Private equity and portfolios
Sell-side AI diligence: answers to prepare before buyers ask
By SourceX Editorial · Updated
Short answer
Sell-side AI due diligence means preparing written answers on how your company uses AI and shares data before the buyer's request list arrives. Build five folders: an AI inventory, vendor terms, data shared externally, a governance policy and an incident log. A consistent, documented answer on day one beats a perfect answer found late in the process.
Key takeaways
- Many buyers now send AI questions alongside commercial, legal and financial requests, so the answers should exist before the data room opens.
- The AI inventory must include tools staff adopted on their own, not only the systems IT bought.
- Vendor terms decide whether customer or employee data may have trained someone else's model, so read the training and retention clauses for every AI tool.
- Every outbound data flow, from a data license to a vendor pilot, needs a one-line record of scope, rights and status.
- An incident disclosed with its fix reads as governance; an incident the buyer finds reads as a gap.
What does sell-side AI due diligence cover?#
Sell-side AI due diligence covers the questions a buyer will ask about how the company uses AI tools, what data has left the business, and who controls both. The CFO usually owns the workstream because the answers touch contracts, revenue, risk disclosures and the data room index.
The scope is wider than the product. A distributor with no AI features still has a sales team drafting quotes in a chatbot, a service desk using AI summaries inside its help desk, and an accounts payable team testing an invoice capture tool. Each raises the same buyer questions: what data went in, under which terms, and what the company can prove.
Preparing early changes the tone of the process. Answers written calmly ahead of time stay consistent across the CIM, the management presentation and the disclosure schedules; answers assembled against a request list deadline often contradict each other.
The prepared-answer pack: five folders to build#
The prepared-answer pack is a set of five folders, each with a short written answer on top and the supporting documents underneath. Buyers and their advisors read the summary first and then sample the evidence, so the summary must match the documents exactly.
| Folder | Written answer on top | Evidence underneath | Usual owner |
|---|---|---|---|
| AI inventory | Which AI tools and features the company uses, by team and purpose | Tool list, single sign-on and expense extracts, product feature list | CFO with IT lead |
| Vendor terms | Whether any vendor may train on company, customer or employee data | Signed order forms, terms versions, opt-out confirmations | CFO with counsel |
| Data shared externally | Every outbound flow of records, its scope and its basis | Data licenses, pilot agreements, data sharing addenda | General counsel |
| Governance policy | Who approves new AI tools and what staff may enter into them | Acceptable use policy, approval log, training records | COO or IT lead |
| Incidents | Any misuse, exposure or complaint and how it was resolved | Incident log, remediation notes, customer correspondence | General counsel |
How do you build an AI inventory that survives questioning?#
An AI inventory survives questioning when it is built from records rather than from a department survey alone. Staff forget tools they tried once, and buyer advisors can cross-check the inventory against spend and login data.
The plan tier column matters more than it looks. Many AI vendors treat consumer, team and enterprise plans differently on training and retention, so the same product name can carry very different answers.
- Pull the single sign-on application list and flag every AI product or AI add-on.
- Search card statements and expense reports for AI subscriptions bought on personal or team cards.
- List AI features switched on inside existing systems, such as help desk reply suggestions, CRM email drafting or meeting transcription.
- Ask each department head to confirm the list in writing and add anything missing.
- Record for each tool: owner, purpose, data types entered, plan tier and whether training on inputs is on or off.
- Mark retired tools and keep the cancellation confirmation.
Vendor terms: the clauses buyers read first#
Vendor terms are the clauses in each AI tool's contract that decide what the vendor may do with your inputs and outputs. Buyers read them to learn whether customer records, employee data or source code may already sit inside someone else's model.
Keep a copy of the terms version that applied when each tool was adopted, not only today's version. Terms change, and the buyer's real question is what applied to the data you already entered. Zoom, for example, added a sentence to Section 10.4 of its terms on August 7, 2023, after backlash over earlier changes, stating it would not use audio, video or chat customer content to train its AI models without consent. A company that used the product before and after that date has two answers to document.
| Clause | What to confirm | Answer that raises questions |
|---|---|---|
| Training on inputs | Whether the vendor may use prompts, files or outputs to train or improve models | Training on by default with no record of an opt-out |
| Retention | How long inputs and outputs are kept and how deletion is requested | No stated retention period or deletion route |
| Subprocessors | Which model providers and hosts process the data | Model provider unknown or undisclosed |
| Confidentiality | Whether inputs are treated as your confidential information | Inputs treated as feedback the vendor may reuse |
| Change of control | Whether the contract continues after a sale | Termination or consent right on change of control |
Data shared externally and the governance record#
Data shared externally means every route by which company records left the business for a purpose beyond ordinary service delivery. That includes data licenses, benchmark programs, vendor pilots that used real records and aggregated data clauses in vendor contracts.
For each flow, write one line: counterparty, record types, date range, whether personal details were removed, the governing contract and whether it continues after a sale. If the company has licensed operational records to an AI developer, add exclusivity, term, permitted use and deletion obligations, because those terms transfer with the business.
The governance record sits beside it. A short acceptable use policy, an approval log for new tools and evidence that staff were told the rules usually answer the policy questions. If no policy exists yet, adopting one before the process starts is better than describing an informal habit.
How should incidents be disclosed?#
Incidents should be disclosed with the fix attached, in language agreed with counsel and consistent with the disclosure schedules. A common example is an employee pasting a customer list or a contract into a consumer chatbot; the useful answer states what happened, what data was involved, what the vendor's terms allowed and what changed afterward.
Do not wait for the buyer to find an incident in an email thread or a support ticket. Whether and how a specific event must be disclosed depends on the purchase agreement and the facts, so route the log through counsel before anything reaches the data room.
Illustrative: a PE-backed distributor prepares its pack#
Illustrative: a fictional industrial distributor owned by a lower-middle-market fund plans a sale process. Its CFO builds the five folders from NetSuite expense data, the Okta app list and written confirmations from branch managers.
The inventory finds a call transcription tool the inside sales team adopted on a team plan that let the vendor train on recordings. The finance team switches training off, records the date, confirms the vendor's deletion route and logs the episode as a resolved incident. The data shared externally folder lists an existing non-exclusive license of de-identified order exception records, with its term and a clause that survives a change of control.
When the buyer's AI questionnaire arrives, every answer points to a document already in the room. The incident reads as a governance example rather than a negotiation point, and the license appears as a documented asset instead of a surprise.
How SourceX approaches sell-side AI questions#
SourceX approaches sell-side questions through documentation created during each license, not after it. Every package that moves through the SourceX five-step transaction (Supply, Rights, Preparation, Approval and Delivery) produces a SourceX Evidence Packet covering provenance, licensing rights, permitted use, the privacy record and release authorization.
For a company preparing for sale, that packet becomes the evidence in the data shared externally folder. SourceX's dataset rights are set out in the signed supplier agreement, data is licensed rather than sold outright, and the company keeps ownership of its records, which keeps the answer to the buyer simple.
Frequently asked questions
When should a portfolio company start preparing AI diligence answers?
Start when the exit plan starts, alongside quality of earnings preparation. The inventory and vendor term review are the slowest parts because they depend on other teams and on finding old contracts. Starting early also leaves time to adopt a policy and switch off risky settings before a buyer looks.
Does having no AI policy hurt a sale process?
It rarely stops a deal on its own, but it invites more questions and broader representations. A short policy adopted before the process, with an approval log and staff acknowledgment, usually answers the governance questions more cleanly than a description of informal habits.
Should we commission a third-party AI audit before a sale?
Usually not as a first step. A well-built prepared-answer pack covers most buyer questions. An outside review makes more sense when the product depends on AI features or proprietary models, where buyers will test performance claims and training data sources in depth.
Who should answer AI questions in the data room?
One owner should coordinate, usually the CFO or a deal lead, so answers stay consistent. Subject experts draft their parts: IT for the inventory, counsel for vendor terms and incidents, operations for the policy. Every answer should be checked against the disclosure schedules before release.
Do existing data licenses help or hurt a sale?
Well-documented, non-exclusive licenses with clear permitted use can support the case that the company's records have value. Exclusivity, open-ended obligations or unclear rights can do the opposite. Buyers judge the documentation as closely as the revenue.
Sources
- On August 7, 2023, after backlash over March 2023 changes to its terms, Zoom added to Section 10.4 a sentence stating it will not use audio, video or chat Customer Content to train its AI models without consent. Source
Related resources
- QuestionDo AI companies buy private business data?
- IndustryHealthcare administration data
- IndustryHealthcare data
- QuestionPublic data vs proprietary data: what's the difference for AI?
- InsightHow to monetize your business data: a practical guide
- InsightCan restaurants and hospitality groups sell their data to AI companies?
See if your company qualifies
A short company assessment. No data uploads are needed.