Picture a software company in the middle of a sale process. Its management presentation has a slide labeled "AI governance," a policy document sits in the data room, and the team is proud of its support agents. Then the advisor asks for something simple: show me the last time one of your agents was blocked from doing something, who approved the rule that blocked it, and where the record lives. The room goes quiet, because the slide is true, the policy is real, and nobody has ever pulled that record. What the advisor is really testing, whatever the questionnaire calls it, is operational control of agents.
That gap is what this guide is about. It is written for private equity technology leaders and portfolio company AI teams who want to prove AI agent governance in due diligence with evidence instead of assurances. It covers what buyers ask, how to move from claims to proof, how AI agent control shows up in runtime controls a reviewer can test, what audit evidence to have ready, how to write AI safety documentation that holds up, and how agent risk management turns findings into a plan across a portfolio.
What is AI agent due diligence? It is the part of a technology review that tests whether a company's AI agents are under real control: who they act for, what they may do, what stops them when they go wrong, and what records prove it. It differs from general AI diligence, which centers on data rights, intellectual property, and vendor dependence, because agents take actions and the proof has to come from how they operate.
Why Agents Change AI Due Diligence
Traditional AI diligence asks whether the data is legally usable, who owns the models, and whether the economics survive a vendor price change. Agents add another question: what can this system do on its own, and how would anyone know if it did something it should not? Three things make that hard to answer from documents alone:
- Agents hold authority. They carry credentials, call tools, and act inside core systems, so a control failure is an operational incident and not just a quality problem.
- Documents describe intent. A policy says what should happen. Only operating records show what did, and sale processes are full of statements about AI governance; diligence is where those statements meet the records.
- The market is learning to ask. Mayer Brown's May 2026 note on private equity deal risk observes that AI diligence in many transactions still resembles traditional software diligence, and that where documentation is missing the review falls back on management representations that cannot be independently verified. It advises sponsors to apply the same preparation to existing portfolio companies to preserve exit value.
There is also a plain accuracy risk. In March 2024 the SEC settled charges against two investment advisers for false and misleading statements about their use of artificial intelligence, with penalties of $225,000 and $175,000. Those cases concerned claims about AI use, not agent controls, but the lesson carries over to sale materials, including a sponsor's own: say only what the evidence supports.
What Buyers and Investors Ask About AI Agents
The questions vary by deal but cluster into a few areas:
| Area | A Typical Question | Evidence That Answers It |
|---|---|---|
| Inventory | Which agents exist, who owns each, and what do they do? | A current register with owners, purpose, and systems touched |
| Authority and access | What can each agent access, and on whose behalf does it act? | Scoped identities or delegated authority, permissions, and access reviews |
| Runtime controls | What stops an agent from taking an action it should not? | Policy configuration and records of actions allowed and blocked |
| Audit evidence | Can you reconstruct what an agent did last month? | Structured logs tied to identity, kept where the company controls them |
| Data and privacy | What personal or confidential data reaches models and tools? | Data-flow descriptions, masking rules, and test results |
| Vendors and models | Which providers and tools does each agent depend on? | A register of models, tool servers, and contracts, with exit options |
| Incidents | Has an agent caused or nearly caused a problem, and what changed? | An incident log and one reconstructed example |
| Regulatory position | Which rules apply to which agents? | A classification by use case and jurisdiction |
Prediction Guard's vendor due diligence checklist covers the vendor-facing version of these questions. On the regulatory row, applicability depends on the use case and on whether the company is a provider or a deployer. Under the EU AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026, the high-risk requirements in Chapter III apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III. Annex III lists intended uses, such as systems used for recruitment or selection, for certain workforce-management decisions, or to evaluate the creditworthiness of natural persons (fraud detection is excluded), and many agents will not match any of them. Even a listed system can be assessed as not high-risk where it poses no significant risk of harm, for example when it performs a narrow procedural task, but never where it profiles natural persons, and that assessment must be documented and registered. Classify each agent instead of assuming, and confirm with counsel.
Proving AI Agent Governance: From Claims to Evidence
Buyers weigh evidence by how hard it is to fake. Think of it as a ladder where each rung moves from saying to showing:
| Rung | What It Looks Like | How a Reviewer Treats It |
|---|---|---|
| 1. Statement | A slide, a management answer, a line in the sale memo | A starting point that has to be verified |
| 2. Document | A policy, a standard, a written procedure | Evidence of intent, not of operation |
| 3. Configuration | The actual policy rules and permissions, with change history | Shows what is enforced, if it is the configuration that is running |
| 4. Operating record | Logs of decisions made, actions blocked, and changes approved | Shows the controls working in practice |
| 5. Independent test or assurance | A third-party test, SOC 2 report, ISO/IEC 42001 certificate, or AIUC-1 certification | A valuable independent signal, though not a substitute for operating records, and it may not cover every material agent |
A company stuck at rungs one and two is asking the buyer to take its word. The target before a process starts is rung three or four for every agent that touches customer data, money, or production systems, with rung five added where it covers them.
AI Agent Control a Reviewer Can Test
The most persuasive evidence of AI agent control is a live demonstration, with one caveat: it shows a control worked in the tested scenario, not that it is enforced consistently across production, so back each one with operating records. A company should be able to run these on request:
- Show the register. Produce the list of agents and owners, and trace one chosen at random.
- Attempt something forbidden. Have an agent try an action outside its scope, and show it blocked and recorded.
- Cut an agent off. Revoke one agent's access and time how long it takes to take effect.
- Show identity. Show each agent's scoped identity or delegated authority and that no shared credential sits behind several agents. A distinct identity per agent is the target, though some systems need a different pattern.
- Show limits. Show the usage and spend limits that stop a runaway loop, and where they apply.
- Show approvals. For high-risk actions, show who must approve and the record of past approvals.
- Replay an incident. Reconstruct a real or simulated event from the records alone.
These tests are meaningful only for controls that sit outside the agent, since a rule an agent can ignore proves little. Bounding blast radius before deployment and applying least agency shrink what there is to defend, and a control plane that enforces policy on each call records decisions as a by-product, as Prediction Guard's runtime controls describe.
Audit Evidence: What to Have in the Data Room
Evidence is easiest to produce when it was generated continuously. A reviewer will expect:
- The agent register, with owners, purposes, models, and tools
- Policy and permission configuration, with a change history and who approved each change
- A redacted sample of audit logs showing enforcement decisions
- The incident log, plus one incident reconstructed end to end
- Results of security and injection tests, and what was fixed
- Access reviews showing who held which permissions and when they were checked
Three practices keep the package credible. Where feasible, keep source records inside your boundary and share redacted extracts, since logs often hold sensitive data a buyer should not have before closing, and where a vendor generates evidence, secure export rights in the contract. Make the evidence tamper-resistant and attributable, since a log anyone could have edited carries little weight. And prefer evidence that shows operation over a period to a snapshot, the difference described in continuous enforcement versus audits.
For what a defensible record contains, see audit log implementation. The AI compliance evidence framework covers packaging, and the audit readiness checklist maps more than seventy evidence types across the EU AI Act, AIUC-1, ISO/IEC 42001, and OWASP.
AI Safety Documentation That Holds Up
AI safety documentation is the written record of why each agent is safe to run and how that was checked. A complete set usually includes:
- Intended use and limits for each agent, including what it must not do.
- A risk assessment per agent, rated and owned, covering misuse, data exposure, and tool abuse.
- A threat model mapped to a recognized list such as the OWASP agentic applications list, so a reader can see which risks were considered.
- Test and evaluation results, including red-team and injection testing, with findings and fixes.
- Change management records showing who approved each change to an agent's permissions or policies.
- An incident response runbook, including how to cut an agent's access and preserve evidence.
- An acceptable use policy for employees and contractors who build or use agents.
Frameworks give it a structure buyers recognize. A function-by-function view of the NIST AI RMF is in this NIST AI RMF mapping. ISO/IEC 42001 is a management-system standard an accredited body can certify, and AIUC-1 is a certification built for AI agents that pairs an audit of evidence with technical testing of the agent. On October 19, 2026, the AICPA and AIUC announced a joint offering that delivers a SOC 2 report and an AIUC-1 certification in a single report from one CPA-led engagement. Both renew annually, with quarterly technical retesting for AIUC-1. Several CPA firms are delivering it now, and a full launch is expected in early 2027.
A certification is valuable independent evidence, not a substitute for operating records. Its scope and date are defined, so a buyer will ask whether it covers the agents that matter and is current.
Agent Risk Management: Turning Gaps Into a Plan
Every honest review finds gaps, and what separates a company that holds its price is often whether they arrive with a plan. Agent risk management means keeping a register of known weaknesses, each with a severity, an owner, and a date. These findings come up most often:
| Common Finding | Why a Buyer Cares | Typical Fix |
|---|---|---|
| Agents nobody has inventoried | Unknown agents have unknown authority | Discover and register every agent, with an owner |
| Several agents sharing one credential | One compromise reaches all of them, and attribution is lost | Move toward scoped identities or delegated authority per agent |
| Policies on paper with no enforcement record | Intent cannot be verified | Enforce policy at a control point and keep the log |
| Evidence held only in a vendor's environment | It may not survive the relationship | Prefer retaining records inside your boundary, or secure export rights |
| No tested way to cut an agent off | Containment is theoretical | Build the revocation path and time it |
| Unbounded usage and spend | A runaway loop becomes a cost and availability event | Set limits per key or per agent where tooling allows |
A Portfolio Scorecard for Sponsors
Companies in a portfolio differ too much for one mandated AI program, but a sponsor can score each against the same list. Rate each control area (inventory, authority and access, runtime controls, audit evidence, safety documentation, vendor dependence, and incident readiness) by the highest rung of the evidence ladder the company can produce for the agents that matter. This is a suggested approach, not an industry standard, and it answers four questions:
| Question | How to Read the Scorecard |
|---|---|
| Which companies have material agent-control gaps? | Any control area stuck at rung one or two for an agent that touches customer data, money, or production systems |
| Which gaps could threaten an exit or raise remediation cost? | Gaps a buyer will test directly and that are slow to fix, such as no revocation path, shared credentials, no operating records, or vendor-held evidence |
| Which controls should be prioritized across the portfolio? | Gaps that recur across companies, since a common fix usually costs less than many separate ones |
| What needs fixing before a transaction, and what can be tracked after closing? | Before a process starts: gaps a buyer will test live or that contradict sale materials. At signing: gaps that can be addressed through negotiated covenants, with an owner, deadline, and remediation plan. After closing: lower-risk items on a dated plan |
The same view shows concentration, such as several companies depending on one model provider, and it suits evaluating shared tooling, as in this control plane decision framework. Findings can also shape deal terms. Law-firm guidance on AI diligence in M&A notes that buyers may seek specific indemnities, escrows, covenants, or closing conditions where material uncertainty remains. Which remedy applies, if any, varies by deal, and a documented plan is easier to price than an unknown.
A Worked Example: A Diligence Session
This scenario is illustrative. A buyer's technical advisor meets the AI team of a software company that has run customer-facing support agents for a year.
The register. The team produces six agents with owners and purposes, and the advisor traces the refund agent end to end.
The block. The refund agent attempts an action above its limit and is refused, and the team shows the decision record with the identity, policy, and time.
The cut. The team revokes the agent's access. It takes effect in seconds for the model route and longer for one integration, which uses a credential shared with two other agents.
The finding. The shared credential becomes the main finding, along with logs for one third-party tool that sit only in the vendor's environment.
The plan. The team arrives with a remediation plan: separate identities within thirty days, a monthly revocation test, and log export from the vendor tool inside the quarter. In this scenario, the advisor records it as a covenant with an owner and a date, not a price concern.
Where This Approach Falls Short
Evidence is more reliable than assurances, and it has limits of its own:
- A demonstration shows one moment. Operating records over time show whether it held.
- Scope can quietly narrow. A certificate or a log may cover some agents and not others, so confirm the boundary.
- Documents can be performative. A thorough policy set that nothing enforces is what a buyer will test for.
- Third-party black boxes remain. Where an agent runs inside a vendor's platform, a company may not be able to show the vendor's controls.
- A control point sees what routes through it. Inventory and routing come first.
- Regulatory answers vary. What applies depends on use case, role, and jurisdiction, so confirm with counsel. This guide is orientation, not legal advice.
Diligence Readiness Checklist
Questions Worth Asking
1. What do buyers look for in AI agent due diligence?
Proof that agents are under control: an inventory, scoped authority, controls that stop disallowed actions, and records that let someone reconstruct what happened. Demonstrations and operating records count for more than policies.
2. Is a written AI policy enough?
No. A policy shows intent. What raises confidence is configuration that enforces it and records showing it working.
3. Do we need AIUC-1 or ISO/IEC 42001 before a sale?
Neither is required, and neither replaces operating evidence. They help when they cover the agents that matter and are current. Start with what your buyers ask for and what you already hold.
4. How should logs be shared in a data room?
As controlled, redacted extracts, not raw exports. Keep source records inside your boundary where feasible and mask personal and confidential data before sharing.
Proof Beats Policy in Due Diligence
The companies that move through diligence calmly can show, on request, what each agent can do, what stops it, and what record proves it. That is what makes AI agent governance verifiable to a buyer instead of promised, and it is operational control of agents in a form a stranger can check.
A practical next step is to take one material agent, run it through the readiness checklist above, and note which rung of the evidence ladder each answer reaches. Fix what that exposes, then extend the same test across the portfolio.