The Direct Answer: AI Diligence Is an Operating-Model Test
An AI acquisition diligence checklist should test whether an AI business can produce reliable revenue with repeatable economics under normal operating conditions. For an acquirer, the central questions are not simply how large the model is, how many customers it has, or whether its product demonstration appears impressive. Investors should determine how much human supervision each transaction requires, which data permissions can survive a change of control, whether customers can replicate the results, and what happens if model performance declines.
Also worth reading: How is AI transforming private markets due diligence for investors and founders? · Which AI Startup Diligence Metrics Actually Matter for Investors in 2026? · What Is the Essential AI Due Diligence Checklist Template for Private Equity Deals in 2026?
A useful checklist divides the review into commercial, technical, legal, financial, security, and organizational workstreams. It should also establish quantitative thresholds before negotiations begin, such as gross-margin performance after inference costs, concentration among the top five customers, uptime expectations, model-drift tolerances, and the time required to reproduce reported results. These are negotiating benchmarks, not universal rules: a company serving regulated enterprises may appropriately spend more to reduce risk, while a lower-cost developer tool may succeed with less documentation.
As of September 27, 2026, AI diligence has become more disciplined. Nasdaq’s acquisition of Dasseti, Juniper Square’s acquisition of Sightglass, and reported use of AI-guided diligence products show that artificial intelligence is being applied both to the acquisition process and to the assets being acquired. Yet automation does not replace professional judgment. Wolters Kluwer’s work on AI in legal due diligence and other workflow products from Thomson Reuters point toward assisted review, while forensic specialists continue to test whether reported financial results are supported by underlying evidence.
How to Assess Commercial Quality and Revenue Durability
Begin with the revenue ledger, not the management forecast. Reconcile signed contracts, invoiced amounts, collections, renewals, usage records, and recognized revenue for at least the latest 24 months, with monthly detail for the most recent 12 months. AI businesses can report rapidly growing annual recurring revenue while experiencing weak retention, heavy discounting, or usage that does not translate into collectible cash. A reasonable diligence trigger is a top-five customer concentration above 30% for a business without strong contractual protection, although the appropriate threshold depends on contract length and switching costs.
Next, test whether the product creates measurable business value. Ask customers to describe the baseline process, time saved, error reduction, conversion improvement, compliance benefit, or revenue effect attributable to the software. A claimed 40% productivity gain should be decomposed into assumptions: task duration, automation rate, exception rate, employee cost, adoption, and implementation burden. Avoid treating vendor-authored ROI as realized value. For every material case study, seek customer confirmation and raw operating data under appropriate confidentiality rules.
The commercial review should also examine channel economics. If 60% of new bookings come through one partner, determine the gross margin after partner commissions, implementation labor, and support. Examine whether usage-based pricing exposes the seller to inference costs, whether annual commitments are truly contractual, and whether customers can terminate for convenience. A practical break-even test is to remove the five largest deals and model 18 months of revenue, gross profit, and cash collections using current churn rather than management’s optimistic case.
Technical Validation: From Demo to Reproducible Performance
A polished interface proves very little about production reliability. Require the seller to run a representative evaluation set that was created before diligence began, with success criteria defined in writing. Compare the current production model, any model that will be transferred, and at least one reasonable baseline. For relevant applications, measure precision, recall, false-positive rate, false-negative rate, human-review time, latency, and cost per successful outcome; accuracy alone can conceal expensive or dangerous errors.
Technical diligence should then test reproducibility. Identify the exact model version, system prompt where applicable, retrieval sources, feature pipeline, evaluation dataset, and inference configuration used in customer delivery. The team should independently rerun a sample of outputs and trace them to source material. Reproducibility below 95% for material cases is a warning that the benchmark may not represent the actual deployed system, not automatic proof of misconduct.
Data and infrastructure deserve equal attention. Map whether the seller relies on third-party APIs, open-source components, cloud contracts, proprietary datasets, or customer-provided information. Record model costs as a percentage of revenue and stress-test them against a two- to threefold increase. A product with a 75% gross margin at today’s token prices may have materially weaker economics if a provider changes pricing, traffic rises, or the company must move to a higher-cost architecture to improve control.
Finally, ask what breaks after closing. Does the acquirer need the original founders, key engineers, specific compute credits, or a non-transferable cloud agreement? Model, prompt, and workflow documentation should be separated from secrets and personal data. The goal is not to approve a perfect system, but to price known limitations and assign an owner and deadline for each material defect.
Legal, Privacy, Copyright, and Regulatory Diligence
AI legal diligence must follow the actual product rather than rely on a generic “compliance” statement. Review the company’s terms of service, privacy notices, acceptable-use policies, customer contracts, data-processing agreements, model cards, incident records, and government correspondence. Determine who owns training data, fine-tuning datasets, prompts, generated outputs, feedback, annotations, and derived embeddings. Copyright ownership is often less clear than a seller expects, especially where customer or public data was collected without explicit contractual rights.
Privacy analysis should identify the data categories processed and the legal basis claimed for each jurisdiction. Relevant questions include whether the system processes personal information, sensitive data, health data, financial information, children’s data, or information subject to GDPR, the UK GDPR, the EU AI Act, U.S. state privacy laws, or sector-specific requirements. The review should distinguish a vendor acting only as a processor from a company deciding purposes and means as a business actor. That distinction can change contracts, documentation duties, and exposure.
For higher-risk uses, examine risk classification, human oversight, recordkeeping, bias testing, cybersecurity controls, and incident escalation. A system used to rank loan applicants, make employment decisions, or support medical activity may require a different review than an internal writing assistant. Counsel should also inspect open-source licenses, third-party indemnities, restrictions on model training, and whether the seller has ever received a takedown or rights complaint.
A sensible closing condition is completion of material privacy and IP remediation before funds close, with narrowly scoped escrow, indemnity, or price adjustments for lower-severity issues. Legal automation can classify documents and identify missing clauses, but it cannot determine factual ownership or give legal advice about every jurisdiction. Human counsel must interpret the findings, especially where the product affects regulated decisions.
Financial, Security, and Organizational Diligence
AI financial diligence should treat compute, data, and expert review as operating costs rather than research abstractions. Rebuild monthly gross margin using hosting, model-provider fees, data acquisition, labeling, evaluation, implementation, sales commissions, and the labor required to monitor outputs. Reconcile usage metrics from the product platform to invoices and revenue records. Where possible, compare recognized annual recurring revenue with contracted recurring revenue and then with collected recurring revenue.
A useful seller benchmark is contribution margin after inference and direct support costs. Some venture-style AI businesses may operate below mature-company thresholds while building a larger market, but the buyer should still understand the cash burn needed to reach a stated 20% or 30% contribution margin. Run at least three scenarios: current pricing and traffic, a 50% inference-cost increase, and a 20% drop in net revenue retention. Management’s base case should be compared with a downside case that assumes slower adoption and additional human review.
Security diligence should cover identity controls, encryption, tenant isolation, secrets management, access logs, vulnerability testing, backups, disaster recovery, and incident history. Request evidence rather than certifications alone. A target with a 99.9% uptime commitment should be asked for monthly uptime, incident duration, service credits, and time to recovery for the previous 12 months. Security questionnaires and penetration-test reports should be reviewed, and a qualified specialist should test any high-risk architecture directly.
The organization review must identify dependence on individual experts. Prepare an access-controlled transition plan for source code, credentials, documentation, model accounts, data rights, and customer operations. Interview the founders, product leader, security lead, and at least two engineers or reviewers who understand production failures. Concentration of critical knowledge in fewer than three people is a continuity risk that should be reflected in retention arrangements and closing conditions.
Comparing AI Diligence Approaches
There is no single best way to perform AI acquisition diligence. The right choice depends on asset complexity, transaction value, regulatory exposure, and the acquirer’s internal capacity. AI-assisted tools can accelerate document review, connect related evidence, and flag inconsistencies, but their output must be sampled and interpreted. Traditional financial, legal, and technical diligence remains necessary because automated systems may miss unusual contracts, hidden data rights, or context-specific technical dependencies.
| Feature | AI-Assisted Diligence | Traditional Manual Diligence | Hybrid Approach |
|---|---|---|---|
| Speed | Fast initial review of large document sets | Slower, especially across thousands of records | Machine triage followed by focused expert review |
| Typical coverage | Broad first-pass pattern detection | Deep but sampling-dependent | Broad search plus deep testing of material findings |
| Best use | Contract clustering, metadata extraction, anomaly flags | Judgment-heavy legal and technical analysis | Most mid-market and larger acquisitions |
| Main weakness | False positives, unsupported summaries, access restrictions | Key-person bottlenecks and inconsistent sampling | Higher coordination cost and process discipline |
| Cost profile | Usually subscription, usage, or platform pricing | Primarily professional and internal labor time | Software plus targeted professional-services fees |
| Evidence standard | Leads requiring validation | Primary evidence when properly tested | Automated leads validated against source records |
A hybrid approach is usually the most practical default. Start a time-boxed screening, then set a six-to-eight-week confirmatory process for a conventional mid-sized deal, adjusted for complexity. For example, allocate 15% of effort to legal and privacy, 20% to commercial and financial, 30% to technical validation, 20% to security, and 15% to integration planning. These percentages are starting points, not rules; a healthcare AI asset may need far more legal and clinical work.
Common Mistakes That Distort the Decision
The first common mistake is confusing a technology demonstration with commercial adoption. A system can perform exceptionally well on curated examples while customers still spend more time correcting it than using it. Ask for anonymized workflow observations, error rates by customer, implementation duration, and the percentage of outputs accepted without modification. If management cannot explain who validates results and why customers renew, the apparent technical advantage may not support the valuation.
The second mistake is accepting synthetic benchmarks without independent tests. Ask whether benchmarks were created by the same employees who trained the product, whether test data leaked into model development, and whether results reflect current production traffic. A 90% benchmark can be commercially weak if the remaining 10% contains the most important cases or if human review consumes most of the expected savings.
The third mistake is underestimating inference economics. Low model usage during a pilot may become expensive at scale, especially when long-context requests, retries, tool calls, or human fallback are excluded. Require unit economics by customer segment and test higher traffic without assuming that provider credits or temporary discounts will continue. A valuation based only on software gross margin before compute and review labor can materially overstate buyer value.
The fourth mistake is treating data rights as an afterthought. A company may not have the right to retain customer data for improvement, transfer it after a change of control, or use feedback to train a model serving another customer. Missing rights can force redesign, delay revenue, or restrict the acquired product. Contract and data mapping should occur before integration planning, not after signing.
The fifth mistake is relying on a generated diligence memo as final evidence. Every important conclusion should link to an original contract, invoice, log, model run, security report, or customer record. AI summaries can omit qualifiers and create false confidence, so reviewers should sample high-value outputs and inspect the source text. This discipline is especially important when the tool provider also sells the product being evaluated.
When to Walk Away, Renegotiate, or Proceed
Walk away when a material problem is structural and cannot be fixed within a credible period. Examples include an inability to reproduce most customer outcomes, absence of rights to core data, fabricated usage metrics, unexplained regulatory exposure, or customer contracts that can terminate immediately after closing. Also walk away if key engineers will not transfer and management has not acknowledged the operational dependence. A low price does not automatically repair defective intellectual property or unreliable product economics.
Renegotiate when the business is viable but uncertainty has a measurable cost. Use a holdback, escrow, earn-out, working-capital adjustment, or indemnity tied to specific risks. A 15% holdback may be appropriate for unresolved data rights, but terms should reflect severity, remediation time, and the buyer’s bargaining position rather than copy a generic percentage. For retention risk, consider founder and employee transition bonuses tied to six- or twelve-month milestones.
Proceed when the team can explain the product, reproduce representative results, verify revenue, establish data rights, and quantify known limitations. That does not mean the asset is free from defects. It means the buyer knows what it is buying, can price uncertainty, and has a practical plan to operate the system after acquisition. Given the post-acquisition operating systems discussed in M&A literature, integration planning should begin during confirmatory diligence and include model ownership, customer communication, hiring priorities, control testing, and a 100-day risk review.
Set decision gates early. By the end of initial screening, eliminate any asset that fails fundamental rights, customer, or credibility tests. Within 30 days of confirmatory diligence, resolve commercial and technical evidence; by day 60, complete legal, security, and financial reviews; and before signing, document conditions, indemnities, and post-close milestones. If management resists independent validation or refuses access to underlying evidence, that refusal is itself a material signal.
A Practical 30-Day Acquisition Diligence Sequence
Start on day one by creating a controlled data room, assigning workstream owners, and separating verified facts from management claims. During week one, reconcile revenue concentration, inspect the top 20 customers, review the 30 most important contracts, and identify every external model or data dependency. A finding of 40% revenue concentration or a 25% host-cost share should trigger deeper work immediately rather than sit unnoticed until final valuation.
During week two, run technical reproduction and security review. Select at least 100 representative production cases for a simple transaction workflow, or a smaller statistically appropriate sample for a high-volume system. Document task completion, error severity, latency, human intervention, and inference cost. Review the latest 12 months of incidents and test restore procedures, access controls, and separation of customer data.
During week three, complete financial normalization and legal mapping. Build customer-level contribution margins, test downside pricing, and identify liabilities related to warranties, indemnities, privacy incidents, or promised roadmap items. Mark each issue as closing-critical, price-adjustment, post-close remediation, or accepted business risk. During week four, interview reference customers, test integration dependencies, and issue a written investment committee memo with a valuation adjustment for unresolved risks.
The final memo should state what is known, what was tested, what was not accessible, and who owns each remaining action. Numbers should carry units and dates: percentage of revenue, annualized run rate, measured gross margin, count of affected customers, hours of manual review, and days to remediate. By making those distinctions explicit, the AI acquisition diligence checklist becomes more than a collection of review tasks; it becomes a decision system for determining whether the acquired technology can survive scrutiny after the transaction.