The short answer: AI now does real work in technical due diligence, and the work it does is narrow. It reads the entire codebase, the full ticket history, the vendor contracts, and the cloud bill in hours instead of weeks. It does not form a judgment about whether the engineering organization can ship the roadmap you underwrote. That judgment is still yours, and it is still the part that determines the return.
I have run this on live deals and inside portfolio companies. What follows is what actually held up.
Where AI Earns Its Place in Tech DD
Traditional technical diligence samples. A vendor gets three weeks, a partial repo dump, four management interviews, and a data room. They read maybe two percent of the code and extrapolate. The extrapolation is usually directionally right and occasionally catastrophically wrong.
AI changes the sampling rate. Four areas where the lift is clear:
- Full-codebase review. Static analysis has existed for years. What is new is semantic reading at scale: identifying every place the system touches PII, mapping undocumented service dependencies, finding the three modules that carry most of the change risk.
- Third-party and license exposure. Dependency trees, copyleft contamination, abandoned packages, and embedded models with commercial restrictions. This is mechanical work with high downside if missed.
- Engineering velocity from primary data. Commit history, PR cycle times, incident logs, and ticket flow tell you more about delivery capability than a management presentation does. AI makes that history readable.
- Contract and cloud cost review. Reserved instance commitments, auto-renew clauses, per-seat pricing tied to headcount assumptions. These land directly in the model.
Where It Misleads
Three failure modes show up consistently.
Confident architectural narratives. Ask a model to assess a system's scalability and it will produce a fluent, plausible, unfalsifiable answer. Architecture judgment requires knowing what the business intends to do next. The model does not know that.
Missing the human layer. Key person risk, whether the CTO is actually respected internally, whether the last four senior engineers left for the same reason. None of this is in the repo.
False precision on remediation cost. Models will estimate the effort to fix technical debt. Those numbers are anchored on nothing. Treat them as a list of items to price with an engineer, never as an input to the model.
A Process That Works Inside a Three-Week Window
- Week one, machine pass. Ingest the repos, dependency manifests, cloud billing, incident history, and contracts. Produce a findings list with file-level citations. Every claim must point to a specific artifact.
- Week two, human targeting. Your technical advisor works the top twenty findings rather than starting cold. The AI pass tells them where to spend their attention.
- Week three, management sessions. Walk into interviews holding evidence. The quality of the questions changes when you can reference the specific service that has failed eleven times this quarter.
Diligencing the Target's Own AI Claims
Most software targets now claim AI capability. The question that separates real from cosmetic: what would break if the model vendor doubled prices or deprecated the endpoint tomorrow? If the answer is nothing much, the AI is a feature wrapper and should be valued as one. Ask for eval results, error rates in production, and human-in-the-loop volumes. Ask who owns the training data and under what terms.
What to Measure
Two numbers tell you whether this is working. Coverage: what share of the codebase and data room was actually examined. Conversion: how many machine findings survived human verification and reached the investment committee memo. If conversion runs below thirty percent, the setup is generating noise and needs tightening.
The firms getting value here treat AI as an instrument that expands what their existing diligence process can see. The judgment stays with the people who own the outcome.
If you are building this capability into your deal process, book a discovery call.