Vertical AI SaaS business due diligence

Due diligence on a vertical AI SaaS business is largely an ownership investigation, because the product’s value sits almost entirely in intangible assets — training data, a model, code and customer contracts — that are easy to describe informally and much harder to prove cleanly on paper. A buyer already under a letter of intent needs a specific, documented answer to who owns each component of the product, not a verbal assurance, because the gaps that surface here do not resolve themselves after closing; they become the new owner’s problem the day the deal completes.

Documenting who owns what

Request a written inventory covering the training data, the fine-tuned model or weights, the application code and any third-party services the product depends on, with each item marked as owned outright, licensed under specific terms, or built by a contractor. For any component built by a contractor, ask for the signed IP assignment directly rather than accepting a general services agreement as sufficient, since a services agreement alone often does not transfer IP ownership the way an assignment clause does. Where training data was drawn from client files — legal matters, patient records, financial statements — the licence or consent basis for using it in training needs to exist in writing, not as an assumed industry norm.

Verifying data handling and privacy exposure

Confirm the business’s compliance record under federal privacy law, and where any customers are in Quebec, check specifically for compliance with that province’s stricter consent and disclosure regime, including its requirement to disclose when a decision about a person was made using automated processing. Ask whether the business has ever received a privacy complaint or regulatory inquiry, even an informal one, since that history matters regardless of how it was resolved. Where the product processes health, financial or legal information, confirm what contractual confidentiality obligations flow through from the customer to the vendor, because those obligations typically survive a change of ownership and become the buyer’s obligation too.

Reading the customer contracts closely

Pull every material customer subscription agreement and check specifically for assignment or change-of-control language, because a contract that blocks assignment without consent does not necessarily kill a deal but it does change how the transaction needs to be structured and timed. Look for any clause addressing liability for AI-generated errors inside the customer’s regulated workflow, and treat a contract that is silent on this as an open risk rather than a non-issue, since silence usually means the question has never actually been tested. Confirm whether any integration partnership or platform API access referenced in the contracts is held under an agreement that is transferable, or one that will need to be renegotiated after closing.

Confirming the sector regulator’s view of the product

The AI vendor itself is rarely the regulated party, but the professional relying on its output usually is, and that changes what this part of diligence needs to confirm. Where the product supports legal work, ask whether the relevant provincial law society has raised any concern about tools like it, since regulatory attention falls on the lawyer using the output, not on the vendor supplying it. Where the product touches patient records, check the business’s compliance posture under the applicable provincial health-privacy statute — Ontario’s PHIPA or another province’s equivalent — separately from the general federal privacy review, since a health-sector customer’s own regulator can hold that customer, and by extension the vendor, to a higher bar than federal privacy law sets on its own. A product marketed into financial services should be checked against how its claims would read to a securities or banking regulator, because language that could be read as investment or credit advice invites scrutiny regardless of how the vendor itself is registered. None of this makes the underlying business unsound, but a buyer needs a documented answer before closing, not a verbal reassurance from the seller.

What different acquirers check hardest

Who is actually running the diligence changes which findings matter most. A vertical-specific software incumbent buying to add AI features cares most about whether the fine-tuned model and training data are genuinely proprietary, since its own roadmap depends on that differentiation surviving the acquisition intact. A private equity platform assembling a portfolio of vertical software businesses is more focused on whether the contracts and data-handling practices can be standardized across every company it already owns, so a gap that looks minor in isolation — an unsigned assignment, an undocumented retention policy — gets treated as a template problem across the whole portfolio. A horizontal AI vendor buying distribution into a regulated industry usually already runs stronger internal AI-governance practices than the target does, and will diligence against its own bar rather than a general industry standard. A strategic acquirer already serving the same profession tends to weigh reference-customer reputation more heavily than the technical diligence, since it is really buying relationships it already understands how to serve.

What a finding actually means

A missing contractor IP assignment is usually fixable before closing, either by obtaining a retroactive assignment or pricing the residual risk into the deal, and should not by itself be treated as a reason to walk away. Training data used in model training with no documented licence to use it that way is a more serious finding, because it can expose the buyer to a claim regardless of who owned the business when the training happened, and it deserves real legal analysis rather than a quick workaround. Confirmation that the business depends entirely on a single foundation-model vendor, with no differentiated data or tuning underneath it, is not automatically disqualifying, but it should reprice the deal rather than be waved through at the multiple a proprietary-data business would command.