AI in due diligence: faster review, the same responsibility

What the technology does and does not do

AI is most useful for work that repeats across a large number of documents. It can locate and compare provisions, flag missing documents and surface unusual terms. A complete first view of the data room, such as an overview of leases, customer contracts, employment terms and policies, can then be formed more quickly. Such an overview is only reliable once it has been checked against the source documents.

AI does not decide what is material, interpret an ambiguous indemnity, recognise a commercial dependency that does not appear from the documents, or find facts that were never uploaded. Its output depends on the questions asked and the documents available, and it can sound convincing while being wrong. A sound diligence plan therefore sets out which work the technology supports, what the lawyers assess themselves and which points require confirmation from management.

Whoever conducts due diligence must exercise the care expected of a professional advisor; that responsibility does not pass to the technology supplier. Our method reflects this. We work with our own review questions, checklists and standards, and technology helps us apply them quickly and consistently across the whole data room. Every finding that goes into the report is assessed by us against the source document, and we record how the review was carried out.

Searchability and buyer knowledge

In a conventional data room there is a practical limit to what a buyer could reasonably have found. Whether a matter has been fairly disclosed generally depends on the terms of the purchase agreement, the disclosure letter and the organisation and accessibility of the documents. Where a well-framed search would have returned a point straight away, it becomes harder to argue that the point was buried in a large body of contracts.

That does not turn every search hit into buyer knowledge. A result may be incomplete or inaccurate, or too remote from the warranty in question. The questions remain the same: did the seller disclose the matter clearly enough, and did the review team actually see and assess it?

This bears on the negotiation of buyer knowledge and any anti-sandbagging provision. A seller seeking to exclude claims for matters the buyer knew about will want knowledge defined broadly, possibly by reference to everything that was searchable in the data room. A buyer will want knowledge limited to what named members of the transaction team actually knew, and will want to avoid the entire data-room content, or all AI output, being treated as known.

It helps to record at completion exactly which documents were made available: the final contents of the data room, with a date, together with any disclosure letter. If a warranty claim arises later, the debate then concerns a fixed record rather than what a search tool might once have found.

Confidentiality and professional secrecy come first

Transaction documents are confidential, and lawyers are also bound by a statutory duty of confidentiality. The Dutch Bar Association has published recommendations on AI, starting from the principle that the lawyer remains responsible. Those recommendations are the basis of our approach. Confidential client documents are never entered into free or public AI services, only into a secure business environment whose terms we have assessed.

Choosing a supplier comes down to concrete questions: where is the data processed, who can access it, are prompts and outputs retained, is any data used to train a model, and what happens to the data when the relationship ends? A supplier that cannot answer these clearly in its contract is not suitable for a live transaction. The same questions apply where a client asks us to work in its own AI environment.

A data room usually contains personal data, such as employee details, customer contacts and correspondence. The GDPR applies in full: use for a clearly defined purpose, no more data than necessary, appropriate security and a processor agreement with the supplier. We limit use to the transaction review and access to the team working on it.

The AI Act is also part of the framework. In an acquisition it mainly concerns a target company that develops or uses AI itself, which is a subject of diligence in its own right. For the use of AI in the review itself, it chiefly requires that those who use the technology understand what it can and cannot do.

AI use and buyer knowledge

Where the buyer uses AI in its review, the question arises whether that affects what it is deemed to know. The purchase agreement should therefore make clear which documents count as disclosed and what the parties mean by buyer knowledge. The fact that a data room is searchable should not quietly turn into deemed knowledge; if the parties want that result, they should agree it expressly.

A provision might read: "The parties acknowledge that the Buyer and its advisors may have used automated analytical tools in reviewing the Data Room. Such use does not, without more, constitute actual knowledge of any matter, amend the agreed standard of disclosure or relieve the Seller of any express disclosure obligation under this Agreement." Such a provision works best as part of the knowledge and disclosure provisions, rather than as a standalone statement about technology.

These are useful questions for anyone instructing an advisor: which technology is used and in what environment, what data goes into it, whether data is retained or used for training, what arrangements apply to security and personal data, who checks the output, and how the review is recorded. We are glad to answer them at the outset. Where an answer falls short, we restrict the use, choose a different environment or review that part of the documents without the tool.