Secondary buyout due diligence: what the next sponsor will ask about data and AI

What the next sponsor is really testing

A secondary buyout, or SBO, is a sale from one private equity owner to another. The buyer's diligence keeps returning to one question: what value creation is left after the first owner's playbook? Pricing, procurement, an ERP upgrade and a few add-ons have usually been done already. The new sponsor needs a credible next set of levers to justify the entry price, and data and AI now sit on that list.

The concrete version of the question is narrow: which records does the company hold, does it have the rights to use them for AI, and has any of that value already been licensed away? A seller with a system register, a rights summary and, where one exists, an executed license answers with documents instead of opinions.

Why value creation dominates the SBO investment memo

The buyer's investment committee knows returns now have to be earned operationally. McKinsey's Global Private Markets Report 2026 says multiple expansion and cheap leverage, which accounted for 59 percent of private equity returns between 2010 and 2022, have faded, leaving operational value creation as the likely primary source of returns. The same report found that 53 percent of 300 surveyed LPs ranked a GP's value creation strategy among their top five selection criteria.

The asset is also older than it used to be. PitchBook reported a median holding period of 5.8 years for PE assets sold in the first half of 2024. A company reaching an SBO therefore carries years of records created under the first sponsor, much of it in systems that sponsor installed, and that is the history the next owner will ask about.

How the diligence workstreams now cover data and AI

Six questions to expect, and what a prepared seller shows

1. What operating history exists, and where? A system register listing each system, its first year of records, rough volumes and its admin owner.
2. Who created the records? A split between employee-created material and work from contractors or agencies, with the assignment status of the latter.
3. What did customers and users agree to? Current and past versions of the privacy notice and standard terms, with dates. FTC staff have warned that adopting more permissive data practices, such as using data for AI training, through a quiet retroactive change to terms or a privacy policy may be unfair or deceptive, so buyers check the history of the text, not only today's version.
4. Has any data been licensed, sold or shared for AI training? Each agreement with its scope, exclusivity and end date.
5. Was any history deleted? Retention settings, migration notes and the location of pre-migration exports.
6. What value is left? Which datasets remain unlicensed, and what any licensing review found.

The data rights due diligence checklist works through questions 2 and 3 in detail, and the comparison of vendor due diligence and a data licensing review explains which report answers which question.

What an executed license tells the buyer

An executed license is evidence in three ways. A data buyer has already examined the rights, so the next sponsor's counsel starts from a reviewed position rather than a blank page. It shows that demand for the company's records exists, which supports the data section of the next value creation plan. And it fixes the facts in writing: scope, term, exclusivity and what the company kept.

It also carries conditions the seller must disclose. An exclusive AI-training license blocks licensing the same records to anyone else during its term, so the buyer's plan cannot count on them until it ends. The proceeds are one-time, and the quality of earnings will treat them that way. Records outside the license's scope, and records created since, stay available to the company.

Illustrative script for the CFO at the management meeting, with fictional figures to replace with the company's own:

When the current owner should start preparing

The guide to the exit data book shows how this material sits next to KPI support.

What it means for a referral partner

Selling-side operating partners, deal teams and their advisers see the company's systems early in exit preparation, which makes them natural introducers. A company worth introducing is US-based, reached 50+ full-time employees at peak (contractors excluded), has several years of documented operations, holds the rights to what it would license and has an authorized sponsor ready to engage. The company fit checker gives a quick, non-binding first read. The introducer passes on fit information only and never handles records; the primer on what an AI data buyer is explains who reviews the opportunity after that.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. The PE operating partner program page covers firm policies to check first.

Limits and open questions

• Do not put an expected license value in a CIM or management presentation before a license is signed; buyer demand is never certain.
• FTC staff posts are guidance, not rules, and privacy law varies by state, so counsel should judge what past notices permit.
• A company whose records mostly belong to its clients, or are mostly consumer or health data, may have little to license.
• Negotiating a license during a live sale process can complicate it; coordinate with the deal team and counsel.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Next step

Ask the CFO of your next exit candidate for a system register this quarter. If the company fits, register as a partner and introduce it, or have the CEO apply at sourcex.si/apply.