The Complete AI Startup Due Diligence Checklist for 2026

Why Due Diligence Is Different for AI Startups

Buying a traditional SaaS company is relatively straightforward — you verify revenue, review the codebase, check the customer base, and close the deal. Buying an AI startup is a different game entirely.

AI businesses carry a unique set of risks that can torpedo an acquisition if you do not catch them early. Models degrade over time. Training data may have licensing issues you cannot see in a balance sheet. Compute costs can spike unpredictably. A product that looks like proprietary technology might be a thin wrapper over a third-party API that could change its pricing or terms overnight.

In 2026, AI acquisitions are booming — global AI spending is projected to surpass $900 billion by 2028 and acquirers are competing aggressively for quality assets. But the buyers who win are the ones who do their homework. A rushed or incomplete due diligence process is the single most common reason AI deals fall apart or turn into regret.

This guide gives you a structured, repeatable checklist for evaluating any AI startup acquisition. Whether you are buying a $50K micro-startup or a $5M growth-stage company, these checks apply. Print it, bookmark it, and use it every time.

Technical Due Diligence

Technical DD is where most AI acquisitions diverge from standard software deals. You are not just evaluating code — you are evaluating models, data pipelines, and infrastructure economics.

Code Quality and Architecture

• Repository structure: Is the codebase well-organized with a clear separation of concerns? Look for a logical folder structure, consistent naming conventions, and a README that explains how to set up, build, and deploy the project.
• Test coverage: Zero tests is a red flag. You do not need 100% coverage, but core business logic and model inference paths should be tested. Ask for the test suite and run it yourself.
• Dependencies: Check for outdated or abandoned libraries. Run a security audit (npm audit, pip-audit, or equivalent) and note any critical vulnerabilities.
• Technical debt: Have an independent engineer review the codebase. AI projects accumulate debt fast — especially in data preprocessing, feature engineering, and glue code between model components.
• Documentation: Can a new engineer onboard and contribute within a week? If the answer is no, factor that cost into your offer.

AI Model Dependencies

• First-party vs. third-party models: Does the startup own its models, or does it rely on APIs from OpenAI, Anthropic, Google, or other providers? First-party models are more defensible but harder to maintain. Third-party dependencies are fine if the business has a migration plan.
• Model versioning: Is there a clear process for tracking model versions, training runs, and deployments? Or is it a mess of Jupyter notebooks and ad-hoc scripts?
• Inference pipeline: Understand how models are served in production. Is it a simple REST API, a batch processing pipeline, or something more complex? Look for single points of failure.

API and Compute Costs

• Monthly inference costs: Request the last 12 months of cloud and API bills. AI workloads can be shockingly expensive — a product generating $10K MRR might be spending $4K on GPU compute and API calls.
• Cost trajectory: Are costs growing faster than revenue? If compute costs scale linearly with users while revenue grows logarithmically, the unit economics will eventually collapse.
• Rate limits and quotas: If the product depends on third-party APIs, understand the rate limits. Can the product scale to 10x users without hitting a wall?

Scalability

• Load testing data: Ask whether the product has been load-tested. What happens at 2x, 5x, or 10x current traffic?
• Horizontal scaling: Can the infrastructure scale horizontally (add more servers) or does it require vertical scaling (bigger, more expensive machines)?
• Bottlenecks: Identify the primary bottleneck. For AI products, it is usually model inference latency or GPU availability.

Business Due Diligence

Revenue and growth metrics matter just as much in AI acquisitions as in any other deal. Do not let shiny technology distract you from the fundamentals.

Revenue Verification

• Payment processor access: Request read-only access to Stripe, Paddle, or whatever payment processor the startup uses. Verify that reported MRR matches actual deposits over the past 12 months.
• Revenue type: Distinguish between recurring revenue (subscriptions), one-time revenue (setup fees, consulting), and usage-based revenue (pay-per-API-call). Recurring revenue is worth the most. One-time revenue should be discounted heavily.
• Revenue recognition: Ensure revenue is being recognized correctly. Annual prepayments should not be counted as monthly revenue. Look for any deferred revenue or refund obligations.

Customer Concentration

• Top customer share: If a single customer accounts for more than 25% of revenue, that is a significant risk. If they leave post-acquisition, your revenue takes a major hit.
• Customer contracts: Review the terms. Are there long-term contracts that guarantee revenue, or can customers cancel at any time? Look for exclusivity clauses that might limit your ability to sell to competitors.
• Customer interviews: Ask to speak with two or three key customers. Understand why they use the product, what alternatives they have considered, and whether they plan to renew.

Churn Rate

• Monthly churn: Healthy AI SaaS products typically have monthly churn below 3%. Anything above 5% is a red flag that suggests the product is not delivering enough value.
• Cohort analysis: Ask for churn data broken down by signup cohort. Are newer customers churning faster or slower than earlier ones? Accelerating churn means the product is losing its edge.
• Net revenue retention: The gold standard metric. NRR above 100% means existing customers are expanding their spending over time. Below 90% signals a leaky bucket.

Growth Trajectory

• MRR growth rate: Look at month-over-month revenue growth for the past 12 months. Consistent 10%+ MoM growth is strong. Flat or declining growth means you are buying a plateau.
• User growth: Is the user base growing organically, or is growth driven entirely by paid acquisition? Organic growth is more sustainable and valuable.
• Market position: Where does the startup sit in its market? Is it a leader, a fast follower, or a niche player? Understanding the competitive landscape helps you assess future growth potential.

Legal Due Diligence

Legal issues can kill an AI deal faster than anything else. These checks are non-negotiable.

Data Privacy Compliance

• GDPR compliance: If the startup has any European users, it must comply with GDPR. Check for a privacy policy, data processing agreements with sub-processors, and a process for handling data subject access requests.
• CCPA compliance: Similar requirements for California residents. Ensure the startup has proper disclosure and opt-out mechanisms.
• Data retention policies: Understand what user data is collected, where it is stored, how long it is retained, and how it can be deleted. AI startups that train models on user data face extra scrutiny here.
• Cross-border data transfers: If data is processed across borders, ensure compliance with relevant transfer mechanisms (Standard Contractual Clauses, adequacy decisions, etc.).

AI Model Licensing

• Open-source licenses: Many AI startups use open-source models or libraries with specific licensing requirements. Check for GPL, AGPL, or other copyleft licenses that could affect your ability to commercialize the product.
• Training data licensing: If the model was trained on licensed datasets, verify that the licenses permit commercial use and transfer to a new owner.
• Third-party API terms: Review the terms of service for any third-party AI APIs. Some providers restrict how their outputs can be used or resold.

IP Ownership

• Assignment agreements: Verify that all intellectual property — code, models, training data, brand assets — is properly assigned to the company entity, not held by individual founders or contractors.
• Prior inventions: Check whether founders have any prior invention disclosures that could create IP conflicts.
• Patent landscape: Search for existing patents or pending applications. Also check whether the startup's technology might infringe on third-party patents.
• Contractor and employee agreements: Ensure all contributors signed IP assignment agreements. Code written by contractors without proper agreements could create ownership disputes.

Team Due Diligence

The team behind an AI startup is often its most valuable and most fragile asset.

Key Person Risk

• Founder dependency: Can the business operate if the founder leaves on day one? If the founder is the only person who understands the model architecture, the data pipeline, or the customer relationships, that is a critical risk.
• Retention agreements: If key people are essential, negotiate retention packages as part of the deal. Vesting schedules on a portion of the purchase price, employment contracts, or consulting agreements all work.
• Bus factor: How many people need to be unavailable for the business to grind to a halt? A bus factor of one is dangerous.

Documentation Quality

• Operational runbooks: Are there documented procedures for common operations — deployments, incident response, model retraining, customer onboarding?
• Architecture documentation: Is there an up-to-date architecture diagram? Can a new engineer understand the system without a week of hand-holding?
• Knowledge base: Check for internal wikis, decision logs, or design documents that capture institutional knowledge.

Handover Readiness

• Transition plan: Does the seller have a realistic plan for handing over the business? A 30 to 90-day transition period with defined milestones is standard.
• Access inventory: Create a comprehensive list of all accounts, credentials, domains, and services that need to be transferred. Missing one can cause problems months after closing.
• Customer introductions: Plan for introducing key customers to the new owner. Surprise ownership changes can trigger churn.

AI-Specific Checks

These checks go beyond standard technical and business DD. They address the unique risks that come with AI products.

Model Accuracy and Drift

• Baseline metrics: Get documented accuracy, precision, recall, and F1 scores for the model's primary use case. If the seller cannot provide these, that is a red flag.
• Drift monitoring: Models degrade over time as the real world changes. Ask whether the startup monitors for model drift and how often retraining occurs.
• Edge cases: Test the model with adversarial or unusual inputs. How gracefully does it fail? Are there known blind spots?

Training Data Provenance

• Data sources: Where does the training data come from? Was it collected with proper consent? Is it licensed for commercial use?
• Data quality: Garbage in, garbage out. Assess the quality, completeness, and representativeness of the training data.
• Bias and fairness: Has the model been tested for bias across different demographic groups or use cases? Bias issues can create legal and reputational risk post-acquisition.
• Data refresh pipeline: Is there a process for continuously collecting and incorporating new training data? Stale data leads to stale models.

Compute Costs and Infrastructure

• GPU vs. CPU inference: Understand the inference infrastructure. GPU-based inference is faster but significantly more expensive. Check whether the startup has optimized for cost — model quantization, batching, caching, etc.
• Cloud provider lock-in: Is the infrastructure tied to a specific cloud provider? Migrating AI workloads between clouds is painful and expensive.
• Auto-scaling: Does infrastructure scale automatically with demand, or does someone need to manually provision resources? Unexpected traffic spikes should not take down the product.

Vendor Lock-In

• API dependency: If the product depends on a specific AI provider's API, what happens if that provider raises prices by 50% or discontinues the model? Is there a fallback plan?
• Model portability: Can the model be exported and run elsewhere, or is it trapped in a proprietary platform?
• Data portability: Can the training data and feature pipelines be moved to a different infrastructure if needed?

Red Flags to Watch For

After reviewing hundreds of AI startup deals, these are the warning signs that should make you pause — or walk away.

• Revenue that cannot be independently verified. If the seller resists giving you access to payment processor dashboards, assume the numbers are inflated.
• A single customer representing more than 40% of revenue. One phone call from that customer can wipe out nearly half your investment.
• No model monitoring or retraining process. A model without drift monitoring is a ticking time bomb that will degrade in production.
• Founders who want to leave immediately with no transition. If they built it and will not stick around to hand it over, what does that tell you?
• Compute costs growing faster than revenue. This means the unit economics get worse as the business scales — the opposite of what you want.
• Unlicensed training data or unclear IP ownership. Legal exposure from data licensing issues can be catastrophic and is extremely difficult to unwind.
• No tests, no documentation, no deployment pipeline. You are buying a black box that only one person understands. Price accordingly.
• Revenue that is mostly one-time or consulting-based. Recurring revenue is worth 3 to 10x. One-time revenue is worth 1 to 2x at best.
• Founders who cannot clearly explain how their model works. If the people who built it cannot articulate the technology, expect to find chaos under the hood.

Due Diligence Checklist Summary

Use this checklist as a quick reference during your evaluation. Check off each item before moving forward with an offer.

Technical

• Codebase reviewed by an independent engineer
• Test suite exists and passes
• Dependencies audited for security vulnerabilities
• Model dependencies and third-party API risks documented
• 12 months of compute and API cost data reviewed
• Load testing or scalability evidence provided

Business

• Revenue independently verified via payment processor
• Customer concentration analyzed (no single customer above 25%)
• Monthly churn rate calculated and acceptable (below 5%)
• Growth trajectory reviewed for past 12 months
• Unit economics verified (LTV, CAC, gross margins)

Legal

• GDPR and CCPA compliance verified
• All IP properly assigned to company entity
• Open-source and training data licenses reviewed
• Contractor and employee IP agreements confirmed
• No pending lawsuits or regulatory actions

Team

• Key person risk assessed and mitigated
• Operational documentation reviewed
• Transition plan agreed with defined milestones
• Access and credential inventory created

AI-Specific

• Model accuracy metrics documented and validated
• Drift monitoring process in place
• Training data provenance and licensing verified
• Compute cost trajectory sustainable
• Vendor lock-in risk assessed with fallback plans

Frequently Asked Questions

How long does AI startup due diligence typically take?

For micro-startups under $100K, a thorough due diligence process takes one to two weeks. For mid-market deals ($100K to $1M), plan for three to four weeks. Larger acquisitions above $1M often require six to eight weeks, especially if the AI technology is complex or the team is large. Do not rush it — shortcuts in DD lead to expensive surprises post-acquisition.

Can I do due diligence myself, or do I need to hire specialists?

For smaller deals, a technically savvy buyer can handle most of the checklist. However, for deals above $250K, hiring a technical advisor for code and model review and a lawyer experienced in tech M&A is strongly recommended. The cost — typically $5K to $15K total — is small compared to the risk of missing a critical issue.

What is the most commonly overlooked risk in AI acquisitions?

Compute cost trajectory. Many buyers focus on revenue and ignore the cost side. An AI startup with $20K MRR and $12K in monthly compute costs has very different economics than one with $20K MRR and $3K in compute costs. Always model how costs will scale as the business grows.

Should I hire a third-party to audit the AI model?

Yes, if the model is a core part of the value proposition and the deal is above $100K. An independent ML engineer can evaluate model quality, identify technical debt in the training pipeline, and estimate the cost of improvements. This typically costs $2K to $5K and can save you from acquiring a model that needs a complete rebuild.

What happens if I discover problems during due diligence?

Not every issue is a deal-breaker. Minor problems can be factored into a lower offer price. Major issues — like fraudulent revenue, unlicensed training data, or critical security vulnerabilities — should make you walk away. The key is to quantify the cost of fixing each issue and adjust your offer accordingly.

How is AI startup due diligence different from regular SaaS due diligence?

Standard SaaS DD focuses on code, revenue, and customers. AI DD adds several layers: model evaluation, training data provenance, compute economics, drift monitoring, and AI-specific legal considerations like model licensing and bias risk. These extras typically add one to two weeks to the process but are essential for making an informed decision.

Ready to Put This Checklist to Work?

Due diligence is not about finding the perfect startup — it is about understanding exactly what you are buying and paying the right price for it. Every AI startup has risks. The ones worth acquiring are the ones where the risks are known, manageable, and priced in.

Browse verified AI startups on MergeX — every listing includes an AI-powered audit report so you can start your due diligence before you even reach out to the seller. Verified metrics, technology assessments, and transparent pricing. The smartest AI acquisitions start here.