An acquisition target does not need to sell an AI product to have AI exposure. For private equity buyers, shadow AI belongs in technology due diligence because the question is not just what the company has purchased, but what employees are using, what information they are submitting, and which business processes now depend on it.
Consider a hypothetical target whose approved application list contains its ERP, CRM, email platform, and document-management system. Separately, a sales employee uses a personal AI account to revise customer proposals, a finance manager uses a chatbot to explain forecasts, and an operations team relies on an AI-assisted spreadsheet that only one employee understands. The application list may be accurate without describing how the business actually works.
That is the diligence gap. The buyer needs to distinguish a manageable policy issue from a material data exposure, an undocumented operating dependency, or a claimed productivity improvement that will cost more to sustain than the deal model assumes.
Shadow AI is a control gap, not a product category
Shadow AI means AI used for work outside the organization’s approved processes or oversight; the 48 AI guide to shadow AI explains why approval should cover the workflow, not just the tool. For diligence, that means asking about the account, the permitted information, the task, and the review process together.
Ownership disclosure: Tom Cloud, founder of Vertex CIO Advisory, also owns 48 AI. Its linked guide is included as a practical reference, not an independent endorsement of a provider or a requirement to use its platform.
The useful unit of analysis is a workflow. Ask who uses it, what goes in, what comes out, where access is managed, and what happens if the workflow produces the wrong answer or stops working. A company subscription is evidence to examine, not a complete answer.
Why it matters to a transaction
Treat shadow AI findings as business issues rather than counting unapproved tools and declaring the target unsafe. The same discovery can have very different consequences depending on the information involved, the decisions supported, and the controls already in place.
- Data and contractual exposure: Establish whether customer information, confidential commercial material, personal data, or credentials may have been submitted. Compare the actual service terms and account settings with the target’s obligations; involve legal counsel where the facts indicate a possible breach or reporting issue.
- Operating continuity: Identify workflows tied to personal accounts, individual subscriptions, or undocumented prompts and integrations. Ask whether the company can retain access, reproduce the process, and transfer responsibility after close.
- Margin assumptions: If management attributes productivity gains to AI, reconcile the claimed benefit with subscriptions, usage charges, review time, exceptions, and the controls needed to sustain the workflow.
- Output reliability: Identify where AI-generated work informs pricing, customer commitments, financial analysis, or other consequential decisions. Determine who validates it and what evidence supports that review.
A personal account used to improve a public job posting is not equivalent to an uncontrolled workflow processing confidential customer information. The diligence finding should describe that distinction, not flatten both into “AI risk.”
What PE technology due diligence should request
Start with a short, proportionate evidence request. The objective is enough visibility to make a transaction decision, not a collection of employee conversation histories.
- Use-case inventory: Tools and embedded AI features, business purpose, department, account type, owner, and broad input-data categories.
- Approval rules: Approved workflows, restricted information, exception decisions, and the person accountable for approving new use cases.
- Provider and account evidence: Relevant terms, data-handling settings, administrative ownership, retention arrangements, and access-removal procedures.
- Spend evidence: Company subscriptions, authorized expense records, API charges where applicable, and the assumptions behind AI-related savings claims.
- Workflow controls: Documentation, human-review requirements, escalation paths, and examples of how consequential outputs are checked.
- Incident and exception records: Known accidental submissions, access problems, material output errors, and the company’s response.
Use interviews to connect those records to actual work. Ask finance, sales, operations, HR, and technology leadership what employees are trying to accomplish with AI and what would become harder if access disappeared. A non-punitive discussion is more useful than asking employees to defend whether they have broken a rule.
This is consistent with NIST’s Generative AI Profile, which addresses data privacy, information integrity, and information security and recommends maintaining AI inventories and relevant third-party agreements. (NIST AI 600-1) Use that guidance as a reference for the evidence request, not as a claim that completing the request certifies the target.
Missing evidence is not a clean result
Document the limits of discovery. An expense review can identify paid subscriptions without capturing every free account, and a management interview can describe intended practice without proving what every employee does.
Do not infer the contents of a submission from evidence that someone accessed an AI service. Keep information requests within authorized diligence boundaries, avoid unnecessarily collecting sensitive prompts, and record unresolved questions explicitly.
For example, “Management reports no approved AI use; no employee-level inventory was available” is more defensible than “The company does not use AI.” If sensitive use is suspected, request proportionate follow-up evidence rather than assuming either a breach or a clean bill of health.
Translate the finding into a decision
The deal team should receive a finding that states the workflow, evidence, possible consequence, uncertainty, and recommended action. Ownership, timing, and a supportable cost estimate matter more than a red risk label.
As an illustrative finding, a target might identify customer-proposal work conducted through personal AI accounts but be unable to establish which information categories were submitted. The appropriate recommendation would be to clarify the exposure, review relevant customer obligations, and establish an approved workflow with company-owned access. It would not be to assert that customer data was sold, used for training, or permanently compromised without evidence.
Separate potential pre-close issues from Day 1 controls and later improvements. A suspected sensitive-data incident may require immediate investigation; an undocumented but low-risk workflow may belong in the post-close operating plan. Transaction counsel should determine any implications for legal disclosures or deal documents.
For a target whose investment thesis depends on AI, extend the assessment into model dependencies, data rights, operating economics, and the claims supporting that thesis. Vertex’s AI due diligence for private equity addresses that wider question; shadow AI adds the employee-workflow layer, including for targets that do not market an AI capability.
The first 100 days should enable useful AI, not just prohibit it
A blanket ban is not the only response available. The post-close plan should distinguish useful, supportable workflows from activities whose data or decision risks exceed the controls in place.
Begin with a named owner, a limited inventory, clear input rules, and an approved route for selected work. Then put consequential workflows on company-owned accounts, establish review responsibilities, and test whether the controls cover the intended environment.
Connect access and spending decisions to the value-creation plan. Measure a selected workflow against a baseline that includes review effort and errors, not just the speed of generating a first draft. Scale it only when the business can explain the benefit and operate it without depending on one employee’s personal account.
Those actions belong alongside other priorities in a first-100-days technology plan. A workspace, policy, or provider contract should be evaluated as part of that operating plan, not treated as a substitute for it.
The buyer’s question is control, not enthusiasm
“Are you using AI?” is an opening question, not a diligence conclusion. The more useful question is: “Can the business explain its AI use, control the information involved, validate consequential outputs, and sustain the workflows it now relies on?”
That belongs in technology due diligence for private equity, even when the target’s investment story has nothing to do with AI. The objective is to identify what matters to the transaction and what management must own after close, without turning every experiment into a remediation project.
Have an acquisition in progress or an unresolved AI-governance issue at a portfolio company? Schedule a technology diligence conversation to discuss the exposure and an appropriate assessment scope.
