The Problem With Conventional Diligence Timelines
In competitive M&A processes — auction formats, proprietary deals where the seller has alternatives, situations with strategic urgency — the diligence window is frequently compressed. Three weeks is standard. Two weeks is common. In some technology acquisitions, particularly where the strategic rationale is time-sensitive, teams are making investment decisions on less.
Within that window, the IT due diligence workstream is typically one of several parallel tracks — legal, financial, commercial, HR. The IT team gets a fraction of the available time, a partial view of the VDR, and is expected to produce findings that are credible to an Investment Committee that has never read the underlying documents.
The consequence is predictable: scope narrows. High-priority document categories get reviewed; lower-priority categories get sampled or skipped. The team produces findings on what it reviewed, not on what exists. The Investment Committee receives a report that reflects the coverage constraints of the process, not the actual risk profile of the target.
What Changes When Coverage Is Unlimited
The binding constraint on diligence depth has always been human reading time. An analyst can process roughly 15–25 documents in detail per day, depending on complexity. A team of three analysts working 10-hour days over a two-week window can review approximately 600–1,000 documents — from a VDR that may contain 2,000–5,000.
When document processing is no longer the bottleneck — when the full VDR is analyzed within hours of upload — the nature of the diligence process changes. The team doesn't spend its time reading; it spends its time analyzing findings, probing anomalies, and making judgments about materiality. The questions the team asks become more precise because they're based on what the documents actually say, not on what the team expects to find.
This isn't a marginal improvement in efficiency. It's a restructuring of what the diligence team does. The value of an experienced IT diligence practitioner lies in synthesis and judgment — the ability to understand what a pattern of findings means for a specific deal thesis. When AI handles the coverage work, practitioners can apply that judgment to the full set of findings rather than a sampled subset.
The 48-Hour Red Flag Scan
One of the most concrete changes AI enables is a functional triage capability within the first 48 hours of the diligence process. Before a deal team has completed a single management interview, it's possible to have a preliminary finding set that identifies the highest-risk areas — the issues that warrant the most focused attention in the remaining diligence window.
This changes the sequencing of diligence work. Instead of allocating team time based on a pre-defined workplan and discovering critical issues late, teams can reprioritize based on actual findings from the first document batch. A cybersecurity issue that surfaces in the first 48 hours gets three weeks of focused attention rather than two days.
The HP-Autonomy case illustrates the value of this directly. The signals of accounting irregularity were in the documents — they required systematic analysis across the full document set to become visible. An early-stage comprehensive scan would have flagged them as a priority area, concentrating diligence effort where it mattered most.
Speed and Depth Together: What It Requires
Getting both speed and depth from a diligence process requires two things that are independent but complementary: AI-assisted document analysis for coverage and initial finding generation, and experienced human practitioners for synthesis, management engagement, and Investment Committee communication.
The failure mode to avoid is using AI to accelerate document processing while maintaining the same reporting cadence — producing a faster version of the same deliverable rather than a better one. The genuine opportunity is to produce an Investment Committee report that reflects the full document set, not a sampled subset, within the same compressed timeline that previously allowed only partial coverage.
The Verizon-Yahoo breach case shows what happens when the diligence process doesn't achieve this: risk that was in the documents — or should have been in the documents if the IRL had been more precise — isn't surfaced until it becomes a post-signing renegotiation. The cost of that miss was $350 million.
What This Means for Deal Teams
The practical implication for deal teams is not that AI makes IT diligence easy. It's that AI removes the specific constraint — document coverage — that has historically forced teams to choose between speed and depth. Within a compressed deal timeline, a team using AI-assisted analysis can achieve both.
The Investment Committee should understand this shift. A diligence report produced by a team using AI-assisted document analysis of the full VDR is a materially different input than a report produced by the same team reviewing 20% of the documents. The confidence level of the findings is different. The completeness of the IRL is different. The basis for the conclusions is different.
The false choice between speed and depth isn't fully eliminated — there are still limits on how fast experienced practitioners can synthesize findings and engage management. But the binding constraint has moved. The question is no longer how many documents the team can read. It's how efficiently the team can apply judgment to the findings the analysis produces.