AI Due Diligence: What Buyers Must Test
Almost every information memorandum now has an AI story. The target is "AI-enabled", its product has "proprietary models", and the value creation plan assumes AI will take cost out of operations. For a private equity investor or corporate acquirer, the question is no longer whether the business uses AI. It is whether the AI is real, whether the business owns it, and whether it has created liabilities that will land on the buyer after completion. That is what AI due diligence is for, and it is fast becoming a distinct workstream within technology due diligence.
AI due diligence is the part of technology due diligence that tests a target business's use of artificial intelligence: whether its AI capability is real and owned, what it depends on, what data and intellectual property risks it carries, and whether it is governed well enough for a buyer to rely on it.
This guide sets out what boards, deal teams and PE operating partners should test, where the money is usually at risk, and how to scope the work proportionately to the deal.
Why AI due diligence now sits on the deal critical path
Three things have changed in the last two years.
AI is now priced into valuations. Sellers know that an AI narrative supports a higher multiple, so it appears in almost every process. Buyers are paying for it, which means they need evidence for it. A BearingPoint Capital survey reported by City AM found that over a third of PE firms had increased spending on more detailed assessments around cyber, AI and scalable technology, and that buyers increasingly struggled to separate real AI functionality from marketing spin.
Regulators have named the problem. "AI washing", overstating what AI does or how much a business relies on it, has drawn enforcement action from the US SEC and the FTC. In Europe, the EU AI Act imposes tiered obligations that reach UK businesses selling AI-enabled products or services into the EU. Remediation costs for a non-compliant high-risk system can be material, and they belong in the deal model, not the 100-day plan.
Insurers are pulling back. Leading deal lawyers report that warranty and indemnity insurers are looking harder at AI and introducing AI-specific exclusions. If the policy will not respond, the risk sits with the buyer unless the SPA allocates it elsewhere. The collapse of London-based Builder.ai into insolvency in 2025, amid reporting that questioned its revenue figures, moved the gap between AI narrative and operational reality firmly onto the boardroom agenda.
What AI due diligence should test
Generic questionnaires ask whether the target uses AI and whether it has a policy. Those questions no longer tell a buyer anything useful. An effective AI due diligence review tests five areas, each tied to value or liability.
1. Capability: is the AI real and differentiated?
Many "AI-powered" products are third-party models wrapped in a user interface, or rules engines with an AI label. That is not necessarily a problem, but it should change the price. Diligence should establish what is proprietary, what is licensed, what is actually automated and what still depends on people behind the scenes. The test is simple: if a competitor could replicate the capability in a quarter using the same commercial models, it is not a moat.
2. Dependency: who controls the platform?
Where core workflows run on a single external AI provider, the commercial terms matter more than the technology. Buyers should review pricing exposure, usage limits, API deprecation risk, data use rights and the cost of switching. A business that cannot renegotiate or exit its AI platform has a margin risk that rarely appears in the IM.
3. Data and IP: does the business own what it claims to own?
Training data provenance, customer contract permissions and the ownership of AI-generated output all bear directly on enterprise value. If models were trained on customer data without the contractual right to do so, or if code was generated by tools whose terms are unclear, the asset the buyer believes it is acquiring may be weaker than presented.
4. Shadow AI: what has leaked out of the business?
Generative AI tools enter organisations quietly. Staff paste contracts, financials, customer data and source code into public platforms, often accepting terms on the company's behalf without legal review. None of this shows up in an IT asset register or a standard cyber report. A target with no record of which AI tools are in use, and what data has passed through them, has a governance gap that is itself a finding. We cover the board-level controls in more detail in our guide to governing shadow AI.
5. Governance and compliance: can management evidence control?
Where AI influences pricing, underwriting, hiring, claims or customer communications, buyers need to see validation procedures, human oversight and audit trails. Warranties are only as good as the documentation behind them. A representation that outputs are validated is worth little if no validation process exists, and that gap cannot be solved by drafting alone.
The red flags that should change the price or the structure
In our experience, these findings most often move a deal, through price, specific indemnities, escrow, earn-out conditions or a revised 100-day plan:
- AI revenue or cost-saving claims in the equity story that management cannot evidence with system data
- Core product capability dependent on one external model provider on standard, non-negotiated terms
- No inventory of AI tools in use and no policy that staff actually follow
- Customer or employee data used for training without clear contractual permission
- AI-assisted decisions in regulated processes with no human oversight or audit trail
- Key AI capability concentrated in one or two individuals with no retention arrangements
- AI exposure excluded from the W&I policy with no alternative risk allocation in the SPA
None of these is automatically a reason to walk away. Each is a reason to price correctly, protect the buyer contractually and plan remediation before completion rather than after it.
How to scope AI due diligence to the deal
AI due diligence does not need to be a separate, expensive exercise. It should be proportionate to how much of the investment thesis depends on AI.
Where AI is peripheral (most mid-market manufacturing, services and distribution targets), a focused set of questions within the wider technology review is usually enough: shadow AI exposure, data handling and any AI claims in the equity story.
Where AI supports the value creation plan (cost reduction through automation, for example), diligence should test whether the plan is deliverable with the target's data, systems and people, and what it will really cost.
Where AI is the product, a dedicated deep-dive is warranted, covering capability, dependency, IP, regulatory classification and team.
For deals at an early stage, a fixed-fee technology red-flag review gives the deal team a one-page RAG view of the top technology and AI risks, and a clear verdict on whether full diligence is warranted, before significant advisory fees are committed.
Why independence matters in AI due diligence
AI is the area of technology diligence most exposed to conflicts of interest. Advisers who also sell AI implementation, platforms or managed services have an incentive to find a large remediation programme. Software vendors have an incentive to find their own product missing.
Intology is an independent consultancy. We have no technology products to sell and no vendor partnerships to protect. Our diligence is led by senior practitioners who have run technology functions inside PE-backed and listed businesses, so findings are written for the investment committee: what the risk is, what it is worth and what to do about it. Where an engagement continues after completion, findings flow directly into the technology 100-day plan and are delivered through our Embedded Change Model™, so change lands in the business rather than in a report.
For sponsors who need ongoing AI leadership after the deal, a fractional Chief AI Officer can own the remediation and value case through the hold period. AI diligence also sits within our wider M&A advisory services and private equity value creation work.
Frequently asked questions
What is AI due diligence?
AI due diligence is the part of technology due diligence that tests a target's use of artificial intelligence: whether its AI capability is real and owned, what it depends on, what data and IP risks it carries, and whether governance is adequate. It informs price, deal structure and the post-completion plan.
How is AI due diligence different from using AI to do due diligence?
They are different things. AI-powered diligence tools help advisers review data rooms faster. AI due diligence assesses the AI inside the business being acquired. Buyers need the second whatever tools their advisers use.
When should AI due diligence start?
As early as possible, ideally before the first-round bid where AI features in the equity story. A short red-flag review at that stage shows whether the AI claims justify the price before the deal team commits to full diligence.
How long does AI due diligence take?
Where AI is one part of a wider technology review, it adds little time. A full technology due diligence typically takes two to four weeks depending on scope and access to management and the data room. A dedicated deep-dive on an AI-first business is scoped to the deal timetable.
What does AI due diligence cost in the UK?
Intology's technology red-flag review is a fixed fee of £3,500 plus VAT per target, with complex or accelerated deals quoted up to £5,000. Full technology due diligence, including AI, is quoted as a fixed fee per deal once scope is agreed.
Does the EU AI Act affect UK acquisitions?
It can. UK businesses that place AI systems on the EU market, or whose AI outputs are used in the EU, may fall within its scope. Diligence should establish whether any of the target's AI use could be classified as high-risk and what compliance would cost.
Know what you are paying for before you sign
If AI features in the equity story of a deal you are working on, test it before it is priced in. Intology provides independent, fixed-fee technology and AI due diligence for private equity investors and acquirers across the UK, with an NDA within 24 hours and a response within one working day.