AI Due Diligence in M&A: How Legal Teams Run It

AI due diligence is the use of machine learning and large language models to read every document in a transaction’s data room, extract the clauses and obligations that bear on the deal, and flag the risks the deal team has to price. This diligence review replaces sampling with full-population coverage: it reads all of the contracts, surfaces change-of-control, assignment, indemnity and termination terms, and checks the data room against the request list. Accuracy is the constraint on AI due diligence, so a deal lawyer verifies every flagged finding against its source document before the disclosure schedule is signed.

Mergers and acquisitions (M&A) work is where that constraint bites hardest. A buy-side team gets a few weeks with a data room holding thousands of agreements, and the sampling decision that follows is where a missed change-of-control trigger or an uncapped indemnity stays hidden until closing. Running clause-level contract review across the whole population rather than a subset changes what the team knows before it prices the deal.

[cta-1]

Key Takeaways

1. Full-population coverage replaces sampling: the same extraction criteria are applied to every file in the data room, including the agreements a manual reviewer would never reach.
2. The categories AI reliably surfaces are consistent across deals: change of control, anti-assignment, indemnity caps, exclusivity, auto-renewal, termination rights and data-protection obligations.
3. Measured hallucination rates on purpose-built legal AI tools mean the output is a triage queue, not a sign-off. A lawyer opens the source document for every escalated finding.
4. Scanned and image-only material is where coverage drops silently, so the ingestion report matters as much as the risk report.
5. Standing the workflow up takes a defined request list, the team’s own positions loaded as the benchmark, escalation thresholds, and a back-test against a closed deal.

How AI Due Diligence Works, Step by Step

AI due diligence works in four stages: ingestion, extraction, benchmarking and reporting. The system ingests the data room, applies optical character recognition (OCR) to scanned and image-only files, parses each document for the clauses and defined terms the request list calls for, compares what it finds against the standards the team set, and writes the findings into a disclosure schedule or risk summary a lawyer can work from.

Ingestion

The reviewer loads the data room and reconciles the file count against what the system reports it could read. A document that fails to parse produces no findings rather than an error anyone notices, so the gap between the loaded count and the parsed count is where coverage is lost. Four categories account for most of the loss:

1. Image-only PDFs and photographed signature pages, which depend entirely on OCR quality.
2. Handwritten marginalia and hand-marked amendments, which frequently carry the negotiated term.
3. Password-protected and corrupted files, which are skipped silently.
4. Spreadsheets and presentations holding commercial terms outside the contract set.

Treat any gap between the loaded count and the parsed count as a work item, not a rounding difference, and route the unparsed files to manual review.

Extraction

The system identifies each document’s type, parties, dates and the clauses the review is scoped to find, then pulls the operative language with a pointer back to the page it came from. Defined terms are the common failure: a cap expressed as a multiple of “Fees” means nothing until the reviewer checks how that term is defined in the same agreement, and side letters frequently move the number without restating the clause. A reviewer reads the extract to triage and the clause in full before escalating it.

Benchmarking

The findings are compared against the standards the team set, which is what separates a useful queue from a list of every clause in the data room. Those standards come from three places:

1. The acquirer’s or firm’s own negotiated positions.
2. The deal’s risk thresholds.
3. Market practice for the agreement type.

Without them, the output flags a mutual confidentiality obligation with the same weight as an uncapped indemnity, and the reviewer spends the time saved on sorting.

Reporting

The output lands as a disclosure schedule, a risk summary or an issues list, with a record of which criteria were applied to which document. That record is what makes a second reviewer’s spot-check possible, because a partner reviewing an associate’s queue can see three things:

1. Which agreements were tested for a given clause type.
2. Which were tested and cleared.
3. Which were never reached.

A system that reports conclusions without that provenance cannot be checked, which makes it difficult to rely on for a deal that may be litigated later.

How AI Reviews a Data Room at Scale

AI handles large document sets during due diligence by reviewing the full population rather than a sample. A traditional diligence team reads a representative subset of a 4,000-document data room and extrapolates. An AI review reads all 4,000, applies the same extraction criteria to every file, cross-references the results so that a definition in one agreement is tested against its use in another, and reports which items on the request list have no matching document in the data room at all.

Three capabilities sit underneath that, and they are different jobs:

1. Full-population coverage: every agreement is tested against the same criteria, so a buried change-of-control clause in a low-value supplier contract surfaces as reliably as one in a top-ten customer agreement. Sampling cannot offer that, because the sample is chosen by contract value and the risk is not.
2. Cross-document validation: the system compares findings across files to flag contradictions, a schedule referenced but never provided, or a parent guarantee whose scope differs from the obligation it supposedly backs. This is the check a manual team performs last, when the timetable has already compressed.
3. Gap analysis against the request list: the review is measured against what the buyer asked for, not only against what the seller uploaded.

Gap analysis is the capability that changes what the review reports. A due diligence request list (DDRL) is the defined artifact of the transaction, the list of information and materials a company is asked to provide in the context of due diligence, and testing the data room against it reports what is missing rather than only what is present. A missing consent or an absent schedule is a disclosure problem for the seller, and finding it early in the timetable rather than late is leverage.

What AI Catches in a Due Diligence Review

AI can identify risks in due diligence documents automatically, and the categories it catches are consistent across deals: change-of-control and anti-assignment provisions that a transfer would trigger, uncapped or supra-cap indemnities, exclusivity and most-favored-nation terms, auto-renewal and termination-for-convenience rights, data-protection obligations such as a missing data processing agreement, and governing-law or venue terms that do not match the rest of the set.

What each finding costs the deal

1. Change of control and anti-assignment: a consent requirement on a material customer contract becomes a closing condition, a consent fee, or a revenue line the buyer cannot count on.
2. Indemnity caps and carve-outs: an uncapped indemnity, or a carve-out that lifts a liability above the general cap, moves the escrow and the representation-and-warranty insurance conversation. A cap that reads as capped until the defined term is checked is the version that gets missed.
3. Exclusivity and most-favored-nation terms: these constrain what the combined business can sell and to whom, which is a synergy question as much as a legal one.
4. Auto-renewal and termination for convenience: a counterparty that can exit on 30 days’ notice after closing is a different asset from one locked in for three years.
5. Data-protection obligations: a processor relationship running without a data processing agreement, or cross-border transfers without a lawful transfer mechanism, is a remediation cost the buyer inherits.
6. Governing law and venue: agreements pointing at inconsistent forums raise the cost of enforcing anything post-closing, and the outliers are what the review looks for.

Reading the output as a ranked queue is what makes it usable, and the ranking depends on the thresholds set during setup. The same work of identifying contract risk runs on a live transaction, with the deal timetable compressing every step of it.

Traditional vs. AI-Powered Due Diligence

The reviewer’s hours move rather than disappear: less time goes on locating a clause and more on the judgment calls the extraction surfaces. The criteria are what carry the quality, and teams usually look at the tools built for contract due diligence before they look at the workflow, because the request list and the thresholds determine whether any product returns a usable queue, so they are worth settling before the tool choice.

AI Due Diligence in M&A and High-Stakes Deals

AI for M&A due diligence earns its place on the deal when the document set is large enough that manual review forces a sampling decision. On a merger or acquisition, the buy-side legal team uses AI due diligence to validate the investment thesis: scan the contract population for change-of-control triggers that would cost consent fees at closing, find restrictive covenants that constrain the combined business, and identify the gaps between what the seller disclosed and what the request list asked for.

Where a finding changes a number

1. Consent costs and closing conditions: a count of consent-requiring contracts, weighted by the revenue behind them, tells the deal team what closing costs and what can be left to post-closing.
2. Price and escrow: uncapped indemnities, unresolved disputes and unassignable material contracts move the purchase price, the escrow, or the insurance terms.
3. Synergy constraints: exclusivity, non-competes and most-favored-nation terms limit what the buyer can do with the asset it is paying for, which belongs in the model rather than in a footnote.
4. Disclosure schedule accuracy: the schedules are drafted from the review, and a schedule that overstates the seller’s position is a post-closing claim waiting to happen.

The underlying sequence has not changed, and the M&A diligence process still runs on a request list, a data room and a disclosure schedule. What changes is how much of the population the team reads before it commits to a number.

[cta-2]

How Accurate Is AI in Due Diligence?

AI in due diligence is accurate enough to triage a document set and not accurate enough to close one unreviewed. Stanford University’s RegLab and Institute for Human-Centered AI benchmarked purpose-built legal AI research tools and found Lexis+ AI and Ask Practical Law AI produced incorrect information more than 17% of the time, and Westlaw’s AI-Assisted Research hallucinated more than 34% of the time.

What the measured rates do and do not say

Those figures come from legal research tools, not diligence tools, and the tasks differ: a research query asks the system to find and characterize authority, while a diligence pass asks it to locate and extract language already in front of it. Extraction from a supplied document is the easier task, so the research rates are not a diligence error rate. What they establish is the verification requirement, which does transfer. An earlier Stanford study of general-purpose language models found hallucination rates of 69% to 88% on specific legal queries, a direct argument against running data-room material through a consumer model.

What verification looks like on a deal

Verification is a defined step with its own time budget, not a final read-through. It exists because of the mechanics behind hallucination in legal work: a confident, wrong extraction reads the same as a correct one until someone opens the source. On an escalated finding, the reviewer does four things:

1. Opens the source document rather than working from the extract.
2. Reads the clause in full, including the provisos that follow it.
3. Checks every defined term the clause depends on.
4. Confirms no amendment or side letter moved the term.

Teams that measure their own accuracy track how many known findings the system surfaced and how many escalated items turned out to matter. The second number is what tells the team whether the thresholds are set usefully.

What Attorney Review Is Still Required After Automated Diligence

Attorney review after automated M&A diligence remains the standard, and it has an ethical floor. ABA Formal Opinion 512 requires a lawyer using a generative AI tool to understand the tool’s capabilities and limitations, to protect client confidentiality, and to supervise the output rather than adopt it.

The sign-off workflow

1. Name the owner: a queue owned by the team rather than by a person is the one that goes unreviewed when the timetable compresses. The named reviewer owns the escalated queue and records which findings were verified at source.
2. A second reviewer spot-checks a defined share of the cleared items, not only the escalated ones. Clearing errors do not appear in the queue at all, which is what makes them expensive.
3. Privileged material, hand-marked originals and anything under a counterparty restriction on third-party processing go to manual review first, and that routing is decided when the data room is loaded.
4. The lawyer drafts the disclosure schedule from verified findings. An extract pasted into a schedule carries the extraction’s errors into a signed document.

A software vendor does not stand in the position of outside counsel, so if a clause is missed, the supervision duty Opinion 512 describes is likely to place the exposure with the lawyer and the firm. That is why supervision is a workflow step with a name attached rather than a policy statement.

How to Set Up an AI Due Diligence Workflow

Setting up an AI due diligence workflow for a legal team takes five steps: define the request list and the clause set the review has to extract, load the firm’s positions and precedents so the system benchmarks against your standards rather than a generic default, set the risk thresholds that decide what gets escalated, run the system against a closed deal where the answers are already known, and measure the result before putting it on a live transaction.

1. Define the request list and the clause set

Write down the categories the review has to return before any configuration happens. A reusable due diligence checklist is the base, narrowed to the deal type, because an asset purchase asks different questions of the same contracts than a stock purchase does. The threshold that makes this actionable is scope: a first deployment covers the categories that change price or closing, and the rest wait for the second deal.

2. Load the team’s positions as the benchmark

Load the team’s own fallback positions, precedent agreements and prior disclosure schedules, so a finding is measured against the standard the team actually applies. A generic default produces findings that are technically correct and operationally useless. Trigger for a refresh: whenever a negotiated position changes on a deal, the benchmark is updated before the next review, because a stale standard reintroduces the inconsistency the system was brought in to remove.

3. Set escalation thresholds

Decide in advance what reaches a human and in what order. Useful thresholds are concrete:

1. Any uncapped indemnity, or any carve-out above the general cap.
2. Any consent requirement on a contract above a stated revenue figure.
3. Any termination-for-convenience right exercisable within a stated notice period.
4. Any agreement with no governing-law clause.

A threshold expressed as “material” is not a threshold. Without stated thresholds the queue arrives sorted by document order rather than by exposure.

4. Back-test against a closed deal

Run the configured workflow against a transaction that already closed, where the issues list and final disclosure schedule are known. Compare what the system surfaced against what the team found at the time, and read the misses in both directions: findings it missed, and findings it raised that were correctly cleared. The back-test produces the number the team can defend internally. The NIST AI Risk Management Framework operationalizes measurement as one of four core functions, alongside govern, map and manage, rather than a one-time acceptance test, so the back-test is repeated when the model, the configuration or the clause set changes.

5. Measure before the live transaction

Set the two numbers the team will report before the first live deal: recall against the back-test’s known findings, and the share of escalated items that proved worth escalating. Review both after the first live transaction, then regularly and whenever a deal goes wrong, so the measurement is not only a post-mortem. A workflow with no owned metric is likely to drift back to manual review, because nobody can say whether it is working.

The Limits of AI in Due Diligence

The risks of AI in due diligence are confidentiality exposure, hallucinated findings, unreadable source material and misplaced reliance. Sending data-room material to a general-purpose model without a zero data retention commitment can put privileged documents into a third party’s systems.

Confidentiality exposure

Data rooms hold the counterparty’s commercially sensitive material under a confidentiality agreement that frequently restricts third-party processing. The controls to ask for by name are:

1. Zero data retention.
2. Single sign-on (SSO) and multi-factor authentication (MFA).
3. Encryption in transit and at rest.
4. A SOC 2 Type II report.
5. A contractual restriction on training from customer documents.

SOC 2 is an examination against the AICPA’s SOC reporting framework, which covers security, availability, processing integrity, confidentiality and privacy. A vendor described as “SOC 2 certified” is being described loosely: the output is a report, not a certification.

Hallucinated and over-confident findings

A system can return a clause summary that reads correctly and does not match the document, or cite a provision that is not there. The mitigation is structural rather than technical: every escalated finding is verified at source, and a finding with no page pointer back to a document is treated as unverified.

Unreadable source material

Scanned exhibits, photographed signature pages and handwritten amendments either pass through OCR with errors or fail to parse. Reconcile the parsed count against the loaded count at ingestion, and route the difference to manual review. A system that silently excludes part of a data room produces a clean report on the part it could read.

Misplaced reliance

One failure mode costs more than a missed clause: the reviewer who treats a clean report as a cleared data room. The output is evidence about what was tested, bounded by the criteria it was given, and a category that was never in the clause set does not appear as a gap. Reading the configuration alongside the report is what keeps the two straight.

How Spellbook Supports Due Diligence

Spellbook supports AI due diligence inside the documents a deal team already works in. Spellbook’s Associate feature executes multi-step instructions across every document in a project at once, including Word, PDF, Excel, PowerPoint and scanned files read through OCR, so a reviewer can ask for every change-of-control clause across a contract set in one pass.

Three capabilities map onto the problems above:

1. Associate: multi-document projects that surface clauses and obligations across the whole set, which is the full-population coverage problem from the data-room section.
2. Review: clause-level risk flagging with proposed redlines as native Word tracked changes, grounded in the team’s own playbooks, which is the benchmarking step rather than a generic risk list.
3. Compare to Market: benchmarking a clause against 20M+ real contracts across 270+ clause types, for the “is this market standard” question that every escalated diligence finding raises.

Findings from the Associate feature carry pointers back to the source document, so verification starts from the agreement rather than the summary. The reviewer remains the one who verifies the finding, prices it and drafts the schedule.

[cta-3]

Frequently Asked Questions

How much of a data room does AI actually review?

All of the files it can parse, which is not the same as all of the files loaded. The practical figure is the parsed count divided by the loaded count, and the gap sits in image-only PDFs, password-protected files and handwritten material. Reconcile the two counts at ingestion and route the difference to manual review.

What does AI due diligence miss in a scanned data room?

Anything OCR renders badly, which is concentrated in the material that matters: hand-marked amendments, signature pages establishing who actually signed, and faxed side letters that move a negotiated term. Scanned numerals are a common error source, so a cap or a notice period read from a scan is worth checking at source even when it was not escalated.

Which AI due diligence findings need a lawyer to open the source document?

Every escalated finding, and a defined sample of the cleared ones. Priority order is anything that changes price or closing: indemnity caps and their carve-outs, consent requirements, termination and renewal rights, and any clause whose meaning depends on a defined term the extract did not include.

How are buy-side M&A teams measuring AI diligence accuracy?

With a back-test against a closed deal, reported as two numbers: how many of the known findings the system surfaced, and what share of escalated items proved worth escalating. The first measures coverage, the second measures whether the escalation thresholds are set usefully, and a workflow reported on only the first will bury its reviewers.

What does an AI due diligence workflow cost a team in setup time?

The configuration is the short part and the benchmark is the long part. Defining the clause set and the escalation thresholds takes days for a team whose positions are written down, and longer for one without them, because the positions have to be agreed before they can be loaded. The back-test against a closed deal is the step worth budgeting for properly, since it makes the first live deployment defensible.

Run Your Next Deal’s Diligence on the Whole Data Room

Full-population coverage is worth standing up before the next transaction opens, not during it. Try Spellbook free to see how multi-document review and clause-level flagging work on a contract set your team already knows.