How do GPs answer responsible AI questions in LP due diligence questionnaires?

What LPs ask GPs about responsible AI

Responsible AI questions in LP due diligence cover two areas: how the GP uses AI in its own investment process, and how portfolio companies use, build and share data for AI. Industry templates such as the ILPA due diligence questionnaire give LPs a common starting point, and individual LPs add questions of their own.

The questions tend to fall into a handful of themes, each with evidence a GP should be able to produce.

Value creation questions in the same questionnaire are covered in the guide to ILPA DDQ portfolio management questions.

The answer ladder: policy, practice, proof, exceptions

Strong DDQ answers climb four rungs. A policy on its own reads as boilerplate; proof and candid exceptions are what make an answer credible.

1. Policy. What the firm's AI policy says, who owns it and when it was last reviewed.
2. Practice. How it applies in the investment process and at portfolio companies: approvals, AI use inventories, training.
3. Proof. What evidence exists, such as committee minutes, portfolio survey results, vendor reviews and board agenda items.
4. Exceptions. Where practice falls short or is still being built, and the plan and timing to close the gap.

An answer that stops at the first rung invites follow-up questions. An answer that reaches the fourth tends to close the thread.

How to describe portfolio data licensing in a DDQ answer

When a portfolio company licenses operational records for AI training, the DDQ answer should describe what actually happens, in the order it happens. Taking SourceX's process as the example:

• The portfolio company, not the GP, decides whether to license and signs the agreement. It keeps ownership; the records are licensed, not sold.
• Before work starts, the company checks its rights and settles with SourceX which fields are removed, masked or de-identified.
• No record is delivered until the agreement is executed and the company authorizes delivery.
• Opportunities are screened out when the data mainly belongs to clients without their consent, is mainly consumer personal data with no licensing basis, or is mainly protected health information without authorization or de-identification.
• The GP's operating team may introduce companies, but it does not access, export or transfer their records.

The privacy-promise check is where regulators have been explicit. In a January 2024 staff post, FTC staff said companies' promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable whether they appear in privacy policies, terms of service or marketing. A February 2024 staff post added that quietly adopting more permissive practices, such as using consumers' data for AI training, through a retroactive change to terms of service or a privacy policy may be unfair or deceptive. Both are staff guidance rather than rules, but they explain why a company's own commitments are reviewed before anything is licensed. Whether the company needs customer consent to license operational data is a question for its own counsel.

A DDQ answer built on those facts might read:

If anyone at the firm receives referral compensation tied to a portfolio company's license, say so in the same answer and explain how the LPA treats it.

Statements to avoid in AI and data answers

The same wording discipline applies when these initiatives appear in fundraising materials; see Marketing Rule case studies in private equity.

Where licensable records sit in a typical portfolio

The companies most likely to raise the question are the ones with deep operational histories. Businesses that already sell data as their core product need to check that a new AI training license fits their existing commitments, since data already licensed for AI training is a red flag; the guide on information services companies and AI licensing covers that case. Industrial businesses often hold field service, inspection and controls records; see industrial technology private equity.

Any candidate also has to clear the baseline: US-headquartered, 50+ full-time employees at peak (contractors excluded), a documented operating history of several years, rights to license its records and an authorized sponsor such as the owner, CEO or CFO. The who qualifies page has the detail.

What this means for investor relations and the operating team

Investor relations owns the DDQ answer; the operating partner owns any introduction. Keeping those roles separate keeps the answer accurate. A typical sequence runs: the operating partner introduces the company, SourceX qualifies it, the company completes a data inventory, the company agrees price and terms, buyers review, and the company is paid once the deal closes and data is delivered.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. Because the reward is a share of SourceX's fee, it never reduces what the company receives, but LPs will still expect it to be disclosed.

Limits and open questions

• Privacy and AI rules keep changing at state, federal and international level, so date every answer and review it at least once a year.
• LPs weigh AI risk differently; one investor's standard answer can be another's red flag.
• A licensing process with strong controls does not settle whether a specific dataset can be licensed; that is a company-level legal question.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Next step

Draft the data licensing paragraph of your DDQ before an LP asks for it. If a portfolio company looks like a fit, the operating partner can register as a partner and handle the introduction, or the company can submit its own application at sourcex.si/apply.