Picture a software company in the middle of a sale process. Its management presentation has a slide labeled "AI governance," a policy document sits in the data room, and the team is proud of its support agents. Then the advisor asks for something simple: show me the last time one of your agents was blocked from doing something, who approved the rule that blocked it, and where the record lives. The room goes quiet, because the slide is true, the policy is real, and nobody has ever pulled that record. What the advisor is really testing, whatever the questionnaire calls it, is operational control of agents.
That gap is what this guide is about. It is written for private equity technology leaders and portfolio company AI teams who want to prove AI agent governance in due diligence with evidence instead of assurances. It covers what buyers ask, how to move from claims to proof, how AI agent control shows up in runtime controls a reviewer can test, what audit evidence to have ready, how to write AI safety documentation that holds up, and how agent risk management turns findings into a plan across a portfolio.
What is AI agent due diligence? It is the part of a technology review that tests whether a company's AI agents are under real control: who they act for, what they may do, what stops them when they go wrong, and what records prove it. It differs from general AI diligence, which centers on data rights, intellectual property, and vendor dependence, because agents take actions and the proof has to come from how they operate.
Traditional AI diligence asks whether the data is legally usable, who owns the models, and whether the economics survive a vendor price change. Agents add another question: what can this system do on its own, and how would anyone know if it did something it should not? Three things make that hard to answer from documents alone:
There is also a plain accuracy risk. In March 2024 the SEC settled charges against two investment advisers for false and misleading statements about their use of artificial intelligence, with penalties of $225,000 and $175,000. Those cases concerned claims about AI use, not agent controls, but the lesson carries over to sale materials, including a sponsor's own: say only what the evidence supports.
The questions vary by deal but cluster into a few areas:
| Area | A Typical Question | Evidence That Answers It |
|---|---|---|
| Inventory | Which agents exist, who owns each, and what do they do? | A current register with owners, purpose, and systems touched |
| Authority and access | What can each agent access, and on whose behalf does it act? | Scoped identities or delegated authority, permissions, and access reviews |
| Runtime controls | What stops an agent from taking an action it should not? | Policy configuration and records of actions allowed and blocked |
| Audit evidence | Can you reconstruct what an agent did last month? | Structured logs tied to identity, kept where the company controls them |
| Data and privacy | What personal or confidential data reaches models and tools? | Data-flow descriptions, masking rules, and test results |
| Vendors and models | Which providers and tools does each agent depend on? | A register of models, tool servers, and contracts, with exit options |
| Incidents | Has an agent caused or nearly caused a problem, and what changed? | An incident log and one reconstructed example |
| Regulatory position | Which rules apply to which agents? | A classification by use case and jurisdiction |
Prediction Guard's vendor due diligence checklist covers the vendor-facing version of these questions. On the regulatory row, applicability depends on the use case and on whether the company is a provider or a deployer. Under the EU AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026, the high-risk requirements in Chapter III apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III. Annex III lists intended uses, such as systems used for recruitment or selection, for certain workforce-management decisions, or to evaluate the creditworthiness of natural persons (fraud detection is excluded), and many agents will not match any of them. Even a listed system can be assessed as not high-risk where it poses no significant risk of harm, for example when it performs a narrow procedural task, but never where it profiles natural persons, and that assessment must be documented and registered. Classify each agent instead of assuming, and confirm with counsel.
Buyers weigh evidence by how hard it is to fake. Think of it as a ladder where each rung moves from saying to showing:
| Rung | What It Looks Like | How a Reviewer Treats It |
|---|---|---|
| 1. Statement | A slide, a management answer, a line in the sale memo | A starting point that has to be verified |
| 2. Document | A policy, a standard, a written procedure | Evidence of intent, not of operation |
| 3. Configuration | The actual policy rules and permissions, with change history | Shows what is enforced, if it is the configuration that is running |
| 4. Operating record | Logs of decisions made, actions blocked, and changes approved | Shows the controls working in practice |
| 5. Independent test or assurance | A third-party test, SOC 2 report, ISO/IEC 42001 certificate, or AIUC-1 certification | A valuable independent signal, though not a substitute for operating records, and it may not cover every material agent |
A company stuck at rungs one and two is asking the buyer to take its word. The target before a process starts is rung three or four for every agent that touches customer data, money, or production systems, with rung five added where it covers them.
The most persuasive evidence of AI agent control is a live demonstration, with one caveat: it shows a control worked in the tested scenario, not that it is enforced consistently across production, so back each one with operating records. A company should be able to run these on request:
These tests are meaningful only for controls that sit outside the agent, since a rule an agent can ignore proves little. Bounding blast radius before deployment and applying least agency shrink what there is to defend, and a control plane that enforces policy on each call records decisions as a by-product, as Prediction Guard's runtime controls describe.
Evidence is easiest to produce when it was generated continuously. A reviewer will expect:
Three practices keep the package credible. Where feasible, keep source records inside your boundary and share redacted extracts, since logs often hold sensitive data a buyer should not have before closing, and where a vendor generates evidence, secure export rights in the contract. Make the evidence tamper-resistant and attributable, since a log anyone could have edited carries little weight. And prefer evidence that shows operation over a period to a snapshot, the difference described in continuous enforcement versus audits.
For what a defensible record contains, see audit log implementation. The AI compliance evidence framework covers packaging, and the audit readiness checklist maps more than seventy evidence types across the EU AI Act, AIUC-1, ISO/IEC 42001, and OWASP.
AI safety documentation is the written record of why each agent is safe to run and how that was checked. A complete set usually includes:
Frameworks give it a structure buyers recognize. A function-by-function view of the NIST AI RMF is in this NIST AI RMF mapping. ISO/IEC 42001 is a management-system standard an accredited body can certify, and AIUC-1 is a certification built for AI agents that pairs an audit of evidence with technical testing of the agent. On October 19, 2026, the AICPA and AIUC announced a joint offering that delivers a SOC 2 report and an AIUC-1 certification in a single report from one CPA-led engagement. Both renew annually, with quarterly technical retesting for AIUC-1. Several CPA firms are delivering it now, and a full launch is expected in early 2027.
A certification is valuable independent evidence, not a substitute for operating records. Its scope and date are defined, so a buyer will ask whether it covers the agents that matter and is current.
Every honest review finds gaps, and what separates a company that holds its price is often whether they arrive with a plan. Agent risk management means keeping a register of known weaknesses, each with a severity, an owner, and a date. These findings come up most often:
| Common Finding | Why a Buyer Cares | Typical Fix |
|---|---|---|
| Agents nobody has inventoried | Unknown agents have unknown authority | Discover and register every agent, with an owner |
| Several agents sharing one credential | One compromise reaches all of them, and attribution is lost | Move toward scoped identities or delegated authority per agent |
| Policies on paper with no enforcement record | Intent cannot be verified | Enforce policy at a control point and keep the log |
| Evidence held only in a vendor's environment | It may not survive the relationship | Prefer retaining records inside your boundary, or secure export rights |
| No tested way to cut an agent off | Containment is theoretical | Build the revocation path and time it |
| Unbounded usage and spend | A runaway loop becomes a cost and availability event | Set limits per key or per agent where tooling allows |
Companies in a portfolio differ too much for one mandated AI program, but a sponsor can score each against the same list. Rate each control area (inventory, authority and access, runtime controls, audit evidence, safety documentation, vendor dependence, and incident readiness) by the highest rung of the evidence ladder the company can produce for the agents that matter. This is a suggested approach, not an industry standard, and it answers four questions:
| Question | How to Read the Scorecard |
|---|---|
| Which companies have material agent-control gaps? | Any control area stuck at rung one or two for an agent that touches customer data, money, or production systems |
| Which gaps could threaten an exit or raise remediation cost? | Gaps a buyer will test directly and that are slow to fix, such as no revocation path, shared credentials, no operating records, or vendor-held evidence |
| Which controls should be prioritized across the portfolio? | Gaps that recur across companies, since a common fix usually costs less than many separate ones |
| What needs fixing before a transaction, and what can be tracked after closing? | Before a process starts: gaps a buyer will test live or that contradict sale materials. At signing: gaps that can be addressed through negotiated covenants, with an owner, deadline, and remediation plan. After closing: lower-risk items on a dated plan |
The same view shows concentration, such as several companies depending on one model provider, and it suits evaluating shared tooling, as in this control plane decision framework. Findings can also shape deal terms. Law-firm guidance on AI diligence in M&A notes that buyers may seek specific indemnities, escrows, covenants, or closing conditions where material uncertainty remains. Which remedy applies, if any, varies by deal, and a documented plan is easier to price than an unknown.
This scenario is illustrative. A buyer's technical advisor meets the AI team of a software company that has run customer-facing support agents for a year.
The register. The team produces six agents with owners and purposes, and the advisor traces the refund agent end to end.
The block. The refund agent attempts an action above its limit and is refused, and the team shows the decision record with the identity, policy, and time.
The cut. The team revokes the agent's access. It takes effect in seconds for the model route and longer for one integration, which uses a credential shared with two other agents.
The finding. The shared credential becomes the main finding, along with logs for one third-party tool that sit only in the vendor's environment.
The plan. The team arrives with a remediation plan: separate identities within thirty days, a monthly revocation test, and log export from the vendor tool inside the quarter. In this scenario, the advisor records it as a covenant with an owner and a date, not a price concern.
Evidence is more reliable than assurances, and it has limits of its own:
Proof that agents are under control: an inventory, scoped authority, controls that stop disallowed actions, and records that let someone reconstruct what happened. Demonstrations and operating records count for more than policies.
No. A policy shows intent. What raises confidence is configuration that enforces it and records showing it working.
Neither is required, and neither replaces operating evidence. They help when they cover the agents that matter and are current. Start with what your buyers ask for and what you already hold.
As controlled, redacted extracts, not raw exports. Keep source records inside your boundary where feasible and mask personal and confidential data before sharing.
The companies that move through diligence calmly can show, on request, what each agent can do, what stops it, and what record proves it. That is what makes AI agent governance verifiable to a buyer instead of promised, and it is operational control of agents in a form a stranger can check.
A practical next step is to take one material agent, run it through the readiness checklist above, and note which rung of the evidence ladder each answer reaches. Fix what that exposes, then extend the same test across the portfolio.