The data room is becoming the most sensitive AI workspace in any deal. Here is what deal teams must design before the first agent logs in.
A follow-up to my article"The New Members of the Mergers and Acquisitions (M&A) Deal Team"
Introduction: The Bottleneck Just Moved
Picture a sell-side process on a Thursday night. The Virtual Data Room (VDR) holds 40,000 documents. Six bidders are in the room. First-round bids are due in three weeks. For thirty years, the constraint in that scenario has been simple: how fast can people read?
That constraint is disappearing. AI is now embedded in the data rooms deal teams use every day, and in 2026 the conversation has shifted from AI that answers questions about documents to agents that take actions inside the room. They index it, redact it, draft answers to bidder questions, and sweep thousands of contracts for clauses that could change the price of a deal.
In my previous article, I described Generative AI and Agentic AI as new members of the M&A deal team, working alongside bankers through Human-AI Collaboration. This article goes one level deeper, into the room where the most sensitive information in any transaction lives.
My argument is simple. The data room is where AI delivers the largest time savings in a deal, and it is also where a poorly governed agent can do the most damage. Speed is not the prize. Defensible speed is.
1. From Vault to Workspace: Three Generations of the Data Room
The data room has gone through three distinct generations. Each one changed what the room is for, and each one changed what can go wrong.
Generation 1: Secure Vault (2000s to early 2020s)
What the room does: stores documents, controls access, and logs who viewed what.
Primary risk: unauthorized access and leakage.
Who is accountable: the room administrator and the deal team.
Generation 2: Assistive AI (2023 to 2025)
What the room does: auto-indexing, AI redaction, summaries, and question answering with citations.
Primary risk: inaccurate summaries and missed content.
Who is accountable: the person who relies on the output.
Generation 3: Agentic Workspace (2026 onward)
What the room does: agents plan and run multi-step diligence, act on the room, and connect to outside AI assistants.
Primary risk: actions taken on the wrong data, at scale, with excessive permissions.
Who is accountable: shared across business, technology and control functions, and it must be designed.
The market reflects this shift. Leading providers now offer AI search, answer drafting with source citations, automated redaction across many categories of sensitive data, and document translation. Some have begun letting outside legal AI platforms query room documents with the room’s permissions carried over automatically. Connection standards such as the Model Context Protocol (MCP) are also turning the data room from a silo into a permissioned data source that AI assistants can work within.
The third generation is the one that matters for governance. When an agent can act, the question is no longer only "is the answer right?" It becomes "what was the agent allowed to touch, and what did it do with it?"
2. What Agents Actually Do in the Room
The work splits cleanly between the two sides of the transaction. For each task below, the sell side prepares the room, the buy side reviews it, and the last line shows where the human stays in charge.
Room Setup
Sell side: classify and index uploads into the diligence structure.
Buy side: map the room to the buyer’s diligence request list.
Human in charge: confirm the index matches the request list.
Redaction
Sell side: remove personal data and competitively sensitive data before release.
Human in charge: approve every redaction batch before documents go live.
Contract Review
Sell side: pre-screen for issues the buyer will find.
Buy side: sweep all contracts for change-of-control, assignment, exclusivity and termination terms.
Human in charge: verify every material finding against the source page.
Financial Analysis
Sell side: prepare consistent schedules.
Buy side: flag anomalies, customer concentration and unusual adjustments.
Human in charge: judge whether an anomaly is an issue or has an explanation.
Question and Answer (Q&A)
Sell side: draft answers to bidder questions with citations.
Buy side: draft questions from gaps found in the room.
Human in charge: approve every answer before it reaches a bidder.
Synthesis
Sell side: track bidder engagement.
Buy side: build the red flag report and the issues list that feeds purchase agreement negotiations.
Human in charge: decide what affects price, structure or the decision to walk away.
Notice the pattern in the last line of each task. The agent does the reading, sorting and drafting. The human owns every decision that leaves the room or changes the deal.
3. A Worked Example: The Change-of-Control Sweep
Consider a buyer reviewing a software company with 3,200 customer contracts. One diligence question matters more than most: which customers can terminate or renegotiate if ownership changes? Missing a single large contract can leave a revenue assumption in the valuation model that will not survive closing.
A well-designed agentic workflow for this sweep looks like this:
Classification agent: identifies which documents are customer contracts, amendments and side letters, and links each amendment to its parent agreement.
Extraction agent: pulls change-of-control, assignment, termination for convenience and consent clauses from each contract, with page references.
Playbook agent: compares each clause to the buyer’s risk playbook and assigns a risk tier.
Reconciliation agent: joins the high-risk contracts to the revenue schedule, so the deal team sees revenue at risk rather than just a list of clauses.
Human verification: associates verify every high-risk finding against the source page and review a random sample of contracts the agents marked as low risk.
Sign-off: a named senior banker or counsel approves the red flag memo before it reaches the client or informs the bid.
Two design choices make this workflow defensible:
Every finding carries a citation to the exact document and page, so a finding without a source is not a finding.
The team samples the low-risk pile, not only the high-risk pile. In diligence, the dangerous error is rarely the clause the agent flagged incorrectly. It is the clause the agent never flagged at all.
In due diligence, a missed clause is more dangerous than a wrong one. Measure what your agent misses, not just what it finds.
4. The Risks That Move Faster Than the Agent
Every risk below already exists in traditional diligence. Agents change the speed and the scale at which these risks materialize.
4.1 Material Non-Public Information and Information Barriers
A data room is concentrated Material Non-Public Information (MNPI). The agent’s access must never be broader than the access of the person it works for. That means the agent works within one deal and one user’s entitlements, keeps no memory across deals, and runs on vendor terms that prohibit training on client data and define how long prompts and outputs are retained. An agent that remembers Deal A while working on Deal B is an information barrier breach waiting to happen.
4.2 Clean Team Rules
In transactions between competitors, antitrust counsel often limits competitively sensitive information, such as customer-level pricing, to a small clean team before closing. Sharing that information too broadly can create what lawyers call gun-jumping risk. A human analyst knows not to open the clean team folder. An agent only knows what its permissions allow. Clean team restrictions must be encoded as access policy, not left as an instruction in a prompt.
4.3 Right Answer, Wrong Path
An agent can produce an accurate red flag memo and still create a control failure if it reached that answer by reading documents the user was not entitled to see. Reviewing the output will never catch this. Only the execution trace can show which documents were read, under whose identity, and whether a policy check was applied at the moment of access.
4.4 The Documents Are Written by the Other Side
This is the risk most teams overlook. In a data room, the counterparty controls the content. A document could contain hidden text designed to steer an AI reviewer, such as an instruction to describe a contract as standard or to skip a schedule. This is called prompt injection, and in an adversarial setting like a deal it is not theoretical. Every document in the room must be treated as untrusted input. Agents should use read-only tools during review, and instructions found inside documents must never be carried out as commands.
4.5 Cross-Bidder Leakage
On the sell side, a Q&A agent serving six bidders creates a new leakage path. If the agent drafts an answer for Bidder A using a document released only to Bidder B, the seller has a fairness problem and possibly a confidentiality breach. Q&A agents must be scoped per bidder, and no answer should be released without human approval.
4.6 Confident Summaries
A fluent summary of a 60-page agreement reads as authoritative even when it omits the one clause that matters. The more polished the output, the less likely a tired reviewer at midnight is to check it. This is why citations, sampling and named sign-off are not bureaucracy. They keep fluency from being mistaken for accuracy.
5. Design Before the First Agent Logs In: A Control Checklist
Inherit permissions, never expand them. The agent acts with the entitlements of the user it serves, within one deal.
No cross-deal memory. Purge agent context and working files when the deal closes or the user rolls off.
Lock down vendor terms. No training on client data, defined retention, defined data location, and the right to audit.
Cite or it does not count. Every finding links to a document and a page.
Read-only by default. Any action that changes the room or reaches a counterparty, such as releasing an answer or a document, requires human approval.
Treat every document as untrusted. Apply prompt injection defenses and never carry out instructions found in content.
Measure recall, not just precision. Seed a golden set of known issues and confirm the agent finds them before you trust it on a live deal.
Sample in proportion to materiality. Larger contracts and higher-risk categories receive more human review.
Trace everything. Record who asked, what was read, which tools were called, which model and prompt versions ran, and what the reviewer accepted, edited or overrode.
Name the accountable human. Every material finding has an owner who signs it, and escalation thresholds are set before the deal starts.
None of these controls requires a new governance bureaucracy. Each one maps to a framework a financial institution already runs:
Permission inheritance and clean team policy: entitlements management and information barrier policies.
Vendor terms, retention and audit rights: third-party risk management.
Golden set, recall measurement and version pinning: model risk management, including supervisory guidance such as SR 26-2, the April 2026 revision of the earlier SR 11-7 guidance.
Execution traces and sign-off records: records retention and internal audit.
Prompt injection defenses: cybersecurity and application security.
What changes is that these existing frameworks must now recognize an agent as a participant in the deal.
6. What Changes for the Deal Team
The technology is the easy part. The harder change is in the work itself.
Juniors become verifiers. The analyst who once spent nights reading contracts now spends that time checking agent findings against sources. That is a different skill, and it must be taught deliberately.
Timelines compress, and expectations follow. When one buyer can finish a contract sweep in days, sellers will expect every serious bidder to move at that pace. Firms without governed tooling will either slow down or cut corners.
Sellers must prepare AI-ready rooms. Clean scans, searchable text, consistent naming and complete amendment chains now affect how well every bidder’s agents can read the room, and therefore how confidently bidders can price the deal.
Senior judgment becomes more visible. When reading is no longer the bottleneck, the value of the deal team concentrates in interpretation: what a finding means for price, structure and risk allocation.
That first point raises a question I will explore in my next article: If agents do the reading that used to train junior bankers, how does the industry build the next generation of senior judgment?
Conclusion: Defensible Speed
AI in the data room is no longer a pilot. It is becoming standard deal infrastructure, and firms that use it well will run faster and more thorough diligence than firms that do not. But the data room is not an ordinary workspace. It holds the most sensitive information in the transaction, it is shared with counterparties, and every finding can move a price.
The winners will not be the firms with the most autonomous agents. They will be the firms that can show, for every finding, what the agent read, under whose authority, and which human signed off. In deals, speed has always mattered. In the age of agents, defensible speed is what will matter most.
Where is your organization drawing the line between what an agent can do in the data room and what only a human can decide? I would welcome your perspective in the comments.
Explore more: Start Here · Topics · Archive · About