AI due diligence: what deal teams can automate today

Adoption surveys now show near-universal presence. Deloitte's 2025 survey of 1,000 senior corporate and private equity leaders in the United States found that 86% of responding organisations had integrated generative AI into M&A workflows, and 65% of those had done so within the past year. Its 2026 Pulse Study reports that 90% of organisations currently use it, and describes the technology as active rather than experimental. Spending follows: 83% of the 2025 respondents had invested $1 million or more specifically for their M&A teams.

Presence is not depth. McKinsey's survey of 200 M&A participants in 2025 found that only 30 percent engage with gen AI at moderate to high levels. Deloitte's 2026 study similarly reports that fewer than one-third of organisations have reached full integration of their tools. The pattern is familiar from other functions: many pilots, a handful of embedded workflows, and a long tail of individual use of general-purpose assistants without agreed standards.

The deal environment gives teams reason to act. PwC reports that global deal values rose 36% in 2025 while volumes rose by just 1%, with global M&A values around $3.5tn. Fewer, larger transactions raise the cost of error per deal and increase the pressure to process large volumes of documents quickly. PwC also found that approximately one-third of the 100 largest corporate transactions of 2025 cited AI as part of the strategic rationale, so many teams are now diligencing AI-related risk as well as using AI to do the diligence.

For a head of corporate development the implication is to separate three questions that are often blurred. Which tools does the team use to work faster? Which AI-related risks and opportunities must it test in targets? And what governance sits over both? Treating these as one programme leads to tool purchases without standards. Start by auditing what your team already uses, including personal accounts, then set a short list of approved tools and uses.

The action is modest and immediate. Within a month, inventory current use across the deal team and its advisers, ask your advisers how they use AI on your files, and agree a one-page policy on permitted data, review requirements and record-keeping. That gives you a baseline from which to measure speed and quality, and it surfaces the hidden use that creates confidentiality exposure.

Advisers deserve the same scrutiny as tools. Financial, legal and commercial advisers are adopting AI quickly and may apply it to your files without a conversation. Ask each adviser which models they use, whether data leaves their environment, how outputs are reviewed and whether the efficiency shows up in fees or timelines. Put the answers into engagement letters, so that your expectations about confidentiality, quality control and pricing are written down before the first data-room login.

Where teams use AI tells you where they trust it. In McKinsey's 2025 survey, 66% of respondents used gen AI in the dealmaking phase and 65% during integration and separation. Use in due diligence was 49%, and in target identification 48%, with an all-phases value of 57%. Diligence sits in the middle of the pack, which is surprising given how document-heavy it is, and suggests that teams are cautious where errors are costly and findings feed directly into price.

Deloitte's 2025 data point the same way, though they measure a different question. Among adopters, 40% apply generative AI to M&A strategy and market assessment, 35% to target identification and screening, and 35% to due diligence. Deloitte's 2026 study adds that 49% of respondents apply it in deal closing and 52% in post-close integration, while only one-third use it for judgment-intensive negotiating steps. These surveys use different samples and wording, so we do not combine them, but the direction of travel is consistent.

The Datasite and FT Longitude survey, a vendor-commissioned study of 1,000 senior dealmakers reported in July 2026, shows how much intent exceeds practice: 96% said they were using or exploring AI for sourcing and screening. Sourcing is a low-regret use because errors cost time rather than value; a missed target is invisible and a wrong target is filtered by the next step. Diligence errors, by contrast, can propagate into a price or a warranty package.

The reading for a deal team is that diligence is where the next increment of value lies, because it is both document-heavy and underpenetrated. That is also where discipline matters most. Begin with contained tasks such as data-room indexing, contract extraction and summarisation, where output can be checked against source documents, and expand only when error rates on your own files are measured and acceptable.

Teams should also be wary of treating survey percentages as benchmarks. Definitions of use vary from occasional drafting help to a workflow embedded in the data room, and a respondent who has tried a tool once may count as a user. The more useful benchmark is internal: the proportion of deals in which AI output was reviewed against source and the share of findings that changed on review.

McKinsey reports that 40 percent of respondents say gen AI enabled 30 to 50 percent faster deal cycles, and that users report an average cost reduction of roughly 20 percent. Those are material numbers for a function that bills advisers by the hour and competes for scarce time in an auction. They also come from self-assessment by participants, in a survey of 200, and should be read as indicative of direction and order of magnitude rather than as audited results.

The mechanism is plausible. Diligence involves hundreds or even thousands of hours of reading across contracts, financial statements, policies and correspondence. A tool that indexes the data room, extracts key terms into a structured table and drafts first-pass summaries removes the least valuable hours first. The saving shows up as shorter cycle time between data-room opening and a first view of issues, which in competitive processes can decide whether a bidder is invited to the next round.

Not every saving is a gain. Time saved on reading is lost again if the team must re-verify everything, or if the tool returns long outputs that are harder to audit than the source. Teams should therefore measure net time, including review, and compare it with a baseline from comparable deals. Cost reductions will also not appear as lower adviser fees unless engagement terms change, so expect the first benefit as capacity rather than as savings.

The leadership decision is how to use that capacity. A team that can review more documents faster can either screen more targets or go deeper on fewer. Our view is that depth is the better use in a market where, according to PwC, values are concentrated in fewer, larger transactions. Set an explicit rule: a defined share of time recovered from document review is reallocated to commercial work such as customer calls, pricing analysis and integration planning.

Finally, ask what evidence you need to believe the numbers inside your own team. A simple pilot design works: run AI-assisted and conventional review on the same sections of two past deals, record time, issues found and issues missed, and have a senior reviewer adjudicate. A few weeks of such testing will tell you more than any vendor claim, and it produces the data you need to justify wider rollout to your investment committee.

Think about the learning curve. Teams that adopt AI in diligence often see a dip in the first deals as people learn to prompt, review and trust outputs, followed by gains once the workflow settles. Plan the pilot on a deal with a manageable timetable, give the team protected time to learn, and capture lessons in the playbook. Avoid introducing a new tool in the middle of a competitive auction, where the pressure to cut corners is greatest.

The most rigorous public evidence on reliability comes from legal research rather than M&A, but it is instructive. Stanford researchers who tested leading commercial legal research tools found that each hallucinated between 17% and 33% of the time, even though they reduced hallucinations relative to general-purpose chatbots. Those tools are built on curated legal databases with retrieval, the design usually promoted as the remedy for fabricated answers, so general-purpose assistants used on data-room documents should be treated with at least equal caution.

Deal professionals recognise the problem. In the Datasite and FT Longitude survey, accuracy was ranked the most important requirement by 71% of respondents, ahead of security at 70%, and 58% said they rely on human review and validation to build trust in AI-generated outputs. McKinsey is similarly direct about the state of the art: current integration tools require abundant human judgment and oversight, and it expects accurate and dependable end-to-end gen-AI M&A tools only within the next two to five years.

The practical consequence is a verification design, not a verdict on the technology. Every AI-extracted fact that influences price, warranties or conditions should be linked to its source passage, so a reviewer can click through and confirm. Outputs should be structured, for example a clause table with page references, rather than free-text summaries. Reviewers should sample at a rate that rises with the importance of the issue and be trained to look for omissions as well as errors.

Omissions are the harder risk. A model that summarises a hundred contracts and misses the one with an unusual change-of-control clause creates false comfort. Counter this with checklists of must-find items agreed in advance for each workstream, and ask the tool to report on each item explicitly, including where nothing was found. Compare AI output against a human review of a sample of documents to estimate recall, not just precision.

Set thresholds in advance. Decide the error rate your team will tolerate for each task, test against it on your own documents, and record the results. Where a tool does not meet the threshold, restrict it to triage, meaning ordering documents by likely relevance, and leave extraction to people. That turns a debate about whether AI is accurate enough into a measurable decision for each use.

Data security is the concern most often named by deal professionals. In Deloitte's 2025 survey, 67% of respondents highlighted it as a leading concern, and in the Datasite and FT Longitude study 70% cited security as a key requirement. Data rooms hold material non-public information, personal data of employees and customers, and commercially sensitive terms. Sending those to a public model, or storing them with a provider that may retain or train on them, can breach non-disclosure agreements and data protection law.

Professional duties point the same way. The American Bar Association's Formal Opinion 512, issued in July 2024, states that lawyers using generative AI must be cognisant of the duty to keep confidential all information relating to the representation of a client, unless the client gives informed consent. Your legal advisers are subject to rules of this kind, and your own contracts will have confidentiality clauses with similar effect. Ask advisers which tools they use on your files and where the data goes.

A workable control framework has four parts. Use enterprise tools with contractual commitments on retention, training use and sub-processors. Keep data within an agreed jurisdiction, which matters for European and Gulf targets. Apply role-based access and keep an audit trail of prompts and outputs, as these may be needed to evidence what was reviewed. And agree with the seller, or in the process letter, whether and how AI tools may be applied to data-room contents.

Regulation is adding to the checklist. The EU AI Act already requires providers and deployers to support the AI literacy of staff using AI on their behalf, and its obligations for high-risk systems will apply from December 2027. Most diligence tools will not be high risk, but a team that deploys AI in recruitment or credit decisions at a target, or that diligences such systems, will need to understand the classification. Keep a register of the tools you use and what each is approved for.

The decision for corporate development is to require an approved-tools list, a prohibition on pasting data-room content into unapproved systems, and a short training for everyone with data-room access. These are inexpensive measures that address the failure most likely to cause real damage, which is not a wrong summary but a leak of a counterparty's confidential information.

The strongest signals from the surveys concern what teams will not delegate. Deloitte's 2026 study finds only one-third use generative AI for judgment-intensive negotiating steps. In the Datasite and FT Longitude survey, 45% said the decision to sign a deal should always remain a human responsibility. The same survey shows less settled views elsewhere, so we regard it as a signal of professional instinct rather than proof, but it matches what experienced deal leaders say about accountability.

The logic is straightforward. A deal decision combines the diligence record with judgement about people, timing, alternatives and risk appetite. Models can summarise the record and propose questions, but they do not carry accountability and they cannot assess a management team's candour in a meeting. A signing decision also draws on information that is not documented, such as how a seller behaved under pressure, which no data-room tool captures.

We find it useful to sort tasks by two features: whether output can be checked against a source, and how directly the output moves price or risk allocation. Tasks that are verifiable and low consequence, such as indexing and first-pass summaries, are safe to automate with sampling. Tasks that are verifiable but high consequence, such as extracting change-of-control and indemnity terms, can be AI-assisted with full review. Tasks that are not verifiable or are judgement-heavy remain with people, supported by AI for drafting and challenge.

Interpretation tasks need particular care. Whether a clause is unusual depends on market practice and the deal context. Whether a customer's churn is a warning or noise depends on conversations with the customer. Whether a forecast is credible depends on how management has performed historically. AI can prepare the evidence for these judgements and can be used as a challenger that asks what could go wrong, but it should not be the author of the conclusion.

Put this into the operating model by naming the human accountable for each workstream conclusion, and by requiring that investment committee papers state which findings were AI-assisted and how they were verified. That discipline protects the team if a finding is later challenged and shows the committee where the evidence is strong and where it is thinner.

Protect the apprenticeship. Junior analysts have traditionally learned to judge by reading documents, building models and being corrected by seniors. If AI removes the first pass, teams must create other routes to the same experience, for example by asking juniors to review AI output against source, to write the issues list and to present findings. Without deliberate design, a team can become faster this year and thinner in judgement within three.

A frequent mistake is to introduce AI as a cost project. If the primary aim is fewer analyst hours, the team will compress headcount, reduce the apprenticeship that builds judgement and still face the same decisions with less capacity. A better aim is to move effort up the value chain. The hours recovered from reading should go to the questions that decide whether the deal creates value: the commercial case, integration plan and the realism of synergies.

The preconditions are organisational. PwC notes that fewer than one in four companies have built solid foundations for AI adoption, which echoes the pattern in diligence: tools are bought before standards, training and data access are in place. McKinsey's recommendations for M&A teams are practical and consistent with our experience: build AI fluency across the team, formalise M&A playbooks, secure executive sponsorship, and develop a one- to two-year roadmap for making gen AI part of operations.

A phased approach works well. In the first phase, choose two or three contained use cases in diligence, such as data-room indexing and contract term extraction, and measure net time and error rates against a baseline. In the second, extend to adjacent tasks and integrate the outputs into your standard diligence report formats. In the third, embed the tools in the playbook, with training, approved-tool lists and verification standards. Each phase should end with a decision based on evidence.

Measure what matters. Track net hours per workstream, defects found in review, issues found late in the process, and the proportion of diligence time spent on commercial questions. Add a qualitative review after each deal, asking where AI helped, misled or was ignored. These measures give the investment committee confidence and allow the team to correct course. They also provide a factual answer when advisers or sellers claim that AI has made diligence cheaper.

The call to action for the next quarter is specific. Approve the tool list and data rules, run one controlled pilot on a live or recent deal, set the reallocation rule for recovered time, and brief the investment committee on how AI-assisted findings will be flagged. Teams that do this will gain speed without losing control, and they will have the evidence to extend use to the stages of the deal cycle where the surveys show the greatest scope.

Karter McKinley supports AI and technology implementation for deal teams: auditing current tool use, designing verification and confidentiality standards, piloting contained diligence workflows, and building the playbook that directs recovered time to commercial work. We work alongside your legal and transaction advisers; the decisions on price and risk stay with your team.