In the fast-paced world of mergers and acquisitions (M&A), there is a growing need to accelerate each stage of the process while ensuring rigor and accuracy. Artificial intelligence (AI) is emerging as a powerful tool to transform IT due diligence by automating document analysis, rapidly identifying risks, and generating sharper, more objective insights. But how far can AI go? What are the real benefits and the limitations to consider? This article explores whether AI could accelerate IT due diligence by exploring its legal and compliance implications and sharing key insights from testing Copilot Studio.
A key element of a successful M&A begins in the early stages, during the IT due diligence phase. It involves a comprehensive evaluation of a company’s entire IT landscape. This includes assessing the CIO organization, cybersecurity measures, governance structures, applications, and infrastructure. Conducting a thorough IT due diligence is critical to determine the fair value of a company and avoid potential risks in an M&A deal.
Today’s IT due diligence faces multiple challenges, including:
- Large volume and variety of data
- Tight time constraints
- Sensitive and confidential data
- Lack of employee awareness limiting collaboration
- Strong regulation and compliance need
One promising solution to address these challenges is the integration of artificial intelligence (AI). AI enhances both the accuracy of data analysis and the generation of valuable insights, enabling stakeholders to efficiently analyze large datasets, make informed decisions and mitigate risks.
Legal and Compliance Considerations for AI in IT Due Diligence
Questions surrounding the legality and contractual permissibility of using AI in these processes must be addressed to ensure that AI adoption aligns with both regulatory requirements and contractual agreements.
The legal landscape for AI is rapidly evolving, with various regulations impacting its use in IT due diligence. Adoption of AI-related laws varies significantly across the world. Some countries have already implemented specific legislation governing the use of AI, while others are still in the process of developing such laws. Additionally, many regions rely on existing regulations, which have been updated to address the challenges presented by AI. This creates a complex and varied legal environment for businesses seeking to leverage AI in their IT due diligence processes.
In this article, we will focus on the European Union (EU) and the regulations that govern AI within this region.
Several key EU laws and guidelines shape the use of AI in IT due diligence. These include the Ethics Guidelines for Trustworthy AI, the AI Liability Directive, the AI Act, and the Directive on Liability for Defective Products.
- The Ethics Guidelines for Trustworthy AI provide expectations regarding the design and deployment of AI systems. These guidelines are non-binding and do not carry formal penalties, but they shape best practices in the AI industry.
- The AI Liability Directive creates potential risks for litigation in the event of errors or omissions by AI systems, although its impact is currently theoretical since the directive has not yet been officially adopted.
- The AI Act, which represents Europe’s first regulatory framework for AI development, deployment, and usage, has limited impact on IT due diligence. The Act aims to ensure that AI systems within the EU are safe, transparent, human-supervised, and compliant with fundamental rights, imposing strict requirements mostly on high-risk AI systems. As AI used in IT due diligence does not fall under the high-risk category, it only requires the mention of AI usage.
- The Directive on Liability for Defective Products inflicts strict liability for damages caused by defective products, which could complicate the use of AI in IT due diligence. If errors occur in AI-driven data analysis, companies may face legal liabilities. To avoid costly errors and penalties, businesses must ensure their AI systems are reliable.
Given that AI applied to IT due diligence primarily handles business data, which is non-personal, the General Data Protection Regulation (GDPR) does not directly impact its use.
While the regulatory environment provides a framework for the use of AI, it is equally important to consider the contractual implications before implementing AI in IT due diligence. In M&A transactions, confidentiality agreements are commonly signed, often with strict clauses that prohibit the use of external tools. As a result, AI tools can only be employed if explicitly authorized by the involved parties.
Testing AI in IT Due Diligence: Insights from Copilot Studio
One of the AI solutions currently on the market could accelerate IT due diligence for use cases such as document synthesis, image analysis, and framework generation. Having explored the legal and contractual implications of using AI in IT due diligence, we tested Copilot Studio, a Software as a Service (SaaS) platform developed by Microsoft. Designed for building custom AI conversational agents or enhancing existing Copilot solutions for M365, Sales, Finance, and Services, Copilot Studio offers a low-code interface that enables users to create, deploy, analyze, and manage AI agents in one place. This approach combines the flexibility of custom development with the efficiency of a ready-made solution.
By connecting our co-pilot to a project’s SharePoint site, AI prompts can be sourced directly from relevant project information. Copilot Studio ensures data confidentiality by authenticating users before granting access to the co-pilot, safeguarding sensitive content. This makes document summarization and image analysis more seamless than ever.
Users simply enter a file name and specify an action, much like a secure version of ChatGPT. With minimal low-code development, document summaries can be further refined. For instance, specific phrases like “summarize this document” or “synthesize that” can trigger an automated workflow, prompting the user to choose between a brief or detailed summary. Based on the selected preference and knowledge source – such as the project’s SharePoint – the AI quickly generates a tailored summary in seconds.
Beyond text-based summaries, Copilot Studio can accelerate image description and analysis. With the Prompt by AI Builder feature, users can input not only text but also files and images, expanding the range of AI-powered insights. For more precise and customized results, adjusting the temperature parameter is key. This setting balances creativity and accuracy in AI responses:
- Low temperature (close to 0) ensures reliable, accurate, and consistent outputs, making it ideal for tasks that require precision, such as data analysis.
- High temperature (close to 1) generates more diverse and creative responses, making it better suited for tasks that involve interpretation or descriptions.
A recent update to Copilot Studio now allows users to import images directly into chatbot conversations, making interactions more intuitive while reducing the need for additional development effort.
Moreover, with the integration of Generative AI (GenAI), users can now generate frameworks using project-specific information. Preferences can be directly incorporated into prompts using adaptive cards, allowing for more personalized interactions. The AI then delivers a tailored response by leveraging a specific knowledge source, such as the project’s SharePoint. However, direct integration with Word or PowerPoint is not yet available.
The Future of AI in IT Due Diligence
Copilot Studio demonstrates strong potential for accelerating IT due diligence by streamlining workflows and enhancing AI-driven insights. However, to maximize its impact, further development and integration with existing enterprise tools will be essential. As AI continues to evolve, refining its capabilities within the IT due diligence process could significantly enhance efficiency and help clients with their decision-making.
But let’s not forget that Copilot Studio is just one example of the many AI tools available to accelerate IT due diligence. In recent years, startups have been developing AI-driven solutions specifically designed for due diligence processes, addressing unique business needs. While many of these solutions are focused on legal due diligence, a growing number are also tailored to IT due diligence.
