Tactical Audit: Run the PE Buyer 6-Dimension AI Diligence on Your Own Company Before They Do

TL;DR: PE buyers now run a 6-dimension AI audit on every deal—data provenance, model dependency, team concentration, governance, modularity, and ownership. You'll score 2 out of 6 today. Every dimension you fix before listing adds 15-30% to your multiple. Every gap you leave is a discount calculated to the penny. Audit yourself using the HatchWorks framework, then apply the 90-Day Bottleneck Audit and Owner's Exit Engine to get ready. Your AI stack is tradeable IP only if you can prove it's owned, portable, and governed.

The 6-Dimension Audit: What PE Buyers Actually Check

In 2024, AI due diligence was a line in the tech review. Today it reprices deals and ends some of them. The buyer's audit is structured. It doesn't feel like a feeling. It moves like a procedure.

The framework is settled. HatchWorks, Opagio, Protiviti, and the legal field all converge on six categories. They assess liability you inherit and assets you're actually paying for. Read them as a checklist you run on your own company before you list it.

1. Ownership: Can You Legally Sell This Asset?

Clean IP title is not routine. It is exceptional. Buyer's counsel will ask for documented chain of title on every model, every weight, every dataset. If a contractor built your AI system, you need IP assignment. If you trained on datasets you licensed, those license terms survive change of control or they do not—and the buyer discovers which during diligence.

The buyer's question: "Do you own this, or do you rent it?" If you cannot answer with documents in a data room, the answer you give is worth a 20% discount on what the deal was priced at two weeks before. Foundation model due diligence now requires explicit contractual flow-down that lets you own the output, or the asset is not yours to sell.

Open-source code is not free. It is conditional. If your AI system runs on dependencies licensed under GPL or AGPL, and your code builds on them, the buyer inherits redistribution obligations that may force source disclosure. That is not a footnote in escrow. That is ownership risk.

2. Data Provenance: Where Did the Training Data Come From?

Tainted data is not recoverable. It is indemnifiable. Unlicensed training datasets, customer data used without consent, and adversarially injected content all create legal exposure the buyer prices. One contaminated dataset can move a $50M deal by millions and add years of indemnity escrow.

Your data map needs to trace where each training dataset came from, whether you hold the legal right to use it, and whether the data is defensible as a moat. The buyer will ask: "Can a competitor legally train on this dataset? Do you own exclusive rights?" If the answer is no, your data position is not a competitive asset. It is a license you rent from a provider who can cancel it or change terms on you.

HatchWorks research shows that stacked weaknesses in data and governance compress valuations in the 15-30% range. That is the direct cost of ambiguity. Buyers will re-trade on findings that even the target's team missed.

3. Model Dependency: Who Owns Your Foundation Model?

Concentration risk is the risk that eats acquirers. If your three most critical AI systems depend on a single foundation model provider: GPT-4, Claude, Gemini: and that provider changes pricing, deprecates the model, or tightens API access, your product becomes unsellable overnight. The buyer knows this. The buyer prices it.

Questions the buyer asks: "If this model became unavailable tomorrow, what would you do? Do you have a tested fallback? How portable is your system architecture?" If your answer is "we would rebuild," you have not answered the question. The buyer calculated the rebuild cost and deducted it from the offer.

Model portability is not assumed. It is documented. Can your system run on multiple providers with no code changes? That is portability. Can it run on Claude but not on Grok, or on OpenAI but not on Anthropic, because the prompt semantics change? That is vendor lock-in. The buyer will calculate the switching cost and move the multiple down.

Diversification beats concentration. Own the models you depend on, or have a tested plan to switch at 30-day notice. Labarna's work on autonomy at exit shows that systems built for portability command higher multiples and survive acquisition integration faster.

4. Team Concentration: Is Your AI Locked Inside One Person?

Institutional knowledge is the fastest-eroding asset in a transaction. If one engineer knows why the model works, how it was trained, and what happens if inputs drift, and that engineer walks after close, the acquirer owns systems no one remaining can safely change. This is not theoretical risk. This is repeatable cost.

The buyer will ask: "Who understands this system? Is that knowledge written down? How many people can explain it?" If the answer is "one person," the retention structure for that person becomes the deal. The buyer will demand a multiplier on that person's retention bonus, and it will be applied as a dollar deduction to the valuation because the buyer sees the risk as permanent.

Distribute knowledge before listing. Document the systems. Run casualty drills where someone other than the key person explains the architecture. If the system cannot survive the absence of a single person, you have not built a sellable asset. You have built a dependency.

5. Governance: Can You Prove You Tested This System?

Governance is not compliance theater. It is evidence under pressure. The buyer will ask for incident logs, bias testing records, human-review processes for high-stakes decisions, and audit trails that show the system has been monitored. If that evidence does not exist, the buyer assumes the worst.

Regulatory readiness is now a valuation factor. Protiviti's 2026 due diligence framework includes explicit assessment of EU AI Act compliance and high-risk system classification. If your system is classified as high-risk under the AI Act and you have no governance program documented, the buyer will either walk or price in the cost of building one post-close.

Build the governance record now. Log incidents. Test for bias. Document human oversight. Create model cards that are not templates but specific to your system. That evidence moves the multiple up because it proves you have been running the system under pressure and it has held up.

6. Modularity: Is Your AI Bolted On or Built In?

Bolted-on AI is fragile AI. If your system consists of a foundation model wrapped around a prompt, with no architectural integration into your core product, the buyer sees a replaceable wrapper, not a defensible asset. Modularity is the hallmark of a system that can be extended, debugged, and integrated into the buyer's stack without rewriting the whole thing.

The buyer's question: "How much technical debt would I inherit if I acquired this?" Duplication, inconsistent error handling, and missing telemetry all increase the cost of owning the system post-close. StepTo's research on AI-generated code shows that unreviewed AI code introduces security vulnerabilities, licensing issues, and maintainability problems that compound during integration.

If your AI system is embedded in clean, modular architecture with manageable technical debt, it is worth more. If it is bolted on, it is cheaper to replace than to integrate.

The 90-Day Bottleneck Audit: Find Your Weak Spots First

You cannot fix what you do not measure. The 90-Day Bottleneck Audit is a process-driven inventory of where your AI system will fail under the buyer's review. It moves fast. It is not a consulting engagement. It is a structured casualty drill.

Here is what it covers. For each production AI system: (1) Trace the full AI supply chain: the model, the training data, the fine-tuning data, the inference infrastructure, and the development tools. (2) Map every dependency. Which ones are critical? Which ones could you swap out in 30 days? (3) Document who owns what. Who owns the code? Who owns the data? Who owns the model weights? (4) Inventory governance. What incident logs exist? What bias testing has been done? What regulatory exposure is lurking? (5) Score modularity. Is the AI system portable to a different platform? Can it run on different models with code changes only?

The output is a one-page scorecard per system. Each dimension scores as green (buyer will approve), yellow (buyer will ask questions and adjust price), or red (buyer will walk or demand remediation before close).

Opagio's AI due diligence framework estimates that 62% of tech acquisitions fail to meet financial targets within three years, often because AI-washing or undetected technical liabilities were not surfaced during diligence. The penalty is 20-40% valuation haircut when AI-washing is detected post-close.

Do not wait for the buyer to find the problems. Find them yourself.

The Owner's Exit Engine: Fixing the Gaps Before You List

Once you know where you are weak, you have 90 days to move the needle. You will not fix everything. That is not the goal. The goal is to move as many dimensions as you can from red to yellow, and from yellow to green. Each move adds points to your multiple.

Here is what ownership looks like. For data provenance: audit every dataset. If a dataset is unlicensed or conditionally licensed, either license it formally or replace it with a dataset you own. For model dependency: stand up a backup model plan. If your primary model provider changes pricing, you have a tested alternative running in a sandbox. For team concentration: document the system so the knowledge is not tribal. Write runbooks. Record architecture decisions. Bring in a second engineer to own a critical piece. For governance: run red teams on your models. Create an incident log. Document human-oversight points. For modularity: refactor the most fragile parts. Pull AI out of monolithic services. Build ccommitterfaces.

The Navy teaches a doctrine: repair what you can before you go to sea. Fixing a system in the engine room under pressure is more expensive than fixing it at the dock. The same principle applies to your exit. Fix it before the process starts.

Here is what the math looks like. If your company is worth $100M on financials, and the AI system is worth an additional $25M, every dimension you move from red to green adds roughly 15-30% to that $25M. That is $3.75M to $7.5M per dimension. Two dimensions: that is real money. Three dimensions: that is the difference between a life-changing outcome and a good outcome.

Supply Chain Governance: The Hidden Audit

PE buyers now run an AI supply chain governance audit alongside the technical review. This is the dimension that surprises most owner-operators.

Here is what they check: (1) Foundation model concentration: does your system depend on a single model provider with no fallback? (2) Training data lineage: can you trace where every piece of training data came from, and do you have the rights to use it? (3) Development tool risk: if your engineering team uses AI-assisted coding tools, are those tools governed? Could they have introduced vulnerable code or license violations? (4) Incident response readiness: if your foundation model provider goes down, has the breach, or changes policy, what is your incident response plan?

AI Governance Institute's supply chain governance playbook shows that the hardest supply chain risk to manage is the one you do not know about: shadow AI tools used in development, undisclosed training data in vendor models, and AI features embedded in software you did not purchase as an AI product.

Map your supply chain before diligence begins. The buyer will do it anyway. Better that you find the exposure first and have remediation plans in place.

The Valuation Impact: What Each Dimension Is Worth

The economics are precise. ACT Capital research documents that AI adoption is now rewriting valuations. Companies with clean AI ownership, distributed team knowledge, and documented governance achieve higher exit multiples than companies with equivalent revenue but weak AI fundamentals.

Opagio's work quantifies it. Baseline multiples for software start at 5-8x revenue. Companies with proven AI capture uplift factors of 1.2-1.6x. Companies with high AI risk or unproven systems face downward adjustments of 0.6-0.8x. That is a 40% swing on the same revenue base.

For a $100M ARR software company, the difference between 1.2x uplift and 0.6x downward adjustment is $600M in value. Two companies with identical revenue. One has audited, modular AI. One has bolted-on AI with key-person risk. The buyer pays $240M for one and $120M for the other.

You control which company you are before the auction starts.

Frequently Asked Questions

Q: How long does the 90-Day Bottleneck Audit take to run? The assessment itself: the structured inventory of your AI systems across the 6 dimensions: takes 40-60 hours of focused engineering time, spread over 4-6 weeks. Fixing the findings takes longer. A data governance gap might take 4-8 weeks to remediate. A team concentration issue might require hiring and knowledge transfer, which is 8-12 weeks minimum. The audit is fast. The remediation is measured in calendar time, not effort.

Q: We don't have time to fix everything. Which dimensions matter most for PE buyers? Start with ownership and data. If a PE buyer cannot get clean title to your models and your training data, every other dimension becomes negotiation theater. Ownership and data are non-negotiable. Second priority is team concentration and model dependency. Those two dimensions move the multiple most visibly because they directly affect the buyer's cost-to-integrate post-close. Governance is table stakes: if you have no governance, assume a 15% valuation haircut. Modularity is bonus: if your system is clean and modular, that moves you up further.

Q: What if we find major problems during the audit? Do we have to disclose them? You do not have to disclose problems you are actively fixing. You do have to disclose problems you know about and have not addressed. The law is clear: material facts must be disclosed to the buyer. What counts as material is fact-specific and depends on industry, deal size, and jurisdiction. The safer play is to fix problems yourself before the data room opens. If you cannot fix something, disclose it early and let the buyer decide whether to proceed.

Q: Can we just hire an external firm to run AI due diligence on ourselves? Yes. But you lose speed and control. External firms will find the same gaps your engineering team will find, but two months later and for $200K. Better to run the audit internally with the engineering team that owns the system. The team will find problems external consultants miss. The team will also build institutional knowledge about what the buyer will ask, which changes how the team engineers from here.

Q: Does this apply if we're not planning an exit in the next 12 months? Yes. The 6-dimension framework is not just exit prep. It is architecture good practice. Systems that score high on the 6 dimensions are systems that are easier to maintain, less likely to fail under load, and more defensible against competitive threats. Run the audit for yourself. The exit is a side benefit.

Doctrine Connection

Due Diligence Is Non-Negotiable. You will either run an audit on yourself before the buyer does, or the buyer will run it for you and move the price down while doing it. The only question is which side of the table you are on when the findings come to light.

When I was standing watch on USS Jefferson City, we ran casualty drills because systems fail under pressure. You do not want to discover a problem in the engine room when the hull is taking on water. You want to have found it, diagnosed it, and trained the crew to respond: all before the emergency happens. The same principle applies to your exit. Run the audit while you have time to think and move deliberately. Do not wait until you are in the data room with a PE team and a countdown clock.

Disclosure

Jeff Barnes, MBA has no personal position in any company, fund, or platform named in this article. demg.ai provides marketing education and systems for owner-operators, not investment advice.

Jeff Barnes, MBA has no personal position in any company, fund, or platform named in this article. demg.ai provides marketing education and systems for owner-operators, not investment advice.