The first five things we check in an AI due diligence

When a fund asks us to audit a startup that sells itself as an AI company, the pitch deck always says the same thing: proprietary models, a data moat, and a demo that works every time. Our job is to find out what is actually true. Before we read a single line of code, we check five things.

1. Does the AI run in production, and since when

A model in a notebook and a model serving paying customers are two different companies. We ask for production logs, not benchmarks. How many requests per day, since which month, for which customers. If the AI feature shipped three weeks before the fundraise, that tells you more than any architecture diagram.

2. What happens when the model is wrong

Every model is wrong some of the time. Serious teams can tell you their error rate, how they detect failures, and what the product does when one happens. If the answer is "the user retries", the AI is a demo feature, not a system. We look for fallbacks, human review steps, and guardrails written in code rather than in the pitch.

3. How the team measures quality

We ask one question: when you change a prompt or swap a model, how do you know you did not make things worse? Teams that run evaluation sets with tracked scores can answer in one sentence and show a dashboard. Teams that answer "we test it by hand" are shipping blind, and the quality of the product depends on who happened to review the last change.

4. What one request costs

Unit economics decide whether the margin survives scale. We compute the full cost of a typical request: model calls, retries, context size, and the infrastructure around them. Then we compare it to what the customer pays. We have seen products where the answer made the business model impossible, and the team had never done the math.

5. Who can rebuild it

AI systems concentrate knowledge in very few heads. We map who designed the pipelines, who wrote the evaluation sets, and who can debug the system at 2am. If that is one person, the acquisition is really a hire, and the price should reflect it.

The pattern behind the five

None of these checks require reading the codebase, and together they filter out most of the overselling before the deep work starts. The code review, the architecture review, and the security review still matter. But they come after, because a clean codebase around an AI that does not deliver is still a bad investment.

This is the checklist we open with when we run AI audits and due diligences for investment funds. If you are looking at a deal and want an independent view, talk to us.