AI due diligence in M&A: is the AI you are paying for real, owned and allowed?

AI due diligence in M&A is the check that the value a target claims from AI is real, that the target may use the data and tools behind it, and that the law allows that use. EDON suggests running it inside commercial and operational diligence and writing each finding into the price, the contract or the 100-day plan.

Why does AI need diligence in a company that does not sell AI?

Because the target probably uses it already. In 2025, 55% of large enterprises in the EU used at least one AI technology, against 30% of medium-sized and 17% of small ones, according to Eurostat (opens in a new tab). Across all enterprises the share has more than doubled in two years, from 8% in 2023 (opens in a new tab) to 20%. Finland is second in the EU, at 38%.

So a trade or private equity buyer of a large company should assume AI runs somewhere in the target, and a buyer of a mid-sized one should ask. Some of it may feature in the seller's equity story; some may sit in tools that staff adopted without anyone signing a contract. Where AI is the product itself, the models also need a specialist technical review.

Exhibit 1. More than half of large EU companies use AI, and overall use has more than doubled since 2023. Source: Eurostat, Use of artificial intelligence in enterprises (Statistics Explained, data extracted December 2025); Eurostat news release, 23 January 2025.

What does an AI due diligence checklist cover?

Five areas, each tied to a question the investment committee already asks. That way the findings go to the people who set the price, not into a separate IT annex.

1. Claims. Does AI deliver the revenue, cost saving or product edge the information memorandum says it does?
2. Data rights. May the target use the customer and personal data its AI depends on?
3. Vendor contracts. Which outside models and platforms does the target rely on, and what happens to their terms on a change of control?
4. Regulation. Which EU AI Act duties apply now or arrive during the buyer's ownership, and what do local data laws add?
5. People. Who built and runs the AI, will they stay, and do staff use tools the company does not control?

Exhibit 2. Every AI question a buyer asks maps to evidence the seller can prepare in advance. Source: EDON analysis, October 2026.

Which AI claims should a buyer test first?

The ones the price depends on. If the seller says AI has cut service costs, that saving feeds the earnings the buyer pays a multiple on. Ask for the figures before and after, the usage data and the person who signed off the business case. A claim resting on a pilot with a handful of users is still a plan.

The US Securities and Exchange Commission treats overstated AI claims as misleading; it calls the practice AI washing (opens in a new tab). In January 2025 it settled charges against Presto Automation (opens in a new tab), a restaurant-technology company that had said its AI drive-through ordering "eliminated the need for human order-taking"; according to the SEC, the vast majority of those orders needed human intervention. In a deal of any size, ask for the usage data behind the headline rate.

In EDON's view, the larger AI risk in most mid-sized and large deals is an overstated claim, not an unsafe model.

Who owns the data and the tools the AI runs on?

Often less than the seller assumes. Customer contracts may forbid using customer data to train models, and personal data needs a legal basis for each use. The problem can also travel with the model: the European Data Protection Board (opens in a new tab) said in December 2024 that unlawful processing of personal data in building a model could affect the lawfulness of its later use, unless the model has been properly anonymised. A buyer does not want to inherit that question without a warranty.

Vendor contracts need the same reading: assignment and change of control, price changes, the vendor's use of the target's data, and exit. A contract that needs the vendor's consent to survive the deal is a closing issue.

Targets with operations in the Middle East also face local data law. Saudi Arabia's Personal Data Protection Law has applied in full since 14 September 2024, and the regulator's guide (opens in a new tab) says it also covers personal data stored with a cloud provider abroad. Moving that data out of the Kingdom, into an AI tool hosted abroad for example, needs safeguards (opens in a new tab) such as standard contractual clauses and a risk assessment, unless the destination has an adequacy decision.

Which EU AI Act duties apply to the target, and when?

Some already apply; the rest arrive while a buyer who signs now still owns the company. On the European Commission's timeline (opens in a new tab), AI literacy duties and the bans on prohibited practices have applied since 2 February 2025, the rules for general-purpose AI models and the penalty regime since 2 August 2025, and most remaining rules, including transparency duties, since 2 August 2026.

The Digital Omnibus on AI, Regulation (EU) 2026/1744 (opens in a new tab), published on 24 July 2026, moved the high-risk dates. Duties for stand-alone high-risk systems, such as AI used in hiring, education or access to essential services, now apply from 2 December 2027; those for AI inside regulated products from 2 August 2028. Fines (opens in a new tab) reach EUR 15 million or 3% of worldwide turnover for most breaches, and EUR 35 million or 7% for prohibited practices. Since the Omnibus, small mid-caps join SMEs in paying the lower of the two for most breaches.

Diligence then asks which class each of the target's systems falls into, and what compliance will cost before each date.

Exhibit 3. A buyer who signs now will still own the target when the high-risk duties apply in 2027 and 2028. Source: European Commission, AI Act Service Desk (timeline; Articles 99, 111 and 113 as amended, consolidated text as at 27 July 2026); Council of the EU, press release, 29 June 2026; Regulation (EU) 2026/1744.

How do findings move into the price, the warranties and the 100-day plan?

Each finding goes to the lever that fits it. EDON calls this "from finding to price". A claim that does not hold changes the earnings base, so it goes into the price. A risk nobody can size yet, such as past use of personal data, calls for a specific warranty or indemnity. A vendor contract that needs consent becomes a condition for closing, and so do retention terms for the people the AI depends on. Gaps the buyer can fix itself, such as an AI inventory, a use policy or literacy training, go into the 100-day plan.

Exhibit 4. From finding to price: each AI finding has a natural home in the deal. Source: EDON analysis, October 2026; an illustrative mapping, as the right lever depends on the deal and on counsel's advice.

Can AI tools help with M&A due diligence?

Yes, for the first pass. In Bain's 2025 survey (opens in a new tab) of more than 300 M&A practitioners, 21% used generative AI in deals, up from 16% in 2023, and more than half expected to by 2027. Tools can sort a data room, pull contract clauses and flag gaps. The judgement on what a finding is worth, and where it goes in the deal, stays with people.

What should a seller have ready for AI due diligence?

An AI pack that answers the five areas before the buyer asks:

• every AI system and tool in use, with its owner, vendor and purpose;
• evidence for each AI claim in the information memorandum;
• a map of the data each system uses and the right to use it;
• vendor terms on change of control;
• AI Act classification and AI literacy records.

A seller who arrives with this pack answers the buyer's doubts before they turn into a discount. Whether AI exposure lowers the price itself is a separate question, covered in Will AI lower the price of your company?

When is this the wrong move?

When AI is not in the equity story and the target uses only standard office assistants, a separate AI workstream costs more than it finds; a few questions in the existing legal and IT checklists will do. Four in five EU enterprises still use no AI at all, according to Eurostat (opens in a new tab), and for many small targets that is the honest answer. Legal opinions belong with transaction counsel; this article stops at what to ask.

What to decide next

Before the first bid, decide whether AI is part of what you are paying for. If it is, scope the five areas into commercial due diligence and agree in advance which lever each type of finding will move. If you are selling, build the AI pack before the process starts.

EDON helps owners and boards frame these questions and connect the answers to the value case and the 100-day plan, alongside the deal's legal and financial advisers. Its capability pages on AI for business and on mergers, acquisitions and market entry go into more detail. Early in the work, EDON puts a high-value, usable deliverable in your hands, something you can act on and keep, before you commit further. We call it the Head Start.