The AI Due Diligence Checklist for Investors

Every AI-enabled company looks impressive in a pitch deck. The challenge is separating genuine AI capability from AI marketing. This checklist provides the structured framework to do exactly that.

Built on the four-dimension AI due diligence framework, this checklist distils the assessment into 40 specific, actionable verification points. Each can be evaluated through document review, management interviews, technical assessment, or independent verification.

Use it as a scoring framework: each item rated Red (fail/missing), Amber (partial/unclear), or Green (verified/satisfactory). A company with more than 5 Red ratings has material AI risk that must be addressed before investment.

Category 1: Technology Verification (10 points)

The technology assessment verifies that AI claims are substantiated by genuine capability.

AI system inventory

1. Complete AI system catalogue exists — every AI/ML system in production is documented with purpose, architecture, team, and business impact
2. Each system has a defined owner — a named individual responsible for the system's performance, maintenance, and governance
3. Production monitoring is active — automated monitoring tracks model performance, data quality, and system health in real time

Architecture and quality

4. Model architecture is documented — model cards or equivalent documentation describe architecture, training methodology, and design decisions
5. Model performance is measured on production data — not just research benchmarks or curated test sets
6. Version control and rollback capability exists — the team can revert to previous model versions if new deployments underperform
7. Retraining processes are defined and scheduled — models are updated on a regular cadence, with drift detection triggering ad-hoc retraining

Verification

8. Independent model evaluation confirms claims — an independent ML engineer has verified that the models perform as described
9. Infrastructure evidence supports claims — cloud compute bills, GPU usage, and training logs are consistent with claimed AI activity
10. Non-AI alternatives have been evaluated — the team can demonstrate that AI outperforms simpler approaches (rules-based, statistical) for each use case

Category 2: Data Asset Assessment (8 points)

Data assets are often the most valuable and most overlooked component of AI capability.

11. Training data sources are documented — every dataset used for model training is catalogued with source, volume, update frequency, and quality metrics
12. Data provenance and legal rights are verified — the company has clear legal rights to use all training data for AI purposes
13. Data quality monitoring is active — automated checks track data completeness, accuracy, consistency, and freshness
14. Proprietary data creates defensible advantage — at least one key dataset is proprietary and cannot be replicated by competitors within 12 months
15. Data refresh pipeline is operational — new data flows continuously into the training pipeline without manual intervention
16. Data governance framework exists — policies and procedures for data handling, privacy, retention, and access control are documented and enforced
17. GDPR/privacy compliance is verified — data processing activities are lawful, documented, and subject to data protection impact assessments where required
18. Data backup and recovery is tested — training data can be recovered from backup in a defined timeframe

Category 3: Talent and Organisation (8 points)

AI capability is embodied in people. Talent assessment is as important as technology assessment.

19. Dedicated AI/ML team exists — at least three people with ML-specific titles and demonstrable ML experience
20. Team composition covers the ML lifecycle — data engineering, model development, MLOps, and evaluation roles are filled
21. Key-person dependency is manageable — no single individual's departure would cripple AI capability
22. Retention risk is assessed and mitigated — AI team compensation is benchmarked against market rates, and retention mechanisms are in place
23. Hiring pipeline is active — the company is actively recruiting AI talent and has a track record of successful ML hires
24. Technical leadership is credible — the AI team leader has demonstrable ML experience (publications, prior ML roles, or measurable project delivery)
25. Knowledge documentation exists — model decisions, training procedures, and operational runbooks are documented — not stored only in individuals' heads
26. Collaboration between AI and business teams — AI projects are driven by business requirements, not technology exploration

Category 4: Regulatory and Compliance (6 points)

Regulatory risk in AI is growing and must be assessed as part of due diligence.

27. EU AI Act risk classification completed — all AI systems have been classified according to the risk tier framework
28. High-risk system compliance documented — systems classified as high-risk have conformity assessments, risk management documentation, and human oversight mechanisms
29. AI transparency obligations met — users interacting with AI systems are informed they are interacting with AI (EU AI Act limited-risk requirement)
30. No AI washing in public materials — AI claims in marketing, investor decks, and public statements are substantiated and proportionate to actual capability
31. Bias testing and fairness monitoring implemented — AI systems that affect individuals are tested for discriminatory outcomes and monitored in production
32. Incident response plan for AI failures — documented procedures for responding to AI errors, bias detection, and regulatory inquiries

Category 5: Commercial Validation (8 points)

Technology capability is necessary but not sufficient. The commercial assessment verifies that AI creates measurable business value.

33. Revenue attribution to AI is measurable — the company can quantify how much revenue or cost saving is directly attributable to AI
34. AI-driven KPIs are tracked — specific metrics (not generic "improved efficiency") demonstrate AI's business impact
35. Customer dependency on AI features — customers actively use and value AI features, evidenced by usage data and feedback
36. Competitive moat is assessable — the company can articulate why competitors cannot replicate its AI capability and in what timeframe
37. AI roadmap is realistic — planned AI investments have clear business cases, defined timelines, and allocated resources
38. Total cost of ownership is understood — the company accounts for all AI costs including hidden integration expenses, not just licensing
39. AI governance framework exists — the company has an AI governance structure appropriate to its scale and risk profile
40. AI is integrated into business strategy — AI is not a standalone initiative but is embedded in the company's growth strategy and operational planning

Using the Checklist in Practice

The checklist is most effective when:

1. Completed before the offer stage — AI risk findings should influence valuation and deal terms
2. Assessed by independent technical experts — not the target's own team or the vendor
3. Documented with evidence — each rating should cite specific documents, interviews, or test results
4. Shared with the investment committee — as a structured risk summary alongside financial due diligence

The Opagio questionnaire provides a systematic digital assessment of technology intangible assets, including AI capability, that complements this due diligence checklist. The Growth Platform tracks these assessments across portfolio companies over time.

Ivan Gowan is Founder and CEO of Opagio. He spent 15 years at IG Group (LSE: IGG) evaluating technology capability across vendors, acquisition targets, and internal teams. The due diligence methodology in this article reflects that practical experience. Learn more about the Opagio team.