TECHNICAL DUE DILIGENCE
Technology & AI Technical Due Diligence
An independent view of the technology, the team and the AI claims behind an investment, acquisition or major vendor decision, written for the people who have to decide.
What is technical due diligence?
Technical due diligence is an independent assessment of a company’s technology, engineering organisation and technical risks, carried out to inform an investment, acquisition or major commercial decision. It tests whether the technology can support the business plan, what it will cost to get there, and whether claims about the product, including AI capabilities, stand up to evidence.
THE PROBLEM
The valuation depends on things the deck cannot show
Technology risk is rarely visible in financials. A platform held together by one engineer, a codebase that cannot scale, an AI feature that is a thin wrapper over a third-party model, or licensing issues in dependencies can all change the value of a deal.
AI claims make this harder. Distinguishing proprietary capability from integration, and demonstrated performance from a demo, needs someone who builds these systems.
WHO IT IS FOR
This is a good fit if you are
- Investors and venture funds
- Private equity firms
- Acquirers and corporate development teams
- Boards
- Founders preparing for a raise or exit
- Companies evaluating technology vendors
It is probably not the right fit if
- You need a detailed code audit or penetration test on its own. Those are specialist services; I can advise on scoping them as part of diligence.
TYPICAL TRIGGERS
When organisations usually ask for this
- A term sheet or letter of intent
- An acquisition or merger
- A significant vendor or platform contract
- A founder preparing for investor diligence
- A board needing an independent view of the technology strategy
SCOPE
What the diligence evaluates
- Application architecture
- Codebase health
- Technical debt
- Infrastructure
- Security
- Scalability
- Engineering team
- Development process
- Data architecture
- AI architecture
- AI claims
- Third-party dependencies
- IP considerations
- Delivery capability
- Roadmap feasibility
DELIVERABLES
What you receive
- An executive risk summary
- Critical findings
- Material technology risks
- An engineering assessment
- An AI assessment
- An architecture assessment
- Technical debt observations
- Investment requirements
- Priority actions
ENGAGEMENT
How diligence works
01 →
Scope
Agree the questions the diligence must answer, the timeline and the access available.
02 →
Review
Documentation, architecture, code sampling, infrastructure, security posture and dependencies.
03 →
Interview
Sessions with technical leadership and key engineers to test understanding and depth.
04 →
Verify AI claims
Test what the AI actually does, what is proprietary and what depends on third parties.
05
Report
An executive risk summary with findings rated by materiality to the decision.
DECISION CRITERIA
How AI claims are tested
- What does the AI do in the product today, demonstrated rather than described?
- Which parts are proprietary, and which depend on third-party models or APIs, with what contractual and cost exposure?
- What data does it depend on, and does the company have the rights to use it?
- How is quality measured, and what happens when the model is wrong?
EXPERIENCE
What informs this work
I am Chief Technology & AI Officer at Webskitters, which I co-founded in 2010. My day-to-day work is technology and AI strategy, architecture and engineering leadership, so the judgement offered here is formed by operating responsibility rather than observation.
The frameworks on this page are published openly on The Practical CTO, so you can judge the thinking before we speak. Where a decision leads to implementation, Webskitters can deliver it, but the advice stays independent of who builds.
CONFIDENTIALITY
Information you submit is treated as confidential and handled in line with the privacy policy. If your process requires a non-disclosure agreement before detail is shared, mention it in the form.
QUESTIONS
Frequently asked questions
Who do you work with in technical due diligence?
Investors, private equity firms, acquirers, boards and founders. Founders sometimes commission diligence on themselves before a raise, to find and fix issues before investors do.
How do you assess a target’s AI claims?
By separating demonstration from description: what the AI does in the product today, what is proprietary, what depends on third-party models, what data it relies on and how its quality is measured. The criteria are listed above.
Do you need access to source code?
Code sampling is valuable and usually expected. Where access is limited, the report states what could and could not be verified, so the confidence of each finding is clear.
How is confidentiality handled?
Submitted information is treated as confidential under the privacy policy. If an NDA is required before detailed information is shared, mention it in the form and it can be agreed before the review begins.
ENQUIRY
Discuss technical due diligence
Outline the decision, the target or vendor in general terms, and your timeline. Please do not include confidential details at this stage.
Information you submit is treated as confidential and handled in line with the privacy policy. If your process requires a non-disclosure agreement before detail is shared, mention it in the form.
Enquiry received
Messages come directly to me. Your details are used only to respond to this enquiry and are handled in line with the privacy policy. The form also records the page you sent it from and any campaign tags, so I know how you found the site.
ABOUT AYAN
Ayan Sarkar
Chief Technology & AI Officer at Webskitters, which he co-founded in 2010, and author of The Practical CTO on enterprise AI, technology architecture and technology leadership.
About Ayan · Articles by Ayan · Speaking · Ask Ayan · LinkedIn ↗
NEXT STEP
Start with the decision
in front of you.
A short description of the situation is enough to begin. If you are not sure which service fits, the contact page works too.