Most acquisition targets now use AI in ways their own leadership may not fully understand.

That creates a new diligence problem: buyers face both information asymmetry and governance immaturity.

AI may be embedded in vendor software, employee workflows, data analytics tools, customer service systems, sales platforms, or back-office processes. Some of it may be known, approved, and documented. Much of it may not be.

Traditional diligence assumes the seller can disclose what matters if asked the right questions. AI challenges that assumption because the seller may never have built the governance infrastructure needed to identify, inventory, and monitor its own AI use.

How AI Enters a Target Business

For diligence purposes, AI usually enters a company through three channels:

• Known and vetted AI. AI that is identified, approved, and purchased through normal procurement channels.
• Embedded AI. AI built into vendor platforms, legacy systems, analytics tools, workflow automation, or decision-support processes.
• Shadow AI. Public or personal AI tools adopted by employees before policy catches up. 

The result is a visibility problem. A meaningful part of the target’s AI footprint may be unknown to the buyer and to the seller’s own leadership.

The Governance Maturity Gap

The central diligence question is: “Is the target’s governance infrastructure mature enough to know what AI it uses?”

The answer exposes the governance maturity gap: the distance between what the buyer needs to evaluate and what the seller’s governance systems are capable of producing.

A seller cannot fully disclose what it has not inventoried or confidently represent what it has not reviewed. AI widens that gap because it can enter a business without passing through the governance processes that would normally capture it. Companies are rapidly expanding AI across business functions, often faster than oversight can follow: enterprise applications are increasingly AI-enabled by default, shadow AI is spreading outside formal controls, and board oversight remains uneven.

As noted in Akerman’s March 2026 Corporate Law Monthly, buyers are responding by extending diligence into governance, compliance, and workforce practices involving AI. Yet many sellers do not have the governance structure in place to answer those inquiries, or even to know their own AI footprint. The resulting lack of visibility makes it difficult for the parties to assess the potential exposure and negotiate representations, indemnities, and other protections suited to the transaction.

Three Questions Buyers Should Ask

For buyers, the diligence framework should be direct and practical.

What is known? Identify the AI systems, vendors, models, data flows, and policies that can be reviewed through traditional diligence.

What is unknown? Identify where visibility is limited: embedded AI features, unapproved employee use, undocumented data inputs, or legacy tools never classified as AI.

Why is it unknown? Is the gap the result of weak governance, or is it an unavoidable limit of the technology? That answer often informs how risk is allocated.

What This Means for Deal Teams

The governance maturity gap can shape how the deal is evaluated, priced, documented, insured, and approved.

For deal teams, that means focusing on five areas:

• Representations. A recurring negotiation point is how closely reps should track what the seller can actually verify. Where governance is still developing, the parties may land on process-focused reps that cover the methodology used, who was surveyed, and which systems and vendors were reviewed. Companies preparing for a sale can strengthen their negotiating position by documenting their AI inventory and governance processes before going to market.
• Indemnities. Indemnity scope often turns on the visibility ceiling as well as the disclosure schedules. If reps are knowledge-qualified or process-based, a standard indemnity may not reach losses that later materialize, which is why targeted indemnities may be needed for undisclosed AI issues.
• Risk-allocation mechanics. Where AI visibility is limited, parties often negotiate escrow holdbacks, extended survival periods for AI-specific reps, and carve-outs from baskets and caps for defined AI risks. These tools can help bridge the gap between verified and unverified risk.
• RWI. Buyers should not assume representations and warranties insurance will fully absorb AI risk. AI-related exclusions, underwriting limitations, or narrow coverage positions may leave meaningful exposure outside the policy.
• Board approval. Boards may want to ask what diligence could not verify, why, and whether that uncertainty is reflected in price, risk allocation, and approval materials.

AI’s impact on a target’s business can itself become a go/no-go issue. Bain & Company reported that 75% of strategic acquirers assessed AI’s impact on targets, and that at least 20% walked away as a result.

If AI can take a deal off the table, buyers need confidence that the target understands and manages its own AI. That confidence depends on whether the seller can show how its AI is inventoried, controlled, and monitored. That is why AI diligence needs to move from a checklist exercise to a governance-maturity assessment.

Key Takeaway

AI diligence requires both identifying risk and testing whether the seller has the governance structure to understand that risk.

Buyers can price known risk. They can negotiate around identified gaps. What they cannot do is assume that missing information is immaterial simply because the seller never captured it.

This Akerman Lens post is intended to inform clients and friends of the firm about developments that may affect their business. It is not intended as legal advice for any specific matter and does not create an attorney-client relationship. Please consult with counsel to determine how this information may apply to your specific situation. We also invite you to visit our Akerman Intelligence page for ongoing analysis and practical application of leading-edge AI-related legal developments across sectors and practices.