1. Define the transaction question
Determine whether data and AI capabilities create transferable cash-flow advantage and can survive legal, technical and commercial diligence.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a data-and-AI underwriting thesis.
The principal failure occurs when a model demo or dataset count is treated as proof of a durable moat. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for define the transaction question should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
2. Set the asset perimeter
Reconcile products, datasets, models, weights, code, prompts, evaluation assets, documentation and operating know-how to legal entities.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an asset perimeter schedule.
The principal failure occurs when valuable assets sit outside the seller or are described inconsistently across teams. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for set the asset perimeter should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
3. Map the operating architecture
Trace how source data, pipelines, feature stores, training, inference, applications and customer workflows connect.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an end-to-end architecture map.
The principal failure occurs when diligence examines isolated components without understanding the production system. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for map the operating architecture should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
4. Build the data inventory
Catalogue each dataset by source, owner, contents, scale, geography, sensitivity, refresh rate, licence and business use.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a decision-grade data register.
The principal failure occurs when large volumes are presented without relevance, quality or rights evidence. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for build the data inventory should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
5. Establish lineage
Link records and transformations from collection through preparation, training, evaluation and production use.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a data-lineage graph.
The principal failure occurs when the seller cannot reproduce how a material output was created. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for establish lineage should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
6. Prove provenance
Retain source manifests, acquisition terms, timestamps, checksums, transformations and accountable owners.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a provenance evidence pack.
The principal failure occurs when origin assertions rely on memory or unsupported labels. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for prove provenance should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
7. Test collection authority
Identify the contractual, statutory or other authorised basis for acquiring and retaining each material dataset.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a collection-rights matrix.
The principal failure occurs when access is mistaken for ownership or unrestricted reuse. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for test collection authority should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
8. Test consent and notice
Reconcile notices, consent records, withdrawal handling and downstream uses where personal data is involved.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a consent-to-use bridge.
The principal failure occurs when historic consent is assumed to cover model training and new commercial purposes. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for test consent and notice should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
Table 1. Rights and consent screen
| Question | Evidence | Decision |
|---|---|---|
| collection | source terms | authorised |
| training | purpose and consent | permitted |
| sharing | customer and vendor terms | bounded |
| withdrawal | propagation test | operable |
Illustrative analytical design; company-specific evidence and professional advice govern.
Values are illustrative evidence indices and require company-specific support.
9. Control purpose changes
Compare original collection purposes with training, enrichment, inference, sharing and monetisation uses.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a purpose-compatibility review.
The principal failure occurs when a commercially attractive secondary use exceeds the documented purpose boundary. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for control purpose changes should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
10. Review customer contracts
Extract rights over customer inputs, outputs, derived data, telemetry, improvements, confidentiality and model training.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a contract-to-system rights map.
The principal failure occurs when product terms promise restrictions that engineering practice does not follow. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for review customer contracts should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
11. Review supplier and platform terms
Assess cloud, model, data, API, labelling and tooling agreements for licence scope, portability, audit and termination.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a dependency rights schedule.
The principal failure occurs when a critical capability depends on revocable or non-transferable third-party terms. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for review supplier and platform terms should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
12. Classify public and open data
Verify licences, attribution, access conditions, robots controls, database rights and permitted commercial use.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an open-data compliance file.
The principal failure occurs when public availability is treated as unrestricted ownership. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for classify public and open data should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
13. Govern synthetic data
Document generation method, seed sources, privacy tests, quality controls and permitted uses.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a synthetic-data assurance pack.
The principal failure occurs when synthetic labels obscure inherited rights, bias or memorisation risk. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for govern synthetic data should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
14. Protect personal and sensitive data
Identify personal, special-category, biometric, confidential and regulated data with minimisation and access controls.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a sensitive-data control map.
The principal failure occurs when sensitive content is embedded in training or logs without an owned control path. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for protect personal and sensitive data should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
15. Map cross-border flows
Locate collection, storage, processing, training, support and access across jurisdictions and vendors.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a cross-border processing map.
The principal failure occurs when transfer exposure is discovered after signing when remediation affects operations. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for map cross-border flows should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
16. Test retention and deletion
Connect policy, contract, consent withdrawal, legal hold, backups and model-removal procedures.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a deletion-propagation test.
The principal failure occurs when records are deleted from applications while remaining in replicas, features or training corpora. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for test retention and deletion should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
Table 2. Data control chain
| Layer | Control | Proof |
|---|---|---|
| source | manifest | origin |
| pipeline | lineage | transformation |
| storage | access and retention | custody |
| deletion | propagation | closure |
Illustrative analytical design; company-specific evidence and professional advice govern.
Values are illustrative evidence indices and require company-specific support.
17. Create the model inventory
Register every production and material development model, version, owner, purpose, data, dependency and deployment.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a model estate register.
The principal failure occurs when the buyer cannot distinguish proprietary models from wrappers or experiments. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for create the model inventory should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
18. Make training reproducible
Preserve code commit, environment, data snapshot, parameters, seeds, compute configuration and run artefacts.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a reproducibility certificate.
The principal failure occurs when reported performance cannot be recreated after staff or infrastructure changes. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for make training reproducible should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
19. Control model versions
Link approvals, releases, rollbacks, changes, incidents and customer commitments to each deployed version.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a model-version ledger.
The principal failure occurs when commercial claims refer to a different model than the one customers use. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for control model versions should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
20. Validate evaluation design
Align benchmarks, holdouts, contamination controls, human review and thresholds with intended use.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an evaluation protocol.
The principal failure occurs when headline accuracy is produced by a benchmark that leaks training data or misses operating conditions. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for validate evaluation design should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
21. Test performance persistence
Measure drift, failure modes, subgroup outcomes, calibration, latency and economics over time.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a performance persistence series.
The principal failure occurs when a one-off result is capitalised as durable future advantage. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for test performance persistence should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
22. Measure human dependency
Identify tacit judgement, labelling, prompt design, exception handling, review and founder knowledge behind outputs.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a human-in-the-loop dependency map.
The principal failure occurs when automation claims conceal labour intensity or key-person risk. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for measure human dependency should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
23. Measure compute dependency
Reconcile hardware, cloud, capacity reservations, unit costs, portability and optimisation paths.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a compute resilience model.
The principal failure occurs when model economics depend on temporary credits or unavailable capacity. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for measure compute dependency should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
24. Audit open-source components
Inventory software, models, weights and datasets with licence duties, notices, copyleft triggers and security status.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an open-source bill of materials.
The principal failure occurs when a permissive label is applied without component-level evidence. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for audit open-source components should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
Table 3. Technology dependencies
| Asset | Dependency | Stress |
|---|---|---|
| model | third-party weights | portability |
| compute | capacity and price | unit economics |
| software | licence and security | continuity |
| people | tacit knowledge | transfer |
Illustrative analytical design; company-specific evidence and professional advice govern.
Values are illustrative evidence indices and require company-specific support.
25. Prove IP ownership
Trace employee, founder, contractor, university, customer and partner contributions to executed assignments and licences.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an IP chain-of-title file.
The principal failure occurs when the seller paid for development but never acquired the relevant rights. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for prove ip ownership should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
26. Protect trade secrets
Evidence access restriction, confidentiality, repositories, logging, offboarding and incident response for secret assets.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a trade-secret protection record.
The principal failure occurs when valuable know-how is described as proprietary without reasonable secrecy controls. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for protect trade secrets should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
27. Assess patents and freedom to operate
Map inventions, filings, ownership, jurisdictions, claims, prior art and external counsel analysis.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a patent relevance map.
The principal failure occurs when patent counts substitute for relevance, enforceability or operating freedom. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for assess patents and freedom to operate should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
28. Assess copyright and outputs
Document human contribution, training inputs, output controls, licences and customer allocation across jurisdictions.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an output-rights analysis.
The principal failure occurs when ownership language promises rights the system may not reliably create or transfer. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for assess copyright and outputs should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
29. Secure the AI estate
Test identity, access, secrets, repositories, supply chain, endpoints, model extraction, poisoning and incident readiness.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an AI security control matrix.
The principal failure occurs when cyber controls stop at the application boundary and omit data and model assets. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for secure the ai estate should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
30. Map regulatory classification
Assess roles, jurisdictions, use cases, risk classifications, documentation and post-market obligations.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a regulatory applicability register.
The principal failure occurs when the company applies one global compliance label to different products and deployments. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for map regulatory classification should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
31. Prove customer value
Connect adoption and model outputs to measurable revenue, cost, risk, speed or quality outcomes.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a customer value evidence pack.
The principal failure occurs when innovation claims are supported by pilots without realised customer economics. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for prove customer value should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
32. Attribute revenue and margin
Reconcile contracts, usage, retention, pricing, compute, data and human-review costs to AI-enabled products.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is an AI contribution bridge.
The principal failure occurs when AI revenue is claimed broadly while incremental economics remain unknown. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for attribute revenue and margin should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
Table 4. Commercial-value bridge
| Claim | Measure | Evidence |
|---|---|---|
| adoption | active workflow | usage |
| revenue | contracted value | reconciliation |
| margin | fully loaded cost | contribution |
| retention | cohort behaviour | durability |
Illustrative analytical design; company-specific evidence and professional advice govern.
Values are illustrative evidence indices and require company-specific support.
33. Measure defensibility
Test uniqueness, rights, quality, feedback loops, integration, switching cost, replication time and required capital.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a moat defensibility scorecard.
The principal failure occurs when scarcity is inferred from secrecy without assessing credible alternatives. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for measure defensibility should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
34. Model replication cost
Estimate lawful data acquisition, labelling, engineering, compute, validation, integration and time required for a capable entrant.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a replication-cost model.
The principal failure occurs when historic development spend is treated as replacement value. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for model replication cost should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
35. Value the asset stack
Triangulate income, relief-from-royalty, with-and-without, replacement-cost and market evidence with scenario risk.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a data-and-AI valuation range.
The principal failure occurs when one multiple is applied to data, models and software despite different rights and cash-flow roles. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for value the asset stack should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
36. Build the diligence data room
Index rights, lineage, contracts, inventories, code, runs, evaluations, controls, economics and incidents to specific claims.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a claim-to-evidence diligence index.
The principal failure occurs when volume of documents substitutes for traceable evidence. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for build the diligence data room should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
37. Translate gaps into deal terms
Allocate remediable and residual risks through conditions, covenants, indemnities, escrow, earnout and operational plans.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a data-and-AI term map.
The principal failure occurs when broad warranty language replaces precise risk ownership. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for translate gaps into deal terms should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
38. Run the first thirty days
Reconcile the asset perimeter, urgent rights gaps, critical dependencies, production models and customer claims.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a thirty-day evidence baseline.
The principal failure occurs when the programme starts with valuation before establishing what is owned. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for run the first thirty days should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
39. Run days thirty-one to ninety
Complete priority assignments, lineage, reproducibility, evaluation, security, contract and economic evidence.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a ninety-day moat proof sprint.
The principal failure occurs when remediation activity is measured without testing whether claims became underwritable. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for run days thirty-one to ninety should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
40. Close through evidence gates
Require owned rights, traceable provenance, reproducible models, controlled dependencies, durable performance and evidenced customer economics.
The controlled record should identify the relevant customer, revenue stream, contract, cohort, relationship owner, commercial dependency, evidence source, baseline, trend, scenario, control, exception, accountable executive, deadline and approval. The immediate deliverable is a data-and-AI close certificate.
The principal failure occurs when transaction readiness is declared from technical enthusiasm rather than a reproducible chain of proof. Reviewers should connect the evidence to revenue durability, gross margin, cash conversion, renewal probability, switching behaviour, counterparty credit and transaction value; distinguish contractual protection from observed customer behaviour; and test whether the conclusion survives a downside scenario.
The decision pack for close through evidence gates should state the commercial question, measurement perimeter, historical evidence, customer-specific facts, forecast logic, sensitivity, management action, buyer implication, residual uncertainty and next gate. Material exceptions should flow into the valuation model, quality-of-earnings work, diligence room, sale-process narrative, transaction protections and board reporting.
Table 5. Transaction evidence gates
| Gate | Required proof | Outcome |
|---|---|---|
| rights | chain of title and licences | owned |
| reproducibility | recreated run | repeatable |
| performance | longitudinal tests | durable |
| value | customer cash-flow link | underwritable |
Illustrative analytical design; company-specific evidence and professional advice govern.
Values are illustrative evidence indices and require company-specific support.
References
- European Union, Regulation (EU) 2024/1689 Artificial Intelligence Act, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- European Union, Regulation (EU) 2016/679 General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
- European Union, Regulation (EU) 2023/2854 Data Act, https://eur-lex.europa.eu/eli/reg/2023/2854/oj
- European Union, Regulation (EU) 2022/868 Data Governance Act, https://eur-lex.europa.eu/eli/reg/2022/868/oj
- European Commission, General-Purpose AI Code of Practice, https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
- European Data Protection Board, Guidelines and recommendations, https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en
- UK Information Commissioner's Office, Guidance on AI and data protection, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- UK Information Commissioner's Office, Explaining decisions made with AI, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/explaining-decisions-made-with-artificial-intelligence/
- National Institute of Standards and Technology, AI Risk Management Framework 1.0, https://doi.org/10.6028/NIST.AI.100-1
- National Institute of Standards and Technology, Generative AI Profile, https://doi.org/10.6028/NIST.AI.600-1
- National Institute of Standards and Technology, Privacy Framework, https://www.nist.gov/privacy-framework
- National Institute of Standards and Technology, Cybersecurity Framework 2.0, https://www.nist.gov/cyberframework
- World Intellectual Property Organization, Artificial Intelligence and Intellectual Property, https://www.wipo.int/en/web/frontier-technologies/artificial-intelligence/index
- World Intellectual Property Organization, Learning Machines: AI and IP for SMEs, https://www.wipo.int/web-publications/learning-machines-an-introduction-to-ai-and-ip-for-small-and-medium-sized-enterprises/en/index.html
- United States Copyright Office, Copyright and Artificial Intelligence, https://www.copyright.gov/ai/
- United States Patent and Trademark Office, Artificial Intelligence resources, https://www.uspto.gov/initiatives/artificial-intelligence
- Federal Trade Commission, AI companies: uphold privacy and confidentiality commitments, https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/01/ai-companies-uphold-your-privacy-confidentiality-commitments
- Organisation for Economic Co-operation and Development, OECD AI Principles, https://oecd.ai/en/ai-principles
- International Organization for Standardization, ISO/IEC 42001 AI management systems, https://www.iso.org/standard/81230.html
- International Organization for Standardization, ISO/IEC 23894 AI risk management, https://www.iso.org/standard/77304.html
- IFRS Foundation, IFRS 3 Business Combinations, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-3-business-combinations/
- IFRS Foundation, IFRS 13 Fair Value Measurement, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-13-fair-value-measurement/
- IFRS Foundation, IAS 38 Intangible Assets, https://www.ifrs.org/issued-standards/list-of-standards/ias-38-intangible-assets/
- International Valuation Standards Council, International Valuation Standards, https://www.ivsc.org/standards/
- European Union Agency for Cybersecurity, Securing machine learning algorithms, https://www.enisa.europa.eu/publications/securing-machine-learning-algorithms
- Cloud Security Alliance, AI Controls Matrix, https://cloudsecurityalliance.org/artifacts/ai-controls-matrix
