Matt Gipple was reviewing General Motors' investment term sheet at Cruise when one IP clause stopped him cold. The clause gave GM ownership of Cruise's IP through what was supposed to be a minority investment. Matt pushed back. As Matt, former General Counsel at Cruise and now Co-founder at Dryvebox, told the CZ and Friends podcast:
"We went back to GM and said, hey, this IP thing doesn't work. Like, if you want this kind of IP, you need to buy us. And then GM was like, well, let's talk about that. And that was kind of like, whoa, we did not anticipate that being real."
GM acquired Cruise. One careful read of one term sheet turned a minority investment conversation into an exit. The work that surfaced it (clause-by-clause review, doctrinal interpretation, fast translation into a recommendation to the founder) is the same work in-house counsel run today on M&A buy-side deals, major vendor onboardings, and AI vendor evaluations.
This guide is for the General Counsel, Associate General Counsel, Legal Operations lead, and Legal Procurement lead carrying that workload.
GC AI's CEO and co-founder, Cecilia Ziniti, was a general counsel three times (Anki, Bloomtech, and Replit), and an in-house counsel at Amazon and Cruise. Ziniti built GC AI to solve the problems she encountered firsthand as an in-house lawyer. That experience is embedded directly into GC AI's system prompt, tone, and workflows.
Quick verdict for in-house GCs. AI due diligence reads the documents, surfaces deviations from market and from your standards, and produces a board-ready memo. It splits into three lanes today: M&A buy-side, vendor (including AI vendors), and AI-asset diligence inside targets. The platform handles the mechanical reading and the structuring. Outside counsel still owns novel-precedent risk and the deal-killer call. The fastest first step: drop a closed deal's data room into a legal AI platform, run the same prompts, compare to the memo your team produced.
How AI Due Diligence Works
AI due diligence is the use of a legal AI platform to compress contract review, regulatory analysis, vendor risk, and board-memo preparation across M&A, vendor selection, and corporate transactions. The phrase carries two meanings, and in-house counsel handle both.
The first meaning is using AI to perform diligence. Ingest a 1,500-document data room. Extract risk-bearing clauses with citations the GC can stand behind. Surface termination triggers and change-of-control language. Draft the memo that goes to the CEO and the board.
The second meaning is performing diligence on AI. Evaluate an AI vendor before purchase. Evaluate the AI assets inside an M&A target: proprietary models, training data licensing, IP ownership, and the bias and discrimination liability the buyer inherits.
Both meanings use the same phrase. Both demand attention from the GC. Skadden writes about the second. Spellbook, Harvey, and LegalFly write about the first. This guide covers both.
The distinction matters because AI due diligence software solves a heavier load than a generic AI document review platform. The diligence workload runs heavier on synthesis (the board needs a recommendation alongside the pile of clause extractions), heavier on confidentiality (the data room is closed by NDA), and heavier on regulatory layering (successor liability, antitrust, data protection, and AI governance laws all stack on a single transaction).
Successor liability is one of those layers, and it sits at the top of any M&A buy-side risk list. The doctrine lets a buyer inherit the seller's debts, contracts, or pending litigation, even when the buyer structures the deal as an asset purchase rather than a stock purchase. The de facto merger exception is the corner of the doctrine where courts treat an asset purchase as if it were a merger, so the seller's liabilities transfer with the assets. Both can derail a deal late in diligence.
Natalya Vasilchenko, Associate General Counsel at Atlas Copco Group, demonstrated the in-house diligence workflow during a GC AI 101 class with this prompt:
"I asked for a summary of defacto merger exception for successor liability, include a table and then write a summary for business stakeholder."
That single prompt threads three diligence requirements in one move. A doctrinal pass for the lawyer's working notes. A structured table for analysis. A business-summary version for the deck the CEO carries to the board. The platform either moves between those modes inside one chat or it does not.
The Three Lanes of In-House Due Diligence
In-house diligence sorts into three distinct lanes. A capable AI due diligence platform serves all three with the same engine, the same security posture, and the same audit trail.
M&A Buy-Side Diligence
M&A buy-side diligence is the heaviest lift on an in-house team's calendar. The board approves a target. Six to twelve weeks later, the deal closes or it dies. Between those points, the legal team reads a virtual data room (anywhere from 200 to 5,000 documents), maps the target's commercial contracts, employment agreements, IP assignments, regulatory filings, and litigation exposure, and writes a buy/no-buy memo for the deal team and the board.
AI compresses each step. Data-room ingestion runs against the full document set in a single session. Risk-bearing clauses (assignment, change of control, termination for convenience, exclusivity, MFN, indemnification scope) surface in extract form with character-level citations the GC can paste into the memo. Successor liability questions get a doctrinal pass. The board summary writes in business prose. The lawyer still owns the recommendation. The platform gets the team to the recommendation faster.
Where a GC was reading 200 contracts by hand, the AI surfaces the 30 that need attention. Where the board memo was three weekends of writing, the AI produces a stakeholder-ready first draft in two hours.
Vendor Due Diligence (Including AI Vendors)
Vendor diligence used to be a procurement-led checkbox: signed DPA, current SOC 2, insurance certificates. Today, AI vendor diligence is the heavy lane. Procurement, security, and legal share the workload, and the legal team carries the AI-specific questions: what data does the vendor train on, what retention applies, what bias liability does the buyer inherit, and what indemnification covers AI-generated outputs.
The contract structure changes too. Standard MSA terms presume the vendor knows what its product does. Generative AI vendors face genuine uncertainty about model behavior, output ownership, and downstream third-party claims. The diligence questions follow the gap.
Courtney, a participant in the GC AI 101 class, demonstrated the vendor-RFP workflow with this prompt: "I asked it to provide 15 RFP questions to provide to CLM vendors and told it some of the functionality we were looking for." The platform produces the question set; the lawyer edits for fit. AI generates the comprehensive starting list, the lawyer applies judgment, the team standardizes the workflow.
AI-Asset Diligence Inside Target Companies
The third lane emerged recently and remains underdiscussed in mainstream M&A coverage. When a buyer acquires an AI-native company or a company with material AI products, the IP, model provenance, training data licensing, and bias-and-discrimination exposure travel with the acquisition.
Skadden's "M&A in the AI Era" lays out four categories: data rights and model training, compute costs and key personnel concentration, deal structures (earnouts, escrows) for AI assets, and indemnification for downstream regulatory or data claims.
Hunton Andrews Kurth's "IP Due Diligence Tips for AI Assets in M&A Transactions" walks the IP-side mechanics: identifying each AI asset in the target, verifying ownership of contributions from employees and third parties, evaluating open-source dependencies, and reading indemnification clauses for the AI-specific claims that did not exist in M&A templates two years ago.
A legal AI platform supports the lawyer running these questions. The platform reads the contracts, the IP assignments, the licensing schedules, and the data-rights documentation, and surfaces the gaps for the lawyer to investigate. The model evaluation work itself routes to the engineering team and outside specialists.
How AI Cuts In-House Diligence Cost and Time
The cost math is the reason in-house teams are moving diligence to AI. The 2024 ACC Law Department Management Benchmarking Report shows median legal departments spend $1.8 million annually on outside counsel; top-quartile departments spend $11.2 million or more. Around 87% of that external budget goes to law firms. M&A diligence is one of the largest consumers of that spend.
The time math is the other reason. A 2-to-5-lawyer in-house team that scales linearly with the data room is a fiction. A 200-document deal and a 2,000-document deal arrive on the same calendar. The General Counsel still owes the CEO a recommendation in 30 days. The classic response (hire outside counsel for full document review) protects the deal but blows the budget. The other classic response (have the in-house team read the data room directly) protects the budget but compresses sleep.
Vendor diligence has the same cost shape. A procurement team runs hundreds of vendor evaluations a year; legal review is the bottleneck. AI vendor evaluations carry higher legal complexity than the SaaS contracts of five years ago. The gap between procurement throughput and legal capacity is exactly where AI compresses the work.
A legal AI platform built for in-house teams reads the corpus at consistent depth, structures the output into memo-ready sections, and gives the lead lawyer a reviewable artifact to refine. GC AI customers running diligence on the platform identify it as a top three use case driving outside counsel spend reduction across the in-house workload (December 2025 ROI study).
The 5 Capabilities That Decide AI Due Diligence
Five capabilities decide whether a legal AI platform clears the in-house diligence bar:
Full data-room ingestion. Analyze the full corpus in one session, with no chunking workaround.
Citation-anchored extraction. Character-level pulls from the source document, with verbatim language attached.
Context-aware Q&A across the deal. Interchat memory scoped to the specific deal or vendor file.
Structured deliverables for business stakeholders. A board memo on demand, with clause extracts as evidence.
Audit trail and security. SOC 2 Type II, SOC 3, GDPR, zero data retention with the LLM providers, AES-256 encryption.
Test each shortlist candidate against all five before signing. Each capability below maps to a specific GC AI product surface.
Full Data-Room Ingestion
A real M&A data room runs from 200 to 5,000 documents. A real vendor diligence packet runs from 30 to 200 documents (DPA, MSA, SOC 2 report, security questionnaire, insurance certificates, sub-processor list, AI model documentation). The platform must ingest the full set in a single session.
GC AI's Files capability analyzes up to 1,500 pages at once. The diligence team uploads the data room, organizes documents by category, and runs prompts against the full collection without rebuilding context each chat.
Citation-Anchored Extraction
A board memo lives or dies by what the GC can defend. "The target has a change-of-control clause in its top customer contract" reads weak without the contract name, page, and exact language. Character-level citation closes that gap.
GC AI's Exact Quote feature pulls verbatim language with character-level citation against the uploaded documents. The lawyer reading the AI output sees the source string alongside the analysis and decides whether the claim holds.
Context-Aware Q&A Across the Target or Vendor
Diligence questions stack. A first pass surfaces the headline risk. The follow-up asks how the target indemnifies that risk, who signed the indemnification, and what the cap looks like. The platform has to remember the file set, the prior questions, and the user's working hypotheses across a multi-day workflow.
GC AI's Projects feature gives the diligence team interchat memory scoped to a specific deal or vendor file. The team comes back to the project tomorrow morning and the AI knows the contracts, the prior findings, and the open questions.
Structured Deliverables for Business Stakeholders
The output of diligence is a memo. The audience for that memo is the CEO, the CFO, the deal team, and the board. The output cannot read like a litigation brief. The platform either drafts business-stakeholder language or it does without.
Natalya Vasilchenko's prompt above captures the shape: a doctrinal pass for the lawyer's notes, a business-summary version for the deck. GC AI moves between those modes inside a single chat, and the lawyer edits the business summary instead of rewriting it from scratch.
Audit Trail and Security
Data rooms are confidential by NDA. Vendor diligence packets contain confidential security postures. AI-asset diligence inside a target reads the seller's core IP. The platform's security posture has to match the data class.
GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, with zero data retention agreements with OpenAI and Anthropic, and AES-256 encryption.
"GC AI has become a daily partner for our lean legal team. It gives us fast, reliable analysis across multiple jurisdictions and keeps us ahead of regulatory change. It's transformed how we operate." —Joys Choi, Senior Director, Legal at Tipalti
The AI Due Diligence Platform Landscape in 2026
Several categories of platforms touch in-house diligence work. Each fills a different layer of the stack. Some coexist, some compete head-to-head.
Category | Best fit |
|---|---|
In-house horizontal legal AI | The General Counsel's full workload, including diligence, contract review, research, and Word drafting |
Legacy clause-extraction | High-volume document extraction inside law-firm M&A practices |
Law-firm horizontal AI | AmLaw firm partners running deal teams; in-house extension launched 2026 |
Drafting-led AI | Word-native drafting workflows for both law firms and in-house |
AI-native VDRs | Workflow infrastructure for hosting and accessing the data room itself |
In-house horizontal: GC AI. Purpose-built for in-house counsel by a 3x former General Counsel, GC AI runs across the diligence workload (M&A, vendor, AI-asset) with the same engine that runs the rest of the in-house team's work: contract review, research, redlining, and Word drafting. The platform serves 1,600+ legal teams across 53 countries, including 80+ public companies and 25 unicorns. The trial structure runs 14 days free, with no credit card.
Legacy clause-extraction: Kira and Luminance. These platforms started in law-firm M&A practices, where the workflow centers on extracting clauses from large document sets at high volume. The technology predates generative AI and runs mature in the clause-extraction lane. In-house teams that already run a Kira workflow with their outside counsel sometimes coexist with GC AI rather than replace it: Kira sits with the law firm doing extraction, GC AI sits with the in-house team doing synthesis and the board memo.
Law-firm horizontal: Harvey. Harvey launched with law firms and built its product around large-firm workflows: Vault for diligence-scale document ingestion, Assistant for drafting, Knowledge for cross-domain research, Workflow Agents for custom automations. Harvey expanded into in-house in 2026. The product DNA is AmLaw, which carries through the pricing model, the training program, and the partner-and-associate adoption pattern. See the full breakdown in GC AI vs Harvey.
Drafting-led: Spellbook. Spellbook serves both law firms and in-house, with a Word-native drafting focus. The Benchmarks feature applies a proprietary contract dataset to market-standard analysis. Spellbook's diligence workflow exists as a secondary use case alongside the lead drafting workflow. See the full breakdown in GC AI vs Spellbook.
AI-native VDRs: Datasite and Intralinks. These are virtual data rooms with AI features bolted on for indexing, search, and lightweight summarization. Treat them as workflow infrastructure (the data room itself), and run the analysis in GC AI, Harvey, or Spellbook against documents hosted in Datasite or Intralinks.
How to Evaluate AI Due Diligence Software
Seven questions decide whether a legal AI platform fits in-house diligence work. Use them as a demo checklist. GC AI is purpose-built to handle every question on this list, and the framework works as a buyer template for any platform on your shortlist.
Does the Platform Cite from the Document, Character-Level, or Paraphrase?
Paraphrase reads fluent. Paraphrase also drifts. The board memo needs source-level citation the GC can defend in front of opposing counsel. Ask the trial team to show the citation behavior on a contract you already know. If the citation does not point to a character range inside the document, the platform is paraphrasing and the output cannot anchor a defensible diligence memo.
Can It Ingest a Full Data Room (1,000+ Documents) in One Session?
Some platforms cap at 50 documents per chat or 100 documents per project. That cap creates a non-starter for M&A diligence. The platform either ingests the full data room in a single session, or the diligence team rebuilds context each time they shift focus.
Does It Produce a Board-Ready Memo, or Stop at Clause Extracts?
Clause extraction is necessary. The deliverable is the memo to the CEO and the board. Test the platform on a real diligence prompt and ask for the business-summary output. If the platform returns a 30-page clause table and stops there, the GC writes the memo from scratch.
What Is the Data Retention Policy with the Underlying LLM Providers?
Data rooms are confidential by NDA. Ask the platform vendor to show their data retention agreements with the underlying LLM providers in writing. Zero-data-retention with OpenAI and Anthropic is the canonical answer for in-house diligence work. Anything weaker raises a flag for the security team.
Is It Built for the In-House GC's Workload, or Retrofitted from a Law-Firm Tool?
The in-house workload differs from the law-firm workload. Smaller teams. Tighter board deadlines. Memo-style deliverables. Platforms designed for law firms make the in-house team look like a small law firm. Platforms purpose-built for in-house make the team look like the strategic legal function the CEO needs.
How Does It Handle the AI-Asset DD Lane (Model Provenance, Training Data, Bias Liability)?
If the target company has material AI products, this lane carries deal-specific risk. The platform either reads the IP assignments, the licensing schedules, the open-source dependencies, and the indemnification clauses, or the diligence team carves out the AI-asset work to outside counsel.
What Is the Trial Structure?
Free, 14 days, no credit card sets the standard for in-house-friendly trials. Any platform that requires a sales call before access is signaling a procurement-heavy buying motion. For in-house teams that want to run a closed deal's data room through the platform during the trial, the 14-day, no-credit-card window is the threshold.
The Role of AI Education and Team Adoption
A platform without fluency stays shelfware. The in-house teams that get the strongest leverage from AI diligence are the teams that invest in working the prompts, building the playbooks, and standardizing the team's approach.
GC AI Classes are free, California CLE-eligible, and taught by former general counsels. More than 3,000 lawyers have completed the courses, with average instructor ratings of 4.7 to 4.9 stars. Diligence-heavy teams typically start with the 101 class and add the 201 once the team has the basics down.
101 Intro to AI Prompting (75 minutes, 1 CLE hour). The prompting frame the diligence team applies on day one.
201 Advanced (90 minutes, 1.25 CLE hours). Playbooks, advanced prompting patterns, and the workflow shape diligence-heavy teams use.
105 AI in Word. The Word Add-in for diligence work that lives in Microsoft Word.
106 Using Playbooks. Running pre-built and custom Playbooks during a diligence sprint.
107 Building Playbooks. Building team-specific Playbooks from your standard positions.
Pre-built Playbooks ship for NDAs, DPAs, MSAs for SaaS, and MSAs for commercial purchases. Diligence teams use these as starting points, then build custom Playbooks for the deal-specific questions that come up in a single transaction.
What In-House Teams Measure After Adopting AI for Due Diligence
The December 2025 GC AI ROI study of more than 100 active customers measured the impact across the in-house workload:
14 hours per week saved per lawyer
14% reduction in outside counsel spend
21% greater perceived accuracy than generalist AI on legal tasks
97.5% of teams see value before month one
Approximately $252,000 in annual savings for the median company
The dollar math: $252,000 = 14% × $1.8 million, the median outside counsel spend per the ACC report. For top-quartile departments at $11.2 million in outside counsel spend, the same 14% reduction lands closer to $1.5 million in annual savings. Run your team's own numbers through the GC AI ROI Calculator.
These are workload-level numbers, measured across the full in-house portfolio (contract review, research, diligence, redlining). The diligence-specific contribution sits inside that aggregate, with AI compressing the data-room read, the clause extraction, and the board-memo draft directly. Diligence teams report the time savings show up loudest in the M&A buy-side and AI-vendor lanes.
The qualitative measure that matters in the boardroom: the GC walks into the deal-team meeting with the memo done.
Start With One Deal That Matters
Pick a closed deal where you already have the memo your team produced. Drop the data room into GC AI. Run the same diligence prompts. Compare the AI's output against the memo. The gap is the time and cost the platform pays back on each future deal.
Frequently Asked Questions
What Is AI Due Diligence?
AI due diligence is the use of a legal AI platform to read all the documents in an M&A data room or vendor file at consistent depth, surface deviations from market and from internal standards, and produce a structured memo for board or executive review. The work covers buy-side M&A diligence, vendor diligence (including AI vendors), and AI-asset diligence inside target companies.
How Does AI Improve M&A Due Diligence?
AI compresses M&A due diligence by ingesting the full data room (1,500 pages or more in a single session), surfacing risk-bearing clauses with character-level citations, and drafting business-stakeholder summaries the deal team and board can read directly. In-house teams using GC AI for the in-house workload report 14 hours per week saved per lawyer, with diligence among the top three use cases driving the savings (December 2025 ROI study).
Can AI Handle Vendor Due Diligence and AI-Vendor Due Diligence?
Yes. AI handles standard vendor diligence (DPA, MSA, SOC 2, security questionnaire) and the AI-specific question set (model training data, retention, bias liability, indemnification scope). One participant in the GC AI 101 class generated 15 RFP questions for CLM vendor evaluation in a single prompt. The same workflow scales to AI vendor diligence with prompts tuned for AI-specific risk.
How Does AI Due Diligence Handle Privilege and Confidentiality?
The AI due diligence platform's data-handling posture has to match the data class. GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, with zero data retention agreements with OpenAI and Anthropic, and AES-256 encryption. The data room and vendor packets sit inside that posture, and no inputs train the underlying LLMs.
What Does AI Due Diligence Software Cost?
Pricing varies by platform. GC AI publishes a 14-day free trial with no credit card and a transparent starting price. Harvey, Spellbook, and the legacy clause-extraction tools have varying pricing models, with several requiring a sales call before access.
How Accurate Is AI for Due Diligence Work?
Accuracy depends on the platform and the prompts. The December 2025 ROI study of GC AI customers reported 21% greater perceived accuracy than generalist AI on legal tasks, with 97.5% of teams seeing value before month one. Citation-anchored extraction (character-level pulls from the source documents) gives the buyer a check on accuracy: if the platform points to the source string, the lawyer can verify each claim.
Can AI Replace Outside Counsel for M&A Due Diligence?
No. AI compresses the high-volume work (data-room reading, clause extraction, first-draft memo writing) that previously absorbed outside counsel hours. The lawyer still owns the recommendation, novel or precedent-setting risk still routes to outside counsel, and deal-killer judgment calls stay with the in-house GC. The 14% reduction in outside counsel spend across the in-house workload (December 2025 ROI study) measures the compression around full replacement.
Who Provides AI-Powered Due Diligence Platforms?
GC AI is purpose-built for in-house counsel and runs across M&A, vendor, and AI-asset diligence on the same engine. Harvey launched with law firms and added an in-house extension in 2026. Spellbook serves both law firms and in-house with a Word-native drafting focus. Kira (Litera) and Luminance run high-volume clause extraction inside law-firm M&A practices. Datasite and Intralinks provide AI-native virtual data rooms as the workflow infrastructure layer.
