AI roll-up due diligence checklist for client-data rights and operating records

Why AI roll-up diligence needs a records section

Standard diligence confirms that records exist; AI roll-up diligence also has to confirm who may use them, for what, and whether the history will survive integration. The investment thesis depends on rebuilding a services firm's workflows with AI, which assumes the buyer can use the target's workflow data, and the same records may later be licensable by the add-on itself.

Quality of earnings, legal and IT diligence each touch part of this, but no single workstream usually owns it. The checklist below gives it an owner. It complements the criteria AI roll-ups use to pick targets and should run before the purchase agreement is final.

The checklist

Ownership: client material vs the target's own records

The rules behind these items are set out in the explainer on using acquired firms' client data.

• List every data category and label it client-owned, firm-owned or mixed.
• Read a sample of engagement letters and MSAs for confidentiality, data-use limits, return-or-destroy clauses and ownership of deliverables.
• Identify where the target acts as a service provider handling clients' personal information. California's CCPA requires a written agreement limiting a service provider's use of that information to specified purposes (California Civil Code 1798.100 et seq.).
• Check contractor and offshore agreements for a written assignment of rights in work product.
• Confirm no business records sit in personal accounts belonging to the owner or staff.

Privacy promises, consents and sensitive data

• Collect every version of the target's privacy notice and terms, with dates, and flag any statement about AI, model training or third-party sharing.
• Do not plan to fix restrictive promises by amending terms after closing. FTC staff warned in February 2024 that quietly and retroactively changing terms of service or a privacy policy to allow uses such as AI training could be unfair or deceptive (FTC staff post on changing terms of service).
• For call recordings, document the notice and consent process used; recording-consent rules vary by state.
• If the target handles protected health information, for example in revenue cycle or healthcare administration work, confirm whether any dataset was de-identified under HIPAA's Expert Determination or Safe Harbor method (HHS de-identification guidance).

Systems, access and export

• Inventory each system with its administrator, subscription holder, years of history and export format.
• Confirm subscriptions and admin credentials sit with the company, not with a vendor, a client or a departing owner.
• With the seller's consent, test one export during diligence and check that metadata such as timestamps, status changes and assignees survives.
• Record retention and auto-delete settings and any legal holds in place.
• Locate backups of retired or archived systems and confirm they can still be read.

Record depth and AI exposure

• Identify workflows whose records carry outcomes: tickets resolved or escalated, reviews passed or sent back, approvals given or withheld.
• Find the date AI tools entered each workflow, if any, and how many years of history predate it.
• Ask whether any records were generated, rewritten or summarized by AI.
• Ask whether the target has already licensed data for AI training or granted exclusivity to anyone.

License readiness for the add-on

• 50+ full-time employees at peak (contractors excluded).
• Several years of documented operations spread across many systems.
• Rights to license its own records, separated from client material.
• An authorized sponsor (owner, CEO, CFO or authorized representative) who would consider an exclusive license for an agreed term after closing.

Deal documents

• The LOI and purchase agreement oblige the seller to keep systems running and archives intact until closing; see what to include in an LOI.
• Representations cover data rights, privacy compliance and any prior data licenses.
• A transition services arrangement covers system access until migration.

How to use the results

For deals that proceed, the AI roll-up integration playbook picks up from day one, starting with a deletion freeze.

Who owns each part of the checklist

Red flags for any later license

These do not always kill the acquisition, but each one rules out or delays licensing the records:

• The data belongs to clients or another party, and there is no consent.
• Records are mainly consumer personal data with no licensing basis, or mainly protected health information without authorization or de-identification.
• Archives were deleted, or nobody at the target can run an export.
• A court, trustee or assignee controls the assets and has not been involved.
• Records were generated with AI to look like human work.
• The data was already licensed for AI training.
• The owner will not consider an exclusive license.

The add-on's own team can work through the rights readiness checklist after closing to fix what can be fixed.

This is general information, not legal, tax or financial advice. Have deal counsel confirm how these rules apply to each target.

Next step

Hand this list to the deal team before the next target's diligence kickoff. The page for private equity operating partners explains how sponsors introduce portfolio companies, who qualifies gives the full baseline, and you can register as a partner so add-ons, or targets you pass on, can be introduced with your referral link.