The Pre-Diligence AI Audit: 5 Questions Every Acquirer Will Ask Before They Ask About Revenue

By the AuditSentinel Research Desk

In November 2025, the international law firm Orrick issued an advisory that should have been forwarded to every venture-backed founder in the world: "Make sure any in-progress agreements and acquisitions covering AI products will reflect the requirements of the AI Act when the Act comes into force. This will likely require changes to contract terms as well as due diligence and revised procurement."

The advisory wasn't addressed to Fortune 500 general counsels. It was addressed to the deal community — investors, acquirers, and the advisors who structure technology transactions.

The message was unambiguous: AI governance is now a diligence item. And the questions acquirers are preparing to ask are more specific than most founders expect.

The New Diligence Landscape

Traditional technology due diligence examined infrastructure, security certifications, and intellectual property ownership. Software due diligence — which CohnReznick explicitly distinguishes as a complement to, not replacement for, traditional IT diligence — examines what's actually running: the tools, the subscriptions, the codebases, the data flows.

In 2026, AI governance sits at the intersection of both. An acquirer's IT audit team will examine your AI tool inventory. Their legal team will examine your regulatory exposure. Their financial team will model the cost of remediation. And all three will feed findings into the valuation model.

Here are the five questions that have moved from "emerging practice" to "standard diligence" — with the source documentation that establishes each one.

Question 1: "Provide a complete inventory of all AI tools in use across the organization, including those procured outside central IT."

Source: Zylo 2026 SaaS Management Index (IT controls 15% of spend), Gartner (30–40% shadow IT), Binadox case study (60% shadow IT discovered during IPO prep).

Why they're asking: The gap between declared and actual AI tool usage is now a known-known in the diligence community. Acquirers assume a 40–60% undercount in any self-reported inventory and are specifically testing for the discrepancy.

What they'll find if you're not prepared: Redundant subscriptions (three project management AIs, four code assistants), unvetted browser extensions with LLM backends, free trials that auto-converted to paid plans, and department-level tools that never touched a procurement workflow. The financial reconciliation alone can take weeks.

How to prepare: Run a corporate card audit, not just an IT survey. Cross-reference expense reports against the SaaS management platform. Expect to find 1.5–2x more tools than your initial count.

Question 2: "Have any proprietary codebases, customer datasets, or material non-public information been exposed through employee use of public LLM interfaces?"

Source: Samsung ChatGPT incident (Forbes, May 2023), Cyberhaven 2024 study (27.4% of AI-pasted data is sensitive), LayerX (77% of employees have shared sensitive data via AI).

Why they're asking: The Samsung case has become a standard reference point in M&A diligence. Acquirers are specifically testing for the Samsung scenario — employees pasting source code, customer data, or strategy documents into public LLMs. A finding creates a documented liability that cannot be explained away.

What they'll find if you're not prepared: If you can't answer with confidence, the acquirer assumes exposure. The absence of evidence becomes evidence of risk. And the remediation cost — forensic analysis of what may have been exposed, legal assessment of disclosure obligations, potential regulatory notification — gets subtracted from the offer.

How to prepare: Deploy monitoring that can answer this question definitively. "We don't think anything was leaked" is not a diligence-grade answer. "Our monitoring indicates no proprietary code or customer PII has been pasted into public LLMs in the past 12 months" is.

Question 3: "Demonstrate compliance with the EU AI Act's documentation and transparency requirements for any high-risk AI deployments."

Source: EU AI Act (Regulation 2024/1689), August 2, 2026 enforcement date. Orrick advisory (November 2025). Private Equity International (2026, "EU AI Act triggers due diligence push for PE investors").

Why they're asking: With the high-risk system compliance deadline approaching, any transaction involving European customers, data, or operations must price in AI Act compliance. The cost of remediation — engineering time, legal fees, external auditors — ranges from €100,000 to €500,000 and directly affects deal economics.

What they'll find if you're not prepared: A compliance gap that requires immediate remediation, diverting engineering resources at precisely the moment the acquirer wants to accelerate growth. The timeline risk alone can delay integration planning by months.

How to prepare: Classify every AI deployment against the Act's risk framework. Document your governance framework — policy, enforcement, monitoring. The documentation is not just a compliance artifact; it's the first thing diligence will request.

Question 4: "Reconcile declared SaaS spend against actual SaaS spend, including line-item explanation for any variance exceeding 10%."

Source: Gartner (25%+ SaaS overspend through 2027), Zylo 2026 Index (median $9,455/employee, IT controls 15%), Binadox IPO case study (60% shadow IT).

Why they're asking: When declared and actual SaaS spend diverge by 25–40%, the acquirer doesn't just adjust the financial model. They question the reliability of every number you've provided. SaaS governance is a proxy for operational maturity, and a large variance signals immaturity across the entire finance function.

What they'll find if you're not prepared: The variance itself is the finding. You can't explain it away once it's discovered. The acquirer will either haircut the valuation by the estimated remediation cost or walk entirely — not because of the money, but because of the signal.

How to prepare: Run the reconciliation before diligence. Know your variance. Remediate what you can. Document what you can't — with a timeline and cost estimate. The narrative "we identified $118K in shadow spend, remediated 75%, and are monitoring the remainder" is diligence-grade. The narrative "we didn't know there was a gap" is not.

Question 5: "Do you have an AI governance policy, and can you demonstrate that it is enforced — not just documented?"

Source: Sourcepass ("Exit-stage buyers conduct rigorous IT and cybersecurity reviews. Deficiencies discovered late can delay transactions or reduce valuation"), Evalyze.ai due diligence guide ("Every delay erodes the firm's confidence"), Quandary Peak Research (software governance as leading indicator of operational maturity).

Why they're asking: Samsung had a policy. It failed. The distinction between having a policy and enforcing a policy is now the distinction between a diligence pass and a diligence finding. Acquirers are specifically testing for enforcement — monitoring data, logged interventions, trend analysis — not just policy documentation.

What they'll find if you're not prepared: A policy document with no enforcement mechanism is worse than no policy at all. It demonstrates that the company identified the risk and chose not to address it. That's negligence, not ignorance — and it's priced accordingly.

How to prepare: Your AI governance framework needs three components: policy (what employees should and shouldn't do), detection (monitoring that identifies violations), and response (what happens when a violation is detected). Any two without the third is insufficient.

The Timeline That Makes This Urgent

The EU AI Act's August 2, 2026 deadline is not a compliance cliff that only affects regulated industries. It's a diligence trigger that affects every company building, deploying, or using AI — which, in 2026, means every technology company.

Orrick's advisory made this explicit: "This will likely require changes to contract terms as well as due diligence and revised procurement." The implication is that deals in progress right now — negotiations, term sheets, LOIs — need to account for AI Act compliance before the ink is dry.

Private Equity International confirmed the trend: the AI Act is triggering diligence pushes across PE portfolios globally, not just in Europe. The regulation's extraterritorial reach means US-based startups with European customers are subject to the same scrutiny.

The Preparation Window

If you're targeting a transaction within 24 months, the window to prepare for these five questions closes before you enter the process. By the time the acquirer's diligence team is in your data room, the findings they produce will shape the terms. Your job is to find the problems before they do.

This quarter: Complete the AI tool inventory. Run the financial reconciliation. Identify the gaps.

Next quarter: Remediate the gaps you can close quickly. Document the ones you can't — with cost estimates and timelines.

Ongoing: Deploy monitoring and enforcement. The policy that matters is the one you can prove is working.

The startups that get acquired at premium valuations are not the ones with perfect AI governance. They're the ones who can demonstrate they understand their exposure, are managing it actively, and can answer the five questions with data — not with assurances.

Sources: Orrick November 2025 compliance advisory, Private Equity International 2026 due diligence reporting, EU AI Act (Regulation 2024/1689), CohnReznick software due diligence framework, Sourcepass M&A IT guidance, Quandary Peak Research technical diligence methodology, Evalyze.ai startup due diligence guide, Zylo 2026 SaaS Management Index, Gartner IT spending forecasts, Binadox shadow IT case study, Cyberhaven 2023/2024 enterprise studies.