AI due diligence has changed sides. Two years ago it meant checking whether the startup really used AI. Now term sheets carry AI-specific conditions, and the diligence list reads like a compliance audit: regulatory classification, data provenance, model dependencies, incident history. Founders who can answer in an afternoon close faster and defend valuation better. Here is the list; from the deals we have sat on both sides of.
The ten questions that now decide AI diligence
- Classification memo. Where does each product feature sit under the AI Act; prohibited, high-risk, transparency-tier, minimal? One page, dated, reasoned. Its absence tells an investor you have not looked.
- Timeline exposure. Which obligations hit you in August 2026, December 2027, August 2028, and what does compliance cost between now and exit?
- Training-data provenance. Licensed, scraped, synthetic, customer-contributed? Opt-out compliance for EU sources; lawful basis for personal data (see our copyright piece). “We used what was available” is a valuation discount in one sentence.
- Customer-data training rights. Do your contracts actually permit training on customer data? Retroactive consent-gathering is a diligence classic, and expensive.
- Model dependency map. Which third-party models under which terms; concentration risk; what happens to unit economics and product if the provider changes pricing, terms or the model itself.
- Moat honesty. If the product is a thin wrapper, what is defensible; data network effects, workflow depth, distribution? Legal diligence increasingly overlaps with the investment thesis here.
- KVKK/GDPR posture. Automated-decision handling, VERBIS accuracy, transfer mechanics for model APIs, DPIA where warranted.
- IP chain over outputs and code. AI-assisted code and content under updated assignment clauses; open-source and model-licence compliance in the build (GPL contamination now has an AI-era sequel).
- Incident and eval record. Red-teaming, bias testing, incident log, not perfection, but process. An empty log is read as absence of looking, not absence of incidents.
- Reps that will be asked of you. Expect AI-specific warranties: classification accuracy, training-data lawfulness, no prohibited practices, disclosure of regulator contact. Negotiating knowledge qualifiers is where counsel earns fees.
For investors: what the answers mean
Clean answers to 1–4 are table stakes. The separating signal is 9: teams with a living eval-and-incident process integrate regulation as engineering, and those are the teams whose compliance costs stay linear as they scale. Conversely, a brilliant demo with an unclassifiable feature set is deferred risk priced into the round, or it should be.
For founders: prepare once, reuse every round
The package above is two weeks of work with counsel, and it compounds: the same file answers enterprise procurement, the FRIA-adjacent asks from EU customers, and the next round. We prepare it as a standing data-room module in our startup practice, and increasingly, the AI module is the first folder investors open.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro callMore from Vircon Insights
Tax Due Diligence in Türkiye: What Buyers Check and How Sellers Prepare
August 3, 2026AI in Advertising Is Now a Disclosure Question in Türkiye: The Targeted Advertising and AI Rules in Force Since 1 August
August 3, 2026Article 50 Is Live: The Two-Week Transparency Runbook for AI Products Serving EU Users
August 18, 2026Türkiye's First Official RWA Move: The Digital Precious Metals Communiqué Opens a Third Lane for Tokenization
August 11, 2026Türkiye's 12th Judicial Package Through a Technology Lens: The Full Map of Law No. 7589
August 10, 2026Türkiye Raises the Fintech Capital Bar Again: New Minimum Equity Floors for Payment and E-Money Institutions
August 7, 2026Related Practice Areas
Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →