Strangers at the Gate: AI Diligence and Who Survives

A lawyer I count as a friend published an article in December about how buyers and their counsel should examine a company's AI. I printed it and read it with a pen in hand, which is what I do when I expect to argue with something.

I did not argue much. Danny Tobey, Sean Fulton, and Coran Darling set out, area by area, what a buyer now looks for in a target's AI, and the work is thorough enough that it is already in use. What kept striking me, page after page, was that almost nothing on their list is really a question about AI. Ownership of training data, validation records, drift monitoring, vendor terms, who approves what before it reaches production. Every one of those is either something a well-run program produces in the ordinary course of its work, or it is evidence that no such program exists. Counsel is not asking about the technology. They are asking how the institution runs.

That is the argument of the paper the Center publishes today, and it is written for the other side of the table from where Danny sits. I am not a lawyer. What I know is what it takes to build the thing counsel is trying to verify.

Two consequences are worth naming here. The first is that thin AI use is not a reason for a lighter look. Maturity cannot precede use, because operational discipline develops only through deployment and the demands deployment makes on data, governance, and operations. An organization with nothing meaningful running in 2026 has not avoided risk. It has failed to act, and that has a price of its own.

The second is that almost none of this requires a transaction. Enterprise customers send AI questionnaires with major procurements, and the questions are counsel's questions on different letterhead. Insurance carriers ask what models you run and under what controls, and what you attest at renewal binds you when you claim. Regulators inquire. So do auditors, inspectors general, legislative committees, and, in open societies, citizens with a records request. No one in that list needs a letter of intent to open a file.

Which leaves the uncomfortable part. The dimensions that weigh most in any of these encounters are the slowest to move: data governance, operational discipline, the fluency of the workforce. None of them can be built in the weeks between a letter of intent and an open data room, and not all of them in eighteen months. The city is built in peacetime.

So the paper ends where I would want any leader to start. The organizations that fare best in diligence are not the ones that prepared for it. They are the ones that never needed to.

With hope that it finds you in peacetime,

Andrew Welch
Executive Director
The Center for Trustworthy AI