Due Diligence on a Target's AI: What to Ask

Updated October 2026 · 5 min read · Anweshna

Why it is now its own workstream

Three things changed in the last two years:

• Overclaiming has been enforced. In March 2024 the SEC settled charges against two investment advisers, Delphia and Global Predictions, for false and misleading statements about their use of AI, with combined penalties of $400,000. The SEC chair called the practice "AI washing".^[1] A target's AI claims are now a disclosure question, not just marketing.
• Use outran records. Mayer Brown observed in May 2026 that many companies have no centralised record of which AI systems are in use, on what terms, or what data has passed through them.^[2] Without that record, diligence depends on management representations nobody can verify.
• Regulation arrived, then moved. The EU AI Act is in force, and its timetable was amended in July 2026 (see below).

Question set 1: what does the target claim, and is it true?

• Which products are described as "AI-powered" in marketing, investor materials and customer contracts?
• For each one: what is the model, who built it, and what does it actually decide or produce?
• How much of the work described as automated is done by people?
• Which performance figures are published, and where is the evidence for them?

Mayer Brown frames the core test simply: is management overstating the sophistication of the company's AI capabilities?^[2] If revenue or valuation rests on an AI claim, the claim is a valuation input, and it should be tested the way revenue is.

Question set 2: what AI is in use, officially or not?

The following are from Mayer Brown's May 2026 list for private equity sponsors:^[2]

• Are employees uploading confidential or customer information into public generative AI platforms?
• Has proprietary code been used in, or generated by, third-party systems?
• Are customer-facing decisions being influenced by unverified AI-generated outputs?
• Are existing insurance programmes designed to respond to AI-related failures?

Add two of your own. Is there a written AI-use policy, and is it enforced? And which AI vendors hold customer data, and under what contract terms?

Question set 3: data and IP

• What data trained or fine-tuned any model the target owns? Did it have the right to use that data for training?
• Do customer contracts permit customer data to be used to improve models?
• Does the target own the outputs and any models it trained, or does a vendor's licence limit that?
• Was any code in the product generated by AI tools, and does the target's code-ownership analysis account for it?

Question set 4: where the EU AI Act applies, and when

If the target sells into the EU or its AI's output is used there, the AI Act may apply. The timetable changed in 2026, and many published checklists still show the old dates.

The dates come from Regulation (EU) 2026/1744, the "Digital Omnibus on AI", published in the Official Journal on 24 July 2026. It amended Article 113 of the AI Act and explains the delay by the late availability of standards and guidance.^[3] For diligence, the practical questions are:

• Does any of the target's AI fall into a high-risk category, and has anyone at the target assessed that?
• If it does, is there a plan to meet the obligations by the new date, and is it costed?
• Which obligations already apply today? Check with counsel rather than relying on any checklist, this one included.

What goes into the purchase agreement

Findings from this workstream usually land in three places: specific AI representations (compliance with law, rights to training data, accuracy of public AI claims); specific indemnities for known issues; and the insurance discussion, where AI is becoming a point of friction. See Will AI-Assisted Diligence Satisfy an R&W Insurer?

Where screening helps

Anweshna's M&A ruleset includes an AI & Tech Governance category, and it is one of the seven that can block a deal. A screen across the data room surfaces where the target's own documents discuss AI use, model vendors and AI-related disputes, and where they are silent. It won't produce the AI inventory for you; it tells you which documents to read first while you ask for it. See our AI & tech governance page.

When the answers are weak

Weak answers are common, and they are informative. No inventory usually means no AI governance, and no governance means any representation about AI compliance is a guess. The practical response is to narrow what you rely on: ask for specific representations rather than general ones, and focus testing on the AI that drives revenue.

Bottom line

Ask for the inventory, test the claims, trace the data, and check which AI Act dates actually apply. The answers either support the value the seller is attributing to AI, or they become specific representations and indemnities. Both outcomes are better than taking "AI-powered" at face value.

Screen a target's documents for AI governance risk →