This article is for boards, audit and risk committees, corporate development teams, legal leaders, and technology executives. You need to decide whether AI changes deal value, transaction risk, or integration complexity.
We define AI diligence, show where AI supports the deal lifecycle, list what to examine in the target, and turn findings into defensible decisions and a post-close plan.
Key Takeaways
- Two tracks define AI diligence: using AI to review deal materials, and evaluating the target's own AI.
- Look past model performance to security, privacy, IP, contracts, regulation, and continuity.
- Evidence gathering accelerates with AI; qualified people decide materiality, valuation, and risk acceptance.
- Board-ready output names the risk, evidence, impact, owner, escalation threshold, deal treatment, and post-close action.
What Is AI Due Diligence for M&A?
Two meanings, kept separate
AI diligence is the structured investigation of how a target develops, buys, deploys, governs, secures, and uses AI before closing. That is diligence of AI.
The phrase also describes using AI tools to review contracts, financials, and public records. That is diligence with AI. Mixing the two blurs both the evidence and the risks.
The expected output is an evidence-backed view of material risks, dependencies, obligations, and remediation needs. An unverified AI-generated summary does not qualify.
Why AI is now a transaction issue
AI can affect a target's revenue claims, customer commitments, IP, data rights, regulatory exposure, and reliance on outside providers. Deloitte's 2025 study surveyed 500 corporate and 500 private-equity respondents, and 86% reported integrating GenAI into M&A workflows.
Adoption is not accuracy, though. Stanford researchers found that leading legal research tools hallucinated on more than one in six queries. That benchmark covers legal research, not M&A contract review, but it shows why validation matters.
Cyber history shows what hidden liabilities cost. Verizon discovered Yahoo's breaches during diligence, and the price dropped by $350 million. AI exposures can work the same way.
Who owns what
Corporate development, legal, finance, privacy, security, engineering, compliance, HR, and business leaders each review a different slice of the target's AI estate.
The board should not test models. It should require:
- Named owners for each workstream
- Materiality thresholds
- Escalation rules
- Evidence behind every high-impact conclusion
How AI Supports the M&A Due-Diligence Lifecycle
Pre-deal and outside-in research
AI can organize public disclosures, regulatory actions, litigation, patents, job postings, product claims, and adverse media before the data room opens. The output is a question list, not a verdict. Label each item as a confirmed fact or a signal for management follow-up.
Data-room ingestion and request lists
AI can classify and index contracts, policies, architecture documents, vendor records, incident reports, and security evidence. Pair that with a targeted AI request list:
- Model and use-case inventories
- Data maps
- Training and testing records
- AI vendor contracts
- Customer representations
- IP records
- Incident history
- Governance materials
Contract and obligation analysis
Natural language processing can extract change-of-control provisions, data-use rights, audit rights, model restrictions, indemnities, and licensing terms. Every material finding must link to the source document, clause, version, and reviewer so lawyers can check it.
Technical and cyber analysis
AI can compare architecture diagrams, access records, cloud configurations, data flows, and vulnerability reports to surface inconsistencies or concentration risk. Use it to prioritize human review and testing. It does not replace qualified security, privacy, or engineering judgment.
Post-close integration
Structured findings should feed integration planning: model ownership, vendor consolidation, data governance, access reviews, and incident response. Sort each risk into one of three buckets:
- Resolve before closing: issues that change the decision or price
- Handle through deal protections: items allocated by representations, indemnities, or escrow
- Post-close roadmap: manageable improvements with owners and dates
What to Examine in an AI Due-Diligence Review
AI inventory and materiality
Require a full inventory of AI in use:
- Models, copilots, and automated decisions
- Internally built systems and embedded vendor features
- Public AI tools employees use
The NIST AI RMF treats inventory as a foundation for governance. Rate each item on:
- Business criticality and revenue dependence
- Customer or employee impact
- Sensitive-data access and regulatory significance
- Cost of failure
Data rights, IP, and privacy
Ask what data trains, tunes, and runs each system, and whether the target can lawfully use it and transfer it. The stakes are real. In FTC orders such as Everalbum and WW/Kurbo, remedies reached the models and algorithms built on improperly collected data, not just the raw data.
Review ownership and licensing of code, models, prompts, outputs, open-source components, and vendor AI features. Note any restrictions triggered by a change of control. Purely AI-generated output may lack copyright protection under Copyright Office guidance.
Security, resilience, and dependencies
Assess technical controls and third-party concentration:
- Identity and access controls, encryption, logging, and monitoring
- Model and prompt security, including prompt injection and data poisoning
- Backup, recovery, and incident response
- Dependencies on cloud, foundation-model, and data providers
- Single points of failure, pricing exposure, and termination rights
Legal and regulatory exposure
Map the requirements to the target's sector, use cases, data, and customers. Current examples include:
- Colorado: replacement legislation (SB26-189) generally operative January 1, 2027
- California: ADMT compliance beginning January 1, 2027
- Texas: TRAIGA, effective January 1, 2026
- New York City: bias audits for automated employment tools
- Illinois: employment AI rules effective January 1, 2026
The SEC's Presto proceeding shows the risk of misleading AI claims, including undisclosed third-party technology.
Flag EU AI Act exposure if the target operates across borders. Check pending investigations, customer disclosures, and marketing claims, and have counsel confirm current requirements.
Model performance and oversight
Request validation, testing, bias assessment, monitoring, version control, and human review records. Keep technical accuracy separate from business suitability, legal acceptability, and explainability. A model can be accurate and still be unusable if the target cannot explain an adverse decision.
Commercial value and red-flag classification
Test whether AI-related revenue, savings, and valuation assumptions hold up against contracts, usage data, and unit economics. Then classify findings:
- Deal breakers: stop or restructure the transaction
- Price or protection issues: adjust value or allocate risk
- Pre-close remediation: fix before signing off
- Post-close improvements: track with an owner and date
Governance, Security, and Human Oversight
Secure AI use inside the deal team
Set rules for your own tools before any deal data touches them:
- Access controls and matter-level data separation
- Retention limits and encryption
- Vendor training policies and data residency where relevant
Require a documented approval process and ban confidential materials in unapproved public tools. ABA Opinion 512 requires lawyers to verify AI output and weigh confidentiality against tool terms.
Evidence and auditability
Outputs should carry citations, timestamps, document versions, confidence limits, and a record of human review. A polished summary with no trail is unsuitable when findings drive valuation, protections, or regulatory representations.
Human-in-the-loop checkpoints
Define review points for legal interpretation, security conclusions, privacy analysis, financial assumptions, and model performance. Then test the tools on representative documents for:
- Hallucinations and omissions
- Inconsistent treatment across similar facts
- Bias and false positives
A vendor demo is not a test.
Decision rights and escalation
Decide in advance who can accept, remediate, defer, or escalate each risk. A workable tiered model:
- Low: limited impact, management accepts within policy
- Medium: affects a critical process, executive approval, time-limited
- High: material outage, regulated exposure, or brand damage; escalate to the CEO, committee chair, and full board when thresholds are crossed
Tie each high-severity issue to a concrete decision:
- More diligence or a management representation
- Remediation covenant, indemnity, or escrow
- Price adjustment, closing condition, or walking away
Board reporting
Give the board a plain-English dashboard: material AI dependencies, risk trend, unresolved issues, owners, deadlines, and changes since the last review. That is the standard Tyson Martin applies in board work: clear decision rights, credible reporting, stable metrics, faster escalation, and execution you can inspect.
How to Implement an AI Due-Diligence Process
Set scope, owners, and evidence standards
Start with:
- Deal thesis, sector, and operating model
- Sensitive data and known AI use cases
- Geographic exposure and risk appetite
Assign accountable owners across legal, technology, security, privacy, finance, and operations.
Then define required evidence, how materiality is judged, which findings need independent validation, and when to escalate.
Build an evidence-based issue register
Record each finding with:
- Source and affected system or contract
- Business impact and likelihood
- Regulatory relevance
- Owner and remediation status
- Proposed transaction treatment
Use AI to sort and summarize evidence. Specialists validate conclusions and document unresolved uncertainty. A vendor action is not done until evidence is received and validated.
Turn findings into a decision and 90-day plan
Translate findings into negotiating positions, closing requirements, warranties, indemnities, integration sequencing, access reviews, and monitoring. Legal counsel decides the transaction language. Skadden's 2026 analysis treats AI-specific representations and indemnities as options, not standard terms.
If no executive clearly owns the issue, Tyson Martin's board advisory and interim or fractional CISO support can help set decision rights, escalation thresholds, and a 90-day cyber-risk plan with owners and measurable outcomes.
His M&A cyber due diligence engagement typically runs three to four weeks and ends with a board-ready risk summary, red-flag memo, and post-close remediation roadmap.
Frequently Asked Questions
What is AI due diligence?
It is both the evaluation of a target's AI systems and the responsible use of AI to examine documents, risks, obligations, and evidence during an M&A process.
How is AI used in due diligence?
Teams use it for document classification, contract and policy analysis, pattern detection, public-source research, issue tracking, and reporting. Human experts make the final decisions.
What should an AI due diligence checklist for M&A include?
A solid checklist covers AI inventory, data and IP rights, privacy, cybersecurity, third-party dependencies, contracts, regulatory exposure, model testing, governance, business value, and post-close integration.
What are the main risks of using AI in M&A due diligence?
Main risks include incomplete data, hallucinations, missed clauses, bias, privacy and security exposure, weak auditability, vendor dependence, and overreliance on automated conclusions.
How can boards oversee AI risk during an acquisition?
Boards should require clear ownership, materiality thresholds, traceable evidence, plain-English reporting, escalation rules, deal protections where needed, and measurable post-close remediation.
