Verifying Counterparty AI Readiness in M&A Targets

A practical due diligence checklist for investigators assessing whether AI and generative AI practices in a target create secure value or invite fraud and operational exposure.

What the Report Shows

The World Economic Forum Global Cybersecurity Outlook 2025 highlights AI and generative AI as the single most significant near-term influence on cybersecurity: 66% of surveyed organisations expect AI to have the greatest impact on cyber risk over the next 12 months. At the same time, only 37% report having a process to assess AI tool security before deployment. The report also flags that generative AI is enabling more scalable adversarial tactics, increasing phishing, social engineering and deepfake threats, while supply-chain and third-party risk remains a core barrier to resilience. These findings are drawn from the GCO survey, interviews and workshops conducted in late 2024 and synthesised in the Forum publication. The report cautions that results are self-reported and based on a qualified sample, so figures reflect that cohort and should be interpreted accordingly.

AI due diligence and cyber risk assessment in Swiss Detective Agency.

What This Means for Due Diligence

For M&A and strategic investment decisions, the gap between perceived impact and formal assessment processes is material. A counterparty that embraces AI without documented security screening is more likely to introduce adversarial risk into your ecosystem. That risk can surface as more convincing phishing campaigns, easier impersonation of executives, automated fraud vectors, and hidden vulnerabilities propagated through suppliers and third parties. Investigators should treat the absence of AI security processes as a conditional risk factor, one that increases the importance of corroborating evidence, control testing and specialist review. The investigator’s role is to collect, verify and document the relevant artefacts, to identify inconsistencies and red flags, and to escalate technical questions to qualified cyber specialists where deeper validation is required.

Investigative Checks to Consider

1. Governance and policy evidence

Request and review policies, board minutes or risk registers that reference AI adoption, model governance, vendor selection and data usage. Absence of documented policy does not prove negligence, but it is a notable gap given the report’s finding that only 37% have pre-deployment AI security processes.

2. Inventory of AI tools and suppliers

Obtain a list of AI/GenAI tools in use, including internal models and third-party services, and the contracts that govern them. Check whether third-party suppliers are mapped to critical processes, and whether the organisation maintains visibility beyond direct suppliers, given the report’s emphasis on supply-chain exposure.

3. Security assessment artefacts

Ask for records of security assessments, threat modelling, penetration test summaries, or third-party audit reports specifically related to AI tools. If none exist, document this absence and consider it a trigger to recommend specialist technical review.

4. Data provenance and handling

Verify documentation on training and inference data sources, anonymisation practices, access controls and retention policies. Poor data controls amplify risk of model inversion, data leakage and compliance exposure.

5. Incident and response history

Review incident logs, phishing and social engineering incident records, and any investigations tied to AI misuse or deepfake-related events. The report notes rising phishing and social-engineering incidents; patterns of repeated incidents warrant deeper scrutiny.

6. Talent and competency evidence

Collect organisational charts, job descriptions, and hiring plans for roles tied to AI governance and security. The Forum finds a widening cyber skills gap, and the presence or absence of qualified personnel is a relevant indicator of the target’s ability to manage emerging AI risks.

7. Regulatory and compliance mapping

Request evidence of regulatory impact assessments, cross-border data flow reviews, and compliance checks tied to AI-related laws or sectoral rules. Regulatory fragmentation is a reported friction point and complicates risk exposure, especially for multinational deals.

8. Change control and deployment processes

Inspect release notes, change logs, and approval records for model updates or AI-enabled features, to establish whether there is an auditable, controlled deployment process.

9. Red-team or adversarial testing records

If adversarial testing has been performed by third parties, request summaries and remediation records. If such testing is absent, document this gap as an actionable finding for decision-makers, and recommend escalation to a specialist testing provider.

10. Business continuity and third-party concentration

Assess dependency concentration on a small number of AI suppliers, and whether contingency plans exist for supplier compromise or major service disruption. The Forum emphasises supply-chain fragility as a systemic concern.

Red Flags to Watch

// No documented process to assess AI tool security prior to deployment, particularly when AI is used in customer-facing or automated decision workflows.

// AI vendors or models that lack transparency on data provenance, licensing or security controls.

// Repeated or unmitigated social-engineering incidents that coincide with new AI deployments.

// Heavy reliance on a single third-party AI provider without contractual security SLAs or incident notification clauses.

// Governance documents that exist nominally but lack evidence of application, such as unsigned policies, or policies with no supporting change or training records.

When Specialist Review Is Needed

Investigators should escalate to qualified cyber and AI specialists whenever technical validation is required. Examples include verifying model behaviour under adversarial inputs, assessing vulnerability in model-serving infrastructure, or performing controlled adversarial testing. The investigator’s role is to assemble the evidence, identify what needs technical validation, coordinate access for specialists and document findings and limitations for decision-makers. Do not represent that the investigator performs specialist testing unless that capability is explicitly part of the engagement.

Practical Options for Decision-Makers

The following are practical options organisations may consider based on investigative findings:

Require the target to obtain an independent AI security assessment before closing.

Negotiate contractual representations and warranties specific to AI governance, data provenance and third-party supplier resilience.

Condition payment on remediation milestones addressing critical gaps, such as instituting documented AI screening processes or implementing supplier risk controls.

Commission a targeted adversarial test from a qualified provider if absence of testing is a critical unresolved risk.

These are possible responses to findings, not claims derived from the Forum report. The investigator documents the need, scope and evidence to support any of these options.

Documenting Findings for Legal and Board Review

When preparing a due diligence report, clearly separate observed artefacts, factual gaps and recommended next steps. Note the source of each assertion, whether it is documentary evidence, an interview, or the Forum’s survey findings. Highlight limitations, for example where evidence was not available for review or where technical questions remain for a specialist.

Conclusion

AI is reshaping the cyber risk landscape, and the World Economic Forum’s Global Cybersecurity Outlook 2025 underscores both the impact and the preparedness gap. For M&A investigators, the priority is to collect verifiable evidence that a target has formal AI security processes, or to flag gaps that translate into adversarial exposure. Where technical validation is required, coordinate specialist review and present a clear, documented path for decision-makers.

If you are preparing for a transaction and need a discrete, evidence-led AI due diligence review, **contact our team** to discuss how we gather, verify and present the right artefacts and escalations for your deal timeline.

#Switzerland #PrivateInvestigator #PrivateDetective #PrivateDetectiveAgency #Zurich #AIDueDiligence #MergersAndAcquisitions #CyberRisk #DueDiligence