How to address AI risk in a CIM with evidence instead of reassurance

How should a CIM handle AI risk?

Name the risk and answer it with evidence. A CIM that skips the question leaves bidders to answer it with their own assumptions, and those assumptions usually show up as a discount. A short, specific section showing which revenue is exposed, what the company has already automated and which assets AI cannot replicate reads as management in control rather than management hoping nobody asks.

The strongest version also reframes part of the risk. A services or software business that has done real work for years holds records of how that work gets done, and those records are scarce. Presented accurately, they move from a footnote to an asset.

Why bidders will ask about AI either way

Financial sponsors now read every CIM through an AI lens, because they are using AI in their own portfolios. McKinsey's Global Private Markets Report 2026 says multiple expansion and cheap leverage have faded as sources of private equity returns, that operational value creation is now likely the primary source, and that sponsors are applying AI to operating levers. A deal team that uses AI to cut costs in one company will ask, of the next, where AI could cut revenue.

Strategic acquirers ask a different version: will the target's services still be bought in their current form in three years? Both questions need the same evidence.

What you need before writing the section

• Revenue by service line or product for at least three years
• A task-level description of what the company's people do for clients
• A list of automation and AI tools already in use, with start dates and measured effect on hours or margin
• The pricing model for each service line: hourly, fixed fee, subscription or outcome-based
• Client retention and pricing history over the same period
• A systems list showing how far back the company's records go
• The privacy policy and the data-use clauses in client contracts

The Exposure, Evidence, Edge method

1. Map exposure by revenue line. Break revenue into the tasks clients actually pay for and rate each one high, medium or low exposure to automation. Be candid; every serious bidder will run the same exercise.
2. Show what has already been automated. Hours saved, margin change and staff redeployed, with dates. One measured example beats a page of claims.
3. Show pricing resilience. Fixed-fee and outcome-based pricing let the company keep automation gains; hourly pricing passes them to clients. If pricing is hourly, say what is changing and show early results.
4. Show client evidence. Retention, expansion and renewal rates since AI tools became widely available are the best proof that clients still value the work.
5. Name the edge. Accountability for outcomes, licensed or regulated work, long client relationships, on-site delivery and proprietary records are things a model does not replace on its own.
6. Present the records as an asset. AI developers building agents need records of real multi-step work, and those barely exist on the public web. Researchers at Epoch AI have projected that, if current trends continue, language models will fully use the stock of public human-written text between 2026 and 2032, a forecast with wide uncertainty. Licensed, permissioned business records are one answer, and the comparison of licensed and scraped data explains why buyers pay for clean rights. Describe the records factually; do not put a value on them.
7. Place it consistently. The same facts should appear in the investment highlights, the business description, the risk section and the management presentation.
8. Back every statement in the data room. Each claim in the section should point to a report, contract or export a bidder can check.

Where AI belongs in the CIM

Software targets face a second set of questions about the code itself; AI-generated code in due diligence covers what buyers ask.

Common mistakes

The FTC post is staff guidance, not a rule. This is general information, not legal, tax or financial advice. Confirm data-use questions with the company's own privacy counsel.

Illustrative example

Illustrative only; the firm and its numbers are fictional. A sell-side advisor is preparing the CIM for a 170-employee software implementation consultancy. Exposure mapping shows configuration documentation and data-migration scripting as high exposure, workshop facilitation and change management as low, and testing as medium.

The evidence: the firm moved documentation to AI-assisted drafting two years ago, cut hours per project and kept fixed-fee pricing, so margin rose. Client renewals held. The edge: long client relationships and nine years of company-authored project records, including statements of work, ticket histories and decision logs with outcomes. Client deliverables belong to clients under their contracts, so the CIM describes only the firm's internal records. Before the CIM is finished the owner chooses to explore a license through SourceX, and the CIM says so factually, without a value.

How advisors introduce the records option

1. Ask the owner, not the bidders, whether licensing the firm's operating history is worth exploring.
2. Check the basics on who qualifies: 50+ full-time employees at peak (contractors excluded), years of documented history, clean rights and a sponsor who can sign for the company.
3. Run the company fit checker together for a preliminary, non-binding read.
4. Submit the company through the referral form or share your referral link, which lands the owner on the sourcex.si/apply form with your credit preserved.
5. SourceX and the company handle the inventory, terms and any license; your involvement with the records is nil, and nothing binds the company until it signs.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is payable only after the buyer pays and SourceX receives its fee, never comes out of the company's payment, and is not guaranteed.

When a data buyer contacts the owner unprompted during a sale, the guidance on handling an unsolicited AI data offer mid-sale applies.

Next step

Apply the Exposure, Evidence, Edge method to your next CIM draft. If the records story holds up, register as a partner and introduce the owner; the M&A advisor partner page explains how the program works alongside a sale.