Why AI startups need a different checklist
A standard diligence process covers team, market, financials and legal. AI companies add five risks it can miss:
- Model dependence. If the core feature is a prompt on one provider's API, a price change or deprecation can break the product or the margin overnight.
- Data rights. Training or fine-tuning data with unclear licensing creates IP exposure that surfaces at acquisition, not at seed.
- Inference economics. Every query costs compute, so gross margin can fall as usage grows, unlike traditional SaaS.
- Self-reported quality. Benchmark claims are often run by the company on its own test set, with no method or date published.
- Regulation. EU AI Act obligations have been phasing in since 2025, and sector rules (health, finance, hiring) add their own requirements.
The checklist
23 checks across seven areas, each with the red flag to watch for.
| # | Area | Check | Red flag |
|---|---|---|---|
| 1 | Technology & models | Which models power the product, and which are proprietary vs third-party APIs? | Core feature is a prompt on one vendor's API |
| 2 | Technology & models | What happens if the model provider raises prices, changes terms or deprecates the model? | No fallback model tested |
| 3 | Technology & models | What is defensible beyond the model: data, workflow, distribution, integrations? | Advantage disappears with the next foundation model release |
| 4 | Technology & models | How is the system evaluated, and are results reproducible on a held-out set? | Demo results only, no evaluation suite |
| 5 | Data | What data trained or fine-tuned the models, and what rights does the company hold? | Scraped data with unclear licensing |
| 6 | Data | Do customer inputs train shared models, and do contracts allow it? | Training on customer data without explicit terms |
| 7 | Data | Does usage create proprietary data that improves the product? | Usage data isn't captured or can't legally be used |
| 8 | Product & quality | What accuracy and failure-rate metrics exist for the core use case? | Accuracy claims with no method or date |
| 9 | Product & quality | Has anyone outside the company tested the quality claims? | Self-reported benchmarks only |
| 10 | Product & quality | How are regressions caught when underlying models update? | No regression testing |
| 11 | Security & privacy | What is the status of SOC 2, ISO 27001 and the latest penetration test? | No audit planned before enterprise sales |
| 12 | Security & privacy | What controls exist against prompt injection and data leakage? | Never red-teamed |
| 13 | Security & privacy | Can the company list its sub-processors and its retention and deletion terms? | Can't list sub-processors, including model providers |
| 14 | Security & privacy | What is the GDPR/CCPA posture, and is there a HIPAA BAA where health data is involved? | Selling into regulated sectors without the paperwork |
| 15 | Commercial | What is gross margin after inference and hosting, per customer and per query? | Margin falls as usage grows |
| 16 | Commercial | Does the pricing model match the cost driver (seats vs usage)? | Flat seat pricing on usage-heavy costs |
| 17 | Commercial | What do retention and expansion look like by cohort? | Pilots that don't convert to contracts |
| 18 | Legal & regulatory | Who owns the code, models and outputs, and what is the copyright exposure? | Contractor IP never assigned |
| 19 | Legal & regulatory | How is the product classified under the EU AI Act and relevant sector rules? | No assessment of whether the product is high-risk |
| 20 | Legal & regulatory | What indemnities does the company offer customers? | Uncapped IP indemnity |
| 21 | Team & governance | Is there depth in ML, data and security roles? | One person holds all model knowledge |
| 22 | Team & governance | Is there an AI governance process: ethics policy, incident response, human oversight? | No incident process |
| 23 | Team & governance | What compute and vendor commitments has the company made? | Large prepaid compute against short runway |
Use independent evidence, not the pitch deck
Checks 8–14 are where self-reported claims are most common and easiest to verify. In huby's methodology, product owner documentation ranks below huby's own testing and third-party audits as evidence. Ask whether the startup has an independent evaluation; on huby, submission is free and owners cannot pay for placement or a score. Of the 24 AI products huby scores today, 6 reach the Strong band (4.0+) overall.
Red flags that should pause a deal
- The founders can't name which models the product depends on.
- Training data rights are "being reviewed" by counsel.
- Gross margin is only reported before inference costs.
- Every quality metric comes from an internal benchmark.
- No security audit is planned despite an enterprise pipeline.
Frequently asked questions
- How is AI used in due diligence?
- Investors and deal teams use AI to read data rooms, summarize contracts, flag unusual terms and compare financials across documents, which cuts first-pass review time. It still needs human review: models can miss context or misread clauses, and deal documents are confidential, so check the tool's data terms first. This checklist covers the reverse case: diligence on an AI company.
- What do investors check in AI startup due diligence?
- Beyond standard team, market and financial checks, investors test whether the AI advantage is defensible or a thin wrapper on a third-party model, whether the company has rights to its training data, how inference costs affect gross margin, and whether quality, security and privacy claims are independently verified. Regulatory exposure, such as EU AI Act classification, is increasingly part of the review.
- What are the Four P's of due diligence?
- The Four P's usually mean people, philosophy, process and performance, a framework from evaluating investment managers. Applied to an AI startup: people is the team's ML and security depth, philosophy is its approach to data and safety, process is how it builds, tests and ships models, and performance is the evidence, ideally independent, that the product works.
- What is technical due diligence?
- Technical due diligence reviews a company's technology before an investment or acquisition: architecture, code quality, scalability, security, technical debt and team. For AI companies it adds model dependencies, data rights, evaluation practice and inference costs. An internal technical partner or an outside firm usually runs it, and findings feed valuation and deal terms.
Look up the startup's huby report, or ask the founders to submit for an independent evaluation.
Submit a product