You just closed on an acquisition.
The target company had solid financials, clean legal records, and impressive technology. Your due diligence team checked everything: contracts, IP, employment issues, cybersecurity, and data privacy.
Six months later, you discover the target was using an AI hiring tool that screened out qualified candidates based on age. The EEOC investigation started before the acquisition closed, and you just didn’t know about it.
Now you own the liability. The lawsuit. The regulatory penalties. And the reputational damage.
Your due diligence missed it completely.
Here’s what nobody tells you: AI systems are the hidden liability in most acquisitions.
You’re not just buying the target’s revenue and technology. You’re buying their ungoverned AI systems, their undisclosed AI risks, and their compliance violations you won’t discover until it’s your problem.
Why Standard Due Diligence Misses AI Risk
M&A due diligence is usually thorough. But AI risk doesn’t fit neatly into any of the standard buckets.
Your IT team focuses on infrastructure and security, not whether algorithms are making biased decisions.
Your legal team looks for active lawsuits, not latent discrimination risks hiding in AI systems.
Your compliance team reviews known regulations, not emerging AI laws that barely existed when your checklist was written.
So AI risk falls through the cracks. Nobody asks about it. The target doesn’t think to disclose it. And you inherit a time bomb.
The Five AI Liabilities You’re Acquiring (Without Knowing It)
1. Ongoing Discrimination and Bias Risks
The target’s been using AI to screen job candidates, approve credit applications, or make decisions about services. Nobody ever tested it for bias. Nobody documented how it works. Nobody checked if it treats protected groups fairly.
Now you own all of it: discrimination claims from past decisions, ongoing liability as the system keeps running, regulatory exposure under laws like the Colorado AI Act or EU AI Act, and potential class actions if the bias affected hundreds or thousands of people.
And here’s the worst part about it. You don’t even know which AI systems they’re using because nobody asked.
2. Undisclosed Regulatory Violations
The target has high-risk AI systems that should be complying with new regulations. They’re not. Nobody’s done the required impact assessments. Nobody’s implemented the mandated controls.
You just inherited regulatory fines that can reach massive amounts, orders to shut down non-compliant systems, ongoing compliance costs you never budgeted for, and the reputational hit when your company gets named in enforcement actions.
3. Vendor AI Contracts with Terrible Terms
The target uses third-party AI systems. When you finally read the vendor contracts, you discover they disclaim all liability. No warranties about bias testing. No audit rights. No real indemnification.
So now you’re fully liable for vendor AI failures, even though you didn’t build the system, even though the vendor sold it as “unbiased,” and even though you can’t easily exit these contracts without disrupting the business.
4. Customer Commitments You Can’t Actually Deliver
The target’s sales team made promises. They told customers the AI is “unbiased,” “explainable,” and “compliant with all regulations.” Those promises are everywhere in customer contracts, on the website, in marketing materials.
The problem is, none of it’s true. Now you’ve got contractual obligations you can’t meet, misrepresentation liability, potential customer disputes and contract terminations, and maybe even class action exposure if enough customers were misled.
5. Zero Documentation
The target deployed AI systems without doing any of the things they should have done: no risk assessments, no bias testing results, no approval records, no monitoring data, no incident logs, no governance policies.
You can’t explain how these systems work. You can’t defend them. You have no evidence of responsible AI practices. When regulators or plaintiffs’ lawyers come asking questions, you’ve got nothing.
And because it all happened before the acquisition, you can’t create the documentation now. It just doesn’t exist.
Why Sellers Don’t Disclose AI Risk
Most of the time, this isn’t fraud. Sellers genuinely don’t know they have AI risk.
They don’t even think of it as “AI”.
It’s just “some automation tools we use” or “a feature in the software.” They have no idea that “automation” is actually high-risk AI creating legal liability.
They don’t know what’s required. Most companies have never heard that AI systems need governance, testing, documentation, or compliance reviews. So they haven’t done any of it. And they can’t disclose what they don’t know exists.
When you ask about technology, they talk about servers and infrastructure. When you ask about compliance, they focus on traditional regulations. AI risk doesn’t show up in their answers because it doesn’t fit the questions you’re asking.
Plus, they don’t have a central inventory. Marketing is using AI tools. HR’s using AI tools. Sales is using AI tools. Nobody knows the full picture. So even if they wanted to disclose AI risk, they couldn’t give you a complete answer.
What AI Due Diligence Actually Looks Like
If you want to avoid inheriting AI disasters, here’s what needs to happen:
Phase 1: Get a Complete AI System Inventory
Request a full list of all AI systems, internal and vendor-provided. What each one does. What decisions does it make or influence? Who uses it and for what?
Don’t accept “we don’t really use AI” as an answer. Dig deeper. What tools does HR use for recruiting or screening candidates? What customer-facing systems use automation or personalization? What vendor software has “AI-powered” features?
Most companies have way more AI than they realize.
Phase 2: Identify the High-Risk Stuff
Focus on systems that make decisions about hiring, credit, healthcare, or access to services. Systems that monitor employee behavior or performance. Systems that process biometric or sensitive personal data.
These are the ones creating discrimination liability, regulatory exposure, and litigation risk.
Phase 3: Review Governance and Compliance
For each high-risk system, start asking hard questions:
Was a risk assessment done before deployment? Has the system been tested for bias? What were the results? Is it being monitored after deployment? What regulations apply to it? Has anyone actually checked if it’s compliant?
If most answers are “no” or “we’re not sure,” you’re looking at significant risk.
Phase 4: Check Vendor AI Contracts
Pull the vendor contracts. Look for warranties about AI performance, liability provisions, audit rights, and what happens when regulations change.
Remember: you’re liable for vendor AI failures even if the vendor disclaims all responsibility in the contract.
How to Actually Protect Yourself
Once you’ve identified AI risk, you’ve got options:
Walk away if the risk is too high. EU AI Act fines can hit 7% of global revenue. Sometimes the risk just isn’t worth it.
Adjust the purchase price to account for the cost of fixing ungoverned AI systems and the potential liability you’re inheriting.
Require pre-close remediation, make AI compliance a condition of closing. Force the seller to do the work and spend the money to fix it.
Negotiate strong reps, warranties, and indemnification, and make sure the seller is on the hook for AI-related claims. Keep a meaningful chunk of the purchase price in escrow for 18-24 months.
Shut down risky systems immediately after close until you can properly assess and fix them. Yes, it disrupts the business. But it’s better than letting liability compound every single day.
The One Question That Exposes Everything
Here’s the question that separates companies with real AI governance from those with none:
“Can you show us the risk assessment and bias testing documentation for your three highest-risk AI systems?”
If they can produce it immediately, they probably have their act together.
If they need to “check with the team” or “pull some information together,” they don’t have proper documentation.
If they say “we don’t really think of them as high-risk,” they have absolutely no idea what they’re doing.
The quality and speed of their response tell you everything.
Stop Treating AI as Someone Else’s Problem
Most M&A teams assume tech diligence covers AI. It doesn’t. Or legal diligence covers it. It doesn’t. Or compliance diligence has it handled. Also no.
So nobody actually covers it. And you end up acquiring millions in hidden AI liability.
Schedule a 30-minute AI M&A Diligence Review where we’ll:
- Show you what AI diligence actually looks like
- Give you specific questions to add to your checklist
- Help you assess AI risk in current or pending deals
Because finding out six months after close that the target company’s AI is discriminatory and completely undocumented?
That shouldn’t be a surprise. It should have come up during diligence, when you could still walk away.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor
brian@visionaiconsult.com | 877-424-7853