AI in a portfolio company rarely stops a transaction — more often it changes its price or the shape of the earn-out. Just two years ago, questions about artificial intelligence fit on a single tech-DD slide: which tools, which vendor, how many licenses. Today, in our view, AI deserves its own workstream in due diligence — with its own lead, its own checklist and its own red flags. Not because everything has to be automated before signing. Because the investment thesis increasingly assumes a margin uplift whose source is meant to be AI — and a thesis without verification is risk, not value creation.
This playbook doesn't replace a full DD report. It gives the deal team and the operating partner five questions worth walking through with management before a price is proposed — and a list of patterns that, in our practice, signal that the "AI-native" picture is thinner than it looks on the pitch deck.
Five questions worth walking through before signing
1. Which operational processes are genuinely automated, and what still rests on people with laptops? A "good" picture is processes with a documented map, a clear owner and a before/after measurement — automation is part of the runbook, not the CEO's demo. A "weak" picture is slides with vendor logos and individual scripts maintained by one person in the operations department. Question for management: show us one end-to-end process with the points where a human decides and where an agent executes — and who approves the result.
2. Are the AI models and vendors wired into the architecture with oversight, or running "on the side"? A "good" picture is data classification, a human-in-the-loop policy for sensitive decisions, logging of model calls and a clear boundary between the production system and the experimentation environment. A "weak" picture is API keys in a spreadsheet, client data sent to a public endpoint without a policy, and an agent that "just replies in the inbox." Question for management: where does the experiment end and production begin — and who formally approved it.
3. What does governance look like — who, on what data, with what rights, with what auditability? A "good" picture is an inventory of AI systems with a risk level (in the spirit of the EU AI Act classification), a register of training and evaluation data, a retention policy and an audit trail from prompt to response. A "weak" picture is no register, no governance owner, and the answer "we have that in the security policy" with no specifics. Question for management: show us which AI system runs today, who owns it in the organization, and how you'd prove to a regulator that you're not breaching client data.
4. Are the IP and the knowledge in the company, or in the heads of three people and in Slack threads? A "good" picture is documented prompts, evaluations, embeddings and runbooks in the company's repository — with rights, licenses and a clear answer to what happens when the author leaves. A "weak" picture is the magic of one particular engineer, no repository, and the answer "Marek and Ania know that." Question for management: if two specific people disappeared today, what would stop working — and how long would it take to get back to today's level.
5. What is the realistic path to a margin uplift from AI — and does it depend on a single vendor? A "good" picture is a margin thesis broken out per process, with assumptions about inference cost, a fallback model and a scenario where the vendor changes prices. A "weak" picture is "AI will increase the margin" with no per-process breakdown and a single vendor hard-coded into the architecture. Question for management: if your main vendor doubled prices tomorrow or changed the license terms, what would happen to the margin thesis — and what's your plan B.
What to avoid — red flags
- "AI-native" on the deck, "Excel-native" in operations. The marketing slogans aren't reflected in the process map or in the tools the team actually uses.
- No AI owner in the organization. It's not about a "Head of AI" title — it's about a person with a budget, a decision and responsibility for the systems register.
- Client data in public models without classification. An early signal of regulatory and reputational risk — regardless of jurisdiction.
- One vendor, one contract, one person. Each of the three is a risk — all three at once are deal-impacting risk concentration.
- A "pilot" running longer than a year with no decision to productionize or retire. A signal that the organization can't close an experiment — which usually comes back in the first year after the transaction.
The next 30 days — what the diligence captain can do regardless of this transaction
Regardless of whether this particular transaction closes, it's worth setting up — over the next month — a repeatable AI DD workstream for the fund's entire pipeline. In practice that means three things. First — the checklist of the five questions above, added to the standard DD pack and assigned to a specific person on the team (operating partner, technical advisor or an external operator-architect). Second — a register of red flags from previous transactions, kept like an incident log, so the next deal team learns from others' findings rather than its own. Third — a short framework for pricing AI risk: which system stays, which we refactor in the first ninety days, which requires renegotiating the vendor contract. This isn't a full methodology — it's the minimum version that works from the next pitch deck on.
Bring the process
If you're building your own AI DD workstream, or you've just got a deal where AI is part of the investment thesis, bring the process. We work from something concrete — the five questions above are a good starting point for a conversation. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI.