Financial due diligence is a CA assignment where someone else’s deal sets the deadline. The data room opens late, ledgers arrive in three formats, and the buyer wants a quality-of-earnings view before the term sheet goes stale. Firms increasingly ask me whether AI can read the data room, find the adjustments and draft the report.
My answer, as a chartered accountant with a Big 4 background who now builds AI workflows for finance teams, is that AI can take a real share of the reading and sorting. It cannot own the numbers that change the price. Below: where the line sits, the confidentiality rules that apply before any upload, and a rubric for deciding, task by task, what a tool may do.
What AI is genuinely good at in a diligence file
Most diligence hours go into finding, sorting and reconciling, not concluding. That is where AI helps:
- Data-room triage. Indexing documents against the information request list and flagging what is missing, so gaps are chased in week one.
- Ledger analytics. Flagging large, unusual or round-sum entries and year-end reversals as candidates for normalisation, not conclusions.
- Contract extraction. Pulling change-of-control clauses, guarantees and termination rights from key agreements into one schedule.
- Reconciliations. Tying the trial balance to audited accounts and GST returns to revenue, with every difference listed for a person to explain.
- First drafts. Draft narrative and a running question list for management, from reviewed schedules.
Each produces a list for a person to work through: the tool narrows the haystack; the reviewer decides what is a needle.
What must stay with the CA
Whatever moves the price or the sale and purchase agreement is judgement, and I would not delegate it:
- Quality-of-earnings adjustments. Whether an item is truly non-recurring depends on facts the ledger does not hold.
- Net debt and debt-like items. Deferred consideration, unpaid statutory dues and disputed liabilities need a view on substance, not a keyword match.
- Normalised working capital and tax exposures. Seasonality and pending GST or income-tax matters need management conversations and professional assessment.
- The conclusions and the signature. Whoever signs owns every number, including those a tool proposed.
The NIST Generative AI Profile names “confabulation”, confidently stated false content, as a core risk of generative AI. In diligence that is a plausible clause summary of a contract that says something else. Every extracted figure should trace to a page reference a reviewer has opened.
Confidentiality comes before the first upload
Diligence information arrives under a non-disclosure agreement. Before choosing a tool, settle three questions.
Does the NDA allow it? Many NDAs limit disclosure to named advisers. Check whether a third-party AI service fits the permitted use; ask the counterparty if unclear. Use only business plans whose terms you have read; OpenAI’s enterprise privacy page and Microsoft’s Copilot privacy documentation set out training, retention and access commitments for their business products. Consumer accounts are out.
Is the target listed? If so, much of what you see may be unpublished price sensitive information. Under the SEBI (Prohibition of Insider Trading) Regulations, 2015, regulation 3(3) allows UPSI to be shared for certain transactions, regulation 3(4) requires the parties to sign confidentiality and non-disclosure agreements, and regulation 3(5) requires a structured digital database recording who UPSI was shared with, maintained internally with time stamps and audit trails. Before any UPSI goes into an AI tool, ask counsel how the tool fits that framework.
Is there personal data? Payroll files, employee lists and promoter KYC are personal data under the Digital Personal Data Protection Act, 2023. Mask what the analysis does not need; my DPDP Act and AI client-data rubric for CA firms covers the steps.
If your firm is a SEBI-registered intermediary, such as a merchant banker, note that the SEBI (Intermediaries) (Amendment) Regulations, 2025 make a regulated person solely responsible for data privacy, for the output of AI tools it relies on and for legal compliance, whether the tool is built in-house or bought. SEBI’s June 2025 consultation paper on responsible AI/ML usage proposes model governance, testing and data privacy principles.
A decision rubric for AI in financial due diligence
Before each engagement, agree the AI role, review gate and stop condition for every workstream. The NIST AI Risk Management Framework organises this as govern, map, measure and manage; the rubric is the “map” step for a single deal.
| Diligence workstream | AI role | Minimum review gate | Stop if |
|---|---|---|---|
| Data-room indexing and gap list | Automate | Associate checks the gap list against the request list | Tool cannot see all folders, or the NDA bars third-party processing |
| General ledger scan for unusual entries | Automate | Senior reviews every flagged entry before it becomes an adjustment | Ledger export incomplete or not tied to the trial balance |
| Contract clause extraction | Assist | Each clause checked against the page reference | Summaries without page references |
| Trial balance, GST and TDS reconciliations | Assist | Every difference explained by a person, with evidence | Differences closed by the tool without explanation |
| Quality-of-earnings adjustments | Human only; AI may list candidates | Engagement lead decides and documents each adjustment | Any adjustment proposed and accepted without management discussion |
| Net debt, debt-like items and working capital | Human only | Engagement lead and partner | Classification driven by keywords alone |
| Tax exposure assessment | Human only | Tax specialist assesses likelihood and amount | Exposure amounts taken from a model summary |
| Report narrative | Assist (first draft) | Partner reviews every number against schedules | Draft issued before schedules are final |
| UPSI or personal data of a listed target | Stop until cleared | Counsel and partner approve the approach for the deal | No confidentiality agreement or structured digital database entry |
What decides the role is how directly the output feeds the price and how sensitive the input is. Model quality is secondary.
Where this fits in a CA practice
Diligence is a good place to prove AI value: heavy reading, fixed timetable. Run the first engagement in parallel with the usual process, as in the 90-day AI pilot playbook for CA firms, and apply the review gates in the AI controls checklist for CA firms. The ledger-scanning approach overlaps with AI for audit working papers; reuse what your audit team has validated.
For the wider map, start at the AI for chartered accountants in India hub. To score your own opportunities, take the free AI Opportunity Scorecard, see the scoped AI Opportunity Audit, or book a discovery call.
Monday-morning checklist
- Pull your standard information request list and mark each line automate, assist or human only, using the rubric above.
- Read the NDA template you sign most often and note whether third-party processing by an AI service is permitted.
- Confirm the firm has a business plan for its AI tool, with training and retention terms filed by a partner.
- Write a one-line rule: no UPSI from a listed target goes into any tool until counsel has cleared the approach for that deal.
- Require a page reference against every figure a tool extracts, and spot-check them before review.
- Name the reviewer for quality-of-earnings, net debt and tax exposures on the next mandate.
Frequently asked questions
Can AI do financial due diligence in India?
AI can index the data room, scan ledgers, extract contract clauses, run reconciliations and draft narrative. Quality-of-earnings adjustments, net debt, tax exposures and the conclusions need a qualified professional who reviews the evidence and signs the report.
Is it safe to upload data-room documents to ChatGPT or Copilot?
Only if the NDA permits it, the firm uses a business plan whose data terms have been read, personal data is masked and access is limited to the deal team. Consumer accounts should not be used for diligence files.
Does SEBI regulate AI use in due diligence on listed companies?
The SEBI insider trading regulations govern how UPSI is shared, including confidentiality agreements and a structured digital database. SEBI-regulated intermediaries are also solely responsible for the output of AI tools they rely on. Take legal advice on the specific deal.
Sources
- NIST AI Risk Management Framework
- NIST AI 600-1 — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- SEBI — (Prohibition of Insider Trading) Regulations, 2015 [last amended on 12 March 2025]
- SEBI — (Intermediaries) (Amendment) Regulations, 2025: responsibility for the use of AI (Gazette, 6 February 2025)
- SEBI — Consultation paper on guidelines for responsible usage of AI/ML in Indian securities markets (20 June 2025)
- Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)
- OpenAI — Enterprise privacy
- Microsoft Learn — Data, privacy and security for Microsoft 365 Copilot
Disclaimer: this article is general educational commentary from implementation work. It is not legal, tax, audit, securities-law, valuation or investment advice, and it does not create an adviser–client relationship. SEBI regulations, the DPDP Act and vendor terms change; verify primary sources and take professional advice on your specific transaction before acting.