Applied AI in M&A Webinar Series: AI in Due Diligence

The third session of IMAA’s Applied Artificial Intelligence in M&A Webinar Series moved deeper into the deal process. Session 1 mapped AI across the full deal lifecycle, and Session 2 examined deal origination and sourcing. This session turned to one of the most resource-intensive phases of any transaction: due diligence.

The question on the table was not whether AI can support due diligence. The question is whether it can do so in a way that is verifiable and secure. It also has to be actually useful to practitioners under real deal pressure.

Two founders brought live platform demonstrations and hard-won experience to the session. James McVeigh is the founder and CEO of Cyndx, a global search and discovery platform. It leverages AI to map private markets and support M&A activity.

Rabie Zahri is the co-founder and CEO of Positon AI, an AI-native deal execution platform. He built it drawing on his experience overseeing more than $2 billion in acquisitions at Hewlett Packard Enterprise.

Prof. Dr. Christopher Kummer, Founder and CEO of IMAA, moderated the session.

Together, they offered a candid, practically grounded view of where AI is already delivering measurable value in due diligence. They were equally direct about where the hard problems remain.

A Brief History of the Data Room 

Kummer opened the session with a reminder of how far the due diligence process has already come. 

Physical data rooms were once the norm. Practitioners flew to a location and sat in a room without windows. There, they worked through binders of documents under strict time limits. When virtual data rooms arrived roughly three decades ago, they were transformative.  

The ability to access materials remotely, control who saw what, and track document activity reshaped how deals were conducted. 

AI is the next shift. But the ambition is considerably more expansive than digitizing access. The question now is whether AI can read and understand what is inside those rooms. Just as important is whether it can synthesize that information into something useful. More critically, whether it can do so in a way that holds up under the scrutiny deals demand. 

The Architecture Question: Connected vs. Controlled 

Before either speaker demonstrated their platform, Zahri raised a foundational question. It shapes every AI application in due diligence: where does the data actually go?

He drew a distinction between two approaches to integrating AI with deal workflows. 

The first, which he calls MCP-connected, involves streaming data out of the deal environment to external AI systems. This exposes sensitive deal information to third-party vendors and their respective data policies. 

Each of those vendors has its own data policies. Each connection introduces additional points of failure. And each transfer of data outside the platform erodes the clean chain of custody that makes due diligence defensible. 

The second approach is the one Positon AI is built around. It keeps AI entirely within the four walls. Every AI operation happens inside the platform. No client data, no deal information, no target research is ever transmitted to an external model. 

“When you refactor and build everything AI-native, you have complete control on governance, permissions, workflows,” Zahri said. “The AI is part of that stack, within the four walls.” 

This is not merely a security preference. In deal-making, data leakage is a material risk. Target companies sharing sensitive financial or operational information through a virtual data room are extending trust on specific terms.  

What AI-Native Due Diligence Actually Looks Like 

Zahri’s platform demonstration showed what it means to build AI into every layer of the deal process rather than layering it on top. 

Positon AI organizes deal activity across clearly defined phases — pre-LOI and post-LOI. Within each phase, separate workstreams cover the major functional areas: finance, legal, HR, IT, procurement, and others.

Each workstream has its own permissions. Team members see only what their role permits. The AI assistant, called Odin, operates under the same access controls. 

“If you don’t have cleanroom access to finance, and that particular information exists in the cleanroom, you will not get information from Odin from that area,” Zahri said. “It’s all built in.” 

This matters more than it might first appear. A general-purpose AI assistant that can access everything in a data room regardless of user permissions would create exactly the kind of information asymmetry that due diligence processes are designed to prevent.  

A procurement team lead should not have AI-synthesized access to HR data. A banker managing a sell-side process should not inadvertently surface confidential information from a buyer’s workstream. 

Positon AI calls its permission and access model ring-fencing architecture. It ensures that AI follows the same rules as the humans it supports. 

Answering Questions Across Multiple Documents 

The most practically significant demonstration in the session was Odin’s ability to answer diligence questions when the relevant information is scattered across multiple files. 

The most practically significant demonstration in the session centered on Odin, Positon AI’s built-in AI assistant. It showed Odin’s ability to answer diligence questions when the relevant information is scattered across multiple files. 

The most practically significant demonstration in the session centered on Odin, Positon AI’s built-in AI assistant. Odin’s ability to answer diligence questions when the relevant information is scattered across multiple files stood out as a key capability. 

Odin scans the entire data room and assembles the answer from wherever the relevant information lives. It cites the source files.  

If two documents with the same name contain different information, Odin identifies both and flags the difference. This includes scenarios where one version is redacted and the other is not. 

“The answer does not have to be in one file,” Zahri said. “It can be in multiple files, and it will summarize it for you.” 

The system does not answer questions it cannot find evidence for. When asked a question with no corresponding data in the room, Odin returns nothing rather than inferring or generating a response.  

Zahri demonstrated this with a simple query about the current time. This design choice is deliberate. In a diligence context, a confident but fabricated answer is not just unhelpful; it is dangerous. 

Managing Q&A at Scale 

One of the most underappreciated operational challenges in large due diligence processes is question duplication. When a transaction involves multiple workstream teams, each with their own fiduciary responsibilities, the same question often gets asked by three different people independently.  

The sell side then has to answer it three times. 

Positon AI catches duplicate questions automatically and consolidates them. Once the sell side has reviewed and approved a response, it fans the answer out to everyone who needs it. 

The sell side answers once; all workstream leads receive it. 

“A lot of people have fiduciary duty to ask those questions, so they don’t want to collaborate on it,” Zahri acknowledged. “So that’s something we capture here — it’s context-driven, meaning AI has the context, and it’s able to figure out what’s a duplicate and what’s not.” 

Document Handling: Redaction, Watermarking, and Audit 

The platform handles the mechanics of secure document exchange with a level of automation that removes most of the manual overhead from the sell side. When documents are uploaded, they can be automatically redacted according to pre-configured rules: terms, names, or categories that should never be visible to any buyer.  

Legal teams can set these rules once; every subsequent upload is processed against them automatically. 

The redaction capability is robust by design. Zahri noted that it handles scanned documents, handwritten annotations, dual-column layouts, and documents up to 150 pages. These are precisely the formats where manual redaction most commonly fails. 

The platform also allows sellers to share what Zahri calls an Essential Vault with prospective targets or counterparties: a complimentary, secure data exchange environment where initial conversations can happen before a formal process begins.  

This is positioned as an alternative to the email attachments and generic file-sharing services that currently dominate early-stage deal conversations in the middle market. 

The Research Layer: From Data Room to Synthesis 

McVeigh’s demonstration focused on a different dimension of AI in due diligence: the research and synthesis capabilities that help practitioners understand a target’s market position, competitive landscape, and comparable transactions before and during the formal process. 

Cyndx’s Scholar tool allows users to input a research question and receive a structured, sourced research report that can run to between 50 and 150 pages. The report can be delivered in PDF, Word, or PowerPoint format. 

The report includes an executive summary, a structured analytical framework, profiles of individual companies, risk and consideration sections, and full citations for every claim, linked to the underlying source material. 

“We give you a reference to it,” McVeigh said. “Unlike a lot of systems out there today, where they’re not going to give you a reference, we give you a reference so you can go deeper.” 

This citation architecture addresses one of the core reliability concerns with AI in professional contexts. A confident output without a source trail cannot be verified. In due diligence, the output informs decisions that carry legal and financial consequences.  

The ability to trace every finding back to a primary source is not a nice feature — it is a requirement. 

The Finder tool, Cyndx’s core market mapping product, surfaces relevant companies in a given sector along with investor information, public comparables, precedent transactions, patent filings, customer and supplier relationships, and news monitoring across 30 categories. The platform covers 33 million companies across more than 100 languages, with a particular emphasis on private companies that would not appear in English-language databases. 

The Legal Dimension 

The audience session produced a pointed question about AI’s role in the legal aspects of due diligence. It is one of the areas where the stakes of error are highest and where practitioners are most cautious. 

Both speakers addressed it directly. 

Zahri described how the Q&A system surfaces information relevant to legal questions from within the data room, regardless of where it is buried. This includes contract terms, litigation history, and regulatory filings.  

When a seller provides a data dump rather than a curated response, AI can extract the legally relevant content and present it with source citations. The sell side is then responsible for reviewing and formally endorsing the response before it is transmitted to the buyer. 

“What we do is uncover those answers, we suggest them, and then they have to click to add the answer — as either the sell side, or the banker, or the legal counsel,” Zahri said. “Because if you’ve done deal-making, you want the other side to answer directly, because they’re liable for those answers.” 

Kummer added that a law firm he had met with the previous day had described a similar approach: AI tools that compile contract lists and flag risk categories, with human lawyers performing random checks and validating the AI’s assessments before relying on them.  

The liability question remains live and unresolved in the industry. 

McVeigh reinforced the point from the other direction: “At the end of the day, it needs to be verified, and someone needs to be held accountable for the answer that’s being delivered. There are a multitude of examples in the legal space where they did not do that, and it ended up being a huge liability for the law firm.” 

Closing the Data Gap

One of the structural problems in M&A that received less attention than it deserves is the data gap that opens at close. For most deals, the data room is archived at signing, everything gets downloaded to a flash drive or a SharePoint folder, and the integration team starts from scratch trying to reconstruct what was agreed and what the deal thesis was based on. 

Positon AI addresses this by treating close not as a termination point but as a transition. When a deal closes, the deal vault is archived. It remains fully accessible, searchable, and connected to all the Q&A threads, document versions, and activity logs that accumulated during the process. 

The integration phase begins with full continuity. 

“That lift and shift that happens — oh, now we closed the data room, let’s download everything, now you have to also upload it to SharePoint, and that creates a data gap from an integration standpoint,” Zahri said. “What we wanted to do is allow that flow to continue.” 

Synergy tracking, PMO setup, and workstream activity through business day one and employee day one are all planned feature extensions of the same architecture. Not all of those capabilities are live yet, Zahri acknowledged.  

But the infrastructure is designed to support them without requiring a new system. 

Kummer noted that dedicated post-merger integration tooling would be a topic for a later session in the webinar series. 

Key Takeaways 

AI in due diligence is already working — but architecture matters.  

The most significant design decision for any AI-assisted due diligence tool is not which model it uses. It is whether data stays inside the platform or gets transmitted to external systems. For sensitive deal information, the distinction is consequential. 

Human accountability is non-negotiable.  

Neither speaker suggested that AI should or would remove the need for human review of due diligence findings. The value of AI is in surfacing, organizing, and synthesizing information faster and more completely.  

It is not in replacing the judgment of the practitioner or the liability of the answering party. 

Private company data is the hardest problem.  

Most M&A happens in the private markets. Most AI systems are trained on public data. The gap between those two realities is where the reliability of AI due diligence support is most at risk, and where purpose-built platforms have the clearest advantage. 

Completeness reduces risk.  

In due diligence, what you miss matters as much as what you find. AI that can scan a full data room, across all document types and languages, and surface relevant material regardless of where it is buried, directly addresses one of the most common sources of post-close surprises. 

The audit trail is the product.  

Deal-making generates liability. The ability to reconstruct who saw what, when, what questions were asked and answered, and what documents were reviewed is not an administrative convenience. It is an essential feature of any serious deal execution system. 

The Applied AI in M&A Webinar Series continues with an upcoming session focused on AI-driven valuation. Future sessions will address legal due diligence, data confidentiality, and post-merger integration, including a contribution from a US-based attorney on the evolving standards for protecting confidential information in AI-assisted deal processes.