The Hidden Risks of Uploading Deal Documents to AI

Artificial intelligence (AI) is increasingly helping deal teams work faster. Analysts are using the technology to extract figures from confidential information memorandums (CIMs), summarize contracts and find answers to diligence questions in minutes instead of hours. But how those tools access deal information matters.

With many external AI tools, analyzing deal documents means downloading them from the virtual data room (VDR) and uploading them to a separate system. Under tight transaction deadlines, that can seem like a simple shortcut. However, it can introduce risks that are easy to overlook.

What changes when documents leave the data room? 

A VDR provides a controlled environment where access is managed at the deal, folder and file level, and user activity is tracked. Once a document is downloaded and uploaded to another platform, those controls no longer apply to the external copy. This creates several concerns: 

• Confidential information moves outside the deal environment. The VDR no longer controls how the copied document is stored, retained or processed. Instead, those practices are governed by the external AI provider. 
• Permissions and audit visibility are reduced. Access restrictions for specific users or buyer groups do not automatically carry over to downloaded files. The data room may record the download, but it cannot provide a complete record of subsequent activity on another system. 
• Client trust and compliance may be affected. Clients expect sensitive transaction information to be handled within agreed controls. Moving documents to an external AI platform may conflict with those expectations or a firm’s information security and compliance requirements. 

There is also a practical risk: outdated information. A downloaded file represents a snapshot of the data room at a particular point in time. As documents are added, updated or removed, copies held elsewhere may no longer reflect the latest information, making it harder for analysts to know whether they are working from a complete, current set. 

Bring AI to deal documents without moving the documents 

Deal teams should not have to choose between the efficiency of AI and control over confidential information. DealCentre Connect enables supported third-party AI tools to access live DealCentre AI™ content through a governed interface using Model Context Protocol (MCP), eliminating the need to download and re-upload files. Raw documents remain in DealCentre AI and are processed on demand, rather than being transferred to the third-party AI provider. Several controls support this approach: 

• Existing permissions remain in place. Each request is checked against the signed-in user’s existing DealCentre AI permissions at the deal, folder and file level. The connected AI tool cannot access documents the user is not authorized to view. Changes to access take effect on the next request. 
• Access is checked every time. Permissions are evaluated against the current permission settings for each request, rather than relying on a cached session. 
• Activity is logged. Audit records capture the authenticated user, connected AI tool, DealCentre AI MCP tools invoked, workspace accessed and documents accessed. 
• Administrators retain control at the deal level. Only AI providers vetted by Intralinks can connect, and deal room administrators determine whether DealCentre Connect is licensed and enabled for each deal. Supported tools include Claude, Emma, Harvey, Hebbia, Legora, Model ML and Rogo. 

Link, the proprietary AI engine within DealCentre AI, performs the document analysis inside the platform. The external AI tool sends a structured request and receives a precise, AI-generated response without needing to ingest the underlying documents in full. 

What to consider before connecting a third-party AI tool 

A governed connection can help reduce data exposure, but it does not eliminate the need for due diligence. Information returned to a connected AI tool — including extracted passages, answers and citations — is still handled by that provider under its own terms.

Before using an external AI tool for deal work, teams should review its data storage, retention, processing and data residency practices to ensure its use complies with their firm’s policies and client obligations. 

As AI becomes more embedded in mergers and acquisitions (M&A) workflows, the goal should be to improve efficiency without compromising control over sensitive deal information. Keeping documents within the governed deal environment while allowing approved AI tools to access that relevant information offers a more controlled approach to AI adoption in M&A.