Due diligence on an AI document automation business

Due diligence on an AI document automation business is less about confirming the revenue number and more about confirming the chain of title behind the thing actually generating it — the extraction model. Three findings account for most of the deals in this category that fall apart after an accepted offer: an undocumented training-data licence, a missing retention and deletion policy, and a contractor who built part of the pipeline without ever signing an IP assignment. None of these show up in a set of financial statements, which is exactly why a buyer has to go looking for them deliberately rather than waiting for them to surface.

The document list that actually matters

• The data-processing agreements the business holds with its customers, read against what the extraction pipeline actually does with the documents it processes — a mismatch between the two is the single most common finding in this category
• The licence or consent record behind every dataset used to train or fine-tune the model, distinguishing company-generated data, third-party licensed data, and customer documents used with or without permission
• Logs from the exception queue — the record of documents the model flagged for human review — since a business with none is asking a buyer to trust an accuracy claim it cannot verify
• Every contractor agreement tied to the extraction pipeline, confirmed to include an IP assignment clause and not merely a confidentiality clause

Registry searches worth running

A search of Corporations Canada’s register of individuals with significant control confirms who actually controls the company before a purchase agreement gets signed, which matters more in a business built by a small founding team than it might in a larger one. A Personal Property Security Act search — Ontario’s version is one of several provincial equivalents — turns up registered security interests against the company’s assets, including any equipment or intangible collateral pledged to a lender, and an undisclosed registration here is a real problem to resolve before closing rather than after. Where the business has filed patents on its extraction methods, a check of the assignment record at the Canadian Intellectual Property Office confirms those filings are actually owned by the company being purchased.

What a training-data gap actually means

Finding that customer or third-party documents were used to train the model without a licence permitting training use is not a paperwork problem a buyer can simply price around, because the remedy — retraining the model on properly licensed data — is expensive, slow, and may degrade the accuracy the buyer is paying for in the meantime. It also exposes the buyer to a claim from whoever owned the documents, made worse by the fact that the buyer, not the seller, will be the one operating the business when that claim arrives. This is the finding most likely to end a deal outright rather than simply adjust the price.

What a missing retention policy actually means

A business with no documented policy for how long processed documents are kept, or when they are deleted, is carrying an open compliance exposure under federal privacy law and, for any customer based in Quebec, under the province’s stricter Law 25 regime — and a buyer inherits that exposure the moment the deal closes. In practice this finding is more often addressed through a specific indemnity and a post-closing remediation commitment than through a walk-away, but only where the seller is willing to fix it and the scope of past non-compliance is actually knowable.

What an undisclosed model dependency actually means

A business that turns out to depend entirely on a single upstream model provider, with no in-house tuning or fallback and no mention of that dependency during early conversations, is telling a buyer that its margin is not actually within its own control. The specific risk is that the provider changes its pricing, its terms of use, or simply discontinues the tier the business relies on, and the company has no lever to pull in response. This rarely kills a deal outright, but it commonly reduces the price a buyer is willing to pay, because the earnings being purchased are less durable than they first appeared, and a buyer will often ask, at minimum, for a clear picture of switching costs before finalizing terms.

Reading the disclosure schedule

Most findings in this category do not kill a deal on their own — they get captured in the disclosure schedule attached to the purchase agreement, priced into a specific indemnity, or used to adjust the closing terms rather than the headline number. What matters is whether the finding is disclosed accurately and dealt with directly, rather than glossed over in the hope a buyer will not ask a second question. A pattern of vague or shifting answers to specific diligence requests is, on its own, a more reliable warning sign than any single finding.