During technical due diligence, traditional software inventories look at servers, cloud accounts, and codebase repos. But in 2026, employee-led AI adoption is happening off the books—and it creates major liabilities for acquirers.
Here are 4 “Shadow AI” red flags we look for during Digital & AI Due Diligence:
🚨 1. Ungoverned API Calls
Custom scripts or SaaS add-ons sending proprietary company or customer data to external LLM providers with zero data-retention agreements.
🚨 2. Unmonitored Code Generation
Developers using AI coding assistants without automated license scanning, exposing the core IP to copyleft or open-source compliance risks.
🚨 3. Invisible Vendor Dependencies
Key product features wrapped tightly around third-party AI APIs without SLA guarantees, cost controls, or fallbacks if the model changes.
🚨 4. Non-Compliant Personal Data Processing
Customer records ingested into training pipelines without explicit consent, creating immediate exposure under GDPR or Swiss FADP.
Spotting these risks before signing prevents costly post-acquisition compliance remediation.
Is your investment team auditing AI risks in current deal pipelines?
