AI technology due diligence: a checklist for investors
AI technology due diligence tests five areas before you invest: the technology and its data, the team, the market position, the financial model and regulatory exposure. This guide turns each area into questions to put to a target and the evidence that should come back, and shows where AI Insider’s own due diligence work fits.
Updated Q4 2026
How to use this checklist
Run it before a term sheet and again before closing. For each item, record one of three states: evidenced (the target showed you documents or results), claimed (someone said so) or missing. Decisions should rest on the first state. The checklist covers five areas: technology, team, market, finances and regulation.
1. Technology and data
- What does the company own? Its own model, a fine-tuned open model, or a layer on a third-party service. Ask for the architecture and the list of external dependencies.
- How is performance measured? Ask for evaluation results on data that resembles customer work, not only public benchmarks, and for how often tests are re-run after a model change.
- Where did the training and fine-tuning data come from? Ask for a data inventory with the license, consent or contract behind each source, and the rights to use customer data. Providers of general-purpose models in the EU must publish a summary of training content, which gives a useful reference point.
- What does inference cost per unit of revenue? Ask for compute spend, cloud commitments and dependence on scarce hardware.
- What breaks when usage grows? Ask about latency, data pipelines and the technical debt the team already knows about.
- How is the system secured? Ask about access control, leakage of customer data through the model, and any incident history.
2. Team and talent
- Who built the core system, and are they staying? Check vesting, notice terms and who else understands the model.
- What has the research team produced? Look for shipped results and publications rather than titles.
- How much work sits with contractors or data labelers? Ask what happens if a vendor stops.
- Has the leadership delivered before? Check track record against the milestones in earlier fundraising material.
- Can the company hire? Ask about open roles, time to fill and offers lost.
3. Market position
- Who else sells the same outcome? Include the large model providers, who may add the feature to their own products.
- Are customers in production or in pilot? Ask for contract status by customer.
- How concentrated is revenue? Ask for the share held by the largest three customers.
- How was the market sized? Prefer a bottom-up build from customer counts and contract values over a top-down share of a large market. AI Insider market intelligence covers companies, funding and segments for the comparison.
- What does it cost a customer to switch away?
4. Financial and commercial viability
- What is the revenue made of? Separate recurring subscriptions, usage fees and services.
- What is gross margin after compute? Ask for the trend over several quarters and the assumptions behind it.
- What are customer acquisition cost and payback? Ask how they are calculated and over what period.
- How much revenue comes from the AI product itself? Some companies label services or analytics revenue as AI revenue, and the UK government’s AI sector study notes that reported AI revenue growth includes product and service relabeling. Ask for the split.
- Is the pipeline signed or hoped for? Ask for signed contracts, not weighted forecasts.
5. Regulatory and compliance
- Which risk category does each system fall into under the EU AI Act? The Act sets four levels: unacceptable, high, transparency and minimal risk.
- Which obligations apply, and from when? See the dates below.
- How is personal data handled? Ask for the lawful basis for training and for any cross-border transfers.
- Is there a governance process? Look for risk assessments, logging and human oversight. The NIST AI Risk Management Framework is a common reference, and NIST states that version 1.0 is being revised.
- Are there open claims about copyright or data use? Ask for correspondence and legal advice on any.
EU AI Act dates as published by the European Commission
| Date | What applies |
|---|---|
| August 1, 2024 | The AI Act entered into force |
| February 2, 2025 | Prohibited AI practices and AI literacy obligations |
| August 2, 2025 | Governance rules and obligations for general-purpose AI models |
| August 2, 2026 | The Act became applicable, with exceptions |
| December 2, 2027 | Rules for high-risk systems in sensitive areas such as employment, education and critical infrastructure |
| August 2, 2028 | Rules for high-risk AI embedded in regulated products |
Red flags that slow a deal
| Finding | Why it matters | Ask next |
|---|---|---|
| A demo with no evaluation results | Performance on a curated demo says little about customer work | Results on held-out data that resembles customer tasks |
| Training data with no documented rights | Rights problems can force a model to be retrained or withdrawn | The data inventory and the license or contract behind each source |
| Gross margin undefined once compute is counted | Unit economics may not work at scale | Compute cost per unit of revenue, by quarter |
| Revenue labeled AI that is mostly services | The valuation may assume software margins | Revenue split by type and by customer |
| One model vendor and no fallback | Price, terms or availability can change | Switching plan and tested alternatives |
| Key knowledge held by one or two people | Departure could stall the roadmap | Documentation, vesting and cross-training |
When to bring in an outside team
Bring one in when the technical questions go beyond what your deal team can judge, when the timeline is short, or when you want an independent view for an investment committee. AI Insider’s advisory team, which provides an AI commercial and technology due diligence service, says it has evaluated hundreds of AI investments, and it builds commercial and technical due diligence on the same data as its market intelligence.
Questions people ask
What should an AI due diligence checklist include?
Five areas: the technology and its data, the team, the market position, the financial and commercial model, and regulatory exposure. For each, the checklist lists the question to ask and the evidence that should come back, such as evaluation results, data licenses, contracts and a cost breakdown per unit of revenue.
How do you evaluate an AI startup’s technology?
Start with what the company owns: its own model, a fine-tuned open model, or a layer on top of a third-party service. Then ask for evaluation results on data that resembles customer work, the origin and licensing of training data, the cost of inference per unit of revenue, and what breaks when usage grows.
What are the biggest red flags in AI due diligence?
A demo with no evaluation results, training data the company cannot show it has the right to use, gross margin that is undefined once compute is counted, revenue labeled AI that is mostly services, and a single model vendor with no fallback. Each one is a specific question the company should be able to answer.
Does the EU AI Act affect due diligence?
Yes, wherever the target sells into the EU. The target should be able to say which risk category its systems fall into and which obligations apply. According to the European Commission, rules for high-risk systems in sensitive areas apply from December 2, 2027, and rules for general-purpose AI models have applied since August 2025.
How long does AI due diligence take?
It depends on scope, the transaction timeline and how quickly the target opens its data room. Ask any provider for a scoped plan and timeline before you start.
Who should run AI due diligence?
A team that can judge the technology as well as the numbers. Many investors combine their own deal team with specialists in the relevant AI segment, and use an outside team when the technical questions go beyond in-house experience.
Sources
- European Commission, AI Act: regulatory framework for AI. Risk levels and application timeline. As of Q4 2026.
- NIST, AI Risk Management Framework. Statement that AI RMF 1.0 is being revised. As of Q4 2026.
- AI Insider, AI Advisory Services. The statement on evaluating hundreds of AI investments and the Due Diligence entry. As of Q4 2026.
- Department for Science, Innovation and Technology, Artificial Intelligence Sector Study 2024, September 3, 2025. Relabelling of revenue as AI.
- AI Insider, Market intelligence and data. Commercial and technical due diligence built on the same data. As of Q4 2026.
Evaluate your next AI investment
Speak confidentially with the AI Insider due diligence team about an upcoming transaction.