You’ve just been told the business is heading for a sale in eighteen months. The AI programme has been running under your oversight for two years, the tools are embedded in daily workflows, and the outputs are real. The ownership records, refresh protocols, and data handling documentation, however, have never been audited. Working and ready for due diligence are different standards. The gap between them is where acquirers find their discount.
What does acquirer AI due diligence actually check?
Acquirers don’t audit AI maturity to satisfy curiosity. They audit it because an unmanaged AI estate introduces liability, dependency, and operational fragility that erodes enterprise value. Commercial due diligence on AI typically covers five dimensions, and each one can surface a gap that becomes a negotiating lever. The business that addresses them in advance controls the conversation. The one that doesn’t explains itself.
The five dimensions are:
- Data governance. What data the business uses to power its AI tools, how it’s stored, whether it’s licensed for AI processing, and whether personal data has been handled lawfully under UK GDPR.
- Process integration. Whether AI is genuinely embedded in operational workflows or exists as a set of individual subscriptions that would disappear if a few employees left.
- Ownership clarity. For each AI tool in use, who is accountable for it? Delegated AI estates often lack a clean answer.
- Refresh discipline. How prompts, models, and integrations are kept current. An AI tool configured a year ago and never reviewed is a technical debt item. A whole estate of them is a red flag.
- Founder dependency. M&A advisors have long identified owner dependency as the single largest driver of exit multiple discounts, with discounts of 30 to 40 per cent common when decisions and processes are founder-centric. An AI estate built around the way the founder thinks, without capturing the underlying process in documentation, creates a new layer of that dependency rather than reducing it.
Why do delegated AI estates fail these checks?
The pattern is predictable. A founder hands over an AI mandate verbally, with broad intent and limited documentation. The delegate builds fast, deploys tools that work, and demonstrates progress. What rarely follows is the ownership records, governance documentation, refresh schedules, and process maps that make the estate legible to an outside examiner. The result is an AI estate that works day-to-day and reads poorly in a data room.
The research is consistent on why this happens. BCG’s 2025 AI Adoption Puzzle found roughly half of businesses stuck in stagnating or emerging AI stages, unable to move from proof-of-concept to genuine operational integration. MIT’s NANDA study found that only around 5 per cent of generative AI pilots achieve meaningful revenue acceleration; the cause is a gap in workflow integration, not model quality. Both findings point to the same underlying problem: AI is adopted but not institutionalised.
There is also a more subtle failure specific to delegated estates. When AI tools are built to replicate the way a founder thinks and decides, without capturing the underlying logic in documented processes, the business ends up more dependent on the founder’s presence. The business appears to have adopted AI while its founder dependency has increased.
Where are the gaps most likely hiding?
Before you can fix anything, you need to know what the estate actually contains. Many delegated AI programmes carry a shadow layer, tools adopted by individual teams without central oversight. A business heading for a sale may have AI running in customer service, finance, and marketing alongside tools in operations or product that surfaced through individual initiative and were never formally logged.
Three areas concentrate the most common gaps.
Ownership and documentation are the most frequently absent. An AI tool with no named owner is a liability in a data room. If the question “who is responsible for this?” cannot be answered by the team, an acquirer will treat the tool as unmanaged. The fix is a simple register covering tool name, owner, purpose, data it touches, and last review date. One document, significant signal.
Data handling under AI processing is a second risk area. Many businesses have added AI tools to workflows that involve customer or employee data without reviewing whether their existing data agreements cover that use. Under UK GDPR, using personal data in an AI system without a proper lawful basis creates a compliance gap that due diligence will surface.
The third area is refresh discipline. Prompts that were effective at deployment go stale as the business changes. Models release new versions. Integrations break. A business with no process for reviewing and updating its AI tools is carrying technical debt that an acquirer will identify and factor into the offer.
How do you sequence the remediation?
With eighteen months, the gaps can be closed methodically rather than in a scramble. The sequencing matters because some tasks unblock others. Documentation has to precede ownership assignment. Ownership has to be established before refresh protocols can be meaningful. Shadow AI needs to be surfaced before data handling can be reviewed. Get the order wrong and you correct the same problem twice.
A workable sequence in a pre-exit context:
Months one to three: discovery and documentation. Audit the full AI estate, including tools adopted by individual teams as well as the formal programme. For each tool, record the owner, use case, data it touches, and when it was last reviewed. This single step closes the ownership clarity gap and creates the inventory for everything that follows.
Months four to eight: data handling review. With the inventory in place, assess each tool’s data use against the business’s existing agreements and UK GDPR obligations. Where gaps exist, close them before they appear in due diligence. This is also when process maps should be updated to show AI’s actual role in key workflows.
Months nine to twelve: refresh protocols and governance. Establish a light-touch governance layer covering who reviews which tools, how often, and against what criteria. A one-page policy with named owners and a review calendar is enough to demonstrate that the estate is managed rather than inherited.
Months twelve to eighteen: founder dependency audit. Review where the AI estate relies on founder-specific knowledge or decisions. Codify the underlying process. If a tool was built around the way the founder has historically called certain judgements, document that logic explicitly so an acquirer can assess whether the capability is institutional or personal.
What should be ready before the data room opens?
A defensible AI estate is what due diligence requires, not a perfect one. An acquirer wants to see that the business knows what it’s running, who owns it, how it connects to operations, and whether it functions independently of any individual. A business that can answer those questions clearly, with documentation to support the answers, is in a fundamentally different position to one that cannot.
Three things should be ready before the data room opens.
An AI asset register covering every tool in use, with owner, purpose, data classification, and last review date. This is typically the audit’s first request. Having it ready signals maturity immediately; not having it signals a programme that was never managed.
A data handling assessment for AI processing. A documented review confirming that tools handling personal data do so lawfully, with records of any changes made to meet that standard, is sufficient for initial due diligence. It doesn’t require a legal opinion to be useful.
A governance framework covering decision rights and refresh cadence. A written policy with named owners and a review schedule demonstrates that the business has moved from AI adoption to AI management. Change management research consistently shows that technology investments fail not on technical merits but when the human and governance structures around them are underdeveloped. An AI estate is no different. The returns compound when the system is documented, owned, and refreshed, not just when the tools are first switched on.
If you’re eighteen months or fewer from a transaction and want a clear view of where your AI maturity gaps sit, Book a conversation.
