Integration-Led Diligence for the AI Era

‍Part 1: What are you actually diligencing?

Carta's H2 2025 data puts roughly 40% of startup investment dollars into AI companies in 2025, rising to 54% in the first half of 2026. Carta's conclusion: AI has stopped being a sector and become an overlay across sectors. Bain's 2026 M&A Report shows about 50% of tech deals above $500M cited AI-driven value, over 75% of strategic acquirers now assess AI's impact on a target, and 20% have walked away on AI-related findings.

Start by assessing your pre-AI playbook. Model provenance, open-weight licence obligations, inference in cost of goods, deployer-side regulatory duties, automation-dependent operating ratios: none of it appears on a request list written three years ago. Scope for assessing exposure and upside factors, as AI-native businesses bring new business model efficiencies and growth levers.. Not just risks.

What belongs on your checklist hinges on:

1. How is AI relevant to this target: does it sell an AI product, use third-party AI tools, or both?
2. What does the buyer intend to do with the target?

Next update your approach to reading findings. 

Two acquirers can run the same competent diligence on the same target and reach opposite verdicts. One reprices by double digits and walks. The other signs at the ask, having logged the identical finding as immaterial. Why?

Strategic intent differs, and that changes the ROI math.

This is why you need to capture your intent early, in a form that guides downstream decisions and supports iterative buildout of the deal strategy. In Tiger Team M&A's framework this is called a Deal NorthStar: outlining the deal's focus, type of value outcome, and directional approach to integration. A NorthStar scopes diligence and pressure-tests synergy modeling, frames how findings are read and shapes the integration plan, and ultimately guides post-Close execution.

Part 2: How can the same finding be fatal for one deal and irrelevant in the next?

"AI due diligence" requires definition of two populations of target companies (and many companies fit into both).

Population 1: the target carries an AI product. AI is the asset being priced. What model, trained on what, owned under which terms, defensible against what.

Population 2: AI acts on the target's business. AI is a force applied to an asset priced on other grounds. Erosion, substitution, and inherited obligations the seller may not know it holds.

The split is echoed by emerging regulatory legislation. The EU AI Act defines as: providers place systems on the market, deployers use them. Different obligations, different penalties, and a buyer inherits whichever the target holds.

But acquirers are still catching up, with gaps in understanding how to diligence. Frameworks published to-date are almost entirely focused on Population 1: training data provenance, model IP, conformity assessment. Bain's walk-away finding sits with Population 2: whether AI will upend a target's business model, illustrated by translation services and outsourced customer support.

Where do even the newer frameworks miss AI risk?

1: Target headcount is not the post-Close operating model

Diligence frameworks usually assess talent as “key-person” risks (leadership, machine learning engineers, etc). The missing question is the broad view of who / what is doing the work per functional area.

A nine-person support organization serving four thousand accounts is a claim about an automation layer, carrying assumptions nobody wrote down: that vendor contracts assign, workflows are documented, the people who built them stay, and any of it survives contact with your environment.

Bessemer puts fast-scaling AI-native "Supernovas" at roughly $1.13M ARR per employee against about $164,000 for the typical cohort. Their caution matters more than the number: Supernovas reach scale on fragile retention and thin margins, often close enough to core foundation model functionality to attract the thin-wrapper label. Carta shows the other mechanism: team sizes have fallen sharply at every stage since 2023, so revenue per employee rose partly because founders hired fewer people.

Automation inventory. Which functions are carried by tooling rather than people, built on what, by whom, documented where.

Transferability. Whether vendor contracts assign, whether accounts are corporate or personal, whether model access extends to affiliates. A stack built on consumer-tier subscriptions does not travel.

The real key-person risk. The operator who built the deflection layer, holds the prompt chains, and never wrote a runbook.

Synergy integrity. Cost synergy assumes removable overlap. An already-automated target has none, and absorbing it into a heavier operating model can require adding headcount to run what it ran with software.

Retention under your AI regime. Restrictive tool policies and security gates impose a productivity tax on people who joined a company where the tooling was the job.

Cost to serve after migration. If support scalability rests on an AI layer trained on the target's corpus and running through the target's stack, migrating customers to your platform does not move the deflection with them.

2: You need a strategy for code you will not see pre-Close

Population 1 risk cannot be fully assessed pre-Close. Repository access is typically off-limits, and codebase reviews (where they happen at all) run through an independent third party, protecting both sides if the deal breaks. What you receive moves down a ladder: attestations and documents (SOC 2 Type II, penetration tests, incident postmortems, architecture pack, bill of materials), then the target's performance against your metrics, then the third-party scan.

The report answers what was asked and nothing else, so scoping is the exercise. Several critical items are missing from the default template.

Model provenance. Composition analysis will not find this, and open weight is not the same as open source. The Llama Community License, Google's Gemma Terms, and Mistral's mixed regime look open-source from a distance but carry acceptable use policies restricting entire product categories, attribution requirements, and pass-through duties binding the target's own customers. Llama's 700 million monthly active user threshold triggers a separate agreement with Meta, under a policy Meta can revise. Derivatives inherit the stricter terms: an Apache-licensed model merged with a community-licensed one is not cleansed, and adapters carry the same obligations as full weights. A dependency scan (in typical diligence) returns clean on all of it.

Share of AI authorship. Third-party diligence providers now produce a generative AI bill of materials quantifying how much of a codebase was model-written, without the buyer touching source.

Engineering reviews often produce false positives. The default AI workflow delivers a passing test while missing the reuse and error-surfacing that determine what a codebase costs to own two years post-Close. GitClear's analysis of 623 million changes from 2023 to 2026 found cross-file function calls down 35%, refactoring line moves down 70%, and legacy maintenance down 74% against 2022, while copy-paste rose 41%, block duplication 81%, error-masking constructs 47%, and two-week churn 15%. Veracode, testing more than 100 models, found the insecure implementation chosen in 45% of cases, a rate flat through Spring 2026 even as syntax pass rates climbed above 95%. The files read well yet the system does not hold. The gap between code that works and code that works safely at scale is widening.

Moat validation. If a foundation model provider shipped your target's core capability next quarter, is their differentiation (and business model) dead? Does the target own a model, call third-party models via API, do proprietary fine-tuning or embedding, or run a proprietary inference architecture? Is the data proprietary, exclusive, and assignable, or restricted? Request checklists are typically too generic, and diligence teams unprepared, to support this analysis.

3: Margins are engineered not formulated, so diligence the engineering

ICONIQ's July 2026 State of AI report, surveying roughly 305 executives at AI product companies, puts average gross margin at 45% in 2025, a projected 53% for 2026, and 59% by 2027. The gains came from inference cost declines, model routing, and scale leverage rather than pricing adjustments. Two thirds of respondents improved cost per query by 10% or better.

Margin is now engineered, through model selection, routing, caching, and infrastructure discipline. A target reporting 55% because two people run a disciplined routing layer is more defensible than one reporting 55% on a favourable rate card.

Margin composition. Inference as a share of revenue, the routing and caching architecture, provider concentration, committed spend and reserved capacity. Watch the procedural failure: cost of goods sits with finance, inference with the technical workstream, and nobody owns whether the target was modelled on the wrong margin curve.

Pricing durability. As AI reduces the need for human workers, per-seat and cost-plus models become risky. A target whose revenue scales with seats is exposed twice: its product may compress seat counts at its customers, and its customers may compress theirs. ICONIQ has consumption-based pricing climbing from 35% to 42%, outcome-based from 18% to 23%, and 37% of companies planning a pricing change within twelve months.

Revenue quality. Separate AI revenue from AI-attributed revenue. Pilot-to-production conversion. Whether expansion is usage growth or price increase. Whether public AI capability claims can be substantiated, which matters more now that the SEC has named AI representation accuracy in its examination priorities.

For Target Population 2, the question becomes how AI impacts what the target sells.

4: Regulatory criteria shape integration timelines, which shapes diligence

The EU AI Act timeline shifted unevenly in 2026. The Digital Omnibus deferred stand-alone high-risk obligations under Annex III to 2 December 2027, and high-risk AI embedded in regulated products to 2 August 2028. Most Article 50 transparency obligations did not move and apply from 2 August 2026, with marking requirements for systems already on the market following in December. A target assessed against last year's calendar will apply the wrong criteria and miss the timeline implications.

One provision inside the deferral matters more to a buyer than the dates: systems placed on the market before the new deadlines avoid the full high-risk regime until substantially modified. Hold that thought.

SOC 2 Type II, ISO 27001, and ISO 42001 are really revenue gates. Our research across leading vertical AI companies found certification clustering at 12 to 36 months post-launch, compressing to 12 to 18 in regulated verticals. A target without them struggles to grow in the enterprise segment, and the compliance work sits inside your post-Close synergy timeline. There is an implied finding: these certifications examine change management and code review controls over time, so uncertified targets may carry technical debt and immature codebases, which lands back on your GTM and synergy assumptions.

The rest is conventional and still necessary: model and supply chain security, incident history, red-teaming practice, and for Population 2, the deployer obligations inherited from AI embedded in hiring, credit, and customer workflows the target's leadership may never have classified as AI.

How do these diligence lenses tie together?

The key is having a checklist that covers the two target “populations” described here, and understanding that findings are shaped by each deal thesis.

An un-redundant model dependency is critical in one deal and irrelevant in another. A licence threshold the target will never hit is immaterial until your distribution puts them past it. A codebase you never intended to keep turns out to be the only evidence about the team you are buying.

Each reading is defensible. Which one is correct depends on what you intend to do with the target after close, which is another way of saying your diligence read and your preliminary integration plan are two sides of the same coin.

Ready a checklist that covers AI factors, apply it flexibly to each target based on the thesis, and be ready to interpret findings holistically.

‍Tiger Team M&A engineers purpose-built AI for M&A. Founded by veteran Fortune 100 M&A leaders, the company helps serial acquirers turn M&A operations into durable competitive advantage. Reach out to engage@tigerteammna.com with YOUR questions and perspective on AI for M&A!