1. Frame the transaction question
Define target perimeter, AI-enabled products, European exposure, deal structure, valuation date and decision consequence.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an approved AI Act diligence charter. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when regulatory diligence is separated from the investment thesis. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for frame the transaction question should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
2. Map the AI value chain
Identify providers, deployers, importers, distributors, authorised representatives, model suppliers and downstream users.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a role and responsibility map. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the target's legal role is assumed from commercial branding. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for map the ai value chain should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
3. Inventory AI systems and models
Record products, features, models, versions, owners, customers, markets and lifecycle state.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a controlled AI asset register. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when material AI dependencies remain outside the transaction inventory. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for inventory ai systems and models should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
4. Classify prohibited-practice exposure
Test products, features, intended uses and foreseeable uses against applicable prohibitions.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a prohibited-practices assessment. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when a revenue line depends on a use that cannot continue lawfully. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for classify prohibited-practice exposure should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
5. Classify high-risk systems
Assess product safety components and Annex III uses using current Commission guidance.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a high-risk classification dossier. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when high-risk status is missed because the model appears technically ordinary. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for classify high-risk systems should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
6. Classify general-purpose models
Determine whether the target develops, modifies, supplies or integrates general-purpose models.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a general-purpose AI role assessment. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when a customised model creates provider obligations that the deal model omits. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for classify general-purpose models should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
7. Identify systemic-risk exposure
Review capability, notification, evaluation, safety, incident and cybersecurity implications.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a systemic-risk obligations schedule. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when systemic-risk obligations arrive after signing without budget or ownership. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for identify systemic-risk exposure should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
8. Map the enforcement timeline
Separate obligations already applicable, August 2026 enforcement, transparency dates and legacy-model transitions.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an applicability and enforcement calendar. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the transaction timetable relies on an outdated compliance calendar. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for map the enforcement timeline should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
Table 1. AI Act value-chain roles
| Role | Core diligence question | Deal consequence |
|---|---|---|
| provider | who places the system | full provider duties |
| deployer | who uses under authority | use and monitoring |
| importer | who brings to EU market | verification and contact |
| distributor | who makes available | supply-chain controls |
Illustrative controls require transaction-, product-, role-, jurisdiction-, firm- and period-specific approval.
Values are illustrative indices and require replacement with approved diligence and financial evidence.
9. Trace product and market exposure
Map EU establishment, placing on the market, putting into service, output use and affected persons.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a territorial exposure map. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when non-EU incorporation is treated as exclusion from territorial scope. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for trace product and market exposure should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
10. Review technical documentation
Test system descriptions, versions, architecture, capabilities, limitations, data, evaluation and change records.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a documentation completeness index. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the buyer cannot evidence the claims attached to acquired products. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for review technical documentation should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
11. Review downstream information
Assess whether providers supply usable limitations, instructions, integration and compliance information.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a downstream information pack. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when customers cannot discharge their own obligations using the target's documentation. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for review downstream information should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
12. Review training-content summaries
Test whether required public summaries are complete, governed and reproducible.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a training-content evidence file. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when training provenance cannot support the published compliance position. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for review training-content summaries should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
13. Review copyright policy and controls
Assess rights reservations, crawling controls, licences, datasets, exceptions, complaints and remediation.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a copyright compliance dossier. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when copyright exposure becomes an uncapped post-close cost. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for review copyright policy and controls should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
14. Review data governance
Test relevance, representativeness, provenance, quality, bias controls and lawful processing.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a data governance assessment. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when compliance evidence rests on untraceable or unsuitable data. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for review data governance should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
15. Review risk management
Assess lifecycle hazards, foreseeable misuse, testing, mitigations, residual risk and approval.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a product-specific risk file. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when risk registers describe generic AI concerns without product consequences. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for review risk management should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
16. Review evaluation evidence
Test accuracy, robustness, cybersecurity, subgroup performance, red teaming and real-world outcomes.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an independent evaluation report. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when benchmark claims cannot support the exact deployed configuration. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for review evaluation evidence should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
Table 2. Compliance evidence map
| Evidence | Diligence test | Value link |
|---|---|---|
| classification | role and risk tier | market access |
| technical file | versioned claims | remediation cost |
| evaluation | deployed performance | product risk |
| contracts | rights and duties | risk allocation |
Illustrative controls require transaction-, product-, role-, jurisdiction-, firm- and period-specific approval.
Values are illustrative indices and require replacement with approved diligence and financial evidence.
17. Review human oversight
Assess competence, authority, interfaces, escalation, override, workload and monitoring.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a human-oversight operating model. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when human review exists nominally and fails operationally. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for review human oversight should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
18. Review transparency duties
Test notices, AI-interaction disclosure, synthetic-content marking, deepfake disclosure and accessibility.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a transparency compliance matrix. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when customer-facing features lack the required transparency controls. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for review transparency duties should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
19. Review incident processes
Assess detection, classification, escalation, reporting, preservation, remediation and learning.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an incident-management readiness report. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when serious incidents lack a defensible regulatory response path. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for review incident processes should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
20. Review cybersecurity
Test model, data, infrastructure, supply-chain and access controls against applicable duties.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an AI cybersecurity dossier. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the acquired AI estate creates unpriced breach and enforcement exposure. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for review cybersecurity should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
21. Review quality management
Assess policies, design controls, testing, supplier controls, release authority, CAPA and records.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a quality-management assessment. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when compliance activity cannot be repeated as the product changes. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for review quality management should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
22. Review conformity routes
Identify standards, notified-body needs, technical file, declaration and marking requirements.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a conformity assessment roadmap. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the commercial plan omits time and evidence needed for market access. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for review conformity routes should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
23. Review registration and representation
Test database registration, authorised representative, importer and distributor arrangements.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a registration and representation schedule. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the operating model lacks an accountable EU interface. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for review registration and representation should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
24. Review contracts across the chain
Map warranties, information duties, audit rights, change notice, incident support and allocation of obligations.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an AI value-chain contract matrix. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when contracts place compliance duties on parties without evidence or control. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for review contracts across the chain should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
Table 3. Contract control matrix
| Clause | Control objective | Transaction use |
|---|---|---|
| information | downstream evidence | customer continuity |
| change | version notice | supplier control |
| incident | cooperation and timing | response readiness |
| exit | migration and records | dependency downside |
Illustrative controls require transaction-, product-, role-, jurisdiction-, firm- and period-specific approval.
Values are illustrative indices and require replacement with approved diligence and financial evidence.
25. Review third-party models
Test vendor versions, data flows, terms, limitations, evaluations, service levels and exit rights.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a model-supplier dependency dossier. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when a critical dependency can change or disappear outside buyer control. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for review third-party models should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
26. Review open-source components
Assess licence terms, exemptions, modifications, distribution, security and documentation.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an open-source compliance assessment. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the transaction assumes that open source removes all AI Act duties. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for review open-source components should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
27. Review AI literacy and operating capability
Assess role-based training, competent personnel, governance resources and specialist support.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a compliance capability model. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the target owns policies without people able to execute them. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for review ai literacy and operating capability should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
28. Test governance and accountability
Map board oversight, executive ownership, three lines, product decisions and evidence retention.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an AI governance RACI. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when decision rights are diffuse at the point of enforcement. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for test governance and accountability should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
29. Build the evidence-gap register
Score each missing item by obligation, product, market, severity, fixability, owner and timing.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a prioritised evidence-gap register. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when material gaps disappear inside narrative diligence reports. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for build the evidence-gap register should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
30. Cost documentation remediation
Estimate inventory, classification, technical-file, data, evaluation and contract work.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a documentation remediation budget. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the purchase price ignores the labour needed to reconstruct evidence. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for cost documentation remediation should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
31. Cost product remediation
Estimate engineering, model, data, interface, security, monitoring and withdrawal changes.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a product remediation model. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when compliance requires product changes that reduce roadmap capacity. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for cost product remediation should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
32. Cost market-access delay
Model delayed launch, restricted geography, customer approval and renewal consequences.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a market-access timing bridge. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the base case assumes uninterrupted European revenue. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for cost market-access delay should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
Table 4. Remediation-cost bridge
| Cost block | Primary driver | Model output |
|---|---|---|
| documentation | missing records | one-time cost |
| product | engineering change | roadmap and capex |
| market | approval timing | revenue delay |
| operations | testing and monitoring | recurring run rate |
Illustrative controls require transaction-, product-, role-, jurisdiction-, firm- and period-specific approval.
Values are illustrative indices and require replacement with approved diligence and financial evidence.
33. Cost operating compliance
Forecast testing, monitoring, incident, audit, representative, legal and quality-management run rate.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a recurring compliance cost model. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when compliance is modelled as a one-time project instead of an operating cost. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for cost operating compliance should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
34. Quantify revenue at risk
Segment revenue by product, obligation, customer, renewal, geography and remediation dependency.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a compliance-adjusted revenue bridge. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when headline EU revenue overstates the portion that is defensible. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for quantify revenue at risk should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
35. Stress gross margin and cash
Translate remediation, infrastructure, support, insurance and delay into margin and working capital.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a compliance cash-flow scenario. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when regulatory obligations remain outside the cash model. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for stress gross margin and cash should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
36. Adjust valuation
Reflect probability-weighted revenue, cost, timing, market access and terminal-value effects.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a risk-adjusted valuation waterfall. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when enterprise value assumes compliance evidence that does not exist. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for adjust valuation should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
37. Design transaction protections
Consider conditions precedent, covenants, warranties, indemnities, holdbacks, escrows and price mechanisms with counsel.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an AI compliance protection schedule. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when identified gaps have no allocation or closing consequence. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
AI Act diligence should connect legal role, technical evidence, product operations, customer contracts and the deal model at the same version and valuation date.
The decision pack for design transaction protections should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
38. Build the post-close plan
Sequence first 30, 60, 100 and 365-day actions by product and obligation.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a funded post-close remediation plan. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when integration consumes the teams needed for urgent compliance work. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Enterprise-value analysis should distinguish evidenced compliance, remediable gaps, restricted revenue, recurring operating cost and residual enforcement exposure.
The decision pack for build the post-close plan should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
39. Set monitoring and reporting
Define board metrics, exception triggers, incidents, regulatory change, customer issues and remediation closure.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is a post-close AI compliance dashboard. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when the buyer loses visibility after closing. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Reviewers need product-specific evidence, current applicability dates, accountable owners and a direct path from each gap to cash, timing, protection or valuation.
The decision pack for set monitoring and reporting should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
40. Close through evidence gates
Require role classification, material obligations, costed gaps, transaction allocation and accountable execution.
The controlled record includes entity; product; role; use; market; model version; obligation; evidence; owner; decision. The immediate deliverable is an accountable investment decision. Preserve the transaction perimeter, jurisdiction, effective date, system and model version, intended use, value-chain role, evidence source, reviewer, approval and unresolved exceptions.
The principal failure occurs when commercial urgency overrides unresolved enterprise-value exposure. Reviewers should reproduce the evidence, test the exact product and role, reconcile legal, technical and financial units and identify who may approve, remediate, restrict, reprice or withhold the transaction recommendation.
Transaction sequencing can tie signing, closing, consideration and post-close capital to measurable compliance evidence and market-access milestones.
The decision pack for close through evidence gates should show the prior claim, applicable requirement, tested evidence, gap, remediation, cash and value consequence, alternative response, owner, due date, transaction protection and observed outcome. Material exceptions flow into purchase price, closing conditions, reserves, covenants and post-close governance.
Table 5. Deal close gates
| Gate | Required evidence | Deal response |
|---|---|---|
| scope | systems and roles | perimeter confirmed |
| risk | obligations and gaps | exposure priced |
| remediation | cost and owners | capital reserved |
| allocation | protections and plan | decision signed |
Illustrative controls require transaction-, product-, role-, jurisdiction-, firm- and period-specific approval.
Values are illustrative indices and require replacement with approved diligence and financial evidence.
References
- European Union, Consolidated Regulation 2024/1689 Artificial Intelligence Act, https://eur-lex.europa.eu/eli/reg/2024/1689
- European Commission, AI Act Regulatory Framework, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- European Commission, Enforcement Framework of the AI Act, https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
- European Commission, Commission Starts Enforcing AI Act Rules on 2 August 2026, https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august
- European Commission, General-Purpose AI Obligations under the AI Act, https://digital-strategy.ec.europa.eu/en/factpages/general-purpose-ai-obligations-under-ai-act
- European Commission, Guidelines for Providers of General-Purpose AI Models, https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
- European Commission, General-Purpose AI Code of Practice, https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
- European Commission, Guidelines for Providers and Deployers of High-Risk AI Systems, https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-high-risk-systems
- European Commission, Draft Guidelines on Classification of High-Risk AI Systems, https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
- European Commission, Guidelines on Prohibited AI Practices, https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
- European Commission, AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/
- European Commission, AI Act Questions and Answers for General-Purpose AI Models, https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers
- European Commission, Template for Public Summary of Training Content, https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models
- European Commission, Guidelines on the Definition of an AI System, https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-first-ai-acts-rules-application
- European Commission, AI Literacy Questions and Answers, https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
- European Commission, Standardisation Request in Support of Safe and Trustworthy AI, https://single-market-economy.ec.europa.eu/single-market/european-standards/standardisation-requests_en
- European Union Agency for Cybersecurity, Cybersecurity of AI and Standardisation, https://www.enisa.europa.eu/publications/cybersecurity-of-ai-and-standardisation
- European Data Protection Board, Opinion 28/2024 on AI Models, https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
- European Commission, Product Liability Directive, https://eur-lex.europa.eu/eli/dir/2024/2853/oj
- European Commission, Data Act, https://digital-strategy.ec.europa.eu/en/policies/data-act
- International Organization for Standardization, ISO IEC 42001 AI Management Systems, https://www.iso.org/standard/81230.html
- International Organization for Standardization, ISO IEC 23894 AI Risk Management, https://www.iso.org/standard/77304.html
- International Organization for Standardization, ISO IEC 25059 Quality Model for AI Systems, https://www.iso.org/standard/80655.html
- National Institute of Standards and Technology, AI Risk Management Framework, https://www.nist.gov/itl/ai-risk-management-framework
- Organisation for Economic Co-operation and Development, OECD AI Principles, https://oecd.ai/en/ai-principles
- World Intellectual Property Organization, Generative AI Navigating Intellectual Property, https://www.wipo.int/about-ip/en/frontier_technologies/news/2024/generative-ai-navigating-intellectual-property.html
