AI startups are attracting record levels of acquisition interest. From PE firms building AI-enabled portfolio companies to strategic acquirers racing to embed intelligence into their platforms, the volume of AI-related M&A activity in 2025 and 2026 has been striking.

What is less widely discussed is how poorly traditional technology due diligence frameworks handle AI companies. The tools, methodologies, and assessment criteria that work well for evaluating a conventional SaaS platform frequently miss the most important risks when the target is an AI business.

Here is why — and what rigorous AI due diligence actually requires.

The Core Problem: AI Systems Are Fundamentally Different

A conventional software system does what its code says. You can read the logic, trace the decision paths, and predict the output for a given input. Assessing quality is largely a matter of evaluating structure, standards, and engineering practices.

AI systems do not work this way. A large language model, a machine learning pipeline, or a computer vision system produces outputs that emerge from training data, model architecture, and inference processes that are not directly readable in the same way as traditional code. The behaviour of the system is a function of data as much as code — and assessing that behaviour requires a fundamentally different approach.

This distinction has significant implications for due diligence. An assessor who knows how to evaluate a SaaS codebase may not have the skills to evaluate an AI system’s performance, reliability, or risk profile. And an AI company that looks technically impressive on the surface may have deep structural problems that a conventional code review simply will not surface.

Risk 1: Model Performance Is Easy to Misrepresent

AI systems are evaluated by their outputs — and outputs can be curated. A demonstration of an AI model in a controlled environment, on a cherry-picked dataset, tells you very little about how it performs in production on real-world, messy, unpredictable data.

Rigorous AI due diligence requires independent evaluation of model performance on representative data — including edge cases, adversarial inputs, and the kinds of failure modes that only emerge under realistic conditions. Without this, performance claims made during the sales process cannot be meaningfully validated.

Risk 2: Training Data Is a Hidden Liability

The value of an AI system is inseparable from the data it was trained on. That data carries risks that are invisible until you look closely — and sometimes even then.

Key questions include: where did the training data come from? Was it licensed appropriately, or does it include scraped web content that creates copyright or IP exposure? Does it contain personal data that creates GDPR or privacy compliance risk? Is it representative of the real-world population the model will serve, or does it embed biases that will create legal, reputational, or operational problems post-close?

Data provenance and compliance is one of the highest-risk areas in AI due diligence and one of the most commonly overlooked. It requires legal and technical assessment working in parallel — not just an engineering review.

Risk 3: AI Talent Is Disproportionately Concentrated

AI research and engineering talent is scarce, highly mobile, and often concentrated in very small teams. In many AI startups, the core model capability — and the institutional knowledge needed to maintain, improve, and explain it — resides with two or three individuals.

This creates an extreme version of the key person dependency risk that exists in any technology acquisition. If those individuals leave post-close — and AI talent has plenty of options — the acquirer may find themselves owning a model they cannot explain, improve, or debug. Understanding the talent structure and retention risk of an AI team is not optional due diligence. It is central to understanding what you are actually acquiring.

Risk 4: Regulatory Risk Is Evolving Fast

The regulatory environment for AI is changing rapidly. The EU AI Act — now in force — creates specific obligations for high-risk AI systems, with significant penalties for non-compliance. Similar frameworks are emerging in the UK, US, and elsewhere.

An AI startup that was operating in a benign regulatory environment eighteen months ago may now be subject to compliance requirements it has not yet addressed. Understanding what regulatory obligations apply to the target’s AI systems, and whether the company is meeting them, is a critical component of due diligence that did not exist in its current form for most conventional SaaS acquisitions.

Risk 5: “AI-Powered” Is Not Always What It Seems

Not every company that describes itself as an AI business is building fundamental AI capability. Many are thin wrappers around third-party foundation models — GPT, Claude, Gemini — with limited proprietary technology underneath.

This is not necessarily a problem, but it needs to be understood clearly before a deal is priced. A company whose core product is built on API calls to a third-party model has a very different risk profile — and a very different defensibility — than one with genuine proprietary model capability. The valuation implications are significant, and the distinction is not always obvious from the outside.

What Rigorous AI Due Diligence Requires

Assessing an AI startup properly requires capabilities that go beyond traditional technology due diligence:

• AI/ML engineering expertise to evaluate model architecture, training methodology, and performance claims
• Data science capability to assess dataset quality, provenance, and bias
• Legal and compliance knowledge covering AI regulation, IP, and data privacy
• Talent assessment skills to map knowledge concentration and retention risk

At VeryDiligent, we have developed a specific framework for AI due diligence that addresses each of these dimensions — giving investors and acquirers a clear, independent view of what they are actually buying when they acquire an AI business.

Contact us today to discuss your upcoming AI acquisition.

Related reading: Cybersecurity Due Diligence: The New Dealbreaker | Legacy Systems in M&A: The Technical Risks Investors Miss | Our Framework for Technology Due Diligence Explained