AI due diligence: how to evaluate AI before you trust it

AI due diligence starts before the demo looks impressive

You are probably seeing AI everywhere.

Every week there is a new tool promising to save time, automate workflows, create content, analyse data, improve productivity or quietly solve a problem that used to take three people and a spreadsheet. Some of those claims are genuine. Some are optimistic. Many sit somewhere awkwardly in between.

The challenge is that a successful demo does not mean an AI system is ready for your business.

A demo shows the tool in its best light. Your business does not operate in demo conditions. Your data is messy. Your customers ask unexpected questions. Your team has existing habits, approvals, systems and edge cases. The real test is not whether AI can produce one good answer. It is whether it can behave usefully, safely and consistently inside the workflow where you plan to use it.

AI due diligence gives that checking a structure.

What is AI due diligence?

AI due diligence is the process of evaluating an AI tool, model or workflow before you rely on it.

It is similar to assessing a supplier, software platform or business partner. Before you depend on it, you want evidence that it can do what it claims, that the risks are understood, and that your team knows what to do when something goes wrong.

For AI, that means asking practical questions:

• Can I trust the outputs?
• How accurate is the information?
• What data does the system use?
• How does it handle confidential or sensitive information?
• What happens when the AI makes a mistake?
• Who reviews the output before it reaches customers?
• Does it meet security, privacy and compliance expectations?
• Will it still perform consistently as our data, prompts, tools and workflows change?

These questions become more important as AI moves from experimentation into day-to-day business operations.

Trying a tool is easy. Trusting it inside a real business process requires more care.

Can AI do due diligence?

AI can support due diligence, but it should not own the final decision.

AI is useful for reviewing large volumes of information quickly. It can summarise documents, extract key clauses, identify patterns, flag inconsistencies, cluster themes and highlight areas that may need further investigation. In legal reviews, supplier assessments, compliance checks, content audits and operational reviews, this can save time and help people focus their attention.

But AI can also misunderstand context, miss nuance, produce inaccurate summaries or present uncertain information with far too much confidence. That means AI should be treated as an assistant in the due diligence process, not the person signing off the decision.

A stronger approach is usually human-in-the-loop:

1. AI organises and summarises the material.
2. AI highlights possible risks, gaps or inconsistencies.
3. Human experts validate the findings.
4. People make the final recommendation and decision.

Before using AI to carry out due diligence on anything else, it is worth carrying out due diligence on the AI itself. Tiny gremlin clause, but important.

Why AI due diligence matters before deployment

AI tends to look most convincing when it is new. The first output may be fast, polished and surprisingly good. That does not tell you enough.

Test how the system behaves across awkward real examples:

• incomplete source material
• conflicting information
• ambiguous customer questions
• technical terminology
• regulated or sensitive topics
• unusual edge cases
• longer workflows with multiple steps

This is where many AI projects become fragile. The tool works well enough in a controlled test, then struggles when it meets the actual business environment.

AI due diligence helps you spot that before the system is embedded in customer communications, content production, reporting, analysis or decision support.

Start with the use case, not the tool

The first question is not “which AI tool should we buy?”

The better question is “what job are we asking AI to do, and what would good performance look like?”

A tool used to generate rough internal notes does not need the same due diligence as a tool producing public-facing advice, analysing customer data or influencing business decisions. Risk depends on context.

Define the use case clearly:

• What task will AI support?
• Who will use the output?
• Will the output be internal or public?
• Will customers, patients, clients or stakeholders rely on it?
• What would a bad output cost?
• Who remains accountable?

This keeps evaluation grounded in reality. It also stops AI due diligence becoming a generic checklist that says everything is important and therefore helps nobody.

Check accuracy against real examples

Accuracy cannot be judged from one nice-looking answer.

Test the AI against real examples from your own workflow. Use source material, documents, prompts, customer questions and edge cases that reflect how the system will actually be used.

Look for:

• whether the output is factually correct
• whether it preserves important nuance
• whether it invents details
• whether it cites or uses sources properly
• whether it changes meaning when summarising
• whether it handles uncertainty honestly

If the tool is being used for marketing content, check whether it overclaims, flattens your voice, invents proof points or turns specific expertise into generic filler. If it is being used for analysis, check whether it explains assumptions and flags uncertainty.

One of the most dangerous AI failure modes is not a visibly bad answer. It is a plausible answer that is quietly wrong.

Understand the data and privacy position

AI due diligence should include data use, privacy and security.

Check:

• what data the tool receives
• whether inputs are stored
• whether your data may be used for model training
• where data is processed
• who can access it
• how deletion or retention works
• whether the system fits your privacy obligations

This matters even for ordinary content work. Drafts, notes, call transcripts, customer queries, internal documents and product plans can contain information that should not be casually pasted into a third-party tool.

A useful AI setup does not depend on people remembering complicated rules every time they are busy. It builds safer choices into the workflow.

Evaluate workflow fit

An AI tool can be clever and still be wrong for the workflow.

Due diligence should test how the tool fits into the way work actually moves through your business. Does it connect to the systems people already use? Does it create more steps than it removes? Does it make review easier, or does it produce output that takes longer to fix than starting again?

Useful workflow questions include:

• Where does AI enter the process?
• What input does it need?
• Who checks the output?
• Where is the final version saved?
• How are changes tracked?
• How does the next person in the workflow know what happened?

I think about AI as part of Human-Engineered Digital Systems because the tool is only one component. The useful bit is the system around it: people, process, data, review, documentation and accountability.

Decide what needs human review

Not every AI output needs the same level of review.

A rough internal summary may only need a quick check. A public article, client report, sales email, technical explanation or regulated update needs more care. The due diligence process should define those review levels before the tool becomes part of routine work.

For example:

• Low risk: internal brainstorming, rough outlines, formatting support.
• Medium risk: marketing drafts, customer FAQs, operational summaries.
• Higher risk: public advice, legal or medical-adjacent content, financial claims, sensitive customer communication, decisions affecting people.

Human review is not a sign that AI is weak. It is how you make AI useful without handing it responsibility it cannot carry.

Look for consistency, not just quality

AI systems can vary.

The same prompt may produce different outputs. A small wording change may shift the answer. A model update may change behaviour. A tool that feels reliable in January may behave differently later in the year.

Good AI due diligence therefore includes consistency checks:

• Does the tool produce similar quality across repeated tests?
• Does it follow instructions reliably?
• Does it preserve terminology?
• Does it behave differently with longer inputs?
• Does output quality drop with complex or conflicting material?
• How will performance be monitored after deployment?

Many businesses skip this bit. They test once, like the answer, and move on. But AI is not a normal static template. Any workflow that depends on it should include ongoing checks.

Ask what happens when it fails

Every system fails eventually.

AI due diligence should include the boring but essential question: what happens when this goes wrong?

That might mean an inaccurate answer, a privacy concern, a biased output, a broken integration, a hallucinated citation, a missed warning sign or a workflow that quietly routes bad information to the wrong place.

Before deployment, decide:

• how issues will be reported
• who owns fixes
• when outputs should be escalated
• how content or decisions can be rolled back
• how users will be told if something important changes
• how lessons will be fed back into the workflow

This is not pessimism. It is grown-up systems design.

A practical AI due diligence checklist

Before you trust an AI tool or workflow, check the following:

1. Use case: the task, audience, risk level and expected outcome are clear.
2. Evidence: the tool has been tested against real examples, not only vendor demos.
3. Accuracy: outputs are checked for factual reliability, missing context and invented details.
4. Data: privacy, storage, training use, retention and access controls are understood.
5. Workflow: the tool fits into existing systems without creating hidden manual work.
6. Human review: review points are defined according to risk.
7. Accountability: a named person or team owns final approval.
8. Monitoring: performance will be checked over time, not only at launch.
9. Failure plan: there is a process for errors, escalation and rollback.
10. Documentation: decisions, settings, prompts, tests and review rules are recorded.

This does not need to become a bureaucratic monster. A lightweight checklist is often enough to stop the worst mistakes.

AI due diligence is really trust design

The point of AI due diligence is not to block innovation. It is to make trust easier to earn.

If an AI system is genuinely useful, due diligence helps prove it. If it is fragile, risky or unsuitable, due diligence helps you find that out before it causes problems.

The businesses that get the most value from AI will not be the ones that adopt every tool fastest. They will be the ones that know how to evaluate tools, design workflows, keep humans accountable and monitor what happens after launch.

That shift separates experimenting with AI from building something dependable with it.

Due diligence tells you whether a tool is worth trusting on the day you assess it. Whether it stays trustworthy is a different question, covered in our research on production AI reliability and in five types of AI drift. For the checks that come first, see the AI readiness checklist.

If you want help evaluating AI tools before they become part of your business, explore AI setup and consultancy or get in touch through Claire Nicholson Digital. Good due diligence does not add process for its own sake; it helps the AI earn trust before the business leans on it.