The due diligence exercise has long been the backbone of every Mergers & Acquisitions (“M&A”) transaction. It is the process through which a buyer identifies, assesses, and quantifies risk in a target company before committing capital. In India, this has traditionally been a labour-intensive review of contracts, financial statements, regulatory filings, and corporate records, conducted manually over several weeks.

That paradigm is shifting. Artificial intelligence (“AI”) and advanced data analytics are now being deployed across the due diligence lifecycle, enabling practitioners to process entire data rooms in hours rather than weeks, surface risks that manual sampling might miss, and produce insights that feed directly into deal structuring and negotiation.

The Traditional Model and Its Gaps

In a conventional transaction, legal due diligence involves the review of a target’s constitutional documents, material contracts, employment records, intellectual property portfolio, litigation history, regulatory compliance, and property documentation. The process is scoped based on deal size, sector, and the buyer’s risk appetite, with reliance placed on sample-based review of documents provided in a virtual data room. The limitations are well known. When a target has thousands of contracts across multiple jurisdictions, a manual review inevitably covers only a representative sample. Change-of-control clauses, assignment restrictions, and termination rights can be missed if they reside in contracts that fall outside the reviewed sample. Employment and labour law compliance across states, each with its own Shops and Establishments legislation, Professional Tax regime, and labour welfare fund requirements, which are difficult to verify comprehensively. Traditional due diligence, while indispensable, is inherently incomplete. This is the gap that AI and data analytics are increasingly closing.

AI-Powered Contract Analysis and Regulatory Mapping

Natural language processing models (“NLP”) can now classify, extract, and analyse contractual provisions across an entire data room. Rather than reviewing 10% of a target’s 5,000 customer contracts, an AI platform can scan all 5,000 in hours, flagging every contract that contains a change-of-control clause, identify termination-for-convenience rights, and highlighting inconsistent limitation-of-liability provisions, etc. Models trained on Indian legal documents can recognize patterns specific to the Indian regulatory context, such as stamp duty implications under the Indian Stamp Act, 1899, or the presence of arbitration clauses referring to the Arbitration and Conciliation Act, 1996.

The practical significance is immediate. A buyer evaluating a target in a regulated sector can use AI to cross-reference the target’s shareholding pattern against the RBI’s Foreign Exchange Management (Non-Debt Instruments) Rules, 2019, flagging potential sectoral cap breaches or downstream investment concerns. For listed entities, compliance mapping extends to Securities and Exchange Board of India (Listing Obligations. and Disclosure Requirements) Regulations, 2015,and the Securities and Exchange Board of India (Substantial Acquisition of Shares and Takeovers) Regulations, 2011. On the financial side, analytics platforms can ingest ledgers and statutory filings to perform anomaly detection, particularly relevant for GST compliance, where mismatched input tax credit claims between GSTR-2A/2B and GSTR-3B filings under the Central Goods and Services Tax Act, 2017, can expose the target to significant revenue demands.

Litigation, IP, and Data Privacy Diligence

AI tools are particularly effective in litigation diligence. By aggregating case data from the Supreme Court, High Courts, NCLT, NCLAT, and tribunals, analytics platforms can map a target’s litigation footprint, identify recurring counterparties, and assess the financial exposure of pending claims. For IP portfolios, automated cross-referencing between the IP Registry and the target’s internal records can identify gaps between registered and actual ownership which are critical under the Trade Marks Act, 1999, the Designs Act, 2000, and the Patents Act, 1970.

Data privacy diligence has acquired new urgency with the Digital Personal Data Protection Act, 2023. The Act imposes obligations on data fiduciaries regarding consent, purpose limitation, and cross-border transfers, with penalties for non-compliance reaching up to ₹250 crore. AI-enabled diligence can scan the target’s privacy policies, consent mechanisms, and vendor contracts to assess compliance posture, a task that would be impractical to perform manually at scale.

The Legal and Regulatory Framework Governing AI-Enabled Diligence

The use of AI in due diligence does not operate in a legal vacuum. The Digital Personal Data Protection Act, 2023 governs the processing of personal data, including data accessed during due diligence. Where a target’s data room contains personal data of employees, customers, or vendors, the acquiring party must ensure that access and processing comply with the consent and purpose-limitation requirements of the Act. The Competition Act, 2002 is relevant where diligence involves commercially sensitive information. Section 3 prohibits anti-competitive agreements, and the CCI has consistently scrutinised gun-jumping and information exchange in M&A contexts. Confidentiality obligations under the transaction’s non-disclosure agreement, and the broader duty of professional secrecy, remain paramount. The Information Technology Act, 2000, and the rules thereunder, impose reasonable security practices obligations on entities handling sensitive data. The proposed Digital India Act is expected to further regulate AI and emerging technologies.

Limitations and the Role of Human Judgement

AI tools are powerful but not infallible. NLP models can misclassify provisions, particularly in contracts with non-standard drafting or ambiguous language. Analytics platforms are only as reliable as the data they process, incomplete data rooms produce incomplete results. Hallucination, where an AI system generates plausible but incorrect output, remains a documented risk. The most significant limitation is that AI cannot exercise legal judgement. Identifying a change-of-control clause is a mechanical task; assessing its commercial significance in the context of the transaction, the buyer’s strategy, and the regulatory environment requires a lawyer’s expertise. The evidentiary value of AI-generated diligence reports must also be assessed under the Bharatiya Sakshya Adhiniyam, 2023, which governs the admissibility of electronic evidence, including the requirements of Section 65B for electronic records.

Conclusion

AI and data analytics are not replacing the legal judgement that lies at the heart of due diligence. They are expanding the evidentiary base on which that judgement operates, enabling practitioners to review more documents, identify more risks, and provide more informed advice in less time and with greater confidence. The technology must, however, be deployed within the boundaries set by data protection law, competition law, confidentiality obligations, and the fundamental requirement of human legal judgement. The future of due diligence is not man versus machine, it is the disciplined integration of both. As deal complexity grows and regulatory scrutiny intensifies, the firms that master this integration will be best positioned to guide clients through the transactions of tomorrow.’=

Disclaimer: This update is meant for general information and shall not be deemed to be legal advice or a legal opinion. Please reach out to our Private Equity and Mergers & Acquisitions practice group if you require specific advisory assistance regarding your investment portfolios.

Due Diligence in the Digital Age: How Artificial Intelligence and Data Analytics Are Transforming M&A Evaluations and Risk Assessments