AI Governance in M&A Due Diligence: The Questions Buyers Should Be Asking Today

AI Governance in M&A Due Diligence: The Questions Buyers Should Be Asking Today

When a strategic acquirer walked away from a $180M target last year, boards and deal teams took notice. On paper the business looked like an ideal fit - recurring revenue, sticky customers, and a road map that extended the acquirer's product line. What sank the deal was not revenue churn or a customer contract clause. It was the AI due diligence: an audit revealed unlicensed training data, unresolved third-party IP claims, and exposure under the EU AI Act that would have required costly remediation to bring certain models into compliance. The buyer estimated remediation and indemnity exposure at a multiple of the agreed purchase price and pulled the plug.

That story is becoming common. AI models are now both strategic assets and potential liabilities. For buyers, sellers, and lenders, AI governance is no longer a niche technical review - it's a material part of commercial diligence that affects valuation, deal structure, and post-close integration.

This article sets out a practical AI diligence playbook: the questions buyers should ask, the documents to request, the red flags that change deal value, and what sellers should do 12 months before a sale to avoid surprises.

Why AI governance matters in M&A - fast
- Models and datasets can be the core intellectual property of a company, or they can be legal and regulatory time bombs.
- Emerging regulation (notably the EU AI Act) creates compliance obligations for "high-risk" systems that can carry fines, mandatory corrective orders, or market withdrawal.
- Data provenance and licensing determine whether outputs - and revenue streams built on those outputs - are legally defensible.
- Cyber and operational risk: model vulnerabilities, poisoned training data, or subcontractor failures can cause outages, breaches, or bias incidents that hit revenue and reputation.
- Lenders and acquirers increasingly see AI governance as evidence of operational maturity (or the lack of it). That influences leverage, pricing, and covenants.

An AI diligence playbook buyers should use today
Treat AI diligence as a parallel to cyber, privacy, and IP diligence, not an optional add-on. The core categories below map to documents to request, the questions to ask, and the red flags that typically change headline value or push for holdbacks and indemnities.

1) AI inventory and risk tier review
What it is: A catalog of all deployed, in-development, and productized AI models, including their functions, customers served, and where they run (on-prem, cloud, edge).

Documents to ask for:
- Master AI inventory (model name, version, owner, purpose, criticality)
- Business owner register and risk tiering framework
- Architecture diagrams showing data flows and integrations
- Model cards / documentation (intended use, limitations)

Key questions:
- Which models materially contribute to revenue?
- Which models are "high risk" by impact or regulatory definition?
- Who owns the model post-close?

Red flags that affect value:
- Significant undisclosed models that are customer facing
- No owner or sparse documentation for mission-critical models
- Models built on unknown or untracked third-party components

Impact: Missing inventory or high-risk models usually mean price reductions, larger escrows, or conditional close until remediation is complete.

2) Training data provenance and licensing
What it is: Evidence of where training and validation data came from, and whether the company has appropriate rights to use it.

Documents to ask for:
- Data lineage maps and ingestion logs
- Data licensing agreements and supplier contracts
- Scripts/audits showing data cleaning and deduplication
- Records of consent where personal data is used

Key questions:
- Is any training data subject to third-party IP or restrictive licenses?
- Was personal data used without proper consent or legal basis?
- Are there operational processes to prevent "leaky" data (e.g., PII in training sets)?

Red flags that affect value:
- Evidence of scraped or unlicensed proprietary content in training sets
- Use of third-party data with unclear or restrictive licenses
- Personal data without documented lawful basis or appropriate minimization

Impact: Unlicensed training data can create immediate legal claims or injunction risk. Buyers often demand remediation plans, indemnities, or reduce price to account for litigation exposure. In some cases buyers walk away - as in the $180M example.

3) IP ownership and third-party claims
What it is: Verification that the company owns its models and related IP, and clarification of any pending claims.

Documents to ask for:
- Copyright / patent filings and assignments
- Developer contracts and contractor agreements (work-for-hire)
- Open source inventories and OSS compliance reports
- Pending disputes, claims, or takedown notices

Key questions:
- Are models built by employees or contractors with clear assignments?
- What open-source components are in models and are license obligations met?
- Are there any pending or threatened IP claims?

Red flags that affect value:
- Missing assignment language in developer contracts
- Non-compliant use of GPL-style or viral licenses in deployed models
- Active third-party claims or takedown threats

Impact: IP uncertainty drives escrow, reps and warranties, and indemnity pricing; it can also scuttle a deal if the risk is systemic.

4) Regulatory exposure (EU AI Act and sector rules)
What it is: Assessment of whether models fall within regulatory scopes - the EU AI Act is the near-term showstopper for many enterprises - and sector-specific rules (finance, healthcare, consumer protection).

Documents to ask for:
- Regulatory risk assessment aligning models to EU AI Act risk categories
- Records of conformity assessments, CE markings, or plans for them
- Customer communications and labeling related to model transparency

Key questions:
- Which models could be classified as "high-risk" under the EU AI Act?
- Has the company done preliminary conformity assessment or gap analysis?
- Are there sectoral regulator expectations (e.g., FDA, financial regulators)?

Red flags that affect value:
- Models that would be high-risk and lack any conformity work
- Publicly facing systems without required transparency notices or logging
- No plan or budget for remediation to meet regulatory obligations

Impact: Remediation to meet EU AI Act obligations (documentation, testing, third-party audits, monitoring) can be costly and slow. Buyers will price that into offers, or require sellers to remediate pre-close.

5) Vendor stack and model provenance (third-party models)
What it is: Inventory of third-party models, APIs (e.g., LLM providers), and service providers supporting model development and deployment.

Documents to ask for:
- Vendor list with contracts, SLAs, and data processing addenda
- Policies for vendor selection, testing, and risk acceptance
- Logs of API usage, prompts, and dataset exchanges if stored

Key questions:
- Are core functions dependent on black-box third-party models?
- Do contracts limit vendor liability or permit required audits?
- How is vendor model drift monitored?

Red flags that affect value:
- Core IP built on third-party LLMs with restrictive contractual terms
- Contracts that prohibit copying or retention of outputs needed for compliance
- Single-vendor dependencies without exit plans

Impact: Vendor risk can limit an acquirer's ability to integrate or productize the target's tech. It typically leads to conditional pricing, contract novation requirements, or forced migration costs.

6) Governance maturity and operational controls
What it is: Evidence of policies, roles, processes, and tooling that govern model lifecycle: development, testing, deployment, monitoring, and retirement.

Documents to ask for:
- AI governance framework, policies, and training records
- Model risk management playbooks and change logs
- Monitoring dashboards and incident response plans

Key questions:
- Are there formal signoffs and model risk committees?
- Is there continuous monitoring and anomaly detection in production?
- Are bias, fairness, and safety checks standard in development?

Red flags that affect value:
- No documented governance or ad-hoc decision making
- Limited monitoring, lack of rollback procedures, or missing incident trail
- No evidence of executive accountability for AI risk

Impact: Low governance maturity increases integration risk for buyers and often triggers requirements for post-close remediation roadmaps, named executives responsible for fixes, and escrowed funds.

7) Active incidents and historic problems
What it is: Historical record of model failures, customer complaints, security incidents, or regulatory inquiries.

Documents to ask for:
- Incident logs, root cause analyses, post-mortems
- Customer claims, refund data, and PR incident plans
- Insurance claims and coverage details (cyber/tech E&O)

Key questions:
- Has the company experienced model-related outages, harm, or litigation?
- How were incidents handled, and were customers notified?
- What insurance covers AI risks, and are limits sufficient?

Red flags that affect value:
- Repeated incidents with systemic causes
- Lack of corrective action or recurrence of the same issue
- Insurance gaps (e.g., no coverage for emerging AI risks)

Impact: Recent incidents can sharpen buyer concerns and increase contingencies or premium pricing for indemnity.

How diligence findings typically change deal outcomes
- Walk away: Systemic unresolved IP claims, large-scale unlicensed data use, or regulatory exposure that would require disproportionate remediation.
- Price reduction: Quantified remediation costs, anticipated fines, or expected litigation reserves.
- Escrow/holdback: To cover latent liabilities discovered after close.
- Warranties & reps: Specific reps around data provenance, IP assignments, and regulatory compliance.
- Seller remediation: Pre-close fixes mandated in SPA, often with verified evidence.
- Integration carve-outs: Delay adoption of certain models or products until compliance remediation is complete.

What sellers should do 12 months before a sale: build an AI readiness pack
Sellers who anticipate a sale should treat AI governance as a sell-side asset. Preparing a concise but thorough AI readiness pack reduces friction and maximizes value.

12-month checklist
- Compile an AI inventory and create clear model ownership.
- Complete a training data provenance review: map sources, licenses, and consent.
- Conduct an IP audit: ensure developer assignments, clean up contractor agreements, and catalogue open-source dependencies.
- Run a regulatory gap analysis against relevant frameworks (EU AI Act, sector rules), and draft a remediation roadmap.
- Standardize vendor contracts: require rights to audit and retention of usage logs where feasible.
- Implement basic governance: model cards, testing checklists, monitoring, and an incident register.
- Obtain executive signoff: a board or C-suite attestation of AI governance maturity.
- Prepare template disclosures and red-team results that can be shared under NDA.

90- to 30-day checklist
- Assemble the AI readiness pack for buyer review (see below).
- Push critical remediations that materially affect valuation.
- Be transparent: provide clear, factual narrative and evidence for any outstanding issues, alongside timelines and budgets for remediation.

Contents of an AI readiness pack
- Master AI inventory and model cards
- Data lineage and provenance summary, plus key data licenses
- IP assignment and OSS compliance report
- Regulatory gap analysis and remediation roadmap
- Vendor list with material contracts and SLAs
- Governance framework, policies, and role matrix
- Incident log and root cause analyses for material events
- Test results, red-team summaries, and bias/fairness assessments
- Executive summary and risk-adjusted valuation impact

Practical governance - not a showpiece
Buyers want evidence that AI risk is actively managed, not just a slide deck. Practical measures that matter in diligence:
- Immutable logs of training datasets and prompts
- Versioned model artifacts with test reports
- Continuous monitoring and alerting tied to business metrics
- Clear product boundaries that separate experimental models from customer-facing services

Conclusion - treat AI governance as deal strategy, not an afterthought
AI is now part of what acquirers buy: it can be an accelerant for integration and growth - or a latent liability that kills deals. Executives must treat AI governance as part of the M&A playbook. Buyers need a repeatable diligence checklist that sits beside cyber, privacy, and IP. Sellers should prepare an AI readiness pack and remediate material governance gaps at least 12 months before going to market. Lenders and underwriters will expect the same evidence before they underwrite debt.

The practical takeaway: make AI governance visible and measurable. A well-documented inventory, clear data provenance, assigned IP rights, and a regulatory roadmap not only reduce risk - they preserve value. In today's market, the company that can show it governs its AI responsibly is the one that gets the deal done.