The data room just became the AI surface

In eight days, Datasite has wired its virtual data rooms into Claude, ChatGPT, and Microsoft Copilot via the Model Context Protocol. The right way to read this is not as a security feature or a productivity story. It is a platform claim: the data room, not the assistant, owns the M&A workflow.

The move. On 19 May Datasite went live with Claude. On 21 May, ChatGPT. On 27 May, Copilot — announced via a dedicated virtual event on Datasite's own channels.¹ Three of the four assistants that matter to senior dealmakers, all routing through the same authenticated connection into the same VDR (virtual data room — the secure document environment used for M&A diligence). The marketing line is that "documents don't leave the platform."² The line worth paying attention to is the other one: Nertila Asani at Datasite saying AI "is no longer a future conversation in M&A deal-making."² That is a vendor declaring that the operational present has arrived, and pricing its roadmap accordingly.

Why eight days matters. The interesting number is not three assistants. It is the cadence. Rolling Claude, ChatGPT, and Copilot in a single working fortnight tells you that MCP (Model Context Protocol — Anthropic's open standard for connecting assistants to external data and tools) has done what it was designed to do: collapse the integration cost of wiring an assistant to a data source from a quarter of engineering work to something closer to a configuration exercise. That is good news for Datasite this month. It is a more complicated piece of news for Datasite next year.

The offensive read. The conventional framing is that VDR vendors are defending their turf against legal-AI insurgents — Harvey, Legora, and the long tail of contract-review tools that would, given the chance, become the surface dealmakers actually look at. On that reading, Datasite's MCP rollout is a moat-deepening move. I think that reading underrates what is happening. Datasite is not defending the document repository. It is claiming the authenticated connection between the senior practitioner and whichever assistant they happen to prefer. If a managing director at a bulge-bracket bank wants to use Copilot because the firm has standardised on Microsoft, Datasite is the MCP server they route through. If a partner at a magic-circle firm prefers Claude, same answer. The platform owns the join, regardless of which assistant wins the assistant war.

The platform owns the join, regardless of which assistant wins the assistant war.

The Harvey counter. The most serious objection to that reading is that a general assistant querying a VDR is not the same product as a purpose-built legal AI reasoning over the same documents. Harvey's integration with Ansarada (Datasite's closest competitor in the VDR layer) is built around specialist legal reasoning — contract review, clause comparison, redline diligence. PwC's Claude-powered deal tooling sits in the same neighbourhood. For a law firm doing buy-side diligence on a complex carve-out, "ask Copilot about the data room" may simply lose to "ask Harvey, which was trained on this kind of work." Datasite's bet is that the assistant-of-choice question dominates the specialist-tool question for most users most of the time. That is a defensible bet for corporate development teams and sell-side bankers. It is a much weaker bet for the legal workstream, which is where the diligence margin actually sits.

The "documents don't leave" problem. I want to be careful here, because the marketing claim is not a lie — it is just narrower than it sounds. MCP does not export files. What MCP does is retrieve content from the VDR and pass it as context to the assistant. The file stays. The substance of the file, projections, deal terms, counterparty names, board materials, travels into the assistant's context window and, depending on the assistant provider's configuration, into its inference infrastructure. For a domestic deal between two US parties using a US-hosted assistant, that distinction is mostly academic. For a cross-border transaction subject to GDPR Article 44 transfer restrictions, or for a deal where one side's counsel has not consented to the other side's choice of assistant provider, it is not academic at all.³ The audit trail question — who queried what, when, with which assistant, returning which substantive content — is the one regulators and deal counsel will eventually press on. Datasite has the easiest position from which to answer it, because they sit on the authenticated edge. They have not, yet, told the market what that answer looks like.

The convergence problem. If MCP integration is genuinely an eight-day exercise, then Datasite's first-mover position is measured in months, not years. Intralinks can do this. Ansarada already has Harvey. Every serious VDR will have MCP connectivity to the major assistants by year-end. At that point the competitive variable is not "do you have MCP" — it is the quality of the implementation. Permissioning granularity at the document and clause level. Session-level audit logging that survives litigation discovery. Revocation that actually revokes. Cost controls on token consumption, because a complex diligence question against a thousand-document data room is not a cheap query, and the pricing model, bundled, per-query, tiered by deal size, will decide whether AI diligence is a bulge-bracket feature or a mid-market one. None of that is glamorous. All of it is where the next eighteen months of competition will be fought.

What I would watch. Three things. First, whether Datasite publishes a substantive audit-and-consent model for MCP queries, or leaves the "documents don't leave" line to do the heavy lifting. Second, whether Intralinks responds with its own multi-assistant MCP rollout within the quarter — if it does, the differentiation window has already closed. Third, the pricing. Datasite has not, that I have seen, disclosed how AI-query volume is metered. That number, when it appears, will tell you more about the economics of agentic deal execution than any number of partnership announcements.

The headline is that the data room is becoming the AI surface. The smaller, more useful observation is that the data room was always going to become the AI surface — the only question was whether the VDR vendors or the assistant vendors would own the join. For now, on Datasite's evidence, the VDR vendors are ahead. They have eight days, and an open protocol, to thank for it. Whether they keep the lead depends on what they do with the next eight months.

Footnotes

¶