AI due diligence has changed sides. Two years ago it meant checking whether the startup really used AI. Now term sheets carry AI-specific conditions, and the diligence list reads like a compliance audit: regulatory classification, data provenance, model dependencies, incident history. Founders who can answer in an afternoon close faster and defend valuation better. Here is the list; from the deals we have sat on both sides of.
The ten questions that now decide AI diligence
- Classification memo. Where does each product feature sit under the AI Act; prohibited, high-risk, transparency-tier, minimal? One page, dated, reasoned. Its absence tells an investor you have not looked.
- Timeline exposure. Which obligations hit you in August 2026, December 2027, August 2028, and what does compliance cost between now and exit?
- Training-data provenance. Licensed, scraped, synthetic, customer-contributed? Opt-out compliance for EU sources; lawful basis for personal data (see our copyright piece). “We used what was available” is a valuation discount in one sentence.
- Customer-data training rights. Do your contracts actually permit training on customer data? Retroactive consent-gathering is a diligence classic, and expensive.
- Model dependency map. Which third-party models under which terms; concentration risk; what happens to unit economics and product if the provider changes pricing, terms or the model itself.
- Moat honesty. If the product is a thin wrapper, what is defensible; data network effects, workflow depth, distribution? Legal diligence increasingly overlaps with the investment thesis here.
- KVKK/GDPR posture. Automated-decision handling, VERBIS accuracy, transfer mechanics for model APIs, DPIA where warranted.
- IP chain over outputs and code. AI-assisted code and content under updated assignment clauses; open-source and model-licence compliance in the build (GPL contamination now has an AI-era sequel).
- Incident and eval record. Red-teaming, bias testing, incident log, not perfection, but process. An empty log is read as absence of looking, not absence of incidents.
- Reps that will be asked of you. Expect AI-specific warranties: classification accuracy, training-data lawfulness, no prohibited practices, disclosure of regulator contact. Negotiating knowledge qualifiers is where counsel earns fees.
For investors: what the answers mean
Clean answers to 1–4 are table stakes. The separating signal is 9: teams with a living eval-and-incident process integrate regulation as engineering, and those are the teams whose compliance costs stay linear as they scale. Conversely, a brilliant demo with an unclassifiable feature set is deferred risk priced into the round, or it should be.
For founders: prepare once, reuse every round
The package above is two weeks of work with counsel, and it compounds: the same file answers enterprise procurement, the FRIA-adjacent asks from EU customers, and the next round. We prepare it as a standing data-room module in our startup practice, and increasingly, the AI module is the first folder investors open.
Sources. Regulation (EU) 2024/1689 (AI Act).
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
More from Vircon Insights
English Is No Longer the Exception on KAP: The Process to Build Before 1 October 2026
August 31, 2026The Regulator Will See You Now: How Startups Get Into the AI Act Sandboxes (Deadline Moved to August 2027)
August 25, 2026A 12-Month Cap on Off-Exchange Share Sales: Rebuilding the Post-IPO Exit Plan
September 1, 2026Three Ways to Move Up the IPO Queue: Türkiye's New Priority Criteria
September 1, 2026Your Users Are Younger Than Your Terms Say: Children, Age Assurance and AI Products
August 31, 2026Will Insurance Pay When the Model Is Wrong? E&O, Cyber and Product Liability for AI Companies
August 28, 2026Related Practice Areas
Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →