PE Tech Due Diligence in 2026: The AI-Readiness Addendum

Table of Contents

1. Why PE Tech Due Diligence Has Changed
2. The Three Pillars of Modern Tech DD
3. Layer One: Classic Infrastructure & Security Review
4. Layer Two: AI Capability & Readiness Assessment
5. Layer Three: Agentic AI & Claude-Era Model Risk
6. Practical DD Checklist & Scoring Framework
7. Common Pitfalls & Red Flags
8. Post-Close AI Modernisation Roadmap
9. Assembling Your DD Team & External Partners
10. Next Steps: Building Your 2026 Framework

---

Why PE Tech Due Diligence Has Changed

Private equity tech due diligence in 2026 is no longer about code quality and infrastructure alone. The landscape has shifted fundamentally. Where you once asked, “Does this codebase scale?” and “Are their servers secure?” you now must ask: “Can this team execute AI-first product roadmaps?” “What’s their exposure to Claude-era model deprecation?” “How far behind are they on agentic automation?”

The reason is simple: AI capability has become a primary value lever. Companies that ship AI products 6–12 months ahead of competitors capture disproportionate revenue and margin. Conversely, teams that lack AI-readiness infrastructure—proper MLOps, vector databases, prompt versioning, model governance—will struggle to execute post-close. That’s where value creation stalls.

PE due diligence with AI has become a critical workflow for leading firms. Yet most PE DD templates haven’t evolved. They still treat AI as a feature set to audit, not as a core operational capability that determines post-close velocity and exit multiples.

This article outlines a modern, layered PE tech DD framework that sits atop classic infrastructure review. It’s designed for deal teams who need to assess AI readiness, model risk, and agentic automation capability in 45–90 days—and come away with a clear picture of what you’ll inherit and what you’ll need to rebuild.

---

The Three Pillars of Modern Tech DD

Modern PE tech DD rests on three interlocking pillars:

Pillar One: Classic Infrastructure & Security

This is the foundation. You’re evaluating cloud architecture, database design, deployment pipelines, incident response, and compliance posture (SOC 2, ISO 27001, HIPAA, etc.). This layer hasn’t changed much since 2020, but it remains non-negotiable. A company with fragile infrastructure can’t execute AI roadmaps at speed.

Pillar Two: AI Capability & Readiness

Here you assess whether the company has built AI into their product or operations, and whether they have the infrastructure to scale it. This includes: product AI (recommendation engines, generative features, classification models), operational AI (analytics pipelines, anomaly detection, forecasting), and the MLOps maturity that underpins both. Software and tech private equity must harness AI or risk being left behind.

Pillar Three: Agentic AI & Claude-Era Model Risk

This is the new frontier. You’re evaluating: Does the company understand autonomous agents? Have they prototyped agentic workflows? What’s their exposure to large language model (LLM) deprecation, context window changes, and pricing shifts? Are they locked into OpenAI, or do they have multi-model flexibility? This layer directly impacts post-close value creation because agentic automation is where the next wave of cost reduction and revenue uplift lives.

Together, these three pillars give you a complete picture of technical risk, AI execution capability, and post-close modernisation scope.

---

Layer One: Classic Infrastructure & Security Review

Start here. This is your baseline. If the foundation is cracked, AI capability on top of it won’t matter.

Cloud Architecture & Scalability

Ask for a current architecture diagram. Look for:

• Multi-region redundancy: Are they running in a single AWS region or across multiple zones? Single-region is a red flag for uptime and disaster recovery.
• Database design: Are they using a monolithic relational database or have they evolved to polyglot persistence (relational + NoSQL + cache layers)? Monolithic databases often become bottlenecks for AI workloads that require fast feature lookup.
• Compute isolation: Are workloads properly containerised (Docker/Kubernetes) or running on bare metal? Containerisation is table stakes for scaling AI inference.
• Cost efficiency: What’s their cloud spend per user or per transaction? High spend relative to revenue suggests wasteful architecture that won’t scale post-acquisition.

A red flag: companies that can’t articulate their cloud costs by service or workload. That usually means they’ve never optimised for scale and will become a drag on your margin targets.

Deployment & CI/CD Maturity

How fast can they ship code? Ask:

• Deployment frequency: How often do they deploy to production per week? Best-in-class is daily or multiple times per day. If it’s monthly, that’s a bottleneck.
• Automated testing coverage: What’s their unit test coverage? Integration test coverage? If it’s below 60%, you’re looking at manual QA bottlenecks that will slow post-close velocity.
• Rollback capability: Can they roll back a bad deployment in under 5 minutes? If rollback takes hours, they’re not confident in their deployment pipeline.
• Infrastructure as Code (IaC): Is their infrastructure defined in code (Terraform, CloudFormation) or manually configured? Manual configuration is a risk for reproducibility and disaster recovery.

Why this matters for AI: AI workloads require rapid experimentation. If your deployment pipeline is slow, you can’t iterate on models, prompts, or agentic workflows at the speed the market demands.

Security, Compliance & Audit Readiness

This is where most PE deals stumble. Ask directly:

• SOC 2 Type II status: Do they have an active, current SOC 2 Type II audit? If not, what’s the gap? SOC 2 compliance and ISO 27001 certification are increasingly table stakes for enterprise sales and M&A.
• Incident response plan: Have they had a security incident in the last 3 years? What happened, and how did they respond? A company that’s never had an incident is either very lucky or not looking hard enough.
• Access control & identity management: How do they manage employee access to production systems? Are they using SSO and multi-factor authentication (MFA)? If access is managed via shared passwords or spreadsheets, that’s a critical control gap.
• Data encryption: Is data encrypted in transit (TLS) and at rest? Are encryption keys managed separately from application code?
• Third-party risk: What third-party SaaS tools do they use? Have they assessed those vendors’ security posture? A company is only as secure as its weakest vendor.

The hard truth: most early-stage and growth-stage software companies are 12–18 months away from SOC 2 readiness. Budget for a compliance modernisation project post-close. Vanta and similar platforms can accelerate this, but it still requires engineering time.

---

Layer Two: AI Capability & Readiness Assessment

Once you’ve assessed the foundation, zoom in on AI.

Inventory Current AI Usage

Create a detailed map of where AI currently exists in the product and operations:

• Product AI: Does the product include machine learning models? What are they optimising for (classification, ranking, generation, forecasting)? How are they trained and deployed? What’s the latency requirement? Are they real-time or batch?
• Operational AI: Are they using AI for internal workflows—analytics, forecasting, anomaly detection, customer support automation? This is often overlooked in DD but is a major value lever post-close.
• Data pipelines: Do they have mature data infrastructure—data warehouses, ETL/ELT pipelines, feature stores? Or are they stitching together ad-hoc queries and spreadsheets? Immature data infrastructure is the biggest constraint on AI scaling.

Assess MLOps & Model Governance Maturity

Here’s where most companies fall short. Ask:

• Model versioning: How do they track which version of a model is in production? If it’s not tracked in code or a model registry, that’s a red flag.
• Feature engineering: Do they have a feature store (Feast, Tecton, etc.) or are features scattered across different codebases? A feature store is essential for reproducibility and speed.
• Model monitoring: How do they know if a model is degrading in production? Do they monitor accuracy, latency, and data drift? If monitoring is manual or non-existent, models will silently fail.
• Retraining cadence: How often do they retrain models? Weekly, monthly, quarterly, or never? Stale models are a silent revenue killer.
• A/B testing infrastructure: Can they safely test new models against production models? If not, they can’t validate improvements before shipping.

A concrete example: AI-enabled due diligence builds conviction by assessing execution capability. A company with mature MLOps can execute a post-close roadmap in 6 months. A company starting from scratch will take 18 months. That’s a $5–20M swing in value creation depending on your industry.

Evaluate Data Quality & Availability

AI is only as good as the data it learns from. Ask:

• Data volume: How much historical data do they have? 6 months is thin; 3+ years is strong.
• Data labelling: If they have supervised learning models, how are labels created? Manual annotation, crowdsourced, or automated? Label quality directly impacts model accuracy.
• Data pipelines: How long does it take for new data to flow into their warehouse? Real-time, hourly, daily, or weekly? Latency impacts model freshness.
• Data governance: Do they have a data dictionary? Lineage tracking? If data definitions are ambiguous, models will be fragile.
• Privacy & compliance: How do they handle personally identifiable information (PII) in training data? GDPR, CCPA, and similar regulations constrain what data you can use.

Red flag: companies that can’t articulate their data retention policy or haven’t thought about data privacy in the context of AI training.

---

Layer Three: Agentic AI & Claude-Era Model Risk

This is the frontier. Most PE teams aren’t evaluating this yet. That’s your edge.

Understand Agentic AI Readiness

Agentic AI—autonomous agents that can plan, execute, and iterate on tasks—is the next wave of business automation. Agentic AI represents a fundamental shift from traditional automation, and companies that can’t execute agentic roadmaps will struggle to compete.

Ask:

• Agent architecture: Have they prototyped autonomous agents? What frameworks are they using (LangChain, AutoGen, Crew AI)? Or are they still thinking in terms of chatbots?
• Tool integration: Can their agents call external APIs and tools? This is essential for agentic workflows. If they can’t integrate with Salesforce, Jira, or custom APIs, agents are limited to conversation.
• Memory & state management: How do agents maintain context across multiple interactions? Naive implementations lose context; mature ones use vector databases and structured memory.
• Safety & guardrails: How do they prevent agents from taking unintended actions? Do they have approval workflows, cost limits, or action audits?
• Observability: Can they trace what an agent did and why? If not, debugging and improvement will be painful.

A concrete signal: companies that have shipped at least one agentic workflow to production (even in a pilot) are 6+ months ahead of competitors still prototyping.

Assess LLM Dependency & Model Risk

This is critical and often overlooked. Ask:

• Primary LLM provider: Are they locked into OpenAI? Anthropic? Google? Or are they using open-source models? Single-vendor dependency is a risk. OpenAI’s pricing has shifted multiple times; model availability changes. Diversification is prudent.
• Model version pinning: Are they pinning to specific model versions (gpt-4-turbo-2024-04-09) or using floating versions (gpt-4-turbo)? Floating versions mean breaking changes can happen without warning.
• Context window utilization: How much context do their prompts require? If they’re using 80k+ token windows regularly, they’re at risk from context window changes or pricing shifts.
• Prompt engineering maturity: Do they version and test prompts like code, or are prompts ad-hoc and undocumented? Unversioned prompts are a maintenance nightmare.
• Token cost tracking: Do they monitor token spend by feature or user? If not, an unexpected traffic spike could blow through your cost budget.

Red flag: companies that say “We’re using ChatGPT” without understanding which model, which API, or what the cost implications are. That’s a sign they haven’t thought seriously about LLM economics.

Evaluate Inference Cost & Latency Trade-offs

AI inference cost is a primary lever on unit economics post-close. Ask:

• Inference cost per transaction: Do they know what it costs to run inference for a single user request? If not, calculate it: (monthly API spend) / (monthly API calls). If it’s above 1–2% of customer lifetime value, that’s a margin problem.
• Latency requirements: How fast does inference need to be? Real-time (< 100ms), near-real-time (< 1s), or batch (hours)? Faster requirements force you to use expensive models or on-premise inference, which changes the cost structure.
• Model selection trade-offs: Have they evaluated smaller, cheaper models (Llama 2, Mistral) against larger ones (GPT-4)? Or are they assuming the biggest model is always best? Smaller models often deliver 80% of the performance at 20% of the cost.
• Caching & prompt optimisation: Are they caching common prompts or inference results? Do they use prompt compression techniques? These can cut costs by 30–50%.

A concrete example: a company spending $50k/month on OpenAI API calls might cut that to $15–20k/month by switching to a smaller model and adding caching. That’s $360–420k/year in margin improvement. That’s a 2–3x return on a post-close modernisation project.

Assess Regulatory & Ethical AI Readiness

AI regulation is tightening. Ask:

• Bias testing: Have they tested their models for bias against protected classes? If not, they’re at regulatory and reputational risk.
• Explainability: Can they explain why a model made a decision? This is increasingly required for lending, hiring, and healthcare AI.
• Data provenance: Do they know where their training data came from? Copyright and licensing issues around training data are emerging legal risks.
• AI disclosure: Do they disclose to customers that AI is being used? Transparency is increasingly expected and sometimes required.

Red flag: companies that haven’t thought about AI ethics or regulation. That’s a sign they’re moving fast without thinking about downside risk.

---

Practical DD Checklist & Scoring Framework

Here’s a concrete framework you can use in your next deal.

Infrastructure & Security (30% weight)

Scoring: 0–10 for each item

• Cloud architecture & multi-region redundancy: ___
• Database design & scalability: ___
• Containerisation & orchestration (Docker/Kubernetes): ___
• Deployment frequency & CI/CD maturity: ___
• Automated testing coverage (target: >70%): ___
• Incident response & security history: ___
• SOC 2 / ISO 27001 audit readiness: ___
• Access control & identity management: ___
• Data encryption (in transit & at rest): ___
• Third-party vendor risk assessment: ___

Subtotal: ___ / 100

AI Capability & Readiness (35% weight)

Scoring: 0–10 for each item

• Inventory of product AI use cases: ___
• Inventory of operational AI use cases: ___
• MLOps maturity (versioning, monitoring, retraining): ___
• Feature engineering infrastructure (feature store or equivalent): ___
• Data warehouse & pipeline maturity: ___
• Data quality & labelling processes: ___
• A/B testing infrastructure for model validation: ___
• Data privacy & compliance practices: ___
• ML team size & hiring velocity: ___
• ML budget & investment trajectory: ___

Subtotal: ___ / 100

Agentic AI & Model Risk (35% weight)

Scoring: 0–10 for each item

• Agentic AI prototypes or production pilots: ___
• Agent framework maturity & tool integration: ___
• LLM provider diversification (multi-vendor or open-source): ___
• Prompt versioning & engineering maturity: ___
• Inference cost tracking & optimisation: ___
• Model selection & latency / cost trade-offs: ___
• Caching & prompt optimisation practices: ___
• Regulatory & ethical AI readiness: ___
• Claude-era model risk assessment (version pinning, context window): ___
• Post-close AI roadmap clarity & leadership: ___

Subtotal: ___ / 100

Overall Score

(Infrastructure × 0.30) + (AI Capability × 0.35) + (Agentic AI × 0.35) = Overall Score (0–100)

Interpretation:

• 80+: Strong technical foundation. Minimal post-close modernisation required. Fast time-to-value.
• 60–79: Solid foundation with clear AI gaps. 6–12 months of modernisation required. Medium risk.
• 40–59: Weak foundation or significant AI readiness gaps. 12–18 months of work required. Higher risk and cost.
• <40: Fragile foundation or critical gaps. Likely requires major rebuild. High risk; consider passing or deep discounting.

Use this framework to calibrate your offer and post-close value creation plan.

---

Common Pitfalls & Red Flags

Here are the patterns that derail PE tech DD and post-close execution.

The “We Use AI” Claim Without Substance

Many founders claim their product is “AI-powered” when they mean they have a single ML model or a ChatGPT integration. Dig deeper. Ask:

• What’s the business impact of that AI? (Revenue uplift, cost reduction, retention improvement?)
• How is it trained? How often is it retrained?
• What happens if it fails?

If they can’t answer these questions, it’s not a core capability; it’s a feature that could easily be replicated by a competitor.

Prompt Engineering as “Product Development”

Some teams treat prompt engineering as product development. They ship a new prompt, call it a feature release, and move on. This is fragile. Prompts are brittle; small changes to input or model versions can break them. If your post-close roadmap depends on prompt engineering without proper versioning and testing, you’re at risk.

Single-Model Dependency Without Contingency

A company that’s entirely dependent on GPT-4 and hasn’t tested alternatives is at risk. OpenAI’s pricing has shifted multiple times. Context windows change. Models get deprecated. Ask what happens if OpenAI’s pricing doubles or if a model is sunset. If the answer is “we’re not sure,” that’s a red flag.

Ignoring Data Quality

Companies often focus on model architecture and ignore data quality. But garbage in = garbage out. If their training data is incomplete, biased, or mislabelled, the model will be too. Ask directly about label quality and data validation processes.

No Clear Ownership of AI Strategy

If the CEO doesn’t own AI strategy and there’s no dedicated AI/ML leader, execution will be slow. AI is a strategic capability, not a technical detail. If it’s treated as a side project, it will be deprioritised when other fires emerge.

Compliance Theater Without Substance

Some companies have SOC 2 audits but don’t actually follow their own security procedures. Ask to see actual evidence: logs, access reviews, incident reports. If they can’t produce them, the audit is theater.

---

Post-Close AI Modernisation Roadmap

Once you’ve acquired the company, here’s how to approach AI modernisation.

Phase 1: Stabilise & Assess (Weeks 1–4)

• Establish baseline: Document current AI usage, infrastructure, and team capabilities. This is your starting point for measuring progress.
• Hire or contract AI leadership: Bring in a fractional CTO or AI lead who can own the modernisation roadmap. A fractional CTO can accelerate AI readiness by 3–6 months.
• Identify quick wins: Where can you improve inference cost or model performance with low effort? These build momentum and fund further investment.
• Communicate vision: Be clear with the team about why AI modernisation matters and what success looks like.

Phase 2: Modernise Infrastructure (Weeks 5–12)

• Upgrade MLOps: Implement model versioning, monitoring, and retraining pipelines. This is foundational.
• Build feature store: If data pipelines are immature, a feature store (Feast, Tecton) will accelerate model development by 2–3x.
• Optimise inference cost: Profile current inference spend. Identify opportunities to switch to smaller models, add caching, or use on-premise inference.
• Implement prompt versioning: Treat prompts like code. Version them, test them, audit changes.

Phase 3: Expand AI Capability (Weeks 13–26)

• Agentic workflow pilots: Identify 2–3 high-impact operational workflows that could be automated with agents. Run pilots with 10–20% of users or operations.
• Multi-model strategy: If you’re locked into OpenAI, begin testing alternatives (Claude, Llama, Mistral). Build abstractions so you can swap models without rewriting code.
• Data infrastructure: Invest in data warehouse, ETL, and governance if not already in place. This unlocks AI at scale.
• Compliance acceleration: If SOC 2 or ISO 27001 are required, use this phase to move from 60% to 90% readiness.

Phase 4: Scale & Optimise (Weeks 27–52)

• Ship agentic workflows: Move pilots to production. Measure cost savings and revenue uplift.
• Expand AI product features: Use your improved MLOps to ship new product capabilities faster.
• Optimise unit economics: With mature infrastructure, focus on cost reduction and margin improvement.
• Build AI culture: Invest in training and hiring. AI capability compounds over time.

Budget Estimates

For a mid-market software company ($10–100M ARR) with weak AI readiness, budget:

• Fractional CTO / AI leadership: $150–250k/year (part-time)
• Engineering headcount: 2–4 full-time engineers for 6–12 months ($300–600k)
• Infrastructure & tools: $50–150k/year (data warehouse, MLOps, feature store)
• External partner support: $200–500k for architecture design, implementation, and training

Total: $700k–$1.5M over 12 months

For a high-growth company ($100M+ ARR) with moderate AI readiness, costs scale up but ROI is typically 3–5x within 18 months through cost reduction and revenue uplift.

---

Assembling Your DD Team & External Partners

You can’t do this alone. Here’s who you need.

Internal DD Team

• Technical lead: Someone who understands cloud architecture, databases, and deployment pipelines. This is your infrastructure expert.
• ML/AI specialist: Someone who can assess model quality, data practices, and MLOps maturity. If you don’t have this in-house, hire a contractor for the DD period.
• Security/compliance lead: Someone who understands SOC 2, ISO 27001, and data privacy. They’ll assess your compliance exposure.
• Finance/ops: Someone who can map technical findings to financial impact. “We need to rebuild the data pipeline” should translate to “That’s 6 months and $300k.”

External Partners

For deals where AI is a core value lever, consider hiring external partners for 2–4 weeks of intensive DD:

• AI/ML due diligence firm: A specialist who can audit your AI capability and readiness. They’ll produce a detailed technical report and post-close roadmap.
• Security audit firm: For compliance assessment and SOC 2 readiness evaluation.
• Technology architecture firm: For infrastructure and scalability assessment.

Best AI tools for PE due diligence are increasingly available, and specialist firms can help you select and deploy them.

In Sydney and Australia, firms like PADISO offer fractional CTO and AI due diligence services specifically designed for PE teams. They can conduct rapid AI-readiness assessments and build post-close modernisation roadmaps.

Checklist: Building Your DD Team

• Assign internal technical lead for infrastructure review
• Hire or contract ML/AI specialist for AI readiness assessment
• Assign security/compliance lead for audit readiness review
• Assign finance/ops lead for cost & ROI mapping
• Consider external AI due diligence partner for high-stakes deals
• Establish weekly sync cadence with team
• Define decision-making criteria upfront (e.g., “If AI readiness score < 50, we require $X discount”)

---

Next Steps: Building Your 2026 Framework

Here’s how to operationalise this framework for your next deal.

Immediate Actions (This Week)

1. Adopt the scoring framework: Copy the checklist above into your DD template. Make it part of your standard tech review process.
2. Train your team: Run a 1-hour workshop with your technical team on agentic AI, LLM risk, and the three-pillar framework. Ensure everyone understands why it matters.
3. Identify external partners: If you don’t have in-house ML expertise, identify 2–3 firms you can call on for rapid DD. Build relationships now before you need them.
4. Update your IC memo template: Add a section on “AI Readiness” and “Post-Close AI Modernisation” to your standard investment memo. This forces discipline in your analysis.

Medium-Term Actions (Next 30 Days)

1. Pilot the framework: Use it on your next 2–3 tech-enabled deals. Refine based on what you learn.
2. Build post-close playbooks: For each score band (80+, 60–79, 40–59, <40), create a standard post-close roadmap and budget estimate. This speeds decision-making.
3. Establish partnerships: If you’re serious about AI-first investing, partner with a venture studio or AI agency that can support your portfolio companies post-close. AI agency consultation services can help you build AI capability across your portfolio.
4. Benchmark your portfolio: Score your existing portfolio companies on the three pillars. Identify where AI modernisation could unlock value. This becomes your post-close roadmap.

Long-Term (Next 90 Days)

1. Develop AI value creation playbook: For your portfolio, what’s the standard playbook for AI-driven value creation? How much do you typically invest? What’s the ROI? Document this.
2. Build AI expertise in-house: Consider hiring a partner-level executive with deep AI and venture studio experience. They’ll improve deal selection and post-close execution.
3. Communicate with LPs: If your LPs care about AI (and they should), tell them about your AI-first approach to DD and value creation. This is a differentiation point.
4. Monitor the landscape: AI moves fast. Quarterly, revisit this framework. What’s changed in agentic AI, LLM pricing, or model risk? Update your DD process accordingly.

Tools & Resources

To operationalise this, you’ll need:

• DD template: A standardised tech DD questionnaire that includes the AI readiness sections. Share this with targets early so they can prepare.
• Scoring spreadsheet: A simple Excel or Sheets model that calculates your overall score and highlights gaps.
• Post-close roadmap template: A standard 12-month roadmap for AI modernisation, broken into phases and with budget estimates.
• Partner network: 2–3 external firms you can call on for rapid AI assessment, MLOps architecture, and compliance acceleration.

AI agency case studies from Sydney firms can give you concrete examples of post-close AI modernisation outcomes. Use these to calibrate your expectations and ROI models.

---

Conclusion: AI Readiness is a Value Lever

PE tech due diligence in 2026 is fundamentally different from 2024. The companies that win post-close are those that can execute AI and agentic automation roadmaps faster than competitors. That execution depends on three things:

1. Solid infrastructure (cloud, databases, deployment pipelines)
2. AI-ready data and MLOps (feature stores, model versioning, monitoring)
3. Agentic AI capability (agent frameworks, multi-model flexibility, cost discipline)

Most PE targets will score 40–65 on this framework. That’s not a deal-killer; it’s a roadmap. A well-executed post-close AI modernisation project can move a company from 50 to 75+ in 12 months, unlocking 2–3x returns through cost reduction, faster product iteration, and new revenue opportunities.

The teams that master this framework—that can assess AI readiness in 45–90 days and execute a disciplined post-close roadmap—will outperform peers. Start building your framework now. Your next deal depends on it.

Final Checklist: Before Your Next Deal

• Adopt the three-pillar DD framework
• Train your technical team on agentic AI and LLM risk
• Build relationships with external AI due diligence partners
• Create post-close AI modernisation roadmaps for different score bands
• Update your IC memo template to include AI readiness assessment
• Benchmark your existing portfolio on AI readiness
• Establish a quarterly review cadence to update your framework
• Communicate your AI-first approach to your LPs

You’re ready. Good luck with your next deal.