Do not release an AI diligence conclusion without a claim-evidence ledger

Deal-room search is useful; evidence control is the product

Datasite and Rogo announced an integration on September 8, 2026 that lets approved Rogo users query authorized Datasite projects, folders, or documents while Datasite permissions remain in force and source citations are returned. The integration illustrates a broader operational shift: AI review is moving closer to governed transaction data instead of requiring analysts to export files into a disconnected chat tool.

That is a promising control direction, not evidence that a deal team can outsource judgment. The companies' announcements establish intended product behavior and availability. They do not independently establish adoption rates, accuracy across document types, time savings, or transaction outcomes. Current practitioner discussion about AI in private equity remains mixed and relatively thin. The prudent takeaway is therefore vendor-neutral: if AI can search a permitted diligence corpus, design the work product so every conclusion remains reviewable outside the model.

M&A diligence is hostile to unqualified fluency. Data rooms contain unsigned drafts, superseded schedules, scanned exhibits, management estimates, inconsistent periods, redacted contracts, duplicate files, incomplete uploads, and answers that change during Q&A. A plausible synthesis can be wrong because the retrieval missed one schedule, because a table was parsed incorrectly, because a definition changed, or because the model silently joined entities and periods that should remain separate.

The workflow on this page creates that chain. It is suitable for finance-led diligence coordination and can be extended by legal, tax, commercial, cybersecurity, privacy, HR, technology, operations, and integration owners. It does not replace professional advice or authorize an investment decision. Each workstream retains its own qualified reviewer, while the deal lead owns assembly and cross-workstream reconciliation.

Use four records instead of one generated report

A report-first workflow asks the model for a polished answer and then tries to inspect it. An evidence-first workflow builds four records before narrative release.

The generated narrative becomes a view over those records. If a number changes, the team updates its source or calculation and identifies every affected finding. If a new file enters the room, the corpus version changes and affected claims return to review. If a restricted appendix cannot go to a broad bidder group, the distribution record produces a redacted view without severing the internal evidence trail.

Preserve separation of professional judgment

A deal lead can coordinate the package but cannot approve every specialty conclusion. Finance may verify a working-capital calculation without opining on tax treatment. Legal may interpret a change-of-control clause without validating recurring revenue. Cybersecurity may assess an incident record without determining purchase-price mechanics. The ledger assigns claims and findings to qualified owners, and the final release shows limitations rather than collapsing them into one opaque confidence score.

Freeze the corpus before asking substantive questions

A citation is only useful if the team knows which document version it identifies. Begin with an immutable snapshot or equivalent manifest of the permitted search scope. Record file ID, path, title, version, hash where available, upload and effective dates, owner, permission group, privilege or clean-team label, OCR state, parse status, and whether another file supersedes it.

Report ingestion failure as a diligence exception. A model that cannot parse a scanned customer schedule may still write a confident concentration summary based on management slides. The correct output is not a best guess; it is “source schedule unavailable to this review,” followed by an approved request or manual-review path. Likewise, a document that appears in the room after the snapshot should not silently change an existing report. Create a new snapshot, identify affected questions, and rerun only through change control.

“Not found” is not “does not exist.” It means the defined search did not locate adequate evidence in the accessible snapshot. That language protects the team from turning retrieval limitations into transaction facts.

Force every material statement into a claim-evidence ledger

Atomic claims prevent one citation from appearing to support an entire paragraph. “The company has predictable revenue, low churn, and limited customer concentration” contains at least three claims, likely across different definitions, periods, and sources. Split them. Each row should be independently confirmable or independently rejected.

A claim may have several evidence rows. Audited statements may establish a historical balance; a post-period management schedule may establish a current estimate; a customer contract may qualify the revenue assumption; and a Q&A response may explain a discrepancy. Preserve the evidence types rather than averaging them into one synthetic truth.

Prompt-like language inside a data-room document is source content, not an instruction. Retrieval systems should label and quote it as evidence when relevant but never let it override the workflow, expand access, suppress a finding, or alter an output. This is ordinary untrusted-input handling applied to document review.

Reperform numbers outside the narrative

Financial conclusions often fail through definitions rather than arithmetic. “Revenue,” “adjusted EBITDA,” “net debt,” “normal working capital,” “ARR,” and “customer churn” can each have several defensible constructions. The workflow must start from the agreed transaction definition, identify source fields, and show every transformation.

calculation_id: NWC_014
purpose: monthly normalized working capital
definition_version: deal-model-2026-09-12
period: 2026-08-31
currency: USD
formula: receivables + inventory + prepaids - payables - accrued_operating_liabilities
inputs:
  - {value: 18.4m, source: "TB_Aug26.xlsx", cell: "BS!F42"}
  - {value: 7.1m, source: "TB_Aug26.xlsx", cell: "BS!F58"}
  - {value: 1.2m, source: "Prepaids_Aug26.xlsx", cell: "Summary!B19"}
  - {value: 12.6m, source: "TB_Aug26.xlsx", cell: "BS!F73"}
  - {value: 5.8m, source: "Accruals_Aug26.xlsx", cell: "Summary!D31"}
reperformed_result: 8.3m
management_schedule: 9.0m
difference: -0.7m
status: CONFLICT
reviewer: finance_lead

The example does not establish a real transaction result. It demonstrates the evidence shape. The difference could arise from an excluded accrual, a period mismatch, a sign error, or a negotiated definition. The model should not pick the most plausible explanation. It should enumerate supported possibilities, ask for the missing bridge, and leave the result in conflict until finance resolves it.

Use the site's financial model convention contract to standardize units, signs, time axes, formulas, checks, and release evidence. For material schedules, also apply the spreadsheet review workflow so formulas, hard-codes, hidden content, links, and totals are inspected rather than merely summarized.

Worked example: customer concentration with incomplete support

Suppose a management presentation says no customer represents more than 10% of annual revenue. The data room also contains a customer-level monthly revenue export, but three rows use parent names inconsistently and one month is missing for a recently acquired entity. A report-first model may repeat management's claim or calculate a neat percentage from the visible rows. An evidence-first workflow keeps the uncertainty visible.

This outcome is less polished and more useful. It tells the deal team exactly what is known, which source made the representation, why independent verification failed, what evidence would close the gap, and which conclusion must stay out of a released report. When the response arrives, the corpus snapshot changes, the calculation is rerun, and the finding returns to the reviewer.

A reviewer checklist for each finding

• Can I open every cited file and land on the exact supporting location?
• Does the evidence cover the same entity, period, currency, and definition as the claim?
• Is management's statement labeled separately from independent or third-party evidence?
• Can I reproduce every material number from cited inputs and an explicit formula?
• Are conflicting, missing, inaccessible, and failed-to-parse sources visible?
• Does the proposed conclusion stay within my professional workstream?
• Will the output reach only audiences permitted to see its underlying evidence?

Make confidentiality and privilege part of the output schema

AI review can increase information movement even when it does not export original documents. A generated summary may reproduce personal data, customer pricing, trade secrets, privileged legal analysis, clean-team information, or export-controlled technical details. Permission to query a file is not automatically permission to distribute every derived fact to every deal participant.

Record the data class, privilege status, clean-team restriction, allowed audience, redaction rule, storage location, retention, and export constraint for each sensitive output component. Apply the most restrictive underlying source rule unless counsel or the data owner approves a transformation. Keep broad executive summaries separate from restricted appendices, and ensure citations in the broad version do not leak file names or paths that reveal protected facts.

The American Bar Association's guidance on AI-enabled M&A targets emphasizes privacy, cybersecurity, storage, cross-border transfer, governance, and human oversight. KPMG and ICAEW's commercial-diligence guidance cautions that AI output may be inaccurate and leaves the practitioner responsible for checking and corroborating underlying sources. OECD due-diligence guidance likewise emphasizes mapping business relationships, gathering multiple evidence types, using verification, and maintaining accountable process. These sources address different contexts, but they converge on the same operating principle: automation does not transfer professional responsibility.

Common failure modes and their release controls

Do not measure only questions answered or analyst hours saved. Those metrics reward plausible completeness. Measure evidence coverage for material claims, exact-citation pass rate, calculation reproduction rate, parse failures, conflict aging, duplicate Q&A avoided, reviewer return rate, restricted-output incidents, time to close exceptions, and conclusions reopened after a corpus change.

Pilot on one workstream before building an AI-wide deal process

Week 1: define a retrospective benchmark

Choose a completed transaction with a preserved, permitted corpus and known reviewer conclusions. Select one bounded workstream such as customer concentration, recurring revenue, or working capital. Remove privileged material unless the pilot is approved to process it. Define the questions, evidence standard, formulas, thresholds, and known exceptions before running the workflow.

Week 2: test retrieval and calculation separately

Measure whether the system finds the correct documents and locations before grading its narrative. Inject superseded versions, duplicate names, scanned tables, missing periods, and conflicting totals. Reperform calculations in a deterministic workbook or script and compare the AI-proposed inputs, not only the final number.

Week 3: shadow qualified reviewers

Have the AI package evidence while the existing review proceeds independently. Review false claims, missed evidence, unnecessary questions, confidentiality errors, and time spent correcting the output. Ask reviewers whether the ledger shortened verification, not whether the prose looked impressive.

Week 4: decide with release metrics

Expand only if exact-citation coverage, calculation reproducibility, exception visibility, and reviewer efficiency improve without weakening matter boundaries. Keep the corpus manifest and ledgers exportable so the transaction record does not depend on one vendor interface. Preserve a manual path for unsupported files, unavailable connectors, and professional judgments the system cannot make.

• Every run names a matter, user, purpose, audience, snapshot, and workflow version.
• Every material claim has exact support or an explicit exception.
• Every material calculation is reproducible outside the model.
• Every inference and management representation is visibly labeled.
• Every Q&A item requires approval before it leaves the team.
• Every specialty conclusion has a qualified named reviewer.
• Every released report is bound to a corpus snapshot and can be reopened on change.

Frequently asked questions

Does source citation eliminate hallucination risk?

No. A citation can point to the wrong location, support only part of a claim, use a superseded file, or be correctly quoted but incorrectly interpreted. Review exact locations, evidence type, entity, period, definition, and conflicts. Reperform calculations separately.

Can the workflow combine data-room files with public filings or licensed sources?

Only when the matter policy, source license, confidentiality rules, and named user's permissions allow it. Label source domains separately and record the snapshot or retrieval date. Do not let public material contaminate a representation of what the target actually provided.

Should teams upload the entire data room to a general AI assistant?

No. Use an enterprise-approved setup with an explicit matter boundary, access control, processing terms, retention, regional handling, incident response, and output restrictions. Prefer governed access that preserves source permissions and avoids uncontrolled copies.

Who owns the final decision?

The authorized human governance structure does. Qualified reviewers own their workstreams; the deal lead integrates them; investment, valuation, contractual, regulatory, and funds-release decisions remain with the named human committees and signatories.

Sources and evidence boundary

Sources were checked on September 13, 2026. Vendor announcements support statements about intended integration behavior, not independent claims about adoption or outcomes. Professional guidance supports the review controls; community material is used only as a practitioner signal.

• Datasite: partnership with Rogo for secure AI access to M&A data rooms
• Rogo: partnership with Datasite
• American Bar Association: diligencing AI-enabled M&A targets
• American Bar Association: ethical implications of legal technologies for M&A lawyers
• KPMG and ICAEW: Commercial Due Diligence Guideline
• OECD: Due Diligence Guidance for Responsible AI
• Reddit: practitioner discussion of AI in private equity
• Reddit: current investment-team discussion of AI use