AI Readiness Assessments and AI Diligence for Private Equity: Providers, Costs and Deliverables

1. Two Jobs That Share a Name

Firms use "AI readiness assessment" and "AI due diligence" as if they meant the same thing. The two describe different purchases, and mixing them up is how a firm pays for a deal-style risk report when it wanted a plan for its own team, or the reverse.

Job one: firm readiness. The question is what AI your own firm should do. The subject is your deal team, investor relations, finance and operations. The output is a set of decisions: which platform, which workflows first, what rules apply, and a plan with owners.

Job two: target AI diligence. The question is what AI will do to a company you might buy. The subject is the target's revenue lines, data, vendors and people. The output is a price input: risks that change what you pay or how you structure the deal, and upside worth funding once you own it.

A third job sits between them. After close, the readiness method pointed at a portfolio company becomes an AI maturity assessment: where does this company stand, and what should it do first? Section 4 covers the frameworks.

One more naming trap. Some providers use "AI due diligence" to mean diligence done with AI tools, such as faster data-room review and financial spreading. That is a tooling decision, covered in the guide to AI due diligence for private equity. This guide is about assessing AI itself, in your firm or in a target.

2. What a Firm-Level AI Readiness Assessment Should Deliver

A good readiness assessment ends in decisions a partner group can sign. Five deliverables cover it.

• A workflow and data map. Where the hours go across deal work, investor relations, finance and operations, and what data each workflow touches.
• A platform decision. Microsoft 365 Copilot, ChatGPT Enterprise, Claude or Gemini, chosen against your workflows and security needs, with the reasoning written down.
• A ranked use-case list. Every credible use, scored on effort and value, with the first two or three named.
• The governance gaps. What the AI policy, supervision approach and vendor files need before usage scales.
• A 90-day plan. Owners, costs, and the measure that will show whether it worked.

A maturity score with nothing attached is the weak version. A score tells you where you stand. A plan tells you what to do on Monday.

Insist on evidence, because the best-known field experiment on AI at work found the gains are uneven. In a Harvard Business School study with 758 BCG consultants, AI made people much better at some tasks and worse at others that looked just as hard: on one task chosen to sit outside AI's reach, consultants using AI were 19 percentage points less likely to reach the right answer (the working paper). A readiness assessment is where you find out which of your workflows sit on which side, tested on your own documents, before the whole firm finds out the hard way.

Timelines scale with headcount and the number of workflows in scope. A focused assessment of a small firm can finish in 1 to 2 weeks; larger firms and fuller scopes take four weeks or more, the length RSM publishes for its own assessment. Ask each provider what drives its price and its calendar.

3. What AI Due Diligence on a Target Should Deliver

Most deal teams now talk about AI. Fewer investigate it. In KPMG's 2025 Technology M&A Survey, 66 percent of dealmakers discussed technical and AI debt during deal planning, but only 33 percent prioritized investigating it before the deal. A 2026 BCG survey of 100 senior PE investors found 73 percent run digital due diligence on most deals, yet only 29 percent build digital value creation into the pre-deal phase.

AI diligence on a target should answer five questions.

• Substitution. Which revenue lines are services an AI agent could deliver more cheaply within your hold, and what does that do to pricing power and the exit multiple?
• Claims. Is the AI in the CIM real? Ask for usage data, model and vendor contracts, and a demonstration on the target's own data.
• Data. Does the company own, or have the right to use, the data its AI depends on, and is that data a moat or a liability?
• Dependency. Which third-party models and AI vendors does the business rely on, and what happens if their prices or terms change?
• Upside. Where could AI expand margins under your ownership, with rough effort and cost, so the value-creation plan starts with numbers?

The claims question has teeth. In April 2025 the SEC charged the founder of Nate, a privately held startup with a shopping app, alleging he raised over $42 million by telling investors the app used AI to complete purchases without human involvement, when the company relied in large part on contract employees entering orders by hand (SEC litigation release). The allegations have not been proven in court. The lesson for a deal team holds either way: test AI claims with operating data, contracts and a look at who actually does the work.

The output belongs in the IC memo: a scored risk section, the price or structure implications, conditions for the purchase agreement such as representations on data rights, and the upside list that seeds the 100-day plan. Screening-stage work fits before the LOI, when it can still change the price; confirmatory work runs alongside the rest of diligence. For scoring substitution risk in depth, see the guide to assessing AI disruption risk in a target.

4. AI Maturity Assessment Frameworks for Portfolio Companies

After close, the question becomes where each company stands and what it should do first. You do not need to invent a framework. Three published ones cover most needs.

MIT CISR's Enterprise AI Maturity Model. Four stages: experiment and prepare, build pilots and capabilities, industrialize AI throughout the enterprise, and become AI future-ready. In MIT's 2022 survey of 721 companies, those in the first two stages had financial performance below their industry average and those in the last two above it (MIT Sloan). It gives a board a common language.

The NIST AI Risk Management Framework. Four functions, Govern, Map, Measure and Manage, for the risk side of maturity (NIST). It is voluntary and widely recognized, and useful when a portfolio company sells to regulated customers.

ISO/IEC 42001. The international standard for an AI management system, published in December 2023 (ISO). It matters when customers start asking for certification, which is a governance program in its own right.

For comparing companies across a portfolio, a simpler scorecard often works better: five dimensions (data foundation, use cases in production, adoption, leadership, governance) scored on evidence, with the same rubric and ideally the same assessor everywhere. The same BCG survey found only 40 percent of PE investors use a formal digital-maturity score, and just 11 percent link digital progress to the exit narrative. A consistent score, re-run over the hold, is how that link gets built. The portfolio AI maturity assessment guide lays out a rubric.

Bain's 2025 private equity report put the starting question plainly: "Have we assessed the risks and opportunities generative AI creates for each of our portfolio companies?" (Bain). It is far easier to answer for twenty companies when all twenty were measured the same way.

5. AI Due Diligence and Readiness Providers for Private Equity: Who Does What

The same kinds of provider sell both jobs, with different strengths in each. The guide to choosing an AI consultant for private equity covers the full taxonomy; here is how it maps to readiness and diligence.

Big 4 transaction and technology teams. All four now market AI diligence. Deloitte describes it as assessing how AI is reshaping a company's market and whether the company's own AI capabilities, data and talent can defend its position. PwC sells AI and technology due diligence covering AI, product technology and IT systems. EY-Parthenon says it helps PE funds with AI due diligence, and KPMG has published the seven diligence dimensions that look different through an AI lens. The fit is a larger deal where AI diligence should sit inside full financial, tax and technology diligence.

Strategy firms. Commercial due diligence on large deals now carries AI questions, and the firms are rebuilding their own methods around AI: Bain says it is deploying OpenAI capabilities across its diligence practice. The fit is a deal where AI changes the market thesis itself.

Mid-market advisory firms. RSM, CBIZ, Grant Thornton and BDO all sell AI readiness assessments to middle-market companies, which makes them a natural choice for portfolio-company readiness where they already know the finance function. Check independence first if they audit the company or your funds.

Technology due diligence specialists. Boutiques that review code, architecture, security and scalability, and essential when the target is a software business. Many now add an AI module; ask whether it assesses the business model or only the stack.

Specialist AI firms. Small firms focused on AI for private capital, selling fixed-scope readiness sprints and per-target AI diligence. Often the fastest and least expensive option for a small or mid-sized firm. The bench is thin, so check capacity against your deal calendar.

Platform vendors' assessments. Some AI platform vendors and their resellers offer free or low-cost readiness assessments. They are useful as a checklist; expect the answer to point to their platform.

Self-assessment. Free diagnostics and the frameworks in section 4 can take a small firm most of the way on job one. They are weakest on a target, where management's answers are the thing being tested.

6. Providers Compared: Cost, Timeline and Limits

The ranges below are typical of what the market charges. Large firms rarely publish prices, so use the table to frame questions rather than to budget to the dollar.

Price follows scope more than brand: how many workflows, companies or revenue lines are in scope, and whether management interviews are included. Ask each provider what drives its number, and get it fixed in writing.

7. The Deliverable Test: Ask for a Redacted Sample

The fastest way to judge a readiness or diligence provider is a redacted sample of its last deliverable. Read it before you read the pitch.

For readiness work, look for a decision on the first page, ranked use cases with effort and cost, named owners, and governance gaps tied to specific documents. A maturity chart with no decisions is a warning sign.

For target diligence, look for an IC-ready section: scored risks, the evidence behind each score, price or structure implications, and the management questions that were actually asked. If the sample could describe any company in the sector, it will describe yours the same way.

Ask how long the sample took and who wrote it. Then ask for the same people.

8. Questions to Ask Any Readiness or Diligence Provider

Eight questions separate the providers who have done this work from the ones learning on your deal.

• What will we have at the end, and can we see a redacted example?
• Who does the work, by name, and how much of their time is ours?
• What data do you need, where will it be processed, and what is retained afterward?
• Which AI platforms do you resell, co-sell or earn fees on?
• For diligence: do you assess the business model, the technology stack, or both?
• How do you verify AI claims: usage data, contracts, a demonstration on the target's own data?
• What does it cost, what drives the price, and is it fixed?
• What do you not do, and who do you work alongside when it is needed?

The last question is the most revealing. Good providers know their edges and name them without being pushed.

9. Red Flags

Six patterns should slow a purchase down.

• A readiness report that ends in a maturity score and no decisions.
• A diligence report that scores AI risk without saying how each score was tested.
• Findings you cannot trace back to a source document or an interview.
• A platform recommendation from a firm that resells that platform, with no disclosure.
• A price that appears only after three calls, or a discovery phase with no end date.
• A request for unredacted deal data before anyone has explained where it will go.

Any one of these is worth a question. Two in the same proposal is a reason to keep looking.

10. Where to Start

Name the job first: your firm, a target, or a company you already own. Then pick the provider type from the table that fits your deal size and calendar, ask for a redacted sample, and run the eight questions. On a deal, screening-stage AI diligence before the LOI costs less than confirmatory work after it, and it can still move the price.

For the wider choice of who to hire, including a scorecard and a one-week vetting process, see how to choose an AI consultant for private equity.