What Goes in an AI Due Diligence Framework and Report? The 5-Section Output

TLDR: An AI due diligence framework and report is partner-ready when it has five sections, each with named inputs: an exposure score, a readiness score, value hypotheses with a baseline, 100-day recommendations, and red flags that change price or structure. Most AI diligence outputs today are tech DD appendices or vendor slides; neither can be underwritten. The five-section format below is built to survive an investment committee.

Best For: AI operating partners and value-creation directors at mid-market PE funds whose portfolio companies are enterprise-scale (1,000 to 15,000 employees), who have been asked what the AI workstream in a live deal should actually produce.

An AI due diligence framework and report is a scored, evidence-backed document that tells an investment committee how AI changes a target's value, how ready the target is to capture that change, and what the first 100 days after close should do about it. It is not a technology inventory, which is the job of tech DD, and it is not a market sizing exercise, which belongs to commercial DD. Here is why it needs its own format. Around 60% of general partners told EY in April 2026 they are stepping up diligence on AI disruption risk, but almost none of them have agreed what the output of that diligence looks like. Ask three operating partners and you get three different documents. This post defines one: five sections, each with its inputs, its scale, and the test it has to pass before a partner sees it.

Why an AI due diligence framework and report needs its own format

An AI due diligence framework and report needs its own format because the two documents it usually gets folded into answer different questions. Tech DD asks whether the systems work. Commercial DD asks whether the market will pay. AI diligence asks a third question: what happens to this company's cost base and revenue lines when its work becomes automatable, and who captures that, the company or a competitor? Neither existing report has a home for it.

The gap shows up in the data. KPMG's 2025 Technology M&A Survey found that 66% of dealmakers discuss technical and AI debt during deal planning but only 33% prioritize investigating it before close; KPMG calls the difference "the AI blind spot." Meanwhile, AI is already inside the diligence process itself: Datasite's 2026 survey of 1,000 senior dealmakers reports that 50% have AI regularly embedded in due diligence. So deal teams use AI to read the data room faster, then produce no structured view of what AI does to the asset. Odd, when you say it out loud. That is the inversion this format fixes.

What the report is, and what it is not

The report is a decision document with scores that trace to inputs. A strategy deck does not qualify. Neither does a list of use cases, however long. Use-case lists are the most common thing operating partners inherit from a vendor during diligence, and they fail the first test a partner applies: "which of these would I pay for at close, and what would I expect back by month twelve?" A use case without a baseline is an idea, not a hypothesis.

Industry thinking has moved on this in roughly three steps. In 2023 and 2024, AI diligence meant a paragraph in tech DD confirming the target "uses AI." By 2025, after IBM's survey of 2,000 CEOs found that only 25% of AI initiatives had delivered expected ROI and only 16% had scaled enterprise-wide, funds started asking whether the target's AI spend was real. In 2026, the question became underwriting: can the AI thesis go in the model with a number attached. The five-section format is a 2026 answer. For the definition of the discipline itself and how it differs from tech and cyber DD, see what AI due diligence in private equity actually covers.

AI due diligence report vs. tech DD vs. commercial DD

The 5-section structure of a partner-ready AI due diligence framework and report

A partner-ready AI due diligence framework and report has five sections in a fixed order: exposure score, readiness score, value hypotheses, 100-day recommendations, and red flags. The order matters because each section is an input to the next. Exposure tells you where value could move, readiness tells you whether this company can move it, hypotheses put a number on it, the 100-day plan sequences it, and red flags tell the deal team what changes price or structure.

Here is the full structure in one table. The rest of this section walks through each row.

Section 1: the exposure score

The exposure score answers how much of the target's work is addressable by AI, and whether the target or a competitor is positioned to capture it. It is built function by function. For each function, the deal team records the task mix (what share of the work is high-volume, rules-based intake and processing versus judgment work), the volume per workflow from the target's own systems, how sensitive each revenue line is to a competitor using AI to price or serve faster, and how dependent the function is on a single vendor whose roadmap the target does not control.

Each function gets a 1 to 5 score, then the scores roll up with weights by cost base. The weighting is where the method shows: a 5 in a function that is 2% of operating cost should not move the headline. The test before this section goes to partners is that every function score cites a volume number pulled from the target's systems, not from a management presentation. McKinsey's State of AI 2026 survey of 1,719 participants found that only 37% of respondents attribute any EBIT impact to AI, roughly flat on the prior year, which is a useful reminder that exposure is potential, not realized value.

Section 2: the readiness score

The readiness score answers whether this company can act on its exposure. It covers five domains: data access, process maturity, workforce exposure, vendor dependency, and regulatory surface. The scoring method for those domains is covered in detail in the 5-domain readiness scorecard for diligence, so this post only states how the section sits in the report. Readiness is not rolled up into a single number. A company with a 5 on data and a 1 on process maturity is a different investment from one with 3s across the board, and a single average hides exactly that.

The readiness section is where most reports go wrong, because it is the easiest to fill with opinion. Grant Thornton's 2026 private equity AI survey found that only 9% of PE leaders are very confident they could pass an AI governance audit within 90 days, against 22% across industries, and 45% say they are still piloting. If the fund itself cannot pass that audit, its readiness scoring of a target needs documentary evidence behind every domain, not a workshop vote.

Section 3: value hypotheses with a baseline

A value hypothesis is a statement that a named workflow, at a measured baseline cost, can run at a lower cost per run with AI, with a reviewer in the loop, within a stated period. The inputs are the baseline cost of the workflow as it runs today, the expected cost per run with AI, the cost of the human reviewer, the cost of errors at the expected error rate, and timing. Three to five hypotheses is the right number for a partner document. More than that and the partner cannot tell which ones the thesis rests on.

The hard rule in this section: any hypothesis without a measured baseline is labeled "unverified" and excluded from the financial model. It can stay in the report as upside, but it does not go in the number. This rule costs some drama in the IC meeting and saves a lot of embarrassment at the first portfolio review. I would take that trade every time. The evidence for being strict here is consistent. MIT's 2025 GenAI Divide study found that 95% of corporate AI pilots stall before scaled adoption, and Analysys Mason's 2026 prediction is that while 80% of portfolio companies will deploy at least one AI tool, only about 20% will fully meet their ROI expectations. A hypothesis with a baseline is how you tell, in month six, which group you are in.

Section 4: 100-day recommendations

The 100-day section turns the top hypotheses into a sequenced list with one owner, one measure, and one exit criterion per item. The sequence follows readiness, not exposure: the first item is the workflow with the highest readiness score among the hypotheses that passed the baseline test, even if it is not the largest. The reason is that the first item has to produce a number by day 100, because that number is what the portfolio review will ask for, and what every later item will be compared against.

Eight items is the ceiling. FTI Consulting's 2026 Value Creation Index, drawn from 555 senior PE leaders across 14 countries, found that 66% now see AI-related benefits within 12 months, up from 34% a year earlier, but only 31% describe their AI implementation as efficient. The speed is real. So is the waste. A short, sequenced list is how you take the first without the second. For how a portfolio company's own AI proposals should be screened once the plan is live, the 4-question decision grid for portco AI proposals is the companion piece.

Section 5: red flags that change price, structure, or the decision

The red flag section lists findings that change the deal, grouped into three categories: those that change price, those that change structure (escrow, earn-out, conditions precedent), and those that mean walking away. Typical inputs are customer or vendor contracts that restrict the use of data for AI, unclear data rights, regulatory exposure in the target's sector, AI knowledge concentrated in one or two individuals, and AI spend that management did not disclose or cannot explain.

The test for this section is that each flag maps to a specific term in the purchase agreement or a specific condition. A flag that does not change a term is an observation and belongs in the readiness section. Gartner's June 2025 forecast that over 40% of agentic AI projects will be canceled by the end of 2027, with only about 130 of the thousands of self-described agentic vendors judged real, is the reason vendor dependency belongs here and not in an appendix: a target whose AI thesis depends on one of those vendors has a structural problem, not a technical one.

How to build the AI due diligence report so partners can underwrite it

An AI due diligence report is underwritable when a partner can trace every number in it back to a source the fund controls or verified, and when the recommendations have owners and exit criteria. The workstream that produces it runs in parallel with tech and commercial DD, takes three to five weeks for an enterprise-scale target, and is owned by the operating partner for AI, with the tech DD provider feeding the data and vendor inputs.

The sequencing rule for the workstream

The sequencing rule is: exposure before readiness, readiness before hypotheses, baselines before numbers. In practice that means week one is a volume pull (which workflows run at what volume, from the target's systems), week two is the readiness evidence (documents and interviews per domain), weeks three and four are baselines for the three to five candidate workflows, and the last week is the write-up and the red flag mapping to deal terms. Teams that start with a use-case workshop invert this order and end up with a list of ideas and no baselines, which is the single most common reason an AI section gets cut from the IC memo.

For an enterprise-scale target in a traditional industry where the AI exposure is large enough to move the valuation, a generic approach is not enough; the answer is a dedicated diligence program that does three things: pulls workflow volumes directly from the target's systems rather than from management decks, measures a baseline for each candidate workflow before any value is modeled, and maps every red flag to a purchase-agreement term before the report reaches the committee. A general tech DD scope with an "AI" line added does none of those three.

Common objections from partners and operating peers

"I could ask a chatbot to make that matrix in two seconds." Fair, and you should. You would get the headings in two seconds. What you would not get is the volume numbers from the target's billing and ticketing systems, the readiness evidence from interviews, or a baseline measured on the target's actual workflow. The value of the report is entirely in the inputs, and the format exists to make the inputs visible so a partner can check them.

"Is this just RPA in disguise?" Sometimes, and the report should say so. A hypothesis whose workflow is fully rules-based with structured inputs is an automation case, and it should be scored as one, with the lower risk and lower ceiling that implies. The distinction matters because BCG's 2026 Applied AI Index of 1,330 senior leaders found only 5% of companies have the full set of controls in place for autonomous AI, so hypotheses that depend on agents acting without review belong in a different risk bucket from rules-based automation.

"Our deal teams are not AI experts." Most are not, which is why the format is strict about evidence. L.E.K.'s April 2026 survey of 100 U.S. buyout professionals found that only 21% rate their own AI expertise as advanced, and they rate their portfolio companies further behind. A report that depends on expert judgment will not be trusted; a report that depends on traceable inputs can be checked by a non-expert.

What the report becomes after close

At close, the report is rewritten into the first chapter of the value creation plan: the top hypotheses become the first measured workflows, the 100-day list becomes the operating cadence, and the red flags become the post-close remediation list. The scores are re-run at day 100 against the same inputs so the delta is visible. This is also where the operating model gets tested, which is the part most pilots skip; why portfolio company AI pilots fail covers the five tests that catch it.

The reason to keep the same scoring at day 100 is the exit. Analysys Mason's 2026 forecast puts a 15% to 25% premium on exit multiples for companies that can show substantiated AI-driven transformation over peers that cannot. A report whose scores were measured at entry, re-measured at day 100, and tracked through the hold is the substantiation. The broader PE AI diligence playbook covers how this fits across the full hold period.

Where AI due diligence reports go wrong

AI due diligence reports go wrong in four repeatable ways: they roll readiness into one number, they model value without a baseline, they list use cases instead of ranked hypotheses, and they put red flags in an appendix where nobody maps them to deal terms. Each of these turns a decision document back into a strategy deck.

The pressure to produce something impressive is understandable. Bain's 2026 survey of 100 CEOs found that roughly 80% are unhappy with the pace of their AI programs and 82% say their programs are at best partially achieving intended results. Bain and StepStone's 2026 GP outlook found that nearly 40% of GPs do not expect material financial impact from AI this year. Partners in that mood do not want more optimism; they want a document they can check. S&P Global's 2026 private equity survey found 72% of respondents naming operational improvement as the top value creation lever, and 49% naming lack of expertise as the main barrier to AI. The five-section format is built for that audience: people who think in operations and will not underwrite anything they cannot trace.

One last point on scope. PwC's 2026 deals outlook notes that the share of the 100 largest corporate deals citing AI in their strategic rationale fell from about a third in 2025 to 17% in the first half of 2026. Buyers have become more careful about claiming AI in a rationale, which is the right instinct. A scored report is how a fund earns the right to claim it in its own memo.

This analysis was developed using methodologies and operating experience from Assembly.

Frequently Asked Questions

What is an AI due diligence framework and report?

An AI due diligence framework and report is a scored decision document that tells an investment committee how AI changes a target's value, how ready the target is to capture it, and what the first 100 days should do. Its five sections are exposure score, readiness score, value hypotheses, 100-day recommendations, and red flags, each with named inputs.

What are the five sections of a partner-ready AI due diligence report?

The five sections are exposure score, readiness score, value hypotheses, 100-day recommendations, and red flags. Each section feeds the next: exposure shows where value could move, readiness shows whether the company can move it, hypotheses put a number on it with a baseline, the 100-day list sequences it, and red flags map findings to deal terms.

How is an AI exposure score built?

An AI exposure score is built function by function on a 1 to 5 scale, using task mix, workflow volumes from the target's own systems, revenue-line sensitivity to competitors using AI, and vendor dependency. Scores roll up with weights by cost base, and every function score must cite a volume number from the target's data.

How does the readiness score differ from the exposure score?

The readiness score measures whether the company can act, while the exposure score measures how much is addressable. Readiness covers data access, process maturity, workforce exposure, vendor dependency, and regulatory surface, each scored 1 to 5 and never averaged, because a company strong on data and weak on process is a different investment from one that is average everywhere.

What makes an AI value hypothesis underwritable?

An AI value hypothesis is underwritable when it has a measured baseline for the workflow's current cost, an expected cost per run with AI, a reviewer cost, an error cost, and a timing assumption. Any hypothesis without a measured baseline is marked unverified and kept out of the financial model; that rule separates a thesis from a use-case list.

How many value hypotheses should an AI due diligence report contain?

An AI due diligence report should contain three to five value hypotheses. Fewer than three suggests the exposure analysis was shallow; more than five means a partner cannot tell which hypotheses the thesis rests on. Each one names a workflow, a baseline, an expected cost per run, and a measurement rule so it can be re-scored at day 100.

What belongs in the 100-day recommendations section?

The 100-day section is a sequenced list of at most eight items, each with one owner, one measure, and one exit criterion. Items are ordered by readiness rather than by size, because the first item has to produce a measured number by day 100 that every later item will be compared against in the portfolio review.

Which red flags in AI due diligence change price or deal structure?

Red flags that change price or structure include contracts restricting data use for AI, unclear data rights, regulatory exposure, AI knowledge concentrated in one or two people, and undisclosed AI spend. Each flag maps to a specific purchase-agreement term, escrow, or condition; a finding that changes no term is an observation and belongs in the readiness section instead.

How does an AI due diligence report differ from a tech DD report?

An AI due diligence report asks what AI does to the cost base and revenue lines, while tech DD asks whether the systems work and scale. Tech DD produces a risk register and remediation list from architecture, code, and security reviews. The AI report produces scores and hypotheses from workflow volumes, task mix, and operating-model evidence.

Who should own the AI due diligence workstream in a PE deal?

The AI operating partner or value-creation director should own the AI due diligence workstream, with the tech DD provider supplying data and vendor inputs. Ownership sits with the operator because the report is rewritten at close into the value creation plan, and the same person has to defend the scores at day 100 and in the next portfolio review.

How long does an AI due diligence workstream take?

An AI due diligence workstream takes three to five weeks for an enterprise-scale target and runs in parallel with tech and commercial DD. Week one pulls workflow volumes, week two gathers readiness evidence, weeks three and four measure baselines for candidate workflows, and the final week writes the report and maps red flags to deal terms.

Why do most AI due diligence reports fail at the investment committee?

Most AI due diligence reports fail at committee because they roll readiness into one number, model value without a baseline, list use cases instead of ranked hypotheses, and bury red flags in an appendix. KPMG's 2025 survey found only 33% of dealmakers prioritize investigating AI debt pre-deal despite 66% discussing it, which is the same gap.

Is AI due diligence just automation or RPA assessment in disguise?

AI due diligence sometimes surfaces hypotheses that are rules-based automation cases, and the report should label them as such. Rules-based workflows carry lower risk and a lower ceiling than AI cases that need reviewer oversight. BCG's 2026 Applied AI Index found only 5% of companies have full controls for autonomous AI, so the two belong in separate risk buckets.

What evidence does the report require for each score?

Every score in the report requires a traceable source: function exposure scores cite volume numbers from the target's systems, readiness domain scores cite a document or interview, value hypotheses cite a measured baseline, and red flags cite a contract clause or regulatory requirement. A score without a source is marked unverified and excluded from the model until evidence is found.

What happens to the AI due diligence report after the deal closes?

After close, the AI due diligence report becomes the first chapter of the value creation plan. Top hypotheses become the first measured workflows, the 100-day list becomes the operating cadence, and red flags become the remediation list. Scores are re-run at day 100 against the same inputs so the delta is visible and defensible at the next portfolio review.

Does a scored AI due diligence report affect exit value?

A scored AI due diligence report supports exit value because it creates a measured record from entry through the hold. Analysys Mason's 2026 forecast predicts a 15% to 25% exit-multiple premium for companies that can substantiate AI-driven transformation over peers that cannot. Scores measured at entry and re-measured at day 100 are that substantiation.