AI due diligence questions acquirers ask sellers, with how to answer each

Why acquirers now add an AI section to the request list

Acquirers add AI questions because AI use creates data, IP and contract exposure that the traditional IT and data governance sections miss. The questions usually arrive inside the diligence request list, and a seller with documented answers ready keeps the deal moving instead of stalling under exclusivity.

Regulators have made the stakes concrete. FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training models, are enforceable, whether those promises sit in privacy policies, terms of service or marketing. A month later, staff warned that quietly changing terms of service to allow AI training could be unfair or deceptive. Both are staff posts rather than rules, but they explain why acquirers read a seller's past promises so closely.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

The AI due diligence checklist

Each item gives the question an acquirer is likely to ask, then how a well-prepared seller answers it.

AI tools and governance

• Which AI tools do employees use, and on what accounts? List coding assistants, chat assistants, meeting transcription and support bots from SSO logs and expense reports, and note which run on enterprise terms.
• Is there a written AI acceptable-use policy? Provide the policy, its adoption date and how staff acknowledged it.
• Has confidential customer information gone into third-party AI tools? Answer from the policy, tool settings and any incident log, never from assumption.
• Who owns AI governance? Name the person and attach any register of AI use cases and approvals.

Customer data and AI features

• Does any product feature train or fine-tune a model on customer data? Identify the feature, the data used and the contract clause that permits it.
• Have privacy policies or terms changed to allow AI use? Provide every version with its date and the notice customers received.
• Do MSAs and DPAs limit customer data to providing the service? Summarize the standard clause and list negotiated exceptions.
• Is personal data of people in the EU involved? The GDPR can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU, so state whether it applies and how that data is handled.

Existing data licenses and data sharing

• Has the company licensed, sold or shared any dataset with a third party, including AI developers? Provide each agreement.
• Is any license exclusive? State the field of use, the term and the record categories covered.
• Does any license need consent to assign, or change on a change of control? Quote the clause.
• Was the license revenue one-time or recurring? Show it separately from subscription or service revenue.

Training-data rights and provenance

• If the company trains its own models, what data did it use? List each source and the rights behind it.
• Did the company scrape web data or buy datasets from brokers? Disclose it and attach the terms.
• Do employee and contractor agreements assign work product to the company? Provide the templates and flag any gaps.
• Were recorded calls or meetings captured with the notices required where they took place? Describe the notice process and its history.

AI-generated output

• How is AI-assisted code tracked in the repository? Describe review practices and any tagging.
• Has anyone raised a claim or complaint about AI output? Disclose it with its current status.

How a seller answers when a SourceX license already exists

Disclose it plainly. A data license signed through SourceX is a written agreement the company entered after agreeing price and terms, so it belongs in the data room and, in most deals, on the material contracts schedule. Give the acquirer a one-page summary covering five points:

1. What was licensed: record categories and date ranges taken from the company's data inventory, never the records themselves.
2. Rights granted: the records are licensed, not sold, the company keeps ownership, and the license is typically exclusive for AI training for an agreed term.
3. Privacy handling: de-identification and redaction requirements agreed before any work began, with delivery only after an executed agreement and the company's authorization.
4. Economics: one all-in price received as a one-time payment, so it is non-recurring in any quality of earnings work.
5. Approvals: who signed as the company's authorized sponsor, and when.

Check the license's confidentiality terms before quoting it, and describe the licensee by category if names cannot be shared; the explainer on what an AI data buyer is gives plain language for that. The guide to AI representations and warranties in purchase agreements shows how these facts flow into the reps and the disclosure schedule.

How to use the results

The seller intake questionnaire with a records section captures most of these facts at engagement, so the answers exist before an acquirer asks. For companies in the fifth row, the company fit checker gives a preliminary, non-binding read with no contact details required.

Red flags that stall a deal

• The seller cannot say which AI tools staff use or on which accounts.
• Privacy terms changed to allow AI use, with no record of notice to customers.
• A product model trains on customer data and the MSA is silent on it.
• An undisclosed data license surfaces in a vendor list, a bank statement or an employee interview.
• Records were generated with AI to look like real work.
• Nobody can export the systems that the answers depend on.

Next step

Advisors who prepare sellers for these questions often come across companies with deep, unlicensed operating records and a willing owner. If you can reach that owner, register as a partner and make the introduction; the program overview for M&A advisors explains how introductions work for deal professionals. Owners can also apply directly at sourcex.si/apply.