Technical due diligence checklist for AI-built code
Buying or investing in a product written largely by AI? The usual tech due diligence questions still apply, and a few new ones matter more than ever. Use this checklist to know what to ask.
Your first report and call are free.
Ownership and control
- Does the company own its code, in its own repository, outside the AI tool?
- Can the product run without one specific tool, account or person?
- Are licences of the code and its building blocks known and acceptable?
Understanding
- Can someone on the team explain how the critical parts work, without the AI?
- Is knowledge written down, or does it live only in old chat history?
- What happens if the founder who prompted the app leaves?
Security
- Are secret keys kept out of the code, and does every database table limit who sees what?
- Are payments and logins checked on the server?
- When was the last security review or penetration test, and what was fixed?
How the team uses AI
- Are there written rules for using AI coding tools, and are they followed?
- Does anyone senior review AI-written changes to critical parts?
- Do automatic checks stop broken changes before they reach customers?
Hidden costs
- Which parts will have to be rebuilt to grow, and what will that take?
- Do running costs grow faster than revenue: database, hosting and AI usage?
- Are there open security issues, or personal data handled in ways that create GDPR risk?
A red flag, in practice
The demo is smooth, and the founder says the app is secure. Asked who can explain the payment code, the answer is "the AI wrote it". A short look shows the database admin key inside the code that runs in the browser, and the only copy of the code living inside the builder tool.
Neither has to end the deal. Both change it: the keys are replaced and the code moved to the company's own repository before closing, and part of the price is held back until it is done.
What to do with the answers
Price in what needs fixing, ask for fixes before closing where it matters, and protect the rest in the contract. When the answers are unclear, a technical due diligence by an Expert gives you a signed, plain-language report.
Questions
What is technical due diligence?
A review of a company's technology before an investment or acquisition: the code, the infrastructure, the team and the risks, so the price and terms reflect what you are really buying.
Can we check this before seeing the code?
Partly. Documents, a demo and a talk with the founders answer many of these questions. The rest needs read-only access to the code, usually after a letter of intent.
Related
Your first report and call are free.