Before you sign, you’ll know how the target uses AI today, where that use creates risk, and how much efficiency further AI adoption could unlock after close. Clear findings your deal team can price in, in as little as 3–5 days.
Before the LOI through signing
Runs inside your IT due diligence, 3–5 days to 3 weeks
AI risk findings, a readiness score, use cases worth pursuing
Deal teams and operating partners
Diligence
Day 1
TSA exit
Integration
M&A AI due diligence checks a target’s AI before you buy it. It looks at two sides: the risk AI is already creating, from staff pasting company data into free tools to AI features with no governance behind them, and the value AI could add to your investment thesis. You come away knowing what to price in, what to fix before close, and what belongs in the 100-day plan.
The term is also used for software that speeds up document review in a data room. That’s a different thing. This is diligence on the target’s own AI: how it’s used, governed, secured and built, and whether the data can carry the use cases in your plan. It runs as one lens of our IT due diligence, so you get it without a separate workstream.
Is the AI the product’s real edge, or a thin layer on someone else’s model?
Will one AI policy hold across every company you buy?
Is regulated data going into AI tools that aren’t approved for it?
Is the data good enough for AI forecasting, inventory and pricing?
Which AI tools, licences and data leave with the business?
What will a buyer’s AI diligence find, and can you close it first?
AI runs through all four lenses of our diligence, so it’s never reviewed in a silo. Each lens adds the AI checks your deal team needs.
Data architecture and warehousing
Data quality and governance
AI infrastructure readiness
Outside data sources
Automation maturity
AI-ready applications
Is the data AI-ready?
Can AI run at scale?
AI data governance and privacy
Model security
Ethics and bias
Data access controls
AI compliance: GDPR, CCPA, HIPAA, NIST AI RMF, EU AI Act
Third-party AI risk
Is sensitive data protected?
Are the models secured against attack?
AI feature roadmap
MLOps maturity
AI-ready architecture
Safeguards against prompt injection and data leakage
AI talent and skills
AI development tools
Can AI set the product apart?
Is the architecture ready for it?
Demand forecasting
Inventory optimization
Supplier analytics
Returns and quality
Sales pipeline analytics
The operational data foundation
Where can AI cut cost or manual work after close?
Sector add-ons for healthcare, financial services and industrials. Where AI could reshape the target’s market, we also look at pricing pressure, AI-native competitors and what it would cost to keep up.
Most targets don’t sell AI. Their AI risk sits in how people already use it. Each finding comes tagged with what your deal team should do about it.
A cost the deal model should carry
Ask the seller to fix it, or cover it in the terms
A first priority after close
Staff use whatever tools they like, and nobody signs off.
Customer lists, financials and code pasted into tools the company doesn’t control.
Personal, health or card data going where it’s not allowed.
The edge in the CIM turns out to be a thin layer on a third-party model.
Contracts that let a vendor keep company data or train its models on it.
It can be pushed off task, or into saying something it shouldn’t.
Features shipped without a skilled developer checking behaviour and security.
The AI use cases in the plan need data the company doesn’t have or can’t trust.
Every finding comes with a cost to fix and a place in the deal: the price, the terms or the 100-day plan.
Every finding rolls up to one answer for your investment committee: which AI claims in the thesis hold up, what has to happen for the rest to hold, and where the risk belongs in the deal.
A verdict on each AI claim in the thesis
An AI readiness level for each lens, from 0 to 5
Findings tagged by deal action, with a cost to fix
An AI pricing engine lifts margin
Owned model, clean data, already in production.
An AI support agent cuts service costs
No guardrails yet. Fix before it scales.
Proprietary machine learning
A thin layer on a third-party model.
Illustrative example, not a client result.
It runs inside your IT due diligence, on the same timeline, with the same senior team.
AI questions go into the request list, and we read the CIM, deck and data room for AI claims and AI use.
Interviews with leadership, product and IT test the claims. Early qualifiers and disqualifiers reach the deal team within days.
AI findings tagged by deal action, a readiness score and the use cases worth pursuing, in the read-out and the report.
After close, the findings become the starting point for an AI maturity assessment and a governance baseline.
AI due diligence runs inside our IT due diligence. Here’s what that diligence has delivered for sponsors.
Diligence found that a $150M firm serving top-20 U.S. banks had no real security program. After close, we built one to FFIEC banking standards, and the company passed its banking audit with zero findings.
Read the case study →
A $500M division carved out of an $8B public company, with eight facilities on different ERPs and the CIO gone a week before close. We centralized the ERP within three months and stabilized IT.
Read the case study →
A $300M division carved out of a $6B parent faced a 12-month TSA. A rapid IT assessment right-sized the infrastructure and ERP, and the business was running on its own systems in five months.
Read the case study →A very practical assessment of systems, procedures and shortcomings. Conducted 100% remotely with clear communication, and completed a full report on a very tight deadline.
Principal, PE firm with $20B AUMSomething we haven’t covered? A partner can answer it on a short call.
It’s a review of a target’s AI before you sign. It checks the risk AI already creates (how staff use AI tools, what data goes into them, and the policy and controls behind them) and the value AI could add to the investment thesis.
Findings come tagged as price it in, fix before close or 100-day plan, so the deal team knows exactly where each one belongs.
No. AI tools can speed up document review in a data room, and that’s useful. AI due diligence is different: it’s diligence on the target’s own AI, to find out whether it’s a liability, an asset or just a story in the CIM.
It runs as one lens of our IT due diligence, at every tier, from a 3–5 day red-flag review before the LOI to a full-scope review in 2–3 weeks.
You get the AI findings in the same read-out and report, with no extra workstream to manage.
No. Most targets don’t sell AI, but nearly all of them use it. The biggest risks usually sit in everyday use: company data in free tools, no policy, and vendor terms nobody checked.
For software targets, we also test whether the AI in the product is real and defensible.
It starts from your investment thesis, not a generic checklist. We look at whether the AI use cases in your plan are realistic, flag early qualifiers and disqualifiers, and add sector guidance for healthcare, financial services and industrials.
For a platform with add-ons, the same baseline gives you one view of AI risk across every company you buy.
The findings feed an AI maturity assessment: a score, a governance baseline set at your risk appetite, training by role and a roadmap of the use cases that pay first.
That’s the first stage of AIM-PE, the framework behind our AI consulting for private equity.
What the target’s IT will really cost to run, fix, separate or integrate, before you sign.
Code, architecture, tech debt and the cost to scale a software target, checked before you sign.
Security posture, compliance gaps and cyber-insurance exposure, priced before signing.
Whether the ERP can carry the investment thesis, before signing or after close.
Separation design, TSA scope and governance, Day 1 cutover and an early exit from the TSA.
Day 1 readiness, then moving the add-on onto the platform’s systems.
One office running every workstream for carve-outs, ERP integrations and other transactions.
From diligence to Day 1, TSA exit and integration, with one senior team.
Start with a red-flag review: three to five days, AI included, and a clear view of the risk and the upside.
