For as long as corporate due diligence has existed as a discipline, the workflow has looked roughly the same: an analyst opens a database, searches an entity name, downloads a stack of reports — corporate filings, litigation records, sanctions and watchlist hits, adverse media — and then spends the bulk of a working day piecing those fragments into a single coherent picture of who they're actually dealing with. The tools got faster over the past decade. The workflow itself did not fundamentally change.
That is the assumption a new wave of AI due diligence agents is now testing directly. Rather than returning search results for a human to interpret, these systems are given a goal — investigate this vendor, this counterparty, this beneficial owner — and asked to plan and execute a meaningful part of the investigation themselves: retrieving records, resolving entities across jurisdictions, mapping ownership and relationship networks, screening risk databases, and producing a synthesized summary with a documented trail of how it got there.
This is not a hypothetical trend piece about where AI might eventually go. It is a market category taking visible shape in real time, and this week supplied one of its clearest data points yet.
Most risk and compliance teams underestimate it — see how an AI-powered vendor intelligence platform compresses entity resolution, ownership mapping, and risk screening into a single reviewable case file.
Explore Crest IntelligenceFrom Databases to Agents — A Three-Stage Shift
It helps to separate what due diligence tooling has already become from what it is becoming next. Three distinct stages describe the trajectory most enterprise due diligence functions are somewhere along.
Yesterday: an analyst searches one or more databases, downloads individual reports on the entity and its known affiliates, and manually reviews and cross-references them against internal risk criteria — a process that scales linearly with headcount and degrades under portfolio volume.
Today: AI searches, correlates, and summarizes. Most enterprise due diligence platforms and TPRM tools now use AI to accelerate the search-and-correlate step and to flag likely exceptions — reducing the manual load without changing who ultimately conducts the investigation. This is where the majority of enterprise programs, including most AI-in-TPRM adoption to date, currently sit.
Next: AI initiates checks, investigates exceptions on its own initiative, requests missing evidence, creates follow-up actions, and monitors the entity continuously for change — with the risk decision itself remaining governed and accountable to a named human. This is the stage the newest generation of due diligence agents is explicitly built toward, and it is a meaningfully different proposition from AI that merely accelerates search.
The Handshakes Signal — A Dedicated Due Diligence Agent Goes Live
On August 26, 2026, Handshakes, a Singapore-based corporate intelligence and due diligence data provider, announced the launch of the Handshakes Agent — an AI-powered investigative tool built on more than a decade of regulatory intelligence, designed to automate end-to-end due diligence, risk screening, vendor onboarding checks, and conflicts-of-interest reviews. Given a simple entity-name query, the agent retrieves entity reports, maps ownership networks, screens risk databases, and generates a synthesized summary of its findings.
Two design choices in the announcement are worth noting beyond the headline capability. First, the system logs every workflow decision, data source accessed, analytical step, and rationale used throughout an investigation — an immutable audit trail intended specifically for regulatory transparency and traceability, not just internal quality control. Second, given a high-level instruction such as "perform a complete due diligence on vendor X," the agent breaks that objective into a detailed multi-step plan spanning data gathering, cross-jurisdiction entity matching, relationship checking, finding synthesis, and final report compilation — the planning behavior that distinguishes an agent from a search tool.
Handshakes is not the only signal in this direction, and it will not be the last. Analyst coverage of agentic AI more broadly — including Gartner's ongoing research on agentic AI adoption — has flagged autonomous, goal-directed AI systems as one of the more consequential enterprise technology shifts moving into 2026 and beyond, precisely because they change what a human operator delegates rather than simply what they automate. A dedicated due diligence agent, purpose-built for corporate investigation rather than general-purpose task execution, is a concrete instance of that broader shift landing in a specific, evidence-heavy, high-stakes workflow.
Anatomy of an AI-Led Investigation — Seven Stages
Strip away any single vendor's branding and the underlying architecture of an AI due diligence agent follows a recognizable pattern — one that maps cleanly onto how a rigorous manual investigation is already supposed to work, compressed and made consistent at machine speed.
Data
The agent retrieves entity records, filings, ownership disclosures, litigation history, and risk-list data from corporate registries and licensed intelligence sources.
Entity Resolution
The agent matches and de-duplicates entities and individuals across jurisdictions and naming variations, resolving who is actually connected to whom.
Investigation
The agent maps ownership and relationship networks, traces beneficial owners and affiliates, and cross-references sanctions, litigation, and adverse media sources.
AI Summary
Findings are synthesized into a structured summary that explains what was found, where it came from, and why it matters to the entity being assessed.
Risk Signal
The agent assigns a risk signal based on the pattern of findings, distinguishing routine results from exceptions that warrant closer human review.
Human Review
A named analyst or risk owner reviews the synthesized findings, the underlying evidence trail, and the flagged exceptions before any determination is made.
Decision
The human reviewer makes the governed risk-acceptance decision, informed by evidence the agent assembled but not replaced by it.
The first five stages are where the compression happens — work that historically took an analyst hours or days across multiple databases, done consistently and quickly. The last two are deliberately unchanged from how a well-governed manual investigation already runs: a human reviews the case and owns the decision.
Crest.Digital applies agentic AI to vendor due diligence, ownership and entity resolution, and continuous risk screening — with every AI-generated finding routed to a named reviewer before a decision is made.
Why the Risk Decision Stays Human
It is tempting to read the arrival of due diligence agents as a step toward fully autonomous risk decisions. That reading misunderstands both what the current generation of tools is built to do and what regulators, auditors, and boards are actually prepared to accept. An agent can compress data gathering and correlation dramatically. It cannot take accountability for a risk-acceptance decision, weigh a borderline finding against commercial context the system has no visibility into, or explain to a regulator why a judgment call was made a particular way — all of which remain squarely human responsibilities.
This is precisely why the audit-trail design choice in tools like the Handshakes Agent matters as much as the automation itself. ISACA's guidance on AI governance and controls consistently emphasizes that explainability and traceability — not just accuracy — are what make an AI system usable in a regulated risk decision, because a reviewer, auditor, or regulator needs to be able to reconstruct how a finding was reached, not just trust that it was reached correctly. An agent that logs every data source and analytical step it used gives a human reviewer something to actually evaluate, rather than a black-box conclusion to either accept or reject wholesale.
Broader professional-services research on generative and agentic AI in corporate investigations and M&A due diligence, including work published by firms such as PwC on AI's role in enterprise risk and investigation workflows, reaches a consistent conclusion: the highest-value near-term application of agentic AI in due diligence is compressing the evidence-gathering and correlation burden, not removing human judgment from the loop. That framing — augmentation of investigation capacity, governed decision authority retained — is the operating model this generation of tools is actually built around, whatever the marketing language around any individual product implies.
Where This Fits Inside an Enterprise TPRM Program
For third-party risk and vendor due diligence functions specifically, dedicated due diligence agents are not a separate technology trend to evaluate in isolation — they are a natural extension of capabilities most mature TPRM programs are already building toward through AI-assisted vendor due diligence and continuous monitoring. The same entity-resolution and relationship-mapping problem an agent solves for a one-time investigation applies directly to beneficial ownership verification and related-party detection at vendor onboarding — work that has historically required specialist investigators and days of turnaround, now compressible into a reviewable case file within minutes.
The same shift also extends naturally into questionnaire-based due diligence, where an agentic layer can pre-populate and cross-check vendor-supplied answers against independently sourced evidence rather than taking self-attestation at face value, and into ongoing discovery of undisclosed vendor relationships and AI dependencies that a point-in-time investigation alone would miss. Framed this way, a due diligence agent is less a standalone product category and more a capability layer that strengthens each stage of an existing vendor lifecycle — onboarding, periodic reassessment, and continuous monitoring — without requiring a program to be rebuilt from scratch to use it.
Enterprises evaluating this category of tool, whether standalone or embedded within a broader vendor intelligence platform, should apply the same diligence to the tool that the tool applies to a vendor: ask for a demonstrable audit trail, clear separation between AI-generated findings and human sign-off, and evidence of how the system handles ambiguous or conflicting source data rather than presenting a single confident-sounding summary. The organizations that adopt due diligence agents well will be the ones that treat them as an accelerant to an already-disciplined investigation process — not a replacement for having one.
Frequently Asked Questions
A due diligence database is a search tool — an analyst queries it, reads the results, and manually pieces together an investigation across ownership records, litigation history, sanctions lists, and adverse media. An AI due diligence agent is given a goal, such as investigating a specific vendor or counterparty, and independently plans and executes the investigation: it retrieves entity records, resolves related parties and ownership networks, cross-references risk databases, and produces a synthesized summary with a documented audit trail of every step it took. The database is a lookup tool; the agent conducts a bounded piece of the investigation itself, with a human reviewing the output before any decision is made.
No. What is changing is which parts of an investigation an analyst spends time on. AI agents can compress the data-gathering, entity-matching, and correlation work that historically consumed most of an analyst's hours into minutes, and surface a synthesized summary and risk signal for review. What an agent does not do is decide whether a flagged relationship is acceptable, weigh a borderline finding against commercial context, or take accountability for a risk decision. That judgment remains a human responsibility — the shift is toward analysts spending their time on judgment calls and exception investigation rather than manual record retrieval.
Handshakes, a Singapore-based corporate intelligence and due diligence data provider, announced the launch of its Handshakes Agent on August 26, 2026. Given a high-level instruction — for example, to perform complete due diligence on a named vendor — the agent breaks that objective into a multi-step plan: gathering entity data, matching entities and beneficial owners across jurisdictions, mapping relationships, screening risk databases, and compiling a synthesized final report. The system logs every workflow decision, data source, and analytical step it takes, producing an audit trail intended for regulatory transparency and traceability.
Dedicated due diligence agents are a natural extension of the vendor intelligence and continuous monitoring work most third-party risk programs already run, rather than a separate discipline. An agentic layer can pre-assemble entity resolution, ownership mapping, sanctions and adverse media screening, and a synthesized risk summary for a reviewer's first look at a new vendor, a renewal, or a triggered reassessment — compressing work that previously took an analyst hours or days into a reviewable case file within minutes. The program still needs defined risk-acceptance criteria, escalation paths, and a named human owner for every determination; the agent changes how quickly and completely the evidence supporting that determination gets assembled.
Start by mapping which parts of the current due diligence workflow are manual, repetitive, and evidence-heavy — entity resolution, ownership network mapping, sanctions and adverse media cross-referencing — since these are the tasks agentic tools are best suited to first. Evaluate any AI due diligence agent, whether standalone or embedded in a TPRM platform, on the completeness of its audit trail, the transparency of its data sources, and whether it clearly separates AI-generated findings from human sign-off, rather than on speed alone. Treat this as an incremental capability upgrade to an existing due diligence program, not a wholesale replacement of it, and keep the risk-acceptance decision explicitly assigned to a named person regardless of how much of the investigation the agent completes.