AI-generated code in due diligence: the questions buyers ask and how sellers answer

What buyers ask about AI-generated code

Buyers want to know whether AI coding tools changed what they are buying. In practice the topic comes down to five questions: which tools were used and on what terms, where AI-assisted code sits in the product, how it was reviewed, whether the company owns it, and whether it brought in open-source obligations. A seller who answers with documents rather than estimates keeps the subject out of the special indemnities in the purchase agreement.

A typical data request might read: list each AI coding assistant used since a given date, the plan or license tier, the repositories where it was enabled and the written policy that governed it. Sellers who can produce that in a day look organized; sellers who reconstruct it from memory invite a deeper review.

The six areas of AI-code diligence

The buyer's technical advisers will check these answers against the repositories directly. The CTO due diligence interview questions show how that conversation tends to run and what to rehearse.

Why ownership questions are harder for AI-assisted code

Copyright vests initially in the author of a work, and for a work made for hire the employer is treated as the author and owns the rights unless a signed writing says otherwise (17 U.S.C. 201). That framework assumes a human author. The US Copyright Office's AI initiative has published a report part on the copyrightability of AI outputs and a pre-publication report on generative AI training (Copyright Office, Copyright and Artificial Intelligence), and buyers' counsel draw on that body of guidance when they frame questions about how much human authorship sits in a codebase.

The practical response is evidence of human contribution: design documents, review comments, refactoring commits and tests written by named engineers. Leave opinions on copyright status to counsel rather than offering them in a management meeting.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How advisors prepare a software seller before the data room opens

1. Inventory the tools. List every AI coding assistant, its plan tier, who approved it and when it was enabled.
2. Collect the terms in force. Save the tool terms and admin settings that applied in each period, not only today's version.
3. Write or update the policy. If no written policy exists, adopt one now and date it honestly; never backdate it.
4. Map heavy-use areas. Identify services built mainly with AI assistance and the reviewers who approved the changes.
5. Run an open-source scan. Document findings and fixes before the buyer runs its own scan.
6. Draft disclosure language with counsel. Agree what the company will represent about AI use, consistent with the CIM.
7. Brief the CTO. Rehearse the questions with the evidence on screen.

Illustrative: a fictional 140-person B2B software company enabled an AI assistant for all engineers two years before going to market but only wrote its policy during sale preparation. Its advisor had the CTO export the admin console's rollout history, select ten representative pull requests showing review comments on AI-suggested changes, and state the policy date plainly in the disclosure schedule. The topic took one follow-up call rather than a negotiation over indemnities.

If the CIM needs a line on AI use, see how to address AI risk in a CIM, and fix the records problems in deal killers in due diligence before buyers find them.

Why human-authored engineering history is what AI developers license

The records that prove human authorship in diligence are the records AI developers license to train and evaluate coding agents: pull requests with review threads, tickets linked to the commits that closed them, design discussions and postmortems. They capture how engineers reason, disagree and correct course, which finished public code does not show. Epoch AI researchers project that, if current trends continue, language models will fully use the effective stock of public human-generated text between 2026 and 2032 (Epoch AI), one reason non-public, permissioned work records have become a scarce input.

Provenance matters on both sides of the table. Records generated with AI in order to sell them are a red flag that rules a dataset out, while genuine work histories that include some identified AI-assisted commits are assessed case by case. For how buyers on the data side think, read what an AI data buyer is.

What it means for an M&A advisor with software clients

When a software client prepares for a sale, the engineering history gathered for diligence is the core of a possible license. Raise the license after the evidence is collected rather than mid-way through confirmatory diligence, and coordinate it with the sale process. Software companies that fit have 50+ full-time employees at peak (contractors excluded), years of repository and ticket history, clear rights to license it and an owner, CEO or CFO willing to sponsor the decision; who qualifies lists the full baseline, and the M&A advisor referral overview covers the mechanics of an introduction.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed, and the advisor never exports or handles the code or tickets.

Limits and open questions

• The law on AI outputs is still developing, and the Copyright Office's training report is a pre-publication version, not law.
• No standard method measures what share of a codebase AI wrote, so treat any percentage claim with caution.
• Tool terms change; what matters is the version in force when the code was written.
• A license needs the same clean ownership a buyer expects, so unresolved contractor or AI-tool questions delay both.

Next step

Take the software client you know best through the company fit checker once its diligence evidence is assembled. A good result is a reason to register as a partner and introduce the company, or to share your referral link so the CEO can apply at sourcex.si/apply.