Technical due diligence for AI companies adds six questions to a standard review: what the company owns, its rights to training data, how model quality is evaluated, whether costs scale with usage, how dependent it is on model providers and whether security covers the AI stack.
In many AI deals the model is the least defensible asset. Data rights, evaluation discipline and inference economics decide what you are really buying.
Buying an AI company for its model is like buying a restaurant for its signature dish without reading the lease. The dish may be excellent, yet the ingredients may be borrowed and every busy night may lose money. This guide sets out the six questions, evidence and margin check that reveal what an AI deal truly contains.
Why AI deals need a different review
Conventional technical due diligence covers architecture, code quality, security, the team and intellectual property. All of that still applies. It misses, however, where an AI company's value and risk actually sit.
The commercial stakes are real. In 2024 Gartner predicted that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025. In 2025 it warned of "agent washing", meaning products rebranded as agentic without real agentic capability. An investor who pays for a model builder and receives a thin layer over another firm's model has overpaid.
The six questions that decide what you are buying
Organise the AI-specific work around six questions. Each has evidence that answers it and a red flag that should change the price, the terms or the decision.
| Question | Evidence to request | Red flag |
|---|---|---|
| What does it own? | Model lineage and a live switching test | An unmodified third-party model behind a prompt |
| Does it have rights to its data? | Source, licence and consent for each dataset | Data reused with no recorded basis |
| Is quality measured? | Versioned evaluation sets and results history | Quality judged by demos and complaints |
| Do costs track revenue or usage? | Inference cost and revenue by customer cohort | Flat pricing with usage-driven costs |
| How exposed is it to model providers? | Provider contracts and a tested fallback | One provider on standard terms |
| Is the AI stack in security scope? | Audit scope covering logs and pipelines | Prompt logs outside any audited scope |
Gather the evidence that answers them
Send a focused data room request early, because gaps in what returns are findings in their own right. A sound first request covers five areas.
- Architecture: the AI stack from data to serving, naming every third-party model.
- Data inventory: each dataset with its source, licence and personal data status.
- Evaluation: test sets, metrics and results for recent model releases.
- Costs: twelve months of inference cost and revenue by customer cohort.
- Assurance: any SOC 2 report or ISO/IEC 27001 or ISO/IEC 42001 certificate.
Next, run a switching test. Ask the team to replace its primary model with an alternative, live, and score both on its own evaluation set. If quality holds, the value lies in data and workflow, which may be durable. If quality collapses, the company depends on a model it does not control.
Then trace the rights behind each dataset. Customer data used for training needs contractual permission, and personal data brings GDPR duties. Providers of general-purpose AI models on the EU market have faced EU AI Act obligations since 2 August 2025. Ask counsel to confirm the company's role.
Insist on evaluation history for recent releases, including one release that was stopped because quality regressed. Read the provider contracts for deprecation notice, rate limits and price changes. A tested fallback to a second provider is a strong signal, whereas a plan on a slide is not.
Finally, check that security scope covers prompt logs and training pipelines. Identify who can retrain, evaluate and deploy the models, since knowledge held by one or two people is a key-person risk.
Check margin by usage cohort
Inference costs are where AI companies differ most from conventional software. Consider a hypothetical company that charges a flat fee per seat but pays its model provider per request. Other cost of revenue is 12% throughout.
| Scenario | Inference cost (% of revenue) | Gross margin |
|---|---|---|
| Average customer today | 18% | 70% |
| Heaviest-usage tenth of customers | 55% | 33% |
| Average usage doubles, same pricing | 36% | 52% |
| Usage doubles, model price falls 30% | 25.2% | 62.8% |
The margin depends on two things the company does not fully control: customer usage and provider pricing. Ask whether pricing includes usage tiers or fair-use limits. Ask also whether cheaper models can handle routine requests without failing the evaluation set.
Turn findings into deal terms
Most findings do not end a deal; they change its shape. Record each one with its severity and proposed response, so the committee sees risks priced rather than listed. These are common options to discuss with counsel.
- Unlicensed training data: remediation before closing, or a specific indemnity.
- Usage-driven costs: a revised forecast and a pricing change in the first 100 days.
- Single provider: a post-closing fallback plan with a deadline.
- Key-person risk: retention arrangements and a documented handover.
The bottom line
Conclusion
A signature dish does not make a restaurant sound if the lease is short and the ingredients are borrowed. An AI company is the same: its value lies in what it owns, its data rights, its evaluation discipline and margins that hold as usage grows.
Diligence that tests those things turns an AI narrative into a set of priced, owned risks. This week, add the six questions to your next AI deal checklist and ask the target to schedule a live switching test before valuation talks.
Frequently asked questions
What is a switching test in AI due diligence?
It replaces the company's primary model with an alternative and scores both on its own evaluation set, showing whether value sits in the model or in the data and workflow around it.
Why do inference costs matter so much in an AI deal?
Inference costs usually rise with usage, so a company charging flat fees can see gross margin fall sharply as customers use the product more.
Does fine-tuning a model make a company a provider under the EU AI Act?
Usually only if the modification significantly changes the model, which guidance links to using more than a third of the original training compute. Counsel should confirm the company's role.
What is key-person risk in an AI company?
It is the risk that the knowledge needed to retrain, evaluate and deploy models sits with one or two people, so their departure would stall the product.
Do due diligence findings usually stop a deal?
Most do not. They are typically reflected in price, pre-closing remediation, specific indemnities or a post-closing plan agreed with counsel.
References
- Gartner, 30% of generative AI projects will be abandoned after proof of concept by end of 2025 (29 July 2024)
- Gartner, over 40% of agentic AI projects will be canceled by end of 2027 (25 June 2025)
- EUR-Lex, General Data Protection Regulation (EU) 2016/679
- European Commission, Guidelines for providers of general-purpose AI models
- Secureframe, SOC 2 Trust Services Criteria explained
- ISO, ISO/IEC 27001 Information security management
- IEC Webstore, ISO/IEC 42001:2023 Artificial intelligence management system
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.