Unauthorised AI in due diligence: how to limit its use
Employees paste transaction documents into public AI tools because, under time pressure, they have no quick and secure alternative. A more effective solution than a ban is access to AI operating within a virtual data room (VDR), where the document never leaves the controlled environment. Pasting a contract into a public chat just once may be enough to breach a confidentiality clause.
What is unauthorised AI and how common is it in M&A transactions?
Unauthorised AI (also known as ‘shadow AI’) refers to the use of artificial intelligence tools without the knowledge or control of a company’s security department. In due diligence, this usually takes the following form: an analyst pastes a section of a contract into a public chat to find a specific clause more quickly, without asking anyone for permission. Teams rarely receive formal authorisation for such actions, yet they still occur.
According to the SS&C Intralinks and Reuters Events report (H2 2026 Global M&A Dealmakers Sentiment Report, June 2026), based on a survey of over 400 M&A specialists worldwide, 81 per cent of dealmakers use integrated AI at all stages of a transaction. Among those using AI, 54 per cent see the greatest value in products designed for the financial sector. Only 21 per cent of respondents use general-purpose language models with minimal or no customisation.
The report does not directly measure what proportion of this usage is unauthorised. However, it shows that some teams work with general-purpose tools, and a document sent to such a tool may slip beyond the company’s control. The scale of the risk is illustrated by the study AI in Dealmaking: A Benchmark Study (SS&C Intralinks and Reuters, Q1 2026): 80 per cent of dealmakers have experienced incidents or near-incidents related to security or the accuracy of AI in the last 12 months.
Why do employees upload documents to a public AI, and what risks does this pose?
The main reason is time pressure. The team has to find information amongst hundreds of pages of contracts, reports and appendices, often within a matter of days. A public chat provides a response in a matter of seconds, whereas raising a request with the IT department takes longer. Added to this is a lack of knowledge, as it is rare for anyone to explain to the team what risks are involved.
Transactional documentation usually contains:
the company’s financial data,
contracts with customers and suppliers,
employees’ personal data and salaries,
information on intellectual property,
strategic plans.
Once such a document has been uploaded to a publicly accessible tool, the user usually has no control over where the data is processed, how long it is stored, or whether it will be used for further model training. This can result in a breach of confidentiality clauses and, in the case of personal data, also of the GDPR.
Does banning the use of AI solve the problem?
Rarely, as time pressure remains. A more effective solution is a tool that is just as fast as a public chat but operates within a controlled environment. The user asks a question directly within the data room, and the response is generated on the spot, whilst adhering to the access permissions previously assigned. The file is neither downloaded nor transferred to an external tool.
DealDone is developing SECUDO VDR in this direction: the anonymisation of sensitive data and the translation of documents take place within SECUDO VDR itself, rather than in separate tools to which confidential documentation would otherwise have to be transferred. Data is stored in an ISO 27001-certified data centre, and the solution has been positively assessed by the Department of Cybernetics at the Military University of Technology.
DealDone is developing its AI tools precisely along these lines. Features such as the automatic anonymisation of sensitive data and document translation already operate within the platform today, rather than as separate, external tools to which confidential documentation would need to be transferred. As a result, employees do not have to choose between speed and security, as they get both in one place.
In what ways does AI actually speed up work in a secure environment?
The AI used in the data centre reduces the time taken for certain repetitive tasks:
Task | What AI offers |
Searching for information | A specific question rather than going through hundreds of documents one by one |
Contract analysis | Identifying clauses and recurring provisions across multiple files at once, which – with several hundred commercial contracts – can save the legal team many days’ work |
Translations | Faster processing of documentation in several languages when working with a foreign investor |
Anonymisation | Specifying which data to hide before the document is shared |
Summaries | Faster access to sections relevant to the valuation and risks of a transaction |
How can you tell if an AI tool for due diligence is secure?
A secure tool adheres to the same permissions that apply to users. If someone has access to only one folder within the data room, the AI’s responses must be restricted to that scope. Each response should also cite the source document so that the information can be verified rather than simply taken at face value.
It is worth asking your own team five questions:
Is the team aware of the risks associated with public AI tools?
Is there an AI available that operates directly within the data room and is just as fast as a public chat?
Does the document have to leave the controlled environment to obtain a response?
Does the tool respect the permissions assigned to a specific user?
Can the AI’s response be verified in the source document?
FAQ
Should employees be banned from using AI?
A ban on its own rarely works, as the time pressure doesn’t go away. It’s better to provide the team with a secure tool and clear guidelines on what data must not be entered into public services.
Does pasting a contract into a public AI chat breach confidentiality?
It may do so if the contract or NDA prohibits disclosure of the content to third parties, and the user has no control over where the data is processed. It is worth checking the terms of the specific contract.
What is AI operating within a virtual data room?
These are AI features that answer questions directly within the data room. The document is neither downloaded nor sent to an external tool.
Should the AI in the VDR have access to all documents?
No. Responses must be limited to the permissions of the relevant user, and each one should indicate the source document.
Summary
Unauthorised AI use usually stems from time pressure and a lack of a convenient alternative, rather than from ill will. A more effective safeguard than a ban is a tool that is just as fast as a public chat, but operates within an environment controlled by the company.
Book a free SECUDO VDR demo https://www.dealdone.pl/
About us
DealDone is a specialized company that offers high-quality products in the field of information and data security. We provide digitization services and software based on modern technologies for handling confidential information, classified information, and sensitive data, as well as for the digitization, backup, encryption, and delivery of data and documents both within and outside organizations.
For nearly 15 years, DealDone has specialized in providing solutions for the digitization, archiving, and distribution of documents in the form of a Document Management System (DMS) or a Virtual Data Room (VDR).
DealDone independently developed and launched the SECUDO VDR system. SECUDO is a platform for the secure digitization, archiving, exchange, and processing of corporate documents and data, offered as a cloud solution in a Software-as-a-Service model for business customers.
DealDone also owns the portals www.platformainwestora.pl and www.sprzedamfirme.com, through which the company supports transaction processes related to the sale of companies, fundraising, and the search for investors for projects.
In 2025, DealDone joined the international platform Dealsuite (www.dealsuite.com), which supports professionals in the field of mergers and acquisitions (M&A). Thanks to this collaboration, we can respond even more effectively to market needs and offer our clients VDR SECUDO—a secure and intuitive solution for document management in transaction processes.
Comments