How is AI SaaS due diligence different from regular SaaS due diligence?

The base checks are the same: revenue against bank deposits, churn, customer concentration, code and accounts. AI adds five more: margin after model costs, dependence on one provider, ownership of prompts and data, whether the product is more than a thin wrapper, and retention against AI-specific benchmarks. They decide whether the profit is real and will last.

What is the biggest mistake buyers make?

A common one is pricing off the seller's headline profit without rebuilding it from the invoices. Model costs grow with usage, so a profit figure that leaves them out, or that was true at lower usage, can be much higher than what you'd actually earn. Ask for the invoices and run the stress test in this guide.

Are AI wrapper businesses worth buying?

They can be, if they make money and hold their customers. The risk is that a thin wrapper is easy to copy, and a model provider can ship the same feature. Price one lower than a business with integrations or its own data, and see our guide to the AI wrapper business for what separates the two.

What margin should I expect after model costs?

Calculate it as revenue minus hosting, tools, payment fees and model and API costs, divided by revenue. In the illustrative example above, a business with $10,000 of monthly revenue, $800 of hosting and $3,000 of model costs has a 62% gross margin. For reference, a16z's analysis puts AI companies at 50% to 60% and traditional software at 60% to 80% or more, and below about 70% is a discount in software generally.

Who owns the prompts and training data when I buy?

Only what the seller owns and puts in the purchase agreement. Check who made the prompts, fine-tunes and evaluation sets, where the training data came from, and whether customer data can legally transfer. List each asset in the agreement, and have a lawyer review it.

Does the EU AI Act affect a business I buy?

It might, if the product is used in the EU or its output is. The European Commission describes four risk levels, with transparency duties for things like chatbots, and phased dates that have changed since the law passed. Ask a lawyer about the specific product, and check the dates on the Commission's AI Act page.

How long does due diligence take?

We estimate 3 to 6 weeks for a small software business, with up to a week more for an AI product's model and API cost review. Our acquisition timeline planner turns that into dates. Clean records and quick answers from the seller shorten it. These are estimates, not promises.

AI SaaS Due Diligence: What to Verify Before You Buy

A ten-minute screen before you spend money

You can answer these from a listing and one call, before you pay a lawyer or an accountant for anything. If two or more fail, pause and ask questions first.

Question	Looks fine	Pause if
Revenue: can it be verified?	12 months of exports from the payment processor	Screenshots or a typed spreadsheet only
Margin: is profit stated after model costs?	Model and API spend shown by month	Profit quoted with no mention of inference costs
Provider: how many models does it depend on?	More than one, or a tested switch	One provider and no fallback
Data rights: who owns the code, prompts and data?	The seller, with signed assignments	Contractors or scraped data with nothing on paper
Churn: is it shown by cohort?	Monthly cohorts that hold up	One headline percentage with no period

Check 1: margin after model costs

Every model call costs money and the bill grows with usage, so it belongs in cost of goods sold. Our AI company valuation guide cites a16z's analysis putting AI companies' gross margins at 50% to 60%, against 60% to 80% or more for traditional software (a16z, published 2020, updated April 2024). Below about 70% is a discount in software generally, so a thin margin leaves less profit to price.

Ask for: 12 months of model and API invoices by provider, revenue by customer by month, and cost per customer, including the heaviest 10% of users. Then run the sum yourself. These numbers are illustrative, not from a real business:

Monthly, illustrative	Before model costs	After model costs	Provider prices +30%	Usage doubles
Revenue	$10,000	$10,000	$10,000	$10,000
Hosting and tools	-$800	-$800	-$800	-$800
Model and API costs	$0	-$3,000	-$3,900	-$6,000
Gross profit	$9,200	$6,200	$5,300	$3,200
Gross margin	92%	62%	53%	32%

Gross margin is gross profit divided by revenue. The seller's "92%" ignores the biggest cost, and the 62% is what you'd actually buy. The last two columns are the stress test: what happens if the provider raises prices by 30%, or usage doubles and your price doesn't. A 30% price rise costs $10,800 a year here. If that drop flows straight through to the profit you're pricing, at 3 times profit it takes about $32,400 off what the business is worth. Put the stressed profit into the free SaaS valuation calculator before you make an offer.

Check 2: provider dependence

If the whole product runs on one provider, a price change, a rate limit or a new feature from that provider can hit you overnight. Find out which models the business calls, where in the code it calls them, and how hard a switch would be: a config change, or a rebuild?

Ask for: an architecture overview, the provider account terms, and any contracts, credits or committed spend, including whether they transfer to you. Ask whether anyone has actually tested a second model, and what the output quality and cost looked like. A build that can swap providers is worth more than one that can't.

Check 3: who owns what

A buyer is paying for assets, so each one has to belong to the seller. List them:

Code. Every contractor who wrote any of it should have signed an IP assignment. Without one, they may still own their work.
Prompts, fine-tunes and evaluation sets. Who made them, where they live, and whether they sit in a login that can be handed over.
Training data. Where it came from, and whether the seller had the right to use it. Scraped or customer data used without permission is a serious flag.
Customer data. Whether the privacy policy and customer terms allow a transfer to a new owner, and whether customers consented to how their data was used.
Provider terms. What the provider says about who owns outputs and whether it can train on customer inputs.

These are legal questions as much as business ones. Have a lawyer check ownership and the IP assignments, and make the seller's statements about them part of the asset purchase agreement.

Check 4: product or thin wrapper

A thin wrapper is a prompt and an interface over someone else's model. Buyers ask what a competitor with the same API key couldn't copy in a weekend. Signs of depth:

Integrations into the customer's other tools, which take real work to rebuild.
Workflow lock-in: the customer's data and process live inside the product.
Proprietary data that makes the product better the longer customers use it.
Owned distribution, such as search traffic or an email list, instead of one ad account.

The more of these missing, the lower in the price range the business belongs. Our guide to the AI wrapper business shows how that gap turns into price.

Check 5: retention

Ask for monthly cohorts by sign-up month and the seller's net revenue retention. NRR is starting monthly recurring revenue plus upgrades, minus downgrades and cancellations, divided by starting revenue, over 12 months. Our net revenue retention guide has the calculator and the traps. The main one: "99% NRR" with no period is probably a monthly figure, so ask for the trailing 12 months.

These are the benchmarks from that guide, from billing data and not from surveys of big companies:

Benchmark	Figure
B2B SaaS, median net revenue retention	82%
B2B SaaS, upper quartile starts at	97%
AI-native products, median net revenue retention	48%
AI-native products, median gross revenue retention	40%
AI products under $50 a month, gross revenue retention	23%

The AI figures are from ChartMogul's December 2025 billing data. Far above them is a strength, and far below is a reason to reprice. Then separate people who pay for a workflow from people who tried a chatbot: look at usage after month one, how many customers use it every week, and how many are on annual plans or have teammates in the account.

Security and compliance basics

Keep this proportionate to the size of the deal. Ask whether the business has a SOC 2 report or an equivalent. Many small products don't, and for a small app that isn't a deal-breaker, but it matters if the customers are companies that ask for one. Ask where customer data is stored, which countries the model provider processes it in, and whether the privacy policy says so.

If the business has users in the EU, ask a lawyer whether the EU AI Act could apply. The European Commission describes it as a risk-based law with four levels, and chatbots can carry transparency duties such as telling people they are talking to an AI. It applies in phases, and some deadlines have moved since it passed, so check the current dates on the Commission's AI Act page. Whether it covers a particular product is a legal question, not a diligence-checklist one.

Red flags: reprice, escrow or walk

Action	What you found	What to do
Reprice or hold back	Margin below what the seller claimed. One customer above about 20% of revenue. Costs rising faster than revenue.	Rebuild profit from the invoices and re-price on that. Hold part of the price back until the customer renews.
Escrow or earnout	Retention you can't prove yet, or a provider change coming. Accounts that haven't moved.	Tie part of the price to retention in an earnout, and release escrow only when each account has transferred.
Walk away	No clear ownership of the code or the data. A seller who won't give read-only access.	Stop. Nothing in a contract fixes a seller who doesn't own what they're selling.

The price you agreed in the letter of intent usually says it's subject to diligence, which is what lets you reprice. The one-customer line comes from our business acquisition steps guide.

The document request list

Copy and paste this to the seller. Sellers can use it to get ready, and our guide on how to sell an AI app shows what buyers do with it.

Margin

12 months of model and API invoices, by provider.
Revenue by customer by month, exported from the payment processor.
Cost per customer, including the heaviest 10% of users.
A 12-month profit and loss with model costs shown as cost of goods sold.

Provider dependence

An architecture overview: which models, where they're called, and any abstraction layer.
Provider account terms, plus any credits or committed-spend agreements.
Any test of a fallback or second provider, with the results.

Ownership

Signed IP assignments from every contractor who wrote code.
A list of prompts, fine-tunes and evaluation sets, and where each is stored.
A description of training data sources and any consents.
The privacy policy and customer terms.

Product depth and retention

A list of integrations and what customers connect.
Signup and traffic channels, shown live from analytics and Search Console.
A monthly revenue bridge and a cohort retention chart.
Usage by customer: runs or logins per month.

How AIExchange.club helps

We list only AI and SaaS businesses that already make money. Sellers list free, the flat 10% success fee is paid only when the deal closes, and the deal room, escrow and in-platform contracts are included. Buyers pay $49 a month or $399 a year, with a 14-day free trial (see fees and pricing). Listing information comes from sellers, so run your own diligence with the checks above. For the whole process from first call to close, see our guide to buying AI SaaS businesses, and if you're selling, how to sell a SaaS business.