: contracts that transfer, systems that connect, people who stay. AI adds the most value in full-population contract review and in mapping the target's systems and data for the integration plan. The diligence findings should flow directly into a 100-day integration plan.

Private equity

Sponsors run more deals and reuse patterns across them, which makes investment in configured tools pay back faster. Bain found that more than 60% of the private equity firms it interviewed were using at least one tool to improve sourcing, screening or diligence. For a deeper view on the fund side, see the guide to AI for private equity.

Venture capital

Early-stage diligence has fewer documents and more judgment. AI helps with market mapping, founder background checks from public sources and technical review of product claims, but the core decision rests on team and market. The AI for venture capital guide covers how funds are building this into their workflow.

AI by diligence workstream: what changes in each

Due diligence is several investigations running in parallel. AI changes each of them differently, and a realistic plan treats them separately.

Financial diligence

The core questions do not change: quality of earnings, normalized working capital, net debt and the credibility of the forecast. What changes is how quickly the team reaches the hard questions. AI reconciles management accounts to the ledger, groups transactions by description to propose candidate adjustments, and builds customer and product cohorts from raw invoice data.

The judgment calls stay human. Whether a marketing campaign is a one-off or a recurring cost, whether a large customer's price increase will stick, whether working capital was managed down ahead of the sale: these are the debates that move price, and they require someone who has seen enough deals to know what a manipulated number looks like.

Tax diligence

Tax work involves long filings, correspondence with authorities and complex group structures. AI helps by summarizing audit correspondence, extracting positions taken in prior returns, and mapping intercompany flows across entities. Its limits are sharp here: tax rules change, positions depend on facts that are rarely in the documents, and a confident but outdated answer is worse than no answer. Every tax finding needs a specialist's sign-off.

Legal diligence

This is where AI has gone furthest, because so much of legal diligence is reading contracts. Clause extraction, litigation summaries, corporate records review and intellectual property registers all benefit. The AI for legal guide covers the broader shift in legal work; in diligence specifically, the value is full-population review with lawyers focusing on exceptions.

HR and people diligence

Employment agreements, bonus plans, retention arrangements, contractor classifications and pending claims. AI can extract the terms that create cost after closing, such as change of control bonuses, notice periods and non-compete provisions, and flag contractors whose arrangements look like employment. What it cannot do is assess whether the people who carry the know how will stay. That comes from management interviews and, often, from reference calls.

Technology diligence

Code ownership, open source license exposure, security posture, technical debt, system scalability and data rights. AI tools can scan repositories for license issues and known vulnerabilities, and summarize architecture documentation. For targets whose value depends on data and automation, technology diligence should also cover where training data came from, what consents cover it, and whether models and prompts are documented well enough to survive the departure of the people who built them.

Commercial diligence

Market size, competitive position, customer satisfaction and the sustainability of the revenue base. AI accelerates the research layer: synthesizing public reviews, job postings, pricing pages, analyst commentary and competitor messaging. Customer reference calls remain the most valuable input, and AI can help structure and compare the notes across dozens of calls.

When you are the seller: preparing for AI-assisted diligence

Buyers are getting faster. Sellers who prepare accordingly get better outcomes, because surprises discovered late in the process turn into price reductions negotiated under time pressure.

What buyers' tools will find

Assume the buyer will read every contract, not a sample. Assume inconsistencies between your management presentation, your board minutes and your financials will be flagged automatically. Assume your public footprint, from customer reviews to former employees' comments, will be summarized and compared with your narrative.

What to fix twelve months before a sale

• Contracts: every material customer and supplier relationship documented, signed and filed, with change of control terms known in advance.
• Ownership: trademarks, domains, software, data and marketing accounts registered to the company, not to founders or agencies.
• People: current employment agreements, correct classifications, retention plans for the people the buyer will care about.
• Numbers: one-off items documented, working capital explainable, management accounts that reconcile cleanly to the audited statements.
• Data room: a clean index, text-searchable documents and no duplicates.

Use the same technology first

The tools buyers use to read your data room can help you prepare it. Running clause extraction on your own contracts before the process opens shows you what the buyer will see. A vendor due diligence report, commissioned before the sale, lets you explain issues on your terms rather than react to them in a question log.

Founders preparing to raise capital face a lighter version of the same process, and the AI for startups guide covers how investors increasingly use these tools when they screen companies.

Self-assessment scorecard: is your diligence process ready for AI?

Answer yes or no. Count the yeses.

Process

1. Is the diligence scope written and tied explicitly to the investment thesis?
2. Is there a single question log with a named owner?
3. For each workstream, is it defined who produces analysis and who approves it?

Data

4. Does the data room have a consistent index, with most documents text-searchable rather than image-only scans?
5. Are the material contracts identified by value before the review starts?
6. Do you know how many documents are in the data room and how many are duplicates?

Tools and confidentiality

7. Does your AI tool have enterprise terms that exclude training on your data and define retention?
8. Have you confirmed that the NDA allows processing by third-party tools?
9. Is each deal isolated in its own workspace and deleted at project end?

Control

10. Is a human verification sample of at least 10% built into the plan?
11. Does every AI extraction carry a document and page reference?
12. Are report conclusions written and signed by a person, not generated?

Scoring

• 10 to 12: ready for broad use. Focus on measuring time saved and findings added.
• 6 to 9: start with narrow use cases such as clause extraction while you close the gaps on confidentiality and control.
• 0 to 5: fix the process first. AI applied to a messy process produces mess faster.

The 30/60/90 day roadmap

This plan fits organizations that do deals with some regularity: a serial acquirer, a family office, a lower mid-market fund, a professional firm advising clients on transactions.

Days 1 to 30: process and guardrails

• Document your standard diligence process: workstreams, owners, timelines, report template.
• Write the data handling policy: approved tools, data residency, access, retention and deletion.
• Choose a deal closed in the last two years as a test case. You already know the "right answers".
• With counsel, define the 20 clauses that matter most in your typical deals.

Days 31 to 60: test on a closed deal

• Run the tool on the closed deal's data room.
• Compare the machine's extractions with what the team found manually.
• Measure three things: hours saved, issues found that the team missed, issues the tool missed.
• Adjust prompts, clause definitions and document preprocessing where the tool failed.

Days 61 to 90: first live deal

• Use AI on a live deal for indexing, clause extraction and the question log only.
• Keep the human verification sample at 20% for this first deal.
• Run a retrospective at signing: where AI saved time, where it cost time, what it missed.
• Only then expand into financial analysis and commercial diligence.

If you are planning an acquisition, a sale or a capital raise and want to design a diligence process that uses AI where it pays and keeps it out where it does not, a consultation request is the fastest way to start. We begin with the deal thesis and work back to the scope.

What it costs and where the return comes from

Diligence budgets scale with deal size, the number of workstreams and the state of the data room. AI changes the cost structure in two ways.

Direct savings

The visible saving is reading time. Bain's early adopters cut diligence data summarization from about a week to about a day. That saving is real but partly offset by the verification work, which should not be cut. A team that saves 60 hours of reading and spends 15 on sampling has still saved 45 hours.

The larger return: coverage

The bigger gain is coverage rather than cost. A traditional review of 400 customer contracts reads the top 50 in depth and samples the rest. An AI-assisted review can extract key terms from all 400 and send humans to the ones that carry exposure. The issue that blows up a deal after closing is often in contract number 237, not in the top 50.

Hidden costs

• Configuration and testing time before the first live deal.
• Preprocessing of poor scans.
• Governance: policies, logs, access reviews.
• Training the team to supervise output rather than accept it.

Deloitte found that 81% of private equity respondents and 80% of corporates expect measurable return on their generative AI investment in M&A, mostly within one to three years. Whether that happens depends far more on process than on software.

Ten questions to ask any AI due diligence vendor

Vendor demos are built on clean documents. Your data room will not be. Before signing, put these questions in writing and ask for written answers.

1. Is any of our deal data used to train or improve your models, directly or through subprocessors?
2. Where is the data stored and processed, and can we choose the region?
3. How long are documents, prompts and outputs retained, and can we trigger deletion per deal?
4. Does every answer cite the source document and page, and can a reviewer open the source in one click?
5. What accuracy have you measured on scanned, low-quality documents, and how was it measured?
6. How does the system signal that it did not find something versus that something does not exist?
7. Which languages are supported for extraction, and at what accuracy?
8. Can we define our own clause library and reuse it across deals?
9. What audit logs are available for access, queries and exports?
10. Can we run a paid pilot on a closed deal before committing to an annual license?

A vendor that answers question six vaguely is telling you something important. The silent miss is the risk that matters most in diligence, and a serious provider will have thought about how to surface it.

Common mistakes in AI due diligence

1. Starting from the tool instead of the thesis. The extraction list should come from what could change the price, not from the vendor's default template.
2. Treating summaries as findings. A summary without a citation is an opinion.
3. Skipping the sample. Every team that skips verification eventually learns why it exists.
4. Uploading the data room to an unapproved tool. It can breach the NDA and end the process.
5. Ignoring technology diligence on AI-enabled targets. If growth came from data and automation, the data and automation are what you are buying.
6. Writing a longer report because the machine can. Decision makers need the three issues that move value on page one.
7. Disconnecting diligence from integration. What you learn before closing should become the first 100-day plan.

Governance beyond the deal

AI due diligence touches several functions at once: legal, finance, IT security, compliance. Organizations that already have an AI policy should extend it to deal work explicitly, because deal data has stricter confidentiality obligations than most internal data. Those without one can start from the frameworks in the AI for compliance guide and adapt them to the transaction context.

Three governance questions to settle before the next deal:

• Who approves a new AI tool for use on deal data?
• What evidence of human review is required before a finding goes into the report?
• How long are deal workspaces, prompts and outputs retained, and who deletes them?

The founder's view

I have sat on both sides of the diligence table. As a seller, it feels like an exam you did not study for. As a buyer, it is a race against the clock with incomplete information. In both cases, the quality of the outcome depends less on the number of documents reviewed than on the clarity of the questions asked.

AI is moving the work in the right direction: less time hunting for clauses in folders, more time deciding whether a clause changes the price. That shift is healthy, provided nobody mistakes the machine's speed for the quality of the verification.

If you want to bring AI into your next transaction with a process your investment committee and your lawyers can stand behind, request a consultation and we will map the deal, the scope and the controls before the data room opens.

FAQ

What is AI due diligence?

AI due diligence is the use of machine learning and large language models to support the investigation a buyer or investor runs before a transaction. The tools classify data room documents, extract clauses from contracts, flag financial anomalies, check consistency across documents and draft report sections. They speed up reading and broaden coverage, but conclusions about risk, price and deal structure still require experienced human judgment and verification against source documents.

How are companies using AI in M&A due diligence today?

According to Deloitte's 2025 survey of 1,000 corporate and private equity leaders, 86% have integrated generative AI into M&A workflows, and 35% of adopters apply it to due diligence. Bain's 2025 survey of 307 practitioners found 21% actively using it in deal work. The most common applications are data room indexing, contract clause extraction, summarization of diligence findings and drafting questions for the seller.

How do you use AI in due diligence without missing risks?

Use a three-layer model: the machine extracts and flags, analysts verify and investigate, decision makers judge. Require a document and page citation for every finding, have humans read at least 10% of machine-reviewed documents, and always review the largest customer and supplier contracts in full. Test the tool first on a closed deal where you already know what should be found.

Is it safe to upload a data room to an AI tool?

Only to a tool with enterprise terms that exclude training on your data, define where data is stored and for how long, log access and allow deletion at project end. Consumer chatbots are not appropriate for deal documents. Read the non-disclosure agreement with the seller first, because some explicitly restrict processing by third-party tools, and a breach can end the transaction.

Can AI replace lawyers and accountants in due diligence?

No. AI reduces the hours spent reading and extracting, which changes how firms staff the work, but it does not replace professional judgment. Stanford research in 2024 found that leading AI legal research tools still produced incorrect information in more than 17% of benchmark queries. Lawyers and accountants remain responsible for verifying findings, assessing materiality and translating risks into price adjustments and contract protections.

How much time does AI save in due diligence?

Early adopters in Bain's 2025 research reported summarizing diligence data in about one day instead of one week, and nearly 80% of companies using generative AI in M&A reported reduced manual effort. Net savings are lower once verification time is included, but the bigger benefit is coverage: reviewing every contract instead of a sample, which surfaces issues traditional sampling misses.

Where should a mid-market buyer start with AI due diligence?

Start with process, not software. Document your diligence workflow, write a data handling policy, and pick a deal you closed recently as a test case. Run a tool on that data room, compare its output with your team's original findings, and measure time saved and issues missed. Then use it on a live deal for indexing and clause extraction before expanding to financial analysis.