In this third blog of the series, we’ll dive deeper into the due diligence phase. While there is plenty of opportunity for automation, we cannot ignore the inherent risks.
For example, we believe that the blend of human + AI makes for a compelling argument that the work of professionals can be complimented greatly by the time, efficiency and inductive pattern recognition performed by machines. Our emphasis is on the word ‘complimentary.’ When it comes to AI usage in the M&A process, we firmly believe that human interaction and intervention is table stakes. We do not subscribe to an All-In poker attitude. For financial institutions, starting with security before moving to scaling commodity tasks is vital to proactively manage risk and protect their reputations.
Maintaining security and confidentiality in a fast-moving world
The National Center for the Middle Market’s latest Middle Market Indicator reports that nine out of ten middle market companies now use AI, with many describing their capabilities as established or advanced. More than four in five also report concerns about such usage, with the top concern being data privacy and security. Nearly a third of executives put digitalization and technology advancement among the top risks facing their business.
The picture is clear enough as both users and executives worry about the tools already installed. In the due diligence phase, when the documents on your screen belong to another entity, that worry is well-founded.
Deal teams evaluating AI tools often start by asking about the use case or efficiency. However, there is another question that should always come first: Are you permitted to use this AI tool at all?
The Documents in Your Data Room Are Not Yours
During a typical due diligence review, almost nothing on your screen belongs to you. It belongs to the seller, or to the borrower, and it reached you under a confidentiality agreement that says precisely what you may do with it. Those agreements are rarely vague. The standard formulation permits disclosure to your directors, officers and employees, and to advisors and representatives who need to know and who are bound by obligations no less protective than your own.
Where does an AI tool vendor sit on that list? It is not a representative in the sense the drafter had in mind, and its published terms of service are almost never more protective than the NDA you signed. The buyer whose analyst uploads a seller’s customer contracts to a general-purpose model has probably made a disclosure nobody authorized.
The remedy in most confidentiality agreements is injunctive relief. In a live transaction that is not a damages problem, it is a timing problem — and bad timing is how many middle market deals die.
This problem costs almost nothing to remedy at the beginning of a deal, but it could cost a great deal to fix in the middle of one. A sentence in the NDA permitting AI processing under stated conditions is now an ordinary thing to negotiate, and sellers are increasingly asking for the reverse: an expressed prohibition, or a consent requirement. Either result is workable. What is not workable is discovering the question in week six, with the data room fully loaded and an analyst who has been pasting extracts into a chat window since week two.
Automation benefits during due diligence
Due diligence is the phase where the sheer volume of the work often outpaces what any human team can process at speed — and where the risk of missing something is the highest. This phase is about proving the deal is what everyone believes it to be. That makes it fertile ground for agentic AI, but also when the line between “assistant” and “decisionmaker” must be drawn most carefully.
Automation Benefits on Commodity Tasks
Timeliness + Persistence = Immediacy
Due diligence has always been a race against a Close calendar. Contracts, financials, HR files, regulatory filings, vendor agreements — the volume alone historically dictated the pace of a deal, forcing teams to trade thoroughness for speed or speed for thoroughness. That trade-off is exactly where agentic AI offers the most promise.
Two properties of agentic systems combine to change the equation:
- Timeliness — an agent doesn’t wait for a convenient hour to start reviewing the next data room upload. Documents can be indexed, classified, and flagged the moment they land.
- Persistence — an agent doesn’t get tired, doesn’t lose its place, and doesn’t need to be re-briefed after a weekend. It keeps working the queue continuously, across every document, every time.
In a traditional review process, an amended contract, a restated financial statement, or a newly uploaded disclosure schedule triggers a re-review that’s inherently manual and inherently slow — someone has to notice the update, remember what it touches, and re-check every downstream conclusion that depended on the old version. That lag is where we believe risk hides, because the gap between “the file changed” and “the team knows what that means” is exactly the window where a stale read can make it into a negotiation.
The clearest illustration of immediacy at work is what happens inside a data room the moment a single file changes. I ran a very simple prototype on a closed folder structure with Claude Cowork1. The test was simple – replace an entry in the integration risk log, and the agent didn’t just re-index the log; it re-ran the cross-references that depended on it, re-prioritized the risks, and surfaced the delta to the preliminary integration plan — all before an analyst had finished refreshing the folder view. What used to require someone to remember every place a number appeared and adjust it, can now happen automatically with re-analysis that keeps pace with data changing underneath the deal team.
Scaling Your Team
Due diligence has traditionally scaled the way manual labor scales: more analysts, more hours, more coffee. Agentic AI changes that math — but not by replacing the analyst. It changes what the analyst’s first hour on a document looks like. And for mid-sized to small-sized credit unions, this effort becomes complimentary to your CFO who is running both the business as well as the deal.
Instead of starting from a blank page, an analyst can start from an agent’s first pass: contracts already flagged for unusual terms, financial anomalies already surfaced, obvious non-issues already triaged out of the queue. That’s a meaningful head start on the commodity items — the repetitive, pattern-matchable work that consumes analyst hours without requiring much judgment to find, even though human judgment is absolutely required to interpret.
That last distinction is the important one. Empowering analysts to move faster on commodity items doesn’t mean removing them from the loop — it means moving them further up the value chain, faster. Rather than having fewer analysts, analysts could spend their time on the 20% of findings that actually require a human brain, instead of the 80% that just require patience.2
Trend Induction
The most advanced use of agentic AI in due diligence isn’t extraction — it’s pattern recognition across contexts that a human reviewer would rarely have the bandwidth to hold in their head at once.
For example, during technical due diligence at a prior project, my client CTO confidently promoted a new tool from the Core vendor, claiming it would reduce record rejections by 5% and cut ingestion time by 15%. Based on that assessment, the technicals received a green light. An AI agent, however, could have compared those claims against data from prior projects and identified a recurring pattern: this executive frequently overestimated the maturity and impact of emerging technology solutions. Combined with two additional risk indicators already visible in the project data, the absence of a deconversion mapping file from the Core vendor and the fact that the buyer and target operated on different Core Banking platforms (on-premises versus cloud), the agent may have flagged the conversion approach as high risk long before issues surfaced.
In our view, this is where agentic AI moves from being a faster labor pool to being a sharper analytical lens — not because it understands the deal better than your team, but because it can pattern-match across a volume of comparison points that no single analyst, however experienced, could hold in view at once.
Automation gotchas & overconfidence during due diligence
Agentic AI can accelerate due diligence by scanning documents, finding patterns, and drafting issue lists. However, polished outputs can lock in premature conclusions. If the initial summary is wrong, later review may defend it rather than challenge it.
Anchoring creates a false sense of confidence
Anchoring isn’t new in deals. Teams sometimes fixate on the first reasonable explanation. Agentic AI amplifies this by delivering its first take with unshakable certainty.
The risk compounds because confidence is contagious. IBM summarizes research by Valerio Capraro of the University of Milan-Bicocca: in experiments where AI was known to answer incorrectly, wrong AI advice made participants less accurate and more confident. IBM notes the paper has not yet been peer-reviewed. The point isn’t how often AI is wrong, but how readily people accept it. IBM’s summary of wrong AI advice and user overconfidence.
Avoiding overreliance on the initial anchor
By introducing friction to challenge first answers and reviewing AI output critically, humans can remain the decision-makers. Have the AI compete with alternative perspectives before accepting its output. Ask for a downside case before a base case, withhold targets before requesting ranges, and require the agent to explain why its answer could be wrong.
For instance, if AI labels a vendor “low risk,” prompting for downsides may reveal critical dependencies and shift the review from a generic label to a specific risk.
Hallucinations hide inside plausibility
In M&A due diligence, the greater AI risk may not be obvious fabrications, but a plausible conclusion unsupported by evidence. Deloitte notes hallucinations can affect valuation and post-transaction success if teams fail to validate outputs.
For example, an agent might treat a negotiated change-of-control provision as boilerplate or describe customer revenue as diversified while missing that related entities roll up to one controlling party. These errors sound reasonable until checked against source documents. If AI output cannot be validated, relying on it can turn a shortcut into a material due diligence miss.
Human intervention and a “trust but verify” policy
In high-stakes due diligence, people still supply what AI cannot reliably provide:
- Context the agent lacks. Some clauses or anomalies may reflect relationship-specific terms or one-time events outside the AI’s view.
- Materiality judgment. Flagging an issue is not the same as knowing whether it matters to this deal, buyer, or structure.
- Accountability. Someone must stand behind the findings; that responsibility doesn’t transfer to a tool.
Because due diligence findings become deal judgments, AI output should be reviewed before it influences key conclusions. A “trust but verify” policy means using AI for speed while requiring teams to confirm the source evidence, test the reasoning, compare against relevant benchmarks, and assign a named reviewer before accepting a finding.
That discipline preserves the efficiency AI brings to due diligence while helping ensure faster review does not simply produce faster mistakes.
Our lessons learned as authors
Due diligence has always rewarded the team that can move fast without missing what matters. Agentic AI shifts that tension, giving teams more speed on the commodity layer and more comparative insight at the analytical layer, while leaving materiality, judgment, and accountability exactly where they’ve always belonged: with the people running the deal.
Learn more about PQ-Suite at https://pq-suite.com/
Want to discuss your credit union’s merger strategy & process in more detail? Contact ALM First’s team of experienced advisors to learn more.
