Buying an AI company in 2026? Check the training data before anything else

AI due diligence is the review a buyer or investor runs on a company whose value depends on machine learning models: where the models came from, what they were trained on, who owns the weights and the outputs, what inference costs, and which regulatory tier the system falls into. It answers one question before closing: is this defensible, or rented?

Quick recap

• The phrase carries two meanings: diligence on an AI company, and AI-assisted diligence, meaning AI tooling used to run any review faster.
• A standard review covers 9 domains: model provenance and IP, training data, contract data rights, architecture, inference economics, compute commitments, evaluation evidence, governance, and key-person risk.
• Training-data provenance produces the largest unquantified liability, because a scraped corpus cannot be un-trained out of a shipped model without a retrain.
• Ownership splits three ways and each chain is traced separately: the model weights, the training data, and the outputs.
• Many AI companies route most inference to a third-party foundation model, which caps gross margin and creates a switching risk.
• The EU AI Act entered into force on 1 August 2024, with prohibited practices applying from 2 February 2025 and general-purpose AI obligations from 2 August 2025. Penalties reach €35 million or 7 percent of global turnover.
• The 2026 Digital Omnibus moved full compliance for stand-alone Annex III high-risk systems to 2 December 2027, and for Annex I regulated products to 2 August 2028.
• AI tooling shortens first-pass contract review and document classification. It does not shorten judgement, which is why a named human still signs the report.
• A data room for AI due diligence differs from a financial one, because model cards, dataset manifests and evaluation harnesses are the asset being valued rather than a description of it.
• Papermark hosts a data room for AI due diligence with granular permissions, dynamic watermarking, per-visitor analytics and an MCP server from €99/month.

Most AI deals still get diligenced with a software playbook: read the code, check the licences, size the team, move on. That misses the three things that decide whether an AI business is worth its multiple: where the training data came from, who owns the model, and what inference costs against a unit of revenue.

Running the review means putting dataset manifests, model cards, evaluation results and compute reservations in front of five reviewers who should not all see the same things. A data room for AI due diligence handles that with one link per party. Section 9 covers the setup step by step.

Start 7-day data room trial

1. What is AI due diligence?

AI due diligence is a structured assessment of the machine learning systems a target builds, sells or depends on. It is commissioned after a letter of intent, run alongside the technical and legal workstreams, and delivered as a report quantifying what the company owns, what it costs to run, and which regulatory obligations transfer with the shares.

Two activities share the name, and confusing them wastes weeks. The first is diligence performed on an AI company, which is what most people mean when they search the term. The second is AI-assisted diligence, meaning language models and extraction tooling used to run any review faster, on any target. Section 6 covers that second meaning, including where it fails.

The distinction from technical due diligence matters just as much. Technical review asks whether the product can carry the deal thesis: architecture, code quality, security, scalability. AI review asks whether the intelligence inside the product is owned, legal, economic and reproducible. A target can pass a technical review with clean architecture and good test coverage and still fail an AI review because nobody can say where 17 of its training datasets came from.

IP due diligence is the third neighbour, and AI diligence has absorbed much of its scope: the interesting IP question is not whether a patent exists but whether the chain of title runs cleanly from raw data through training runs to the weights in production. Where the target also runs a large internal technology estate, an IT due diligence review covers that separately.

2. The 9 domains of an AI due diligence review

The nine domains below make up the standard scope. Each produces findings that are a cost, a legal exposure, or a constraint on the deal thesis, and a good report expresses all three in the units the deal model already uses rather than in the language of machine learning.

Provenance and data come first, because everything downstream inherits from them. The reviewer traces each production model back to its origin: trained from scratch, fine-tuned from an open-weight base, or a prompt-and-retrieval layer over a hosted foundation model. Then the corpus gets enumerated dataset by dataset, with a licence, a source and a consent basis for each. Companies routinely discover here that the manifest is incomplete, because early datasets were pulled by a founder in a weekend and never recorded.

The middle domains are commercial. Architecture establishes how much of the intelligence is genuinely the company's, which sets both the gross margin ceiling and the switching risk. Inference unit economics convert that into a number per unit of revenue. Compute commitments capture reserved GPU capacity, cloud credits and take-or-pay contracts, frequently the largest off-balance-sheet obligation an AI target carries. The last three are the ones buyers underweight: contaminated benchmarks are common enough that a reviewer should assume contamination until shown the split methodology, governance decides which obligations transfer, and key-person risk decides whether the capability transfers at all.

What each domain asks the seller to produce

The table below maps each domain to the documents a reviewer requests, which is also the folder structure the seller should build before the room opens.

One folder per AI diligence domain, so a dataset manifest and a compute contract carry different permissions.

The sensitivity column drives how the room gets configured. A dataset manifest plus an evaluation harness is close to a reproduction kit, and an acquirer who walks away keeps whatever they read.

3. Training data, model provenance, and the IP questions

Training data is where AI diligence most often pays for itself. A model is a compressed function of the data it was trained on, and unlike a licence breach in a software stack, a training-data problem cannot be patched out. Removing tainted data means retraining: compute, engineering time, a fresh evaluation cycle, and a period where the shipped product performs differently from the one demonstrated.

The reviewer works through the corpus dataset by dataset and asks four things of each. Where did it come from. What licence or contractual right permits its use for training. If it contains personal data, what is the lawful basis. And is any of it derived from a competitor's product, a scraped source, or user-contributed content whose terms never contemplated model training.

Ownership splits three ways and each strand is traced separately. Weights belong to whoever the employment or contractor agreements say they do, which is not automatic when a research contractor ran the training. Training data may be owned, licensed, or merely accessed. Outputs raise a separate question, because customer contracts often assign them to the customer while the company assumes it retains everything.

Fine-tunes on open-weight bases add a layer. Apache 2.0 and MIT are straightforward. Community licences are not: the Llama family requires a separate licence from Meta once a licensee passes 700 million monthly active users, and several open-weight releases carry acceptable-use terms restricting applications. Those terms bind the acquirer after closing.

Dataset manifests and model cards are the documents most worth watermarking: they describe the asset, not the accounts.

An unquantified finding is worse than a large one. A seller who volunteers that 17 datasets have no provenance record, and prices the retrain, is in a stronger position than one who lets the buyer find it in week five.

4. Wrapper or proprietary: margin, switching risk, and compute

The most valuable question in a commercial AI review is how much of the intelligence the company actually owns. At one end of the spectrum is a company training its own models from scratch on proprietary data. At the other is a product that composes prompts, sends them to a hosted foundation model from OpenAI, Anthropic or Google, and renders the response in a good interface. Where a target sits determines margin, defensibility and integration risk.

Nothing about being a wrapper is disqualifying, and reviewers who treat it as a slur produce bad reports. A well-built application layer with real distribution, workflow depth and proprietary evaluation data can be a very good business. But it should be valued with software multiples adjusted for a variable cost of goods a supplier controls.

That adjustment rests on inference cost per unit of revenue. The reviewer takes the cost of model calls, retrieval, embedding and self-hosted GPU time, expresses it against revenue for the same period, then repeats by cohort. A company whose margin falls as usage grows has a variable cost problem that worsens with growth. Three follow-ups matter: what happens if the vendor raises prices, what happens if it deprecates the model version in production, and how long a migration would take.

Compute commitments are the third leg and often the largest surprise. Reserved GPU capacity, take-or-pay cloud contracts and expiring credits can represent multi-year obligations that never enter the working capital discussion. The reviewer reads them for term, minimum spend, utilisation against the reservation, transferability on change of control, and expiry of credits quietly holding the gross margin up.

5. The EU AI Act and the rest of the regulatory stack

Regulation moved from theoretical to dated across 2025 and 2026, and for any target selling into Europe the classification question now belongs in diligence rather than a post-close workstream. The EU AI Act entered into force on 1 August 2024. Prohibited practices applied from 2 February 2025, and obligations on providers of general-purpose AI models, including a summary of training content and a copyright policy, applied from 2 August 2025. Penalties reach €35 million or 7 percent of global annual turnover, and €15 million or 3 percent for most other breaches.

The high-risk timetable then moved. The Digital Omnibus agreed in 2026 deferred full compliance for stand-alone Annex III high-risk systems, which include recruitment tools, credit scoring, education and critical infrastructure, from 2 August 2026 to 2 December 2027. AI embedded in Annex I regulated products moved to 2 August 2028. The deferral is time, not relief: a credit-scoring or hiring product still needs a classification memo, a risk management system, technical documentation, logging, human oversight design and a conformity assessment route.

The practical diligence question is narrow: which tier does each system fall into, who is the provider and who is the deployer, and what evidence exists that the work has started. A target that has classified nothing is telling you the obligations will be discovered on the acquirer's budget.

Three further frameworks appear repeatedly and all are voluntary: ISO/IEC 42001, published in December 2023, the NIST AI Risk Management Framework, released in January 2023, and SOC 2 Type II, a security baseline that says nothing about AI. Underneath all of it, GDPR governs the personal data in the corpus and the inference path, including the 72-hour breach notification duty that transfers with the entity.

6. AI-assisted due diligence: what it shortens and what it does not

The second meaning of the term is AI tooling used to run a diligence process faster. This is standard buy-side practice now, and the honest summary is that it compresses the mechanical parts of review while leaving the parts that carry professional liability exactly where they were.

Four things work well. Document classification, where a model sorts several thousand uploaded files into a request-list structure in minutes rather than days. First-pass contract review, where the tool extracts change-of-control provisions, assignment restrictions, exclusivity and liability caps across a full contract population. Anomaly flagging across financial schedules. And question answering, which lets a reviewer ask which contracts contain a no-training clause and get a list with citations.

Three things do not work, and pretending otherwise is how deals go wrong. Models still fabricate, and a fabricated citation to a document that does not exist is the most dangerous failure mode in diligence because it looks exactly like a finding. There is no chain of custody in a chat window, so an extraction nobody can trace back to a page in a specific document is not evidence. And judgement does not transfer: deciding whether an unassigned contractor training run is a €200,000 problem or a walk-away is the work the fee buys.

The workable pattern is narrow: use the tooling for recall, meaning finding every instance of a thing across a large corpus, and use people for precision. This is why the room matters more rather than less. If a buyer intends to run AI queries across a corpus, the seller should want those queries running against a permissioned, logged, watermarked room rather than a bulk-downloaded folder. Our guide to AI data rooms covers that setup in more depth.

7. Worked scenario: diligencing Tessara AI

A mid-market software group agrees to acquire Tessara AI, a Munich company selling document understanding for insurance claims. Tessara has €14M ARR, 58 employees of whom 9 sit in research, and a pitch describing proprietary models trained on a decade of claims documents. The buyer commissions a technical review and an AI review in parallel over five weeks.

The AI review enumerates 184 datasets in the training corpus. Of those, 96 are licensed or first-party with written rights the reviewer can trace, and 71 are public or open datasets with permissive terms. The remaining 17 have no provenance record: they were assembled in the company's first eighteen months and nobody still there can say where they came from. Those 17 feed the fine-tune behind the core extraction model, which is the product.

184datasets

• Licensed or first-party with written rights96 · 52%

  Traceable to a contract or an internal source
• Public or open with permissive terms71 · 39%

  Licence read and recorded by the reviewer
• No provenance record17 · 9%

  Assembled in year one, source unknown, feeds the core fine-tune

Worked scenario. The 17 datasets with no provenance record are the finding that sets the price, because removing them requires a full retrain of the core extraction model.

Two further findings shape the outcome. The margin work shows 62 percent of inference calls route to a hosted foundation model, putting gross margin at 61 percent against the 78 percent the buyer assumed. And 14 of Tessara's 41 enterprise contracts carry a no-training clause, three covering data in the corpus.

The deal closes with a €4.2M price reduction, a specific indemnity covering the 17 datasets, and a closing condition requiring a documented retrain within six months. Diligence runs through a room holding 260 documents across nine folders, with the AI advisor, IP counsel, data protection counsel and lender each on their own link.

8. Common mistakes, and what the review costs

The most common mistake is running AI diligence as a subsection of the technical review. Nobody on a technical team is going to read 41 customer contracts for no-training clauses or reconcile a dataset manifest against training run logs, and if the scope does not name those tasks, nobody will.

The second is accepting the corpus description the target offers. Publicly available data is not a provenance record, and neither is a list of dataset names without licences. The reconciliation that matters is between the manifest and the training run logs showing what was actually loaded.

The third is treating the model as the only asset, when the durable advantages are frequently the evaluation set, the labelled data and the distribution. The fourth is starting late, because a gross margin that turns out to be 61 percent rather than 78 percent is hard to reflect in a price already agreed. Our M&A due diligence checklist covers where the AI workstream sits in the sequence.

What the review costs

AI diligence is normally scoped alongside the technical review rather than as a standalone engagement. A technical review runs $35,000 to $95,000 with a specialist firm, or $50,000 to $150,000 with a Big Four technology practice, and the AI-specific work adds to that in proportion to corpus size.

Total M&A diligence across all workstreams runs 0.5 to 2 percent of deal value, with mid-market transactions landing between $150,000 and $500,000. Against those numbers the document infrastructure is a rounding error: a room at €99/month costs roughly €125 across a five-week review, and it is the only budget line that also produces a disclosure record you can read three years later.

9. Data room for your AI due diligence

A data room for AI due diligence is not the same artifact as the one finance uses. A financial folder holds numbers that describe the business. An AI folder holds the business itself: the dataset manifest, the model cards, the evaluation harness and the fine-tuning configuration. That should change how the room is built, who gets which link, and what happens after closing.

It also changes who is in the room. AI diligence pulls in reviewers who never appear on a standard deal: an AI specialist, IP counsel reading training data rights, data protection counsel reading consent bases, and a commercial team reading inference economics. Giving five parties one shared link is how a dataset manifest ends up somewhere it should not be.

Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

An AI due diligence data room with one folder per domain, so permissions differ by folder rather than by document.

Why you need a data room for AI due diligence

Most AI diligence still runs over email and shared drives, and it is the workstream where that habit costs the most, because the documents are the asset rather than a description of it. There are four reasons a dedicated data room for AI due diligence earns its place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing, bidder management and compliance across the main providers.

The documents reconstruct the asset. A dataset manifest, an evaluation harness and a fine-tuning configuration together tell a competent team most of what it needs to rebuild what took the company three years. A strategic acquirer who reads all of it and then walks away in week six keeps every page. That is a different exposure from a leaked revenue schedule, and it justifies view-only access and watermarking.

Five reviewers need five different scopes. The AI specialist needs models, datasets and evaluation. IP counsel needs training data licences, IP assignments and customer contract terms, and nothing about infrastructure. Data protection counsel needs consent records and transfer mechanisms. The commercial team needs inference costs. A shared drive gives you one permission set; a room gives you one per link.

Requests arrive in dependent waves. The reviewer asks for the dataset manifest, then for the six data licences it references, then for the training run logs to reconcile against them, then for which of the 41 customer contracts carry a no-training clause. Run over email, that chain fragments across a founder, a head of research and two lawyers.

The disclosure record decides a claim years later. Training-data disputes surface long after closing, and the question then is what the seller disclosed, to whom, and on what date. A room with a per-visitor audit log and an immutable archive answers that precisely. An inbox does not, and the burden falls on the side with worse records.

The rest of this section is the setup: five steps to build a data room for AI due diligence that handles all four.

Step 1: build the room by domain, not by document

Create one folder per domain from the table earlier in this guide: model provenance, training data, contract data rights, architecture, inference economics, compute commitments, evaluation evidence, governance, and team. That structure makes differentiated access possible later, and it doubles as a readiness checklist, because an empty folder is a visible gap.

Upload in bulk by dragging the folder tree straight in. Automatic file indexing on the Data Rooms Plus plan maintains the index as documents arrive, which matters because an AI request list grows in waves rather than arriving complete.

Step 2: set permissions per reviewer group

This is where an AI room differs most from a financial one. Five parties typically need five different views of the same document set, and two folders should never be downloadable outside the deal team.

Granular file-level permissions are set per link rather than per user, so each party gets its own link carrying its own folder scope, email allowlist or domain restriction, and download rule. Access is link-based, so no reviewer creates an account, which removes the friction that makes busy advisors download everything on the first visit.

Permissions are set per link, so IP counsel and the lender see different folders of the same room.

Step 3: protect the folders that would rebuild the model

Switch the training data, model provenance and evaluation folders to view-only and turn on dynamic watermarking, which stamps every page with the viewer's email, IP address and timestamp as it renders. Screenshot protection adds a deterrent on the dataset manifest and the evaluation harness, the two documents a competitor would most like to keep.

The honest limit is worth stating plainly. A downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged here, and why watermarking exists: it makes a leak traceable to a named viewer. Where the counterparty is a competitor, pair the room with NDA agreements at the door and link expiration on the date exclusivity ends.

Screenshot protection on the dataset manifest and evaluation harness, the documents closest to a reproduction kit.

Step 4: run the dependent request waves through Q&A

AI diligence questions chain. The reviewer reads the manifest, asks for six licences, then for training run logs, then for which contracts forbid training. Run over email, that thread fragments and nobody can tell which of sixty open questions is still unanswered.

The Q&A module attaches each question to the document that prompted it, with permissions controlling who sees which threads, so the lender never sees IP counsel's line of enquiry. Answers publish to one group or to everyone, and the log exports for the closing file, because the answers are the disclosure.

Step 5: read the analytics, then close the room properly

Page-level analytics show which reviewer opened which document, when, and for how long. In AI diligence that is an early warning system: an IP counsel who spent forty minutes inside the dataset manifest has found something, and you will hear about it a week before the report lands.

Per-visitor analytics show which AI diligence documents each reviewer opened, and for how long.

For buyers who want to run AI queries across the corpus, the public API and MCP server let a permitted reviewer query documents inside the room rather than bulk-downloading them. After closing, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate. If a training-data claim surfaces three years later, that archive is the record of what was disclosed.

What it costs

The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Premium at €549/month adds 10 team members, API, SSO and whitelabeling. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction.

Start 7-day data room trial

No credit card required.

FAQ

Related resources

• Best virtual data rooms in 2026
• Technical due diligence
• IT due diligence
• AI data rooms
• M&A due diligence checklist
• Startup due diligence