Speaking Topic: Agentic AI Risk as a New M&A Diligence Line Item
Acquirers are still diligencing AI the way they diligence regular software, and that gap is where the real exposure hides.
Standard M&A technical diligence checklists were built for deterministic software. They check code quality, test coverage, and architecture documentation. None of that tells you what an autonomous agent inside the target's stack is actually authorized to do once deployed.
I argue agentic AI risk needs its own line item in the diligence checklist, assessed adversarially, the same way a penetration test assesses a network rather than reading its configuration documentation.
Acquirers who skip this are not under-diligencing the AI, they are not diligencing it at all. They are diligencing the code around it and assuming the rest is fine.
Key Takeaways
- 01Standard diligence checklists were built for deterministic software and do not test AI agent authority boundaries.
- 02Agentic AI risk should be assessed adversarially, as its own diligence category, not folded into general code review.
- 03Skipping this line item means the AI component of the target is effectively not diligenced at all.
Frequently Asked
Why can't existing code review checklists cover agentic AI risk?
Code review checks correctness of what was written. Agentic AI risk lives in what the deployed system is authorized to do at runtime, which a static checklist does not test.
From the Q&A
“How common is it for acquirers to actually ask about this?”
Still rare, which is exactly the gap. Most deal teams have not yet added it as a formal checklist item, so it gets surfaced only when someone specifically goes looking.