AI Due Diligence Checklist Enterprise Acquisition: The 2-Week, 6-Block Working List

TLDR: An AI due diligence checklist enterprise acquisition teams can actually run in a two-week confirmatory window has six blocks and 18 scored questions, and it scores the target's operating model, not its software. The output is two numbers (readiness and exposure), a red-flag list, and one value hypothesis the investment committee can underwrite. Most of the signal comes from one block: who owns the data behind the three largest workflows.

Best For: AI operating partners and value-creation directors at mid-market private equity funds running diligence on an enterprise target (1,000 to 15,000 employees) in a traditional industry such as distribution, manufacturing, healthcare services, or insurance.

An AI due diligence checklist is a fixed set of scored questions that a deal team puts to an acquisition target during confirmatory diligence to establish how much AI value can be underwritten in the base case and how much AI exposure sits in the asset. The checklist described here is built for a specific situation: a mid-market fund, an enterprise target in a traditional industry, a two-week window, and a deal team that has one operating partner carrying the AI mandate alongside the usual financial, legal, and commercial workstreams. Maturity models and technology audits are different documents. This is a working list: the documents to request, the questions to put to management, and a 0 to 3 rubric for each answer, so the result can sit in an investment committee memo without a caveat.

What an AI due diligence checklist enterprise acquisition teams run in two weeks actually covers

An AI due diligence checklist for an enterprise acquisition covers six things: where the labor hours sit, who owns the data, what the systems can tolerate, how exposed the workforce is, what the target already spends on AI and with whom, and what regulatory surface the AI would touch. Everything else, including model quality and vendor roadmaps, is noise at the diligence stage because it cannot change the price.

The reason to be this narrow is time. In a two-week confirmatory window, the AI workstream typically gets one data-room request list, one management session of 60 to 90 minutes, and perhaps two follow-up calls with the head of IT and the head of finance operations. A checklist with 60 questions does not get answered; it gets delegated to a junior associate and returns as a spreadsheet of "TBC". Eighteen questions, each with a named document and a named person, gets answered.

The target profile this list is built for

The target profile is an enterprise with 1,000 to 15,000 employees, often multi-entity, usually running a legacy ERP that is more than ten years old, with finance, procurement, customer service, and claims or order intake teams that process high volumes of documents by hand. In the 2026 Deloitte survey of more than 140 manufacturers, 84% reported measurable value from AI somewhere in operations, but only about one in five use cases had been scaled across sites. That gap, between a proven use case and a scaled one, is what the checklist is trying to price.

How the thinking got here

AI diligence barely existed as a separate workstream before 2023; it was a paragraph inside technology due diligence. By 2026 it had become routine. Datasite's March 2026 survey of 1,000 senior dealmakers found that 50% now have AI regularly embedded in due diligence, the stage they say delivers the highest return. The content of that diligence has shifted too, away from "does the target use AI" toward "could AI change the margin of this specific business, and what would stop it". For the definition and boundaries of the workstream itself, see what AI due diligence in private equity means.

The six blocks of the AI due diligence checklist enterprise acquisition teams score

The six blocks of the checklist are workflow inventory, data ownership, systems tolerance, workforce exposure, current AI spend and vendor dependency, and regulatory and control surface. Each block has three questions, one data-room document request, and one management question. Blocks one to three produce the readiness score; blocks four to six produce the exposure score. The two scores are reported separately and never averaged.

The table below is the full working list. The "evidence" column is what to put in the data-room request on day one; the "ask management" column is what to put on the agenda for the one session you will get.

1. Workflow inventory and volume

Workflow inventory asks where the labor hours actually sit, because that is where AI value in an enterprise lives. BCG's September 2026 study of 1,330 senior leaders found that the 7.5% of companies it calls future-built deliver 2.8 times the EBITDA growth of laggards, and the common trait is that they reshape whole workflows rather than bolt tools onto tasks. A target that has never measured a workflow end to end scores 0 or 1 here, no matter how many AI logos appear in the management presentation.

2. Data ownership and access

Data ownership asks whether anyone at the target can produce the data a system would need, and whether the vendor contract allows it. A Harvard Business Review Analytic Services survey of more than 230 leaders, published in March 2026, found that only 7% consider their data completely ready for AI and 73% say preparing it has been difficult. The management question that matters most is the extract test: ask who would produce 24 months of invoice lines and how long it would take. The honest answer is often a long pause followed by the name of the ERP vendor. A confident answer with an employee's name attached is worth more than any data strategy slide.

3. Systems tolerance and write-back

Systems tolerance asks whether the core systems can take an action from an outside tool without breaking a control. Many enterprise targets in traditional industries run an ERP per acquired entity and have never let anything but a human post to the ledger. The Parsec survey of 1,200 manufacturing leaders in February 2026 put AI adoption at 72% but network-wide scaling at only 10%, and named fragmented systems as the main reason. For a deeper view of the legacy question, see the five-domain framework for AI diligence on manufacturing acquisitions.

4. Workforce exposure and labor mix

Workforce exposure asks how much of the target's labor sits in roles that high-frequency AI would change, and how hard those roles are to staff today. This block cuts both ways. High exposure with high attrition is a value hypothesis: the work is already hard to staff, so AI absorbs growth rather than displacing people. High exposure with low attrition, a collective agreement, and a long notice period is a timing constraint the 100-day plan has to respect.

5. Current AI spend and vendor dependency

Current AI spend asks what the target already pays for, whether anyone can prove it worked, and how hard it would be to leave. Grant Thornton's 2026 private equity survey found 45% of PE leaders still piloting AI and only 9% very confident they could pass an AI governance audit within 90 days. Four AI subscriptions and no baseline for any of them is spending without proof, whatever the management deck calls it, and that spend belongs in the quality-of-earnings discussion.

6. Regulatory and control surface

Regulatory surface asks whether any AI use, current or planned, falls into a category that regulators treat as high-risk. Under the EU AI Act, obligations for high-risk uses such as hiring, worker management, credit scoring, and insurance pricing apply from 2 August 2026, and the Cloud Security Alliance notes that a proposed extension to December 2027 had not been enacted at the time of writing. A target with EU employees and any plan to use AI in hiring has a compliance workstream whether or not the deal team wants one.

How to score the checklist: the 0 to 3 rubric and the red-flag override

The checklist is scored on a 0 to 3 rubric per question, giving a readiness score out of 27 (blocks one to three) and an exposure score out of 27 (blocks four to six). A 0 means no evidence and no named owner; 1 means a verbal answer with no document; 2 means a document that is incomplete or older than two years; 3 means a current document and a named person who can explain it.

Reading the two scores

Readiness at 18 or above out of 27 means an AI value hypothesis belongs in the base case, with a named workflow and a named baseline. Readiness between 9 and 17 means the first 100 days are a data and ownership project, and AI value belongs in the upside case only. Readiness below 9 means no AI value in the model at all; anything else is hope dressed as a plan. Exposure is read the other way: above 18 is a priced risk, and the specific red flags go into the legal and HR workstreams, not the AI memo.

The red-flag override

Three answers override the arithmetic regardless of total score. First, nobody can name a data owner for the largest workflow. Second, the ERP vendor contract prohibits bulk extract or third-party write-back. Third, an AI use already touches hiring or credit decisions with no sign-off process. Any one of these moves the AI value hypothesis out of the base case until it is cleared, because each one has stopped more AI programs than any model quality problem has. Gartner forecast in 2025 that more than 40% of agentic AI projects would be canceled by the end of 2027, citing unclear returns and poor risk management, which are the two things the override is designed to catch before close.

The two-week sequence: who does what on which days

The two-week sequence puts the data-room requests out on day one, the management session on day four or five, the follow-up calls with IT and finance operations on days eight to ten, and the scored memo in the investment committee pack on day thirteen. The sequence is built around one constraint: the AI operating partner is not full time on this deal and will get management's attention once.

Days one to three: requests and desk review

Send the full evidence column from the table as a single data-room request on day one, tagged to the AI workstream so the target's deal coordinator does not fold it into the IT list. Use days two and three to read what arrives and to pre-score every question at 0 or 1 based on what is missing. The pre-score is the agenda for the management session.

Days four to seven: the management session

Spend the session on the "ask management" column, in block order, and give the extract test (block two) at least fifteen minutes. KPMG's survey of 700 senior dealmakers, published in March 2026, found 56% now use agentic AI in diligence and valuation work, so the desk review can be fast; the session is for the answers no document gives, which is almost all of blocks two, three, and six.

Days eight to twelve: follow-ups and scoring

Two calls, one with the head of IT on blocks two and three, one with the head of finance operations or shared services on blocks one and five. Then score. For the high-stakes version of this situation, where the target's EBITDA case depends on an AI margin story the seller is already selling, a generic checklist is not enough; the answer is a dedicated diligence build that does three things: pulls a real sample extract from the top workflow and tests it, interviews two frontline supervisors without management in the room, and rebuilds the seller's AI business case from the target's own volume data rather than the vendor's. That build takes the full two weeks and a second person, and it is worth it only when AI is in the price.

Days thirteen and fourteen: the memo

The memo is one page: readiness score, exposure score, the red flags, one value hypothesis with its baseline and owner, and three 100-day actions. The structure of a partner-ready report is covered in what an AI due diligence report contains; the two-week version is a compressed form of that output, not a different document.

Two-week checklist vs. full AI diligence workstream: when each is right

The two-week checklist is the right tool when AI is not in the headline price and the fund needs a defensible view of readiness and exposure before close. A full AI diligence workstream, running four to six weeks with sample data, is the right tool when the seller's equity story leans on AI margin expansion or the target already runs AI in a high-risk category. The checklist tells you whether the full workstream is needed; it does not replace it.

The pattern in the data supports keeping the two separate. Bain's 2026 GP outlook, based on 103 investment professionals surveyed in late 2025 and early 2026, found that 39% of GPs did not expect AI to have any material financial impact on portfolio companies in 2026, and that reported outcomes skewed toward cost savings rather than revenue. Those are base-case numbers, and they argue for pricing AI conservatively unless the full workstream has proven otherwise. PwC's mid-2026 deals analysis adds a cautionary signal from the other side: among the 100 largest corporate deals, the share citing AI in the strategic rationale fell from roughly one third in 2025 to 17% in the first half of 2026, and PwC noted it had taken those claims at face value rather than verifying them.

Why the operating model question beats the technology question

The operating model question, meaning who owns the workflow, its data, and the right to change it, predicts AI value in an enterprise target better than any question about the technology stack. Deal teams spend most of their diligence time on systems and vendors, yet most of the variance in outcomes sits in ownership. An old ERP with a named data owner for every major workflow beats a modern stack with nobody accountable.

The evidence for ownership over technology is consistent across 2025 and 2026 research. McKinsey's 2026 State of AI survey found that 44% of organizations report scaling AI across the enterprise, up from 38% a year earlier, yet only 37% attribute any EBIT impact to it and about 6% qualify as high performers; the adoption curve and the value curve are not the same curve. The MIT study published in August 2025, based on 150 interviews and 300 deployments, found 95% of pilots stalled before scaled adoption, and that externally sourced tools succeeded about twice as often as internally built ones, a finding that points at execution capacity rather than at the software.

For the deal team, this changes where the two weeks go. Block two gets the most time in the management session. The extract test gets asked twice, once to the CFO and once to the head of IT, and the two answers get compared. L.E.K.'s 2026 survey of 100 US buyout professionals found 68% rely on external advisors for value creation and only 21% rate their own AI expertise as advanced, which is a fair description of most deal teams and a reason to keep the checklist short enough that a non-specialist can run it well. The scoring logic that sits behind the readiness number is laid out in more depth in the five-domain scored checklist for assessing AI readiness during diligence, and what happens after close, when one portfolio company becomes the proving ground, is the subject of running a lighthouse portfolio company AI program.

The hardest questions deal teams ask about an AI due diligence checklist enterprise acquisition targets will not like

The hardest questions about the checklist come from the deal team itself, not the target: whether an AI tool could generate the list in seconds, whether this is just automation diligence under a new name, and whether two weeks is enough to say anything defensible. Each has a direct answer, and each answer is about what the checklist does with the information rather than the list of questions.

"I could ask an AI tool to make this list in two seconds"

Anyone can write eighteen questions, and a tool will do it faster. The thresholds and the override are the asset. The work is deciding that readiness below 9 means zero AI value in the model, that a missing data owner for the largest workflow overrides a good total score, and that exposure and readiness are never averaged. Those rules come from watching which programs stalled after close, and they are what the investment committee is relying on, whether it knows it or not.

"This is automation diligence with a new label"

Automation diligence asks whether a rules-based tool could take over a task. This checklist asks whether the target can produce its own data, tolerate a write-back to its ledger, and name who approves a change to a workflow. The third question, the one about who approves change, is the one automation diligence never asked, and it is the one that decides whether anything scales past the first entity. If the answer to block two is weak, the correct conclusion may well be that simple automation is all the target can absorb in year one.

"Two weeks is not enough to say anything defensible"

Two weeks is enough to say three defensible things: a readiness score with evidence behind each point, an exposure score the legal and HR workstreams can act on, and whether a full AI diligence workstream is warranted before close. It is not enough to verify a seller's AI savings claim, and the memo should say so in plain words. A checklist that admits its limits is more useful to a partner than one that claims a precision it cannot have.

This analysis was developed using methodologies and operating experience from Assembly.

Frequently Asked Questions

What is an AI due diligence checklist for an enterprise acquisition?

An AI due diligence checklist for an enterprise acquisition is a fixed set of scored questions a deal team puts to a target during confirmatory diligence. The version described here has six blocks and 18 questions, each with a document to request and a management question, and it produces a readiness score, an exposure score, and a red-flag list.

How long does the AI due diligence checklist take to run?

The checklist is built to run in a two-week confirmatory window. Data-room requests go out on day one, the management session happens on day four or five, follow-up calls with IT and finance operations fall on days eight to ten, and the one-page scored memo is in the investment committee pack by day thirteen.

What are the six blocks of the checklist?

The six blocks are workflow inventory, data ownership, systems tolerance, workforce exposure, current AI spend and vendor dependency, and regulatory and control surface. Blocks one to three produce the readiness score and blocks four to six produce the exposure score. Each block has three questions, one evidence request, and one question for management.

How is each question scored?

Each question is scored from 0 to 3. A 0 means no evidence and no named owner, 1 means a verbal answer with no document, 2 means a document that is incomplete or older than two years, and 3 means a current document plus a named person who can explain it. Readiness and exposure are each scored out of 27.

What readiness score justifies putting AI value in the base case?

A readiness score of 18 or more out of 27 justifies an AI value hypothesis in the base case, with a named workflow and a named baseline. Scores from 9 to 17 put AI in the upside case only, with the first 100 days spent on data and ownership. Below 9, no AI value belongs in the model.

What are the red flags that override the score?

Three red flags override the arithmetic: no named data owner for the largest workflow, an ERP contract that prohibits bulk extract or third-party write-back, and an AI use already touching hiring or credit decisions with no sign-off process. Any one of them moves the AI value hypothesis out of the base case until cleared.

Why does data ownership matter more than the technology stack?

Data ownership predicts AI value better than the technology stack because most stalled programs fail on access and accountability, not on software. A target with an old ERP and a named owner for every major workflow is a stronger AI asset than one with a modern stack and nobody accountable. The extract test exposes this in one question.

What is the extract test in AI due diligence?

The extract test asks management who would produce 24 months of invoice lines, or the equivalent for the top workflow, and how long it would take. A confident answer with a name attached scores 3. A vague answer, or one that depends on the ERP vendor, scores 0 or 1 and usually triggers the data-owner red flag.

How is an AI due diligence checklist different from a full AI diligence workstream?

A two-week checklist uses documents and interviews to produce readiness and exposure scores; a full workstream runs four to six weeks, pulls a sample extract from the top workflow, and rebuilds the seller's AI business case. The checklist tells the deal team whether the full workstream is needed, and it cannot verify a seller's savings claim on its own.

When should a deal team run the full AI diligence workstream instead?

A deal team should run the full workstream when AI margin expansion is in the seller's equity story or the base case, or when the target already uses AI in hiring or credit decisions. The 2026 Bain GP outlook found 39% of GPs expected no material AI financial impact in 2026, which argues for conservative underwriting unless proven otherwise.

How does workforce exposure affect the AI value hypothesis?

Workforce exposure can be either a value hypothesis or a timing constraint. High exposure in roles with high attrition and long time-to-fill means AI absorbs growth without displacement. High exposure with low attrition, a collective agreement, or a long notice period means the 100-day plan must build in consultation time before any role changes.

Does the EU AI Act affect an enterprise acquisition in a traditional industry?

The EU AI Act affects any target with EU employees or customers that uses AI for hiring, worker management, credit scoring, or insurance risk rating, because those are high-risk categories with obligations applying from August 2026. The Cloud Security Alliance notes a proposed delay to 2027 had not been enacted at the time of writing.

How should existing AI spend at the target be treated?

Existing AI spend at the target should be treated as unproven until a baseline exists for it. Grant Thornton's 2026 survey found 45% of PE leaders still piloting AI and only 9% very confident of passing an AI governance audit within 90 days. Tools with no before-and-after measurement belong in the quality-of-earnings discussion, not in the AI maturity story.

Who on the deal team should own the AI checklist?

The AI operating partner or value-creation director should own the checklist, with an associate handling the data-room requests and desk review. The owner runs the management session and the two follow-up calls, writes the one-page memo, and is the person the investment committee questions on the readiness and exposure scores.

What goes in the one-page AI diligence memo?

The one-page memo contains the readiness score, the exposure score, the red flags, one value hypothesis with its baseline and owner, and three 100-day actions. It states plainly what the checklist could not verify, usually the seller's AI savings claim, and whether a full AI diligence workstream should run before close.

What is the most common mistake deal teams make with AI diligence on traditional-industry targets?

The most common mistake is spending the diligence time on systems and vendors instead of on ownership. McKinsey's 2026 State of AI survey found 44% of organizations scaling AI but only 37% seeing any EBIT impact; the gap is execution capacity, which block two measures and a technology audit does not.