AI Due Diligence for M&A in Saudi Arabia

AI due diligence in an acquisition asks what the buyer is actually acquiring, what the target can lawfully and practically continue to use, and whether the claimed economics survive scrutiny. An impressive demonstration may depend on third-party models, customer-specific permissions, manual review or a founder's personal accounts. Those dependencies can materially change the investment proposition.

For a Saudi acquirer, corporate development team or family office, the review should connect technical findings with the transaction questions handled by financial, legal and commercial advisers. This guide proposes an evidence framework; it does not determine legal rights, transaction approvals or the value of a particular company. Those conclusions require the relevant advisers and the actual transaction documents.

Separate the target's AI claims into testable propositions

Start with the investment thesis. Is the buyer paying for proprietary technology, a productive operating capability, unique authorised data, a trained team, customer distribution or future potential? Different claims require different evidence. A useful application built on licensed components can still be valuable, but the buyer should understand which parts are owned, licensed, replaceable or dependent on individual people.

Ask management to name each material AI-enabled product or internal workflow, its customers or users, revenue or operational contribution, and the consequence of losing it. Reconcile this inventory with sales materials, contracts, system access and actual usage. The objective is not to reward the largest model catalogue; it is to identify the capabilities on which the deal rationale depends.

A transaction-focused evidence request

AI diligence questions that connect an asset claim to transaction evidence

Area	Evidence to request	Decision it informs
Ownership and contribution	Repositories, development history and relevant employee or contractor agreements	Which claimed assets and rights need legal verification?
Models and software dependencies	Component inventory, versions, licences, accounts and supplier contracts	Can the capability continue under the proposed ownership and use?
Data rights and provenance	Source inventory, permissions, purposes, restrictions and retention arrangements	What can be used, disclosed, transferred or combined?
Customer obligations	Relevant contract terms, commitments and representations about AI use	Do commercial promises match delivered behaviour and permitted processing?
Performance	Representative evaluations, failure cases and production outcome records	Does the capability support the investment thesis in its intended context?
Human operating effort	Review queues, staffing, escalation and exception handling	Are the economics genuinely scalable at the assumed quality?
Security and authority	Access model, action permissions, incidents and control evidence	What exposure and remediation effort accompany the capability?
Continuity	Named operators, recovery arrangements, account ownership and exit plans	Can operations survive closing, staff departures and supplier changes?

Request evidence proportionate to materiality. A low-impact internal writing assistant does not require the same review as an AI feature responsible for a major customer promise. Mark each claim as verified, supported with limits, contradicted or unresolved. A management representation is useful evidence of what is being asserted, but it is not equivalent to independent verification of the underlying fact.

Examine rights before moving data into the deal room

Due diligence itself can expose confidential or personal information. Identify what the buyer needs to learn, then use summaries, redacted examples, controlled access or other proportionate arrangements where appropriate. Have the responsible privacy and legal teams assess the disclosure basis, restrictions, recipients and any cross-border arrangements before sharing identifiable records.

SDAIA's Personal Data Disclosure Cases Guideline explains relevant disclosure conditions and points to the law and implementing regulations as the governing references; the guideline is not itself a binding legal document. Treat a confidentiality agreement as one control, not as a substitute for determining whether the proposed disclosure is permitted.

Distinguish diligence access from post-acquisition use. Permission to inspect a sample does not by itself answer whether the acquired business can train on it, combine it with another entity's information or use it for a new purpose. Ask counsel to assess the actual agreements and applicable requirements. Avoid a blanket assumption that buying shares or assets automatically settles every data and licence question.

Test the capability behind the demonstration

Ask for a controlled walkthrough using representative cases selected with the diligence team, including failures and exceptions. Record the environment, versions, permitted actions and human interventions. Establish which parts are automated and which are performed by staff before or after the visible interface. A polished demonstration may accurately show one path while leaving the difficult operating work outside the screen.

Inspect whether performance evidence matches the target's customer claims. If the product is sold for Arabic workflows, English-only test results do not resolve that claim. If it recommends actions but the sales narrative implies automatic execution, clarify the distinction. The assurance guide helps define the claim and limits; the vendor due diligence guide covers evidence from external dependencies.

Normalise the economics of human and supplier dependence

Consider a hypothetical software target reporting SAR 2,400,000 annual revenue from an AI-assisted service and SAR 600,000 direct service cost. Its reported contribution on that simple basis is SAR 1,800,000, or 75% of revenue. Diligence finds SAR 360,000 of necessary review labour omitted from that presentation and SAR 120,000 of additional annual supplier cost needed for the intended commercial arrangement.

Under these illustrative assumptions, comparable service cost is 600,000 + 360,000 + 120,000 = SAR 1,080,000. Contribution becomes SAR 1,320,000, or 55%. This is a planning reconciliation, not a prescribed accounting adjustment or a valuation. Finance must examine whether costs are already included elsewhere, what is recurring and how the target's reporting should actually be interpreted.

Suppose a separate migration is estimated at SAR 210,000. Show it separately as a proposed one-time requirement rather than quietly mixing it into the recurring margin. Do not apply an acquisition multiple mechanically to these figures. The useful finding is that the buyer's operating assumptions differ from the seller's presentation, with evidence and uncertainty that the deal team must assess.

Assess what changes at closing

Build a continuity map for the first period after the transaction. Identify who controls cloud and model accounts, domain names, keys, repositories and deployment access. Check where a departing founder or contractor is the only person able to operate a critical function. Ask the legal team which contracts require consent or other action under the proposed deal structure.

Then examine the buyer's intended integration. A target that works as a separate business may face new constraints when connected to the acquirer's systems or data. Shared identity, consolidated reporting and a new operating location can change the risk and cost picture. Keep the target's current state separate from the post-deal architecture the buyer hopes to create.

Translate findings into transaction decisions

For each material finding, record the affected claim, evidence, uncertainty, financial or operating consequence, proposed response and owner. The response might be further investigation, a revised integration plan, a funded remediation task or a matter for transaction counsel to address in the documents. An engineering reviewer should not independently prescribe contractual protections without the deal advisers' assessment.

Distinguish conditions needed before the buyer can make a responsible investment decision from work that can be planned after closing. Do not move a fundamental rights or capability uncertainty into a generic future improvement list simply to preserve the timetable. Conversely, an ordinary documented maintenance task need not be presented as proof that the whole target is uninvestable.

Design the review team and its independence

Coordinate technical, financial, privacy, legal and commercial review so that one finding reaches the people who can interpret its consequence. A technical inventory alone will not resolve a licence, and a contractual warranty alone does not establish system performance. The evaluation scorecard is useful for a later supplier selection, but it should not replace transaction-specific diligence.

Open for AI also provides delivery services. If an advisory review could lead to remediation work, disclose that potential role and agree how findings will be challenged. For the board's investment discussion, connect the evidence to reserved decisions and escalation, and use the cost framework to separate integration commitments from acquisition assumptions.

Agentic AI consulting can help scope the technical and operating questions in a proposed transaction. Discuss an AI diligence workstream with the investment thesis, target capability inventory and decision timetable, using non-confidential summaries initially. The first task is to agree which claims matter enough to investigate and who is qualified to conclude on each one.