AI due diligence: five questions to ask about a target

Five questions give an investor a workable start to AI due diligence on a target company: what AI systems exist, what they decide, whose data trains them, which markets they reach, and who owns them inside the company. The answers show which laws, including the EU AI Act, may apply and where the gaps are.

Key points

• Start with an inventory. A target cannot assess what it has not listed, and the list should include tools bought from vendors.
• What a system decides about people matters more than how advanced it is. Under the EU AI Act, risk class follows the use.
• Training data raises separate questions about lawful basis, licences and what happens if the data must be removed.
• The EU AI Act can reach companies outside the EU, so the question is where customers and outputs are, not where the target is based.
• A named internal owner for each system is a basic sign of control.

Question 1: What AI systems does the target have?

The EU AI Act defines an "AI system" in Article 3(1) as a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions. Many targets underestimate how much falls inside that definition. A reasonable request is a register that covers:

• models the company built itself;
• third-party models or APIs built into its product;
• AI features inside vendor software, such as screening, support or fraud tools;
• tools that staff use day to day.

For each entry, ask for its purpose, its vendor or builder, and the date it went live.

As good practice, it is also fair to ask what training the target gives staff who operate or use AI systems, and how that training is recorded. The answer shows how seriously the target takes the subject.

Question 2: What does each system decide, and about whom?

This is the question that most shapes risk. Article 6 of the EU AI Act sets the rules for classifying a system as high-risk, and Annex III lists the use areas. They include employment and worker management, education, access to essential services (such as evaluating creditworthiness, and risk assessment and pricing for life and health insurance), law enforcement, migration and the administration of justice. Article 5 separately lists practices the Act prohibits. A target should be able to say that none of its systems falls under Article 5.

Useful follow-up questions:

• Does the system make, or materially shape, a decision about a person's job, credit, education, insurance or access to a service?
• Does a human review the outcome, and can that person actually change it? For high-risk systems, Article 14 deals with human oversight in design, and Article 26 deals with the deployer's use of the system.
• Does any system talk to people, or generate images, audio, video or text? Article 50 sets transparency duties for these, including telling people they are dealing with an AI system and marking synthetic content. The Article 50 duties began to apply on 2 August 2026.

The duties for high-risk systems start later. As amended by Regulation (EU) 2026/1744, the AI Act's duties for Annex III high-risk systems will apply from 2 December 2027, and its duties for AI in products covered by EU product law will apply from 2 August 2028. A target's remediation plan can be ordered around those dates.

Question 3: Whose data trains the system?

Training data is where legal and commercial risk often sit together. Questions worth asking:

• What are the sources: customer data, licensed datasets, public web data, or data from users of the product?
• Was personal data involved? If so, what lawful basis supports its use? GDPR Article 6 sets out the lawful bases, and Article 5(1)(b) requires that personal data be collected for specified purposes and not used in an incompatible way.
• Do customer contracts and privacy notices actually permit use for training?
• For high-risk systems, how are training, validation and testing data governed? Article 10 of the AI Act sets data governance requirements for these systems, including relevance and representativeness, and examination for possible bias.

As good practice, not a legal requirement, an investor can also ask what would happen to a model if some of its training data had to be removed. The answer shows whether the target has records of where its data came from and whether it could retrain.

Question 4: Which markets does the system reach?

Where a target is based does not settle which rules apply. Article 2(1) of the EU AI Act applies to providers placing AI systems on the EU market whether or not they are established there. It also applies to providers and deployers in other countries where the output of the system is used in the Union.

A target with EU customers, or whose system's output is used in the EU, should therefore be mapped to the Act. As good practice, the market list should also record where the people affected by the target's decisions live, because the answer may matter for some jurisdictions' rules. For the United States, a practical starting question is which states the target's users and customers are in. That list is the input for any later review of state-level rules. This article does not describe the scope of any particular US law.

Ask about the target's role in each market. The Act distinguishes providers, who develop or place a system on the market, from deployers, who use one. Under Article 25(1), a party is treated as a provider of a high-risk system in three cases:

• It puts its name or trademark on a high-risk system already on the market.
• It makes a substantial modification to a high-risk system already on the market, so that the system remains high-risk.
• It changes the intended purpose of a system that was not high-risk so that it becomes high-risk.

A target that rebrands or heavily adapts a vendor's model should check whether any of these applies.

Question 5: Who owns each system internally?

A named owner for each system is the simplest sign of control. Ask who approves new AI uses, who handles complaints and errors, and who is told when something goes wrong. Ask whether a written policy exists and whether anyone has tested it.

For providers of high-risk systems, the AI Act itself expects structure. Article 9 requires a risk management system and Article 17 requires a quality management system. Many targets will not be in that category, but the same habits help.

Two voluntary frameworks give a shared vocabulary for these conversations. The NIST AI Risk Management Framework (AI RMF 1.0) was published by the US National Institute of Standards and Technology and is voluntary. ISO/IEC 42001 is the ISO standard for an artificial intelligence management system. Neither is a legal requirement in itself. Whether a target follows one is a good-practice signal.

Common questions

Does the EU AI Act apply to a US target? It can. Article 2(1) covers providers that place AI systems on the EU market wherever they are established, and providers and deployers in other countries where the system's output is used in the Union. The facts of each system decide the answer.

Is every AI system a target uses high-risk? No. Article 6 and Annex III identify the use areas that count as high-risk, and many systems fall outside them. Other duties can still apply, such as the Article 50 transparency duties, which began to apply on 2 August 2026.

When should the inventory be built? As good practice, it is easier to build the inventory before signing than after closing, because the answers can then inform price and terms. The start dates for the high-risk duties are set out under Question 2.

This article is general information and is not advice on any particular transaction.

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.