PRIVINOTCH / Focus areas / AI due diligence

AI due diligence that finds the risk behind the pitch

AI claims are easy to make and hard to verify. We review how a target actually builds, buys, governs and relies on AI, and tell you what it means for value, terms and the first 100 days.

Discuss a transaction Book an intro call

We work under NDA and alongside your legal counsel.

What we look at

Eight areas that drive risk and value

AI inventory and dependencies

What AI is in the product and the business, who built it, and what it depends on.

Data rights and provenance

Where training and operating data came from, and whether the rights to use it are clear.

IP and licences

Ownership of models, outputs and code, and obligations from open-source and third-party licences.

Regulatory exposure

Where regimes such as the EU AI Act, UK GDPR and sector rules may apply, and how ready the target is.

Model risk and performance claims

Whether accuracy, safety and bias claims are tested and supportable.

Vendor and foundation-model concentration

Reliance on a small number of suppliers, and what changes if terms or access change.

Governance maturity

Ownership, policy, oversight and incident handling, and whether they operate in practice.

Security and incident readiness

AI-specific threats, monitoring and response, including prompt injection and data leakage.

Two ways to use it

Buy-side and sell-side

Buy-side: investors, acquirers, lenders

Targeted review during diligence
Findings that feed valuation, terms and conditions
A 100-day plan for post-deal integration

Sell-side and portfolio: founders and companies

An investor’s-eye review before a raise or exit
A prioritised fix list while there is time to act
A ready evidence pack to answer diligence questions faster

How it works

Focused, evidence-led, fast

Step 1

Scope

Agree questions, systems and timetable with the deal team.

Step 2

Review

Documents, systems and management interviews.

Step 3

Report

RAG-rated findings with evidence and implications.

Step 4

Plan

Conditions, remediation and a 100-day roadmap.

Our work complements legal due diligence and is not legal advice. Ratings reflect the information provided and the time available, and we make assumptions and limitations explicit in the report.

Related focus areas

Questions

Frequently asked

Who is this for?

Investors, acquirers and lenders assessing a target that builds or relies on AI (buy-side), and founders or portfolio companies preparing for scrutiny (sell-side and portfolio readiness).

How long does a review take?

It depends on the target’s size, how many AI systems it uses and how quickly information is shared. We agree scope and a timetable up front, and can work to the pace of a live transaction.

What do we receive at the end?

A concise findings report with red, amber and green ratings by area, the evidence behind each rating, issues that should affect valuation, terms or conditions, and a prioritised remediation or 100-day plan.

Do you replace legal due diligence?

No. We complement it. Our work covers governance, risk and operational reality. Legal opinions on contracts, IP and regulation remain with counsel, and we work alongside them.

Can portfolio companies use this proactively?

Yes. Many founders find it valuable to see their AI governance through an investor’s eyes before a raise or exit, and to fix what they find while there is still time.

Is the information we share kept confidential?

Yes. We work under NDA and handle materials in line with our Privacy Notice and the confidentiality terms agreed for the engagement.

Talk to us

Tell us about the deal or company

Share the context in as much detail as you are comfortable with. We will respond on a confidential basis.

Confidential by default
Scoped to your timetable
Complements your legal and financial advisers

Prefer to talk it through? Book an intro call or email info@privinotch.co.uk.