What Is Due Diligence? How VCs Verify AI Startups Now
Summary
What is due diligence? It is the structured verification of a startup's claims before an investor commits capital: financials, legal standing, technology, market and team are tested against the pitch. For AI startups, two extra checks decide the deal: who owns the training data, and whether inference costs hold gross margin at scale. Findings convert into a lower price, escrow, or closing conditions.
Due diligence is the structured verification of a company's claims before money, equity or a signature changes hands. In venture, it means an investor tests a startup's financials, legal standing, technology, market and team against what the pitch deck says. What is due diligence in practice? A request list, a data room, and a few weeks in which every number gets checked twice. For AI startups in 2026, the checklist has two extra lines: who owns the training data, and what inference costs do to gross margin.
What does due diligence actually cover in a venture deal?
Five workstreams run in parallel. Each has an owner, an evidence list and a stopping rule.
Financial: revenue quality, burn, runway, cohort retention. Evidence: monthly P&L, bank statements, ARR bridge.
Legal: cap table, incorporation, contracts, litigation. Evidence: charter, shareholder agreement, option plan, customer MSAs.
Technical: architecture, security, IP ownership, scalability. Evidence: code review, pen test, repo access.
Commercial: market size, pipeline, churn, concentration. Evidence: customer calls, CRM export, win/loss notes.
Team: founder background, key hires, references. Evidence: backchannel calls, employment agreements.
The earlier the stage, the lighter the first four rows. A pre-seed check leans almost entirely on the team row, because there is nothing else to audit. By Series A, the financial and legal rows carry most of the weight, and the investor expects clean books. Kruze Consulting publishes stage-by-stage diligence checklists that show which items investors typically request at pre-seed, Series A and Series B.
One distinction matters before anything else. Due diligence is not an audit. An auditor attests that statements follow accounting rules. A diligence team asks whether the business is what the seller says it is, and prices the gap. Findings do not just pass or fail a deal. They move valuation, escrow terms and closing conditions.
Who runs it, and how long does it take?
On the buy side, a lead partner or principal owns the process, an associate builds the model, and outside counsel handles the legal row. Accountants and technical advisers are brought in for specific questions, not for the whole file. On the sell side, the CFO or a fractional finance lead assembles the data room and fields the questions.
Timelines vary with deal size. A seed round with a lead who already knows the founders can close the check in two to three weeks. A Series B with new investors is closer to six to eight. A control acquisition runs longer because the legal and tax rows expand. Treat these as operator ranges, not benchmarks: no public dataset tracks diligence duration, and anyone quoting a precise average is guessing.
The cost driver is rarely the fee schedule. It is founder attention. A team that spends four weeks answering requests is a team not shipping, and investors who understand this send one consolidated request list instead of five.
The seven-step sequence most deals follow
Screen. Fit with thesis, stage, check size. Most pipeline dies here, which is the point.
Management call. Founders walk through the numbers. The investor listens for what the deck omits.
Request list. A structured file of documents, sent once. Cooley GO's sample VC request list is a widely reused template.
Data room review. Financial, legal and technical rows are checked in parallel.
Reference and customer calls. Backchannel with former colleagues, then three to five customers.
Findings memo. Red flags classified as blocking, price-moving or fixable post-close.
Term sheet adjustment or walk-away. Findings convert into reps, indemnities, escrow or a lower price.
Skipping step 5 is the most common shortcut and the most expensive. A customer who says "we are evaluating alternatives" is a signal no data room contains.
What changes when the target is an AI startup?
Traditional software diligence reviews code quality, security and architecture. Those still apply. The AI layer adds four questions that decide the deal.
Does the company own what it trains on? Training data can be licensed, scraped, purchased or generated by users, and each source carries different rights. An investor asks for the licence behind every significant dataset and checks that model training is a permitted use. Missing provenance is not a footnote. In serious cases it leaves a model unusable. Regulatory reviewers also ask for data protection impact assessments and the lawful basis for any personal data in the training set.
Is the capability proprietary or rented? Foundation models are commoditised. If the product is a prompt and a workflow wrapped around a third-party API, a competitor with a small engineering team can copy it. The signal to look for is proprietary data, evaluation rigour, and depth of workflow integration. A demo proves none of these.
Do unit economics survive scale? Inference cost scales with usage. A startup quoting 80 percent gross margin on a pilot with ten friendly customers has not told you what margin looks like at ten thousand requests a day. Ask for cost per task, by customer cohort, for the last six months.
Can the model be reproduced and defended? Model cards, training logs, evaluation sets and version history are the AI equivalent of audited statements. If the team cannot rerun last quarter's headline accuracy on a fresh dataset, the adoption forecast built on it is soft.
Security gets its own line. Agents with broad permissions, exposure to prompt injection and third-party data access are attack surfaces that classic software reviews were not built to test. The red flag is simple: sensitive data reachable by a system that has no reason to see it.
Where the data comes from: the outside-in layer
Before the data room opens, a diligence team builds an outside-in view from databases. Who else has funded this company, what hiring looks like, how the product's pricing page has changed. This layer is cheap relative to the rest and it sets the questions for the management call.
Crunchbase is the entry point. Per vendor listings, the self-serve Pro plan runs about $49 per user per month billed annually, with exports capped at 2,000 rows a month. That cap is the constraint to plan around: it is enough for a single-company check and too low for mapping a vertical.
PitchBook sits at the other end. It covers roughly 4.5 million companies and 525,000 investors, and it is sold on quote, seat-based, at an enterprise price point. The coverage justifies the cost when you need deal comps, fund-level data and M&A history in one place. It does not justify it for a one-off check.
Dealroom is the stronger option for European targets. Reported pricing starts around EUR 12,600 for a three-seat minimum, so it is a team tool, not a solo analyst tool.
Tracxn organises companies into a curated sector taxonomy with analyst-written landscape reports, and it is strongest in India and Southeast Asia. For an AI target in those markets, it often surfaces competitors the Western databases miss.
None of these replaces the data room. They tell you which claims to test first. The delta between what a database shows and what the founder says is where the management call should spend its time.
Which red flags change the price, and which end the deal?
Not every finding carries the same weight. The useful sort is by what the investor can do about it.
Deal-ending:
Founder or key-contributor IP not assigned to the company
Training data obtained in breach of its licence, with no cure path
Revenue that cannot be reconciled to bank statements
Price-moving:
Inference costs that compress gross margin below the model in the deck
Customer concentration above a third of ARR in a single account
Open-source licence conflicts that require a re-architecture
Fixable post-close:
Missing board minutes or stale option grants
Security gaps with a defined remediation plan
Undocumented model versioning
The sort drives the paper. Deal-ending items stop the process. Price-moving items become a lower valuation or an earn-out tied to verified performance. Fixable items become closing conditions, escrow or holdbacks tied to remediation milestones.
How should a founder prepare before the data room opens?
Start 60 to 90 days before the raise. Run the same five workstreams as a self-audit and fix what is cheap to fix: assign IP, clean the cap table, reconcile revenue to the bank, write down the training-data licences. Investors price what founders can prove, and during diligence every unproven claim converts into a discount.
Build the data room as an operating tool, not a one-time scramble. A monthly close that produces the same artifacts an investor will ask for makes the next raise a copy-paste exercise.
For AI companies specifically, assemble four documents before anyone asks: a dataset inventory with licence terms, a model card for each production model, an evaluation report with the test set described, and a cost-per-task table by cohort. These four answer most of the AI-specific questions in one pass.
What we would actually do
For a seed or Series A check, skip the full external adviser package. Run the outside-in database pass, two customer calls and a one-page legal check on IP assignment and the cap table. That covers the failures that actually kill deals.
For a Series B or an acquisition, pay for the technical review if the AI claim is the valuation. A rented model and a proprietary one price very differently, and the only way to tell them apart is to ask for the evidence.
Signals, not narratives: the diligence file is done when every claim in the deck has a document next to it, or a discount.