Document Review Isn't Due Diligence: Why You Need Independent Verification
A wave of AI tools now promise "due diligence in seconds": upload a contract or a disclosure schedule, and the model returns a tidy summary of risks, gaps and next steps. These are genuinely useful — but they are document review, not due diligence, and mistaking one for the other is how deals go wrong. The distinction is simple: a document reviewer can only tell you what is in the documents you were given. Real diligence is about everything the other side didn't put in the data room.
The blind spot in "upload and summarize"
An AI that reads your uploads is bounded by those uploads. It can flag a missing signature page, a one-sided indemnity, or an absent exhibit — valuable work. But it is structurally blind to the risks that live outside the file it was handed. Consider what a target has no incentive to volunteer, and what a document summarizer therefore cannot catch:
An undisclosed lawsuit filed against the company last quarter. A flagship patent that lapsed for an unpaid maintenance fee, or a trademark cancelled for non-use. A principal or subsidiary that appears on an OFAC or export-control list. A regulatory license the business is required to hold but doesn't. An AGPL-licensed open-source component buried in the codebase that could put the company's own source code at risk. None of these are in the data room — that's precisely why they're dangerous — and no amount of AI reading the data room will surface them.
Due diligence is verification, not summarization
The word "diligence" implies independent effort: you go and check. Traditional diligence is expensive because a team manually pulls court records, patent registers, sanctions lists, corporate filings and regulatory databases and cross-checks them against what the company claimed. The value isn't the summary — it's the independent sources. A finding is only as good as the authoritative record behind it, and the whole point is to compare the target's story against primary evidence they don't control.
That is the line between the two categories. Document review operates on the target's version of events. Diligence operates on the public record. One confirms the paperwork is internally tidy; the other confirms the paperwork is true.
What independent verification actually looks like
Done properly, verifying a company means going, source by source, to the authorities of record: SEC EDGAR for corporate registration, ownership and financials; the USPTO for patents and trademarks and the EPO for patents, with their current status; federal court records for litigation and judgments; OFAC, BIS and DDTC for sanctions and export-control screening; regulators for enforcement history and required licenses; WHOIS and code hosts for domains and open-source exposure; and news archives for adverse media. Each answer should link back to the source so a reviewer can confirm it — because an unsourced "finding" is just another summary.
Historically this breadth is exactly why diligence was slow and costly: a dozen systems, each with its own quirks, searched by hand. That is the part AI genuinely changes — not by reading your documents faster, but by retrieving and cross-checking the public record automatically, then compiling it into something you can act on.
Both, in the right order
This isn't an argument against document review — it's an argument about sequence and completeness. Reading the data room and independently verifying the company are complementary: the documents tell you what the target says, and the public record tells you whether it holds up. A serious process does both, and treats a slick summary of the uploads as the start of diligence, not the finish.
The test to apply
When you evaluate any "AI due diligence" tool, ask one question: where does its information come from? If the answer is "the file you uploaded," it's a document reviewer — keep it, but don't mistake it for diligence. If the answer is "independent public records, with a link to each," you're looking at verification. Only the second one can tell you what the other side left out. This is general information, not legal advice; confirm anything material at the source before you rely on it.