Most private equity deal teams know how to stress-test a target’s technology stack: architecture docs, security posture, scalability, technical debt. But AI is a different animal. Its risks are less visible, its supply chains more opaque, and the regulatory expectations are evolving faster than most operating partners can track.
According to Grant Thornton, only 9% of PE respondents were confident they could pass an AI governance audit within 90 days — the lowest confidence level of any sector — and just 7% have tested their AI incident response playbook. Those numbers are a warning shot: if your target is building, embedding, or reselling AI, and you don’t ask the right questions during diligence, you are buying a governance time bomb.
This checklist is the practitioner’s companion to our PE tech due diligence framework — we won’t rehash the general technical diligence playbook here. Instead, we’ll walk you through the exact questions, artifacts, and evidence you should demand in four critical areas: AI capability and architecture, data rights and IP, model dependencies and vendor risk, and AI governance and audit readiness. For each question, we’ll show you what a good answer looks like, what a bad answer looks like, and the red flags that should make you pause.
We built this guide for private equity firms, operating partners, and corporate development teams evaluating mid-market companies — the kind of $10M–$250M revenue businesses where AI is often a differentiator but rarely governed with the rigor of a public company. PADISO has run this exact diligence playbook across multiple roll-ups, carve-outs, and growth investments, and we’ve seen what happens when AI risk gets overlooked. The goal is to help you sign with your eyes wide open.
Table of Contents
- The State of AI Governance in Private Equity
- AI Capability & Product Architecture
- Data Rights, Lineage & Intellectual Property
- Model Dependencies & Vendor Risk
- AI Governance, Audit Readiness & Incident Response
- Operational AI ROI & Cost Transparency
- How PADISO Helps Deal Teams Validate AI Readiness
- Next Steps: Turn the Checklist into a Deal Memo
The State of AI Governance in Private Equity
The Grant Thornton data tells a blunt story. Only 9% of PE firms feel confident they could pass an AI governance audit within 90 days. Put differently, 91% of respondents know they aren’t ready. And with only 7% having tested an AI incident response plan, the vast majority would be improvising if a model hallucinated sensitive data, produced biased outputs, or leaked proprietary information.
These aren’t hypothetical risks. The NIST AI Risk Management Framework — now the de facto standard for AI governance in the US — maps out a comprehensive set of risks including data poisoning, model inversion, supply chain compromise, and harmful bias. Regulators, auditors, and enterprise customers are increasingly expecting companies to align with the NIST AI RMF 1.0 core functions: Govern, Map, Measure, and Manage. If your target can’t articulate how they map to those functions, you’re already behind.
For PE firms executing roll-ups, the risk compounds. You might acquire three companies, each with different AI models, different data practices, and different levels of maturity. The consolidation play demands a unified governance layer — and that’s not something you can retrofit in a weekend. Our AI Quickstart Audit is designed to surface exactly these gaps in two weeks, but the diligence phase is where you should flag them first.
AI Capability & Product Architecture
Before you care about governance, you need to understand what AI actually does inside the business. Is it a thin wrapper around OpenAI? A fine-tuned open-weight model? A multi-agent system orchestrating complex workflows? The answer determines the risk profile and the moat.
Question 1: Describe your AI architecture and the role of AI in your product or operations.
What to ask for: An architecture diagram that shows all AI components, data flows, model endpoints, and human-in-the-loop touchpoints. If they can’t produce one, that’s a red flag. Ask for a walkthrough with a senior engineer, not just the CTO.
Good answer: “We run a local-first multi-agent system built on Claude Sonnet 5 for complex reasoning tasks, with a fallback to Haiku 4.5 for latency-sensitive classification. All prompts and completions are logged, versioned, and auditable. Our architecture diagram is in the data room — it shows the orchestration layer, the vector database, and the human review queue for high-stakes decisions.”
Bad answer: “We use ChatGPT for everything. Our developers just call the API when they need it. I’m not sure which model exactly — probably the latest one.”
Red flags: No architecture diagram; model choice is described as “whatever works”; no logging or audit trail; no human-in-the-loop for consequential decisions.
Question 2: How do you evaluate model performance, and what metrics do you track?
What to ask for: An evals framework or test harness. Evidence of A/B testing, accuracy metrics, latency percentiles, and cost per inference. If they’re using Claude 5 models, ask if they’ve benchmarked Opus 5 vs. Sonnet 5 for their specific use case.
Good answer: “We maintain a proprietary eval set of 2,000 labeled examples that we run against every model update. We track precision, recall, hallucination rate, and token cost per task. Our dashboard shows that Opus 5 delivers 12% higher accuracy on contract review than Sonnet 5, but costs 3x more per call, so we route tasks based on complexity.”
Bad answer: “We test it manually sometimes. It seems pretty accurate. Our users don’t complain.”
Red flags: No systematic evaluation; reliance on vendor-reported benchmarks; no cost-per-task tracking.
Question 3: How do you handle model upgrades and breaking changes?
What to ask for: A model migration playbook, version pinning strategy, and evidence of testing before rolling out a new model version. With the Claude 5 family, for example, migrating from Sonnet 4.6 to Sonnet 5 might change output style or reasoning patterns — you need a plan.
Good answer: “We pin to specific model versions in production. When a new model is released, we run our full eval suite and a shadow deployment for two weeks before cutting over. We also maintain a fallback to the previous version if performance degrades.”
Bad answer: “We just use the latest API endpoint. If something breaks, we’ll fix it.”
Red flags: No version pinning; no fallback strategy; no testing pipeline.
Data Rights, Lineage & Intellectual Property
AI models are hungry for data, but the legal rights to that data are often murky. You need to know exactly what data the target uses to train, fine-tune, or prompt models — and whether they have the rights to do so.
Question 4: What data do you use for training or fine-tuning, and do you have clear rights to that data?
What to ask for: A data inventory with provenance. Contracts, licenses, or terms of service for any third-party datasets. If they use customer data, you need to see the consent mechanisms and the privacy policy.
Good answer: “We only fine-tune on first-party data we’ve collected with explicit consent. Our data inventory lists every dataset, its source, the license, and the retention policy. We don’t use customer data to train models unless the customer has opted in via a separate agreement.”
Bad answer: “We scrape public websites and use whatever we can find. We haven’t really tracked the sources.”
Red flags: No data inventory; reliance on scraped or unlicensed data; customer data used for training without clear consent.
Question 5: Can a competitor or acquirer replicate your AI without your proprietary data?
This is a moat question. If the AI’s value comes entirely from a third-party model with no proprietary data or fine-tuning, the moat is shallow.
Good answer: “Our fine-tuned model is trained on a decade of proprietary, structured data that no competitor has. Even with the same base model, they couldn’t replicate our accuracy without that data. We also have a data flywheel — every user interaction improves the model.”
Bad answer: “We just use the GPT-5.6 API out of the box. Anyone could do the same thing.”
Red flags: No proprietary data; no fine-tuning; no data flywheel.
Question 6: Who owns the outputs and the model weights?
What to ask for: The terms of service for any third-party model provider. Some providers claim rights to outputs or use them for training. If the target has fine-tuned a model, clarify who owns the resulting weights.
Good answer: “Our contract with the provider explicitly states that we own all outputs and fine-tuned weights. We have a legal review confirming that our IP is protected.”
Bad answer: “I think we own it? The terms of service are pretty long, but our lawyer said it’s fine.”
Red flags: No legal review of model provider terms; ambiguity about output ownership.
Model Dependencies & Vendor Risk
Most companies today rely on at least one external model provider — OpenAI, Anthropic, Google, or a cloud-hosted open-weight model. That creates a critical dependency. If the provider changes pricing, deprecates a model, or suffers an outage, what happens to the business?
Question 7: What is your dependency on external model providers, and what is your vendor contingency plan?
What to ask for: A vendor dependency matrix. List every external model API, the criticality, the switching cost, and the fallback plan. If they’re using multiple providers (e.g., Claude Sonnet 5 for reasoning and GPT-5.6 Sol for code generation), ask how they’d handle a sudden deprecation.
Good answer: “We’re multi-cloud and multi-model by design. Our orchestration layer can route to Claude Sonnet 5, GPT-5.6 Sol, or an open-weight model like Kimi K3 with minimal code changes. We maintain a vendor risk register and test failover quarterly.”
Bad answer: “We’re all-in on one provider. If they go down, we’re down. But they’re a big company — they won’t go down.”
Red flags: Single-provider dependency; no fallback tested; no vendor risk assessment.
Question 8: How do you manage model supply chain risk?
The NIST AI Resource Center emphasizes that AI supply chains are complex — a fine-tuned model might inherit vulnerabilities from a base model, a dataset, or a pre-processing library. You need to know the full provenance.
Good answer: “We maintain a software bill of materials (SBOM) for every AI component. We track the base model, the fine-tuning dataset, the training environment, and all dependencies. We scan for vulnerabilities weekly.”
Bad answer: “We download models from Hugging Face and hope for the best.”
Red flags: No SBOM; no vulnerability scanning; no provenance tracking.
Question 9: What are your model cost projections, and how do they scale with usage?
AI costs can explode. A model that costs $10K/month today could cost $100K/month if usage doubles. You need to see the unit economics.
Good answer: “Our cost per inference is $0.003 for Haiku 4.5 and $0.015 for Sonnet 5. We track cost per customer and have a margin model that accounts for projected usage growth. We’ve also experimented with Fable 5 for high-value tasks and found it 40% more cost-effective than Opus 5 for our use case.”
Bad answer: “AI is cheap. We don’t really track the costs.”
Red flags: No cost tracking; no margin model; no experimentation with cost-efficient models.
AI Governance, Audit Readiness & Incident Response
This is where the Grant Thornton statistic bites hardest. If the target can’t demonstrate a functioning governance program, you’re buying a remediation project, not a ready asset.
Question 10: Do you have an AI governance framework, and how does it map to the NIST AI RMF?
The NIST AI RMF 1.0 is the benchmark. You don’t need full compliance, but you need evidence that the target has started the journey.
Good answer: “We’ve mapped our governance program to the NIST AI RMF’s four functions: Govern, Map, Measure, and Manage. We have an AI ethics policy, a risk register, and quarterly reviews. Our security audit readiness for SOC 2 and ISO 27001 also covers our AI systems.”
Bad answer: “We haven’t really thought about governance. We’re too small for that.”
Red flags: No governance framework; no mapping to any standard; no risk register.
Question 11: How do you handle AI incidents, and have you tested your response plan?
Given that only 7% of PE firms have tested an AI incident response plan, this question is a powerful differentiator. Ask for a documented incident response plan and evidence of a tabletop exercise.
Good answer: “We have an AI-specific incident response plan that covers model hallucination, data leakage, bias incidents, and prompt injection attacks. We ran a tabletop exercise last quarter and identified three gaps we’ve since closed. Our plan integrates with our broader SOC 2 incident response process.”
Bad answer: “We’ll figure it out if something happens.”
Red flags: No documented plan; no testing; no integration with broader security incident response.
Question 12: How do you ensure AI outputs are fair, unbiased, and compliant with regulations?
What to ask for: Bias testing results, fairness metrics, and any third-party audits. If the target operates in regulated industries (finance, healthcare, employment), this is non-negotiable.
Good answer: “We run bias audits quarterly using a combination of automated tools and human review. We track demographic parity and equal opportunity metrics. Our latest audit showed disparate impact below the 0.8 threshold, and we’ve documented the mitigation steps.”
Bad answer: “Our model is unbiased because we don’t feed it biased data.”
Red flags: No bias testing; no metrics; no understanding of fairness definitions.
Operational AI ROI & Cost Transparency
AI can be a massive value driver, but it can also be a money pit. You need to see the ROI, not just the promise.
Question 13: What is the measurable ROI of your AI investments?
What to ask for: A clear link between AI spend and business outcomes — revenue lift, cost reduction, speed improvement. Avoid vague claims like “increased efficiency.”
Good answer: “Our AI-powered underwriting reduced manual review time by 60%, saving $1.2M annually. We track ROI monthly and can show you the dashboard.”
Bad answer: “AI makes everything better. Our team loves it.”
Red flags: No metrics; no link to P&L; no tracking.
Question 14: How do you budget for AI, and what are the hidden costs?
AI costs go beyond API calls — there’s infrastructure, engineering time, evals, and compliance. Ask for a fully loaded cost model.
Good answer: “Our total AI spend is $45K/month, including $18K for model APIs, $15K for infrastructure, and $12K for the engineering team’s AI-focused time. We’ve budgeted for a 20% increase next year as we scale.”
Bad answer: “We spend about $5K on OpenAI. That’s it.”
Red flags: Incomplete cost picture; no budget forecast; no engineering cost allocation.
How PADISO Helps Deal Teams Validate AI Readiness
PADISO is a founder-led venture studio and AI transformation firm that has run this exact diligence playbook for private equity firms, mid-market companies, and scale-ups across the US, Canada, and Australia. Our fractional CTO advisory in San Francisco, New York, Sydney, and Melbourne gives deal teams on-the-ground technical leadership to stress-test AI claims, architecture, and governance.
We don’t just hand you a report. We embed with your team, interview the target’s engineers, review the code, and produce a red-flag summary that goes straight into your investment committee memo. For roll-ups, our platform engineering practice designs the consolidation architecture that turns three disparate AI stacks into one efficient, governed platform — driving the EBITDA lift that makes the deal work.
If you’re staring at a target with AI claims but no evidence, start with our AI Quickstart Audit. In two weeks, we’ll tell you where they actually are, what to ship first, what to retire, and what 90 days could unlock. For firms that want to build internal capability, our AI Readiness Bootcamp uplifts your operating partners and portfolio company leaders on the same diligence frameworks we use.
And when the target needs to get audit-ready fast — because the next enterprise deal depends on SOC 2 or ISO 27001 — our security audit service combines Vanta’s automation with our hands-on engineering to get you there in weeks, not months.
We built PADISO to be the technical partner PE firms call before they sign. Take our free AI Readiness Test to benchmark your own firm, then book a call to discuss how we can derisk your next deal.
Next Steps: Turn the Checklist into a Deal Memo
Don’t let this checklist gather dust. The best deal teams turn it into a structured diligence request list and a red-flag scoring rubric. Here’s a simple three-step plan:
- Send the checklist early. Include these questions in your diligence request list before the management meeting. If the target can’t answer them, that’s a data point in itself.
- Score the responses. Assign a red/yellow/green rating to each answer. A single red flag on data rights or model dependency might not kill the deal, but three red flags across governance and cost transparency should give you pause.
- Bring in a technical partner. If your team doesn’t have deep AI expertise, a fractional CTO who’s done this before can be the difference between catching a hidden liability and walking into a post-close disaster.
AI is the most transformative technology in a generation, but it’s also the most opaque. The diligence checklist above won’t eliminate every risk, but it will surface the ones that matter — before you sign.
Explore our services or read our case studies to see how PADISO has helped 50+ businesses generate over $100M in revenue through strategic AI implementation and rigorous technical diligence. When you’re ready to talk, book a call.