Tick-box AI and the pre-exit plan that holds up

Two people sitting at a desk in an office reviewing printed documents together
TL;DR

Shallow AI that exists mainly to satisfy a board looks adopted but is not integrated, and that gap is exactly what diligence is built to find. Closing it properly is a 6 to 18 month remediation arc, not a sprint, so the work has to begin well before any sale process. Inventory what AI exists and who owns it, remediate the highest-impact gaps, build evidence rather than policy binders, then position the surviving systems against a real business case.

Key takeaways

- Tick-box AI buys a quiet board meeting now and a worse exit later, because diligence is designed to tell a system that is genuinely used apart from one that was deployed to look busy. - The gap is between looking adopted and being integrated. Looks adopted means a tool exists and someone can demo it. Is integrated means it solves a defined problem, has a named owner, is monitored, and the business would notice if it stopped. - Genuine AI maturity is a 6 to 18 month build, not a diligence-window sprint, so a credible governance timeline has to predate the sale conversation. - Prioritise data governance, infrastructure readiness, and model validation first, since the research ties these dimensions most reliably to value, and triage by business impact rather than chasing tidiness. - Honesty is the discipline that holds it together. Documenting how you wish the business ran rather than how it does gets caught and repriced, because diligence teams treat assembled-after-the-fact evidence as superficial.

Somewhere in your business there is probably an AI initiative that exists mainly to put a line in the board deck. It got stood up to show the board something was happening. It ticks the box in the quarterly update, and on paper you are “using AI”. Nobody has yet asked the harder question of whether it is owned, monitored, documented, and tied to a real result. That question does get asked eventually. Usually by a buyer, at the worst possible moment to be answering it for the first time.

This is not a criticism of the decision. Standing up visible AI because a board asked for visible progress is a rational response to the pressure you were under. The trouble is that the same initiative reads very differently across a diligence table than it does across a board table. A board wants to see momentum. A buyer wants to see substance, and a buyer is good at telling the two apart.

The choice you are facing before any sale

You can leave the AI as it is, a tidy line in the deck that nobody has stress-tested, or you can turn it into something that holds up when a buyer takes it apart. That choice has a clock on it. Genuine AI maturity is months of work, so deciding late means deciding badly, with the evidence assembled in a hurry.

The reason the timing matters is specific to how buyers read AI. Diligence has shifted from checking whether a company has AI to checking whether that AI is real, owned, and tied to a business outcome. Reed Smith’s red-flag guide for buyers describes the markers of shallow adoption plainly. No documented business case. Weak data governance. No model validation or monitoring. Ambiguous ownership. The thinner the substance, the larger the gap diligence opens up, and the work to close it cannot be backdated.

When fixing it later looks fine but is not

Leaving the work until the sale process is under way feels efficient, because you only spend the effort when there is a real buyer to spend it on. In practice it is the weaker option. Diligence teams read last-minute documentation assembled after the fact as superficial rather than substantive. The Arkeo AI governance work makes this point directly, that a credible governance timeline has to predate the sale conversation.

There is a second cost to waiting that has nothing to do with the buyer. While the AI sits in its tick-box state, it is not actually doing much for the business. It is unowned, unwatched, and disconnected from a defined problem. The decision to remediate early is the same decision that makes the AI genuinely useful in the meantime. You are not buying diligence cosmetics. You are paying for the months in which the system starts to earn its place, and the evidence is a by-product of that.

When starting early is the right call, and what the arc looks like

Starting early is the right call whenever an exit is on the horizon at all, even a vague one, because the work compounds and cannot be rushed. The research frames AI maturity preparation as a phased arc of roughly 6 to 18 months, sequential by design. Each phase produces the raw material the next one turns into evidence, which is why cramming them into a diligence window does not work.

The first phase is inventory and assessment. You find every AI system that actually exists, including the ones nobody owns, and you document each one’s business purpose, data sources, performance, and owner. The Baker Tilly AI readiness framework gives you a usable lens here, assessing each system across five dimensions: opportunity discovery, data management, IT environment and security, risk and privacy and governance, and adoption. This is also where the orphans surface, the systems relied on day to day with no one responsible for them.

The second phase is remediation and governance. You fix the highest-impact gaps and stand up the basics that were missing, monitoring, data governance, and clear ownership for each surviving system. You do not tackle everything evenly. You triage by business impact and diligence risk, and the research singles out data governance, technical infrastructure readiness, and model validation as the dimensions most reliably tied to value. Fix those first.

The third phase turns the work into evidence, and the fourth positions it. Evidence means demonstrable records rather than policy binders. Model cards that state each system’s purpose, data origin, versions, performance, and limitations, as the 2B Advice documentation work sets out. A model inventory spanning every business function, in the shape the American Academy of Actuaries describes, with risk assessment, validation status, and ownership for each entry. Then positioning means setting the surviving systems against a real business case, so the buyer sees a defined problem solved, not a logo in a slide.

What it costs to get this wrong

Getting it wrong costs you at the exact moment you have the least room to recover, the diligence table. When a buyer’s team tests AI that was deployed to look busy, they find the absence of the things that signal a real system. A tool with no owner and no oversight reads as a liability whatever logo it carries.

The Kroll analysis frames this well, that responsible AI is a management problem rather than a purchase. The directional finding across the research is consistent. Shallow AI reads worse in diligence and tends to depress value, while genuine maturity attracts confidence.

The deeper cost is dishonesty under pressure. When the work is left late, the temptation is to document how you wish the business ran rather than how it does. That gets caught. Diligence has moved towards evidence over assertion, as the Kiteworks governance documentation work describes, where audit trails and access records carry more weight than written policy. A policy with no technical record behind it is a gap, not a reassurance, and a polished narrative that the systems cannot back up is worse than an honest one that admits its limits.

What to ask before you decide

Before you decide whether to start now or leave it, ask whether each AI system would survive a stranger taking it apart. For every system, ask who owns it, what defined problem it solves, whether anyone is watching its performance, and whether the business would notice if it stopped tomorrow. If the honest answers are vague, you are looking at looks-adopted rather than integrated.

Then ask the timing question honestly. If an exit is anywhere on your horizon, the months you would spend remediating are months you do not have once a process starts, and the same work done early reads as governance maturity rather than a scramble. The accountability gap that forms when AI is delegated without executive oversight, which the Charter Global work describes, does not close itself. It closes when an owner decides to own it. If you want a second view on which of your systems are real and which are theatre before a buyer forms their own, book a conversation.

Sources

Baker Tilly (2024). AI due diligence assessment prepares a company for strategic acquisition. Source for the five-dimension AI readiness framework used at the inventory step: opportunity discovery, data management, IT environment and security, risk/privacy/governance, and adoption. https://www.bakertilly.com/insights/ai-due-diligence-assessment-prepares-company-for-strategic-acquisition TechAhead (2025). AI readiness assessment. Source for the phased pre-exit preparation arc and the case for assessing strategic alignment and business value rather than tool presence. https://www.techaheadcorp.com/blog/ai-readiness-assessment/ Arkeo AI (2025). AI governance framework template. Source for the founder-led governance points, ownership structures, and the finding that diligence teams treat last-minute executive involvement as superficial. https://www.arkeoai.com/ai-in-business/ai-governance-framework-template Reed Smith (2025). AI deals, no illusions, a practical red-flag guide for buyers and boards. Source for the absence of a business case, weak data governance, missing validation, and ambiguous ownership as superficial-adoption red flags. https://www.reedsmith.com/articles/ai-deals-no-illusions-a-practical-red-flag-guide-for-buyers-and-boards/ Kroll via The Regulatory Review (2022). Responsible AI is a management problem, not a purchase. Source for AI quality being a question of ownership and oversight rather than tool acquisition. https://www.theregreview.org/2022/07/04/kroll-responsible-ai-is-a-management-problem-not-a-purchase/ Kiteworks (2025). AI governance audit documentation. Source for the shift from policy assertions to technical evidence records such as audit trails and access logs in diligence. https://www.kiteworks.com/cybersecurity-risk-management/ai-governance-audit-documentation/ 2B Advice (2025). Model cards and why they matter for AI documentation. Source for model cards as the foundational documentation a buyer expects for each system. https://2b-advice.com/en/2025/09/16/model-cards-thats-why-model-cards-are-so-important-for-ki-documentation/ American Academy of Actuaries (2019). Model Risk Management Practice Note. Source for the model inventory standard: name, description, system, risk assessment, validation status, and ownership across all functions. https://www.actuary.org/sites/default/files/2019-05/ModelRiskManagementPracticeNote_May2019.pdf A-LIGN (2024). Preparing for EU AI Act compliance. Source for the regulatory backdrop that pushes diligence towards demonstrable governance evidence rather than written policy. https://www.a-lign.com/articles/preparing-for-eu-ai-act-compliance Charter Global (2024). Why AI requires executive ownership, not IT-led initiatives. Source for the accountability gap that forms when AI is delegated without executive oversight. https://www.charterglobal.com/why-ai-requires-executive-ownership-not-it-led-initiatives/

Frequently asked questions

How long before a sale should I start fixing my AI?

Give yourself the better part of a year at minimum, and up to eighteen months if you can. The research describes AI maturity preparation as a 6 to 18 month phased arc. The reason is credibility as much as workload. Diligence teams read last-minute, hastily assembled documentation as superficial rather than substantive, so a governance timeline that genuinely predates the sale conversation is worth more than the same work crammed into the diligence window.

What is the difference between AI that looks adopted and AI that is integrated?

Looks adopted means a tool exists, there is a logo in the board deck, and someone can give a demo. Is integrated means the tool solves a defined business problem, it has a named owner, its performance is monitored, and the business would notice if it stopped. Diligence teams test the difference by interviewing staff about whether systems are actually used and trusted, and by checking each system against documented strategy.

What evidence do buyers actually want to see for an AI system?

Demonstrable records, not policy binders. The deliverables that count are model cards that state each system's purpose, data origin, versions, performance, and limitations, a model inventory spanning every business function, validation results, and audit trails. Diligence has shifted towards evidence over assertion, so a written policy that no technical record supports tends to read as a gap rather than a reassurance.

This post is general information and education only, not legal, regulatory, financial, or other professional advice. Regulations evolve, fee benchmarks shift, and every situation is different, so please take qualified professional advice before acting on anything you read here. See the Terms of Use for the full position.

Ready to talk it through?

Book a free 30 minute conversation. No pitch, no pressure, just a useful chat about where AI fits in your business.

Book a conversation

Related reading

If any of this sounds familiar, let's talk.

The next step is a conversation. No pitch, no pressure. Just an honest discussion about where you are and whether I can help.

Book a conversation