.jpeg){kind=avatar}
56% of dealmakers now deploy agentic AI in due diligence and valuation, the highest share of any deal phase, according to KPMG’s 2026 Global M&A Outlook, a survey of 700 dealmakers across 20 countries fielded between December 19, 2025 and January 27, 2026. Adoption across M&A overall more than doubled in 2025 to 45% of executives, per Bain’s M&A Report 2026. The number underneath that one matters more. Only about a third of those dealmakers say they deploy AI systematically or are redesigning M&A processes to take advantage of it.
That disconnect is the whole story of due diligence automation right now. Most teams bought a tool. Far fewer changed how diligence runs. We saw this coming early: in our State of M&A report we found that over a third of the pitch decks one DealRoom client received in 2023 were AI-related. Interest arrived years before process change did.
I spent over a decade as an M&A advisor, running a boutique M&A practice, before founding DealRoom in 2012. The bottleneck is almost never analytical horsepower. It is the request list, the chasing, the version confusion and the status meeting that exists only because nobody can see where things stand.
What is due diligence automation?
Due diligence automation is the use of software to execute repeatable M&A diligence tasks without a person driving each step. It covers four layers: generating and assigning the diligence request list, collecting and tracking documents against that list, summarizing and extracting data from what arrives and reporting status to the deal team and the board. The first two layers are workflow problems and are effectively solved. The third and fourth are model problems and are not.
Automating a status report is done. Automating a judgment about whether a customer concentration risk kills the thesis is not.
This page is about deal diligence, not KYC
The phrase covers two jobs. Customer and vendor due diligence are continuous compliance functions: identity verification, sanctions screening and monitoring against a fixed rule set, running at volume against structured data. Transaction due diligence runs once per deal, against an unstructured document set assembled by a counterparty with its own incentives, under a timetable set by a signed agreement. Everything below is written for the second job.
Due diligence automation is not the same thing as AI due diligence
Automation is a process question. AI due diligence is a capability question. Automation asks which steps can run without a person pushing them: issuing the request list, assigning an owner, chasing the missing item, publishing the status. AI due diligence asks what a model can understand once a document lands: what a change-of-control clause says, whether revenue recognition looks unusual, which contracts sit outside the standard form. We cover the second question in our guide to AI due diligence.
The two have different failure modes. A workflow automation that breaks produces a late request and a frustrated seller. A model that fails produces a confident wrong answer a partner may act on. Finish the workflow layers first and treat model output as a second reader.
The four layers, ranked by payback
Layer 1: request list generation. The list spans finance, legal, HR, IT, tax and commercial, and on any deal with real operating complexity nobody holds it in their head. Copying the last deal’s list is the default. It is also how dead items get carried forward and sector-specific items get missed. Automating layer 1 means forking a maintained template per deal type, with conditional items that suppress themselves when they do not apply.
Layer 2: collection and tracking. Shortest payback of the four. Every open request needs an owner, a due date, a status and a reminder, and without automation a coordinator rebuilds that picture by hand before every status call. The rebuild is pure duplication: the information already exists, scattered across email, a data room index and someone’s spreadsheet. This layer does not require a model. It requires one shared tracker both sides can see.
Layer 3: document review and extraction. AI reads contracts, pulls change-of-control clauses and summarizes financial statements. KPMG’s 2025 mid-year survey put diligence-specific use of generative or agentic AI among US corporate dealmakers at 36%, up from 25% six months earlier, and at 51% among private equity teams, up from 19%. Reliability splits by task type. Extraction against a defined schema runs at scale with sampled review. Open-ended questions do not.
Layer 4: risk flagging and synthesis. Leave this one alone for now. Layer 4 asks a model to decide what matters rather than find what you asked for, and error cost is highest because a missed risk surfaces after signing. A peer-reviewed study of retrieval-grounded legal research tools measured accuracy of 65% for Lexis+ AI and 41% for Westlaw AI-Assisted Research across 202 test queries, with hallucination rates of 17% and 33%. Those products query a closed, curated corpus. A data room is neither.
How to automate the diligence request list
The request list is the highest-return automation on a deal because every downstream task inherits its structure.
- Start from a maintained master list, not the last deal’s folder. Fork a standing template per deal type. Our free due diligence checklist builder generates a tailored request list from five questions, and our breakdown of the documents a buyer typically requests is the version we keep current.
- Tag every item with a workstream and a trigger condition. Trigger conditions (“only if the target holds EU personal data”) let the system suppress items that do not apply instead of leaving a coordinator to delete them. The categories in our list of typical due diligence questions to ask are a workable taxonomy.
- Assign an owner and a due date at creation, not at kickoff. A request with no named owner is not a request. It is a note.
- Give the sell side the same view. One shared tracker removes the reconciliation call, the meeting that exists purely because two spreadsheets disagree.
- Let status change on document arrival. Nobody should be marking rows complete by hand.
The test: if a coordinator can answer “what is outstanding and who owes it” without opening a spreadsheet or sending a message, the list is automated. If not, it is a shared document with a nice interface.
What diligence automation software actually does
Three product categories get sold under the same phrase.
Document repositories. A virtual data room stores files, controls access and produces an audit trail. That is a security and disclosure function. It does not know a request exists, who owes it or whether it is late. Our virtual data room providers comparison covers that category on its own terms.
Diligence workflow platforms. These hold the request list, with owners, due dates, dependencies and status, and connect each request to the document that satisfies it. A request and its document living in separate systems is what creates the reconciliation problem.
Document intelligence and extraction. Models pull structured fields out of what arrives: parties, dates, change-of-control language, renewal terms.
A useful buying question: ask a vendor to demonstrate an outstanding-items view across every workstream, filtered by owner, with no manual data entry between document upload and status change. Repositories cannot do it. Our M&A software comparison keeps an updated view of the category.
Is a virtual data room the same as a diligence automation platform?
No. A data room is storage with permissions. A diligence automation platform is the request list plus the workflow that resolves it, with the data room attached. Teams that buy storage alone rebuild the tracking layer in spreadsheets, which is the manual work they were trying to remove.
What the evidence actually supports
The strongest published numbers describe narrow tasks, not whole processes, and often a different phase than the one being sold. Bain reports that leading integration programs use AI to identify and confirm cost synergies two to three times more quickly than traditional outside-in diligence had suggested. Read that carefully: the measured win lands after signing, not during diligence. Bain’s framing of the direction is unambiguous:
“AI is quickly becoming indispensable to M&A. Early adopters are gaining a concrete advantage when it comes to dealmaking.”
Suzanne Kumar, Executive Vice President, Global M&A and Divestitures Practice, Bain & Company, January 2026
That advantage accrues to the third of dealmakers who redesigned a process, not to the two-thirds who bought a tool and kept the workflow. Deloitte’s survey of 1,000 US senior corporate and private equity leaders found 86% had integrated generative AI into M&A workflows and 83% had invested at least $1 million, concentrated in strategy and market assessment at 40%, target identification at 35% and due diligence at 35%.
Set against that, McKinsey’s 2025 State of AI survey found 88% of organizations using AI in at least one function but only 39% able to attribute any EBIT impact to it. The most rigorous measurement available comes from a randomized field experiment Microsoft ran across 66 firms and 7,137 knowledge workers between September 2023 and October 2024. The 80% of treated workers who actually used the tool spent about two fewer hours a week on email in the second half of the six-month trial, and the researchers detected no shift in the quantity or composition of workers’ tasks.
Two hours a week is real. It is not a redesigned diligence process.
Does automation cut diligence cost, or only diligence time?
The published evidence measures time. The two converge only when the hours saved get reallocated. Cost moves under one of two conditions: the deal team runs more transactions with the same headcount, or an externally billed workstream comes in-house. If neither is true, automation buys calendar relief and lower error rates, which will not show up in a cost-per-deal comparison. Set that expectation with a CFO before the pilot rather than after it.
Where automation earns its keep
It pays on high-volume, rule-bound, auditable work: issuing a long request list, chasing owners, versioning documents, assembling a status pack, extracting a defined field from a defined contract type. It underperforms on judgment under ambiguity, like deciding whether a customer concentration is a thesis risk or a negotiating point. The dividing line is whether a reviewer can state in advance exactly what a correct answer looks like. If the answer is “I will know when I see it”, keep a person on it.
Timelines have moved against dealmakers. BCG found the signing-to-closing period for deals above $2 billion rose 11% to an average of 191 days, and that roughly 40% of deals did not close within the timeline written into their own documents. That study covers 2018 to 2022, so read it as direction of travel rather than a current figure. Regulatory load is a moving target. The FTC’s revised HSR premerger notification form took effect on February 10, 2025, and the Commission’s own Paperwork Reduction Act analysis estimated it would add an average of 68 hours per filing on top of its existing 37-hour baseline. That expansion did not survive. A federal district court vacated the new form in February 2026, and after the Fifth Circuit denied a stay pending appeal on March 19, 2026 the agencies reverted to the previous form. Plan filing capacity for the version that is actually in force, not the one the last memo described.
Deloitte reached a similar conclusion about where the technology is actually being used, in the words of Erik Dilger, a managing director in its financial advisory practice:
“It’s still early innings for the technology and M&A application is currently concentrated on pre-sign activities”
Erik Dilger, Managing Director, Deloitte Financial Advisory Services LLP, October 2025
Pre-sign is exactly where the request list, the tracker and the status report live.
Where it fails
Dealmakers name the constraints themselves. Deloitte’s survey put data security at 67% and data quality and availability at 65% as the leading concerns impeding wider use of generative AI in M&A.
The accuracy question is not hypothetical. In the 202-query study cited above, Ask Practical Law AI answered 19% accurately and returned incomplete answers on 62%. Retrieval grounding improved performance without eliminating hallucination, on a corpus far cleaner than any data room.
A sequencing that works
Automate in order of least judgment first.
- Standardize the request list as a reusable template per deal type. The M&A Skills Library has a ready-to-run version of this step if you want to test it before changing any tooling.
- Put every request on a single tracker with an owner, a due date and a status visible to both sides.
- Automate reminders and status reporting entirely. No human should assemble a status deck.
- Add AI summarization on defined document classes where a person still signs off.
- Only then consider model-proposed risk flags, as a second reader.
This is the order our due diligence process guide follows, because each step depends on the one above it holding.
Who owns this on the deal team
Put it with the diligence coordinator or the corp dev associate who runs the tracker today, not with IT and not with the deal lead. The person who feels the pain of the manual version is the one who notices when the automated version drifts. Give them three rights: authority to standardize the template across deal types, authority to refuse an off-template request without escalating and a standing slot to report the metrics below.
How to tell whether it worked
Track five numbers on the deal before automation and the deal after it.
- Request cycle time. Median days from a request being issued to it being satisfied, by workstream. First metric to move.
- Open items at each status call. A flat count with rising activity means the tracker is being maintained by hand.
- Requests with a named owner and due date at creation. Target 100%. Below 80%, the other numbers cannot be trusted.
- Coordinator hours per week assembling status. Target zero.
- Reopened items. A rise after AI summarization goes live is the early warning that extraction is running ahead of review.
Report these alongside the due diligence report so the operational view and the deal record do not drift apart. Compare two similar deals rather than a whole portfolio: deal size and sector move diligence effort far more than tooling does.
Compliance
Data security is the concern dealmakers name most often, at 67% in Deloitte’s survey. Five checks address most of it.
- Training exclusion in writing. Confirm in the contract, not the marketing page, that deal documents are excluded from model training.
- Data residency. Know which region documents are processed in, including any subprocessor doing inference.
- Retention and deletion on close. Set a deadline for the vendor to delete deal documents and associated data after the deal closes or diligence ends, and require written confirmation of deletion. Diligence data rooms can otherwise retain information long after a deal ends.
- NDA compatibility. Most sell-side NDAs restrict disclosure to named advisors. A third-party model provider is a disclosure.
- Audit trail on model output. Keep a record of which document version a model read and who signed off on the result.
Teams running AI over confidential deal data in Europe should note that the EU AI Act’s high-risk obligations moved. The Council of the EU gave final approval on June 29, 2026 to new application dates of December 2, 2027 for stand-alone high-risk systems, previously August 2, 2026, and August 2, 2028 for high-risk systems embedded in regulated products, previously August 2, 2027. Prohibited-practice and AI-literacy obligations have applied since February 2, 2025. Guidance published before mid-2026 generally still cites the old dates, so check any compliance memo covering this.
Frequently asked questions
What parts of due diligence can be fully automated?
Request list generation, document collection tracking, owner and due-date assignment, reminders and status reporting can run end to end without human intervention. These are workflow tasks with deterministic rules and an audit trail. Document review and risk assessment cannot. Extraction against a defined schema can run at scale with sampled review, but any judgment about whether a finding changes the deal thesis needs a named human sign-off.
What is the difference between due diligence automation and AI due diligence?
Due diligence automation is about the process: which steps run without a person pushing them. AI due diligence is about capability: what a model can understand inside the documents once they arrive. A team can automate its entire request and tracking workflow without using a model at all, and many should start there.
Does due diligence automation reduce cost?
The credible published evidence measures time, not cost. In a randomized field experiment across 66 firms and 7,137 knowledge workers, the treated workers who used the generative AI tool spent about two fewer hours per week on email, with no detected change in the quantity or composition of tasks. Cost only falls if those hours are reallocated to more deals or if an externally billed workstream is brought in-house.
Is AI reliable enough to review contracts in diligence?
For extraction against a defined schema with sampled human review, yes. For open-ended risk questions, error rates remain material. A peer-reviewed study of three commercial legal research tools grounded in a curated corpus measured accuracy between 19% and 65% across 202 queries, with hallucination rates between 17% and 33%. A data room is a harder retrieval problem than a legal database.
Does the EU AI Act apply to diligence automation?
It may, depending on the system and where processing happens. The Council of the EU gave final approval in June 2026 to move the high-risk application dates to December 2, 2027 for stand-alone systems, from August 2, 2026, and to August 2, 2028 for systems embedded in regulated products, from August 2, 2027. Prohibited-practice and AI-literacy obligations have applied since February 2, 2025. Take legal advice on classification rather than assuming a diligence tool falls outside scope.
.png){kind=small}
.avif)
.avif)
.avif)
.avif)
.avif)
