TechnologyResourcesCapital MarketsComing Soon
All blog postsGuide

AI Due Diligence: An Operational Playbook

Operational playbook · 12 min read

This is the practical companion to the Legal AI for M&A master guide. That one explains why and what. This one explains how, day by day, on a real deal.

The audience is the deal team running buy-side or sell-side diligence on a mid-market or larger transaction with at least one associate, one mid-level, and one partner involved. The advice generalizes up to the largest deals (with more parallelism) and down to PE add-ons (with less ceremony). It does not generalize cleanly to thin asset deals or pure financing deals; those have different shape and AI is less load-bearing.

Stage 1: Data room access and ingestion

The first hour of a new deal still has the same shape it always has. You get credentials, you log in, you take stock of what is there. The change is what happens next.

In the pre-AI workflow, the associate downloads a sample of files, manually creates a folder structure, and starts reading the most obviously material documents (the customer contracts, the master services agreements, the financing docs, the corporate organizational documents).

In the AI workflow, the entire data room is ingested in one pass. Mage connects to Datasite, Intralinks, ShareFile, Box, Dropbox, iManage, NetDocuments, and direct zip uploads. A typical mid-market data room (1,000-3,000 documents) ingests in 30-60 minutes. The associate's first hour is spent setting up the risk checklist for this specific deal: which clauses matter for this target, which jurisdictions are in play, whether financing is involved, how aggressive the partner wants the issue threshold.

A practical note from running this many times: the data room is virtually always incomplete on Day 1. A good ingestion workflow flags the gaps the system noticed (no employee handbook, no top-customer agreements, no IP assignment chain) before the associate starts reading. This list goes back to seller's counsel as the first information request, not the eighth.

Stage 2: Document classification and prioritization

By the time the associate is back from coffee, the data room has been classified. Every document has a category (NDA, MSA, employment agreement, lease, IP assignment, financing instrument, organizational document) and a deal-relevance score.

The right ordering is partner-driven, not system-driven. A typical buy-side priority for a tech target is:

  1. The top 20 customer agreements (revenue concentration).
  2. The financing instruments (debt covenants, change-of-control triggers, lender consents).
  3. IP assignment chain for the founders and key employees (cap-table risk).
  4. Employment agreements for senior team and key engineers (retention risk, IP assignment, non-compete enforceability).
  5. The corporate organizational documents (charter, bylaws, prior stock issuances, board minutes).
  6. The lease agreements (assignment restrictions, change-of-control triggers).
  7. Everything else.

The associate spends Day 1 reviewing classifications on the first three categories, not reading every contract. The system does the reading. The associate spot-checks 10% manually, and any contract whose classification the system is less than confident about gets pushed to top-of-queue.

Stage 3: First-pass risk review

The first pass is run against a configured risk checklist. A reasonable starting list for an M&A buy-side review covers:

  • Change-of-control triggers (assignment, consent, termination)
  • Anti-assignment clauses
  • Exclusivity and non-compete provisions
  • MFN (most-favored-nation) clauses
  • Audit rights and information access
  • Indemnity caps, baskets, survival, special indemnities
  • Termination for convenience, termination for cause
  • Limitation of liability and disclaimers
  • IP ownership and license-back provisions
  • Governing law and forum selection
  • Insurance requirements
  • Material adverse change (MAC) clauses
  • Data processing and privacy obligations
  • Renewal and term provisions

The output of the first pass, run overnight, is a per-document findings list. Each finding has a severity (high, medium, low), a confidence score, the source-clause snippet, and a suggested human review target. By the morning of Day 2, the associate is looking at a sortable, filterable issues view, not a stack of unread PDFs.

We have specific posts that go deep on the harder clause types. See What 300 NDAs Taught Me About Change-of-Control Clauses, Non-Compete Clauses in M&A, Anti-Assignment Clauses in M&A, and Exclusivity Clauses in Commercial Contracts.

Stage 4: Amendment chain resolution

Almost every commercial contract in a real data room has been amended. A master services agreement signed in 2014 will typically have three to fifteen amendments by the time it shows up in a 2026 data room. The current operative terms are a function of every amendment in sequence, not just the last one, and most of the time the parties are interpreting "current" differently.

Naive document review reads each amendment as if it were its own contract. AI-augmented review with a properly-built tool reconstructs the amendment chain and produces a single composite view of the current terms. This is harder than it sounds; we have written a separate technical post on why (Amendment Chain Resolution: The Hardest Problem in Legal AI).

The operational impact: the associate sees the current state of every contract on Day 2, not the original 2014 state plus a stack of amendments to figure out manually. Findings reference the operative provision, with traceability back to which amendment introduced it. The partner's review is on the substance, not on document archaeology.

Stage 5: Memo drafting

By Day 3, the associate has reviewed the high-severity findings, accepted or rejected each, added jurisdictional context, and is ready to produce a memo.

A practical memo structure that works for most M&A deals:

  1. Executive summary: one page, partner-grade. The five things the client should know before the next call.
  2. Material findings by category: financial, IP, employee, regulatory, real property, commercial. Each finding with a one-paragraph description, citation to the source, and a recommended disposition.
  3. Outstanding diligence requests: the gaps in the data room that need follow-up.
  4. Risk register: the issues the team is watching for the duration of the diligence period.

Mage drafts the first three sections automatically from the findings, in the firm's house style, with citations to source documents. The associate edits, the partner reviews. By Day 4, this goes to the client.

The bar on memo output is "the partner edits the language, not the substance." A tool whose first-draft memo requires the associate to start over has not earned its keep. We have failed that bar publicly and corrected it; see Why We Don't Let Users Write Prompts.

Stage 6: Disclosure schedules (sell-side)

Sell-side counsel reading this guide know that disclosure schedules are the part of the deal where time disappears. A mid-market deal can need 40 to 80 schedule items spanning material contracts, IP, employees, real property, debt, litigation, taxes, and regulatory matters. Most of them are mechanical: list every contract over $250k, list every patent, list every lease.

This work is a near-perfect AI task. The system reads the underlying source agreements, applies the schedule's threshold criteria, and drafts entries with citations to the source. The seller's counsel reviews and signs off. We have written about how this works in How to Prepare Disclosure Schedules That Protect Sellers.

The realistic time savings here are large: a sell-side associate who used to spend 80-120 hours building schedules now spends 20-30, and the result is more consistent across schedule items.

Stage 7: Redline review and counterparty markups

Once the deal moves into negotiation, the AI workflow shifts. The system compares each round of counterparty markups against your firm's preferred positions, surfaces material deviations, and produces a comparison memo for the partner.

The bar here is precision. Surfacing every comma is noise; missing a substantive change is malpractice. The right tools categorize changes by materiality automatically and let the associate adjust the threshold per deal. We have a deeper discussion in our Redline Review Workflow page.

Stage 8: Closing checklist and post-signing tracking

The signing-to-closing window is where deals come unglued, and the standard closing checklist tool is a spreadsheet that someone hand-maintains. AI-augmented tools track every condition, every consent, every delivery, every covenant in one place, with status changes pushed back into the data room.

The interim covenants are often where bad surprises live. We wrote about the specific category in Signing-to-Closing Interim Covenants.

Failure modes to plan for

Three things go wrong consistently in AI-augmented diligence. Naming them up front lets you build mitigations.

Jurisdictional drift. A non-compete that is unenforceable in California is fine in New York; the AI will report what the contract says, not what the law says about it. The countermeasure is jurisdiction-aware risk lists and human review of every cross-border issue.

Custom structures that look standard. A bespoke indemnity package that uses standard-looking language but operates differently (different basket type, different survival rules, different cap interaction) is exactly the case where AI-trained-on-standard-contracts can mislead. The countermeasure is to read every indemnity package manually, regardless of the AI's view.

Amendment chain edge cases. A poorly-drafted amendment that says "the parties agree the term is extended" without specifying the new end date will be flagged by a serious tool and silently dropped by a weak one. The countermeasure is to verify amendment chain output on a sample of multi-amendment contracts on every deal.

What this changes about deal economics

The honest answer is: it depends on how the firm bills. For a fixed-fee engagement, AI-augmented diligence is pure margin; the same deliverable for fewer hours. For a billable-hour engagement, it changes what the hours are spent on; less reading, more analysis, more negotiation prep, more client counseling. Either way, the partner-grade output is faster and the gaps are smaller.

The firms making this transition cleanest are the ones treating AI as a force multiplier on associates, not a way to do the same work with fewer people. Junior associates take on more responsibility earlier in their tenure because the bottleneck is no longer "did I read everything." The firm that does this well attracts and retains better associates.

Companion reading

This guide is the operational counterpart to the Legal AI for M&A master hub. For the buyer's-guide angle (which tool to actually pick), see Evaluating Legal AI Tools. For the head-to-head against the most-asked-about competitor, see Legal AI vs. Harvey vs. Generic AI.

To see this workflow on a real deal, request a demo. Bring your data room. We will run it end-to-end and walk you through what we found.

Frequently Asked Questions

What does the first day on a deal look like with AI?

Day one: get data room access, ingest the corpus (typically under an hour for a mid-market data room), run the configured risk pass overnight. By Day Two, the associate has a draft issues list and a categorized document inventory; the partner reviews the high-severity items first. The total elapsed time to a partner-reviewable memo is typically three to five days versus ten to fourteen pre-AI.

What size deal warrants AI-augmented diligence?

Anything where you would otherwise have at least one associate spending more than a week reading contracts. That covers virtually every mid-market and up M&A deal, every PE add-on with material commercial contracts, and most growth-equity financings with a substantive contracts portfolio. Sub-$5M asset deals with a thin contracts portfolio do not need it.

How do you handle a data room with bad file naming?

Real data rooms are messy. Files with names like 'Final v3 (Updated) FINAL.pdf' are the rule, not the exception. The system classifies by content, not filename, so messy naming does not break the workflow. The associate's job is to spot-check the auto-classification on a sample, not to clean the data room first.

What about contracts in languages other than English?

Multi-jurisdiction targets have French, Spanish, Mandarin, Japanese, German, Portuguese, and other contracts in the mix. Mage supports 80+ languages out of the box. The standard pattern is to run the risk pass against the source-language documents, surface the findings with translated quotes, and let the relevant local counsel verify the high-severity items.

How do you avoid automation bias?

Three patterns. First, every AI-flagged finding links to the source clause; an associate clicks through to the actual text before adding it to the memo. Second, the team reviews a randomly-sampled set of allegedly-clean contracts manually on every deal, not just the flagged ones. Third, accuracy is tracked over time and recalibrated against ground truth; the moment the system's clean rate drifts away from manual baseline, the team digs in.

What goes wrong most often?

Two things. First, jurisdictional carve-outs that depend on context the system did not have (e.g., a non-compete that is unenforceable in California but fine in New York). The countermeasure is jurisdiction-aware risk lists. Second, custom indemnity structures that look like the standard ones but operate differently. The countermeasure is to read every indemnity package manually on every deal, regardless of what the system says.

See Mage on a real data room

Bring a current deal. We'll run buy-side or sell-side diligence end-to-end and walk you through the result.

Request a demo