AI in M&A Due Diligence: A Corporate Lawyer's Checklist
Every AI due diligence guide reads like a vendor brochure. Here's a jurisdiction-neutral checklist for corporate lawyers actually running the review, covering privilege, cross-border transfer and disclosure.
Search “AI due diligence M&A” and almost everything you find is a vendor’s guide to why their platform is faster than the last one. That’s a reasonable thing for a vendor to publish. It is not the same document a corporate lawyer needs before putting an AI tool in front of a data room. The tool selection question is the least interesting part of this. The questions that actually determine whether your firm has a problem in eighteen months are about privilege, disclosure, cross-border transfer and what “verified” is supposed to mean when the first draft came from a model.
This is that checklist. It assumes you have already chosen, or been handed, an AI contract review or data room analysis tool. It does not assume any particular jurisdiction, because the underlying obligations, protect privilege, verify before you rely, disclose what a reasonable client or counterparty would want to know, are the same whether the deal is governed by Indian, English or Singapore law. The specific compliance triggers differ, and this checklist flags where.
Before the Data Room Opens
Confirm your firm’s AI governance policy actually addresses due diligence specifically, not AI use in general terms. A policy written for contract drafting does not automatically cover a tool ingesting an entire target company’s document set. If your firm doesn’t have a due diligence specific addendum, that is the first gap to close, not the tool’s confidence score.
Get the vendor’s data handling terms in writing, not their marketing page. You need answers to three questions before a single document is uploaded: does the vendor retain uploaded documents after the engagement ends, are documents used to train or fine-tune any model, and where is the data hosted. A vendor that cannot answer the second question clearly in the contract has not answered it.
Identify your cross-border transfer basis before, not after, documents move. This is the step firms skip most often, because nobody thinks of uploading to a cloud based review tool as an “export.” If your target’s documents contain personal data and the AI vendor’s servers sit outside India, section 16 of the Digital Personal Data Protection Act, 2023 is engaged the moment that data leaves. If you are acting from Singapore, the Transfer Limitation Obligation under section 26 of the PDPA applies on the same logic. A UK-side reviewer routing documents through a US-hosted tool needs an adequacy decision or appropriate safeguards under the UK GDPR before upload, not after the deal team notices. None of this is exotic law. It is the same cross-border transfer analysis you would run for any offshore document review, except AI tools make it easy to forget you are running one at all.
During the Review
Set your verification sampling rate before you see the AI’s output, not after. Decide in advance what percentage of AI-cleared documents a human reviewer will independently check, and hold to it even when the deal timeline gets tight, especially when the deal timeline gets tight. An AI tool that correctly flags 95% of change of control clauses is not 95% safe. It means one in twenty is missed, and you will not know which one until it matters.
Treat certain clause categories as mandatory human review regardless of what the AI concludes, not because the AI is unreliable on these specifically, but because the cost of a miss is asymmetric. Change of control and assignment provisions, material adverse change clauses, exclusivity and non-compete undertakings, and anything triggering a consent or notification requirement on completion belong in this category. A missed boilerplate confidentiality clause is an inconvenience. A missed change of control clause can unwind the commercial basis for the deal.
Segregate privileged material from the AI review workflow before ingestion, not by relying on the tool to identify privilege after the fact. If your review protocol depends on the AI correctly recognising privileged communications within a mixed document set, you have delegated a legal judgment call to a system that has no visibility into who your client’s litigation counsel was or what the dominant purpose of a given communication was. Privilege review stays a lawyer’s job. AI can help locate candidate documents for a human to assess; it should not be making the assessment.
Disclosure, Both Ways
Check the target’s NDA, and your own, for AI-specific restrictions before you upload anything. NDAs drafted from 2025 onward increasingly restrict processing shared confidential information through third-party AI tools without consent, precisely because sharing a document with an AI platform can look like disclosure to an unauthorised third party under a traditionally drafted confidentiality clause. If your NDA predates this issue, get written confirmation from the counterparty that AI-assisted review is permitted before you rely on the tool, rather than assuming silence means consent.
Address AI use in your engagement letter in terms your client would actually understand, not a boilerplate technology clause buried in the standard terms. If AI materially speeds up the review or changes the cost basis you quoted, your client should know that before completion, not discover it when the invoice looks different from what a fully manual review would have cost. This is the same transparency judgment call every AI-adjacent guidance document from MinLaw to the SRA has converged on: would this particular client be surprised to learn how the work was actually done.
Anticipate the W&I insurer’s questions on methodology. Warranty and indemnity underwriters are increasingly asking how due diligence was conducted as part of the underwriting process, and a review methodology that cannot be clearly explained, including what was AI-reviewed, what was human-verified, and at what sampling rate, is a harder underwriting conversation than a traditional review, not because AI is disqualifying but because underwriters price uncertainty. Document your methodology as you go. Reconstructing it after a claim is a much worse position to be in.
Sign-Off
Require a named senior lawyer’s sign-off on every deal-critical finding that originated as an AI flag, and make that sign-off substantive rather than a rubber stamp on a summary. The sign-off should record what was checked and against what source, not just that the AI’s conclusion was accepted.
Keep an audit trail of what the AI reviewed, what a human reviewer independently checked, and what conclusion the human reached, for every category of document where the AI played a role. If a dispute, an indemnity claim or a professional negligence question ever turns on what due diligence actually covered, this record is the difference between demonstrating a defensible process and reconstructing one from memory.
The Judgment Call This Checklist Doesn’t Replace
None of the above tells you which AI tool to buy, and that’s deliberate. Tool selection is a procurement decision. Everything above is a professional responsibility decision, and those don’t change based on which vendor you’re using. The lawyer who has actually built the verification sampling rate, the privilege segregation protocol and the disclosure language into their firm’s standard process before the next deal lands is the one whose due diligence holds up when someone asks how a specific conclusion was reached.
This is exactly the kind of workflow-level judgment we build prompt-by-prompt in the Corporate Advisory module of The AI Bar Foundation for Lawyers, including the situation, prompt, sample output and lawyer’s check structure applied specifically to due diligence and deal review. If your team is running AI-assisted due diligence without that structure written down anywhere, that’s the gap worth closing before the next data room opens, not after.