AI startup diligence red flags, by stage

AI startup diligence red flags are stage-specific because the same fact means something different at different cheque sizes. This page lists only the flags that exist because the target is an AI company. For the general list, a single developer who holds everything, no tests, a rewrite in flight, unpatched dependencies, an architecture that cannot scale, see technical due diligence red flags; nothing there is repeated here.

One flag applies at every stage, so it comes first.

What is the flag at every stage?

The flag at every stage is an AI claim with no test behind it. Reveneau's diligence protocol treats an untested claim as a finding in its own right, whatever the stage, because every enforcement action to date began the same way: a statement about what the AI does that nobody outside the company checked.

The record is short. The SEC's March 2024 settlements with Delphia and Global Predictions, for $225,000 and $175,000, were about statements describing AI capabilities the firms did not have [1]. The SEC's January 2025 order against Presto Automation found that the speech recognition in its deployed AI product had for a period been a third party's, and that the vast majority of orders through its own version needed human intervention [2]. The SEC's April 2025 charges against the former chief executive of Nate, which raised over $42 million, alleged that purchases the app claimed to complete with AI were entered by contract employees [3]. The FTC's Operation AI Comply, announced 25 September 2024, brought five actions in one day, including DoNotPay's $193,000 settlement over its "AI lawyer" claims [4].

At pre-seed the test is one live input in a screen share. At growth it is the eval suite. At every stage the flag is the same: the company said what the AI does and the investor did not check. How to verify an AI claim with a test is the protocol.

What are the flags at pre-seed?

At pre-seed the flags are about honesty of description, because there is no margin to rebuild and often no codebase to read. Three matter.

"AI" in the pitch and no model in the product. Ask to see one input processed end to end. If a person does the work today and the model is on the roadmap, the company is a services business with an intention. That can be a fine investment when described that way. What "we use AI" should mean at pre-seed is the page for this conversation, and technical red flags at pre-seed and seed covers the general ones at that stage.

The founder cannot say which model. A founder building on a model knows its name, its version and its price. One who says "we use the best available" has not yet built anything that depends on the answer.

A base rate ignored. RAND's 2024 report, from interviews with 65 experienced data scientists and engineers, opens by noting that "by some estimates, more than 80 percent of AI projects fail" and labels that as an estimate [5]. A pre-seed pitch that treats the AI feature as done when it is a plan is asking you to ignore the base rate. Discount the roadmap accordingly.

What are the flags at seed and Series A?

At seed and Series A the flags move to margin and dependency, because there is now revenue, an invoice, and a product that customers use in ways the pricing did not predict.

A gross margin nobody has rebuilt. The deck has a blended figure. Nobody has built the per-customer table from the model-provider invoices. Bessemer's August 2025 data puts the fastest-growing AI companies at 25 percent gross margin and often negative [6]; a company growing at that rate with a blended figure in the deck may have contracts losing money on every use. Rebuilding inference gross margin from invoices is the method, and the absence of the table is the flag.

Flat-fee contracts with no consumption cap. A customer who pays a fixed amount and can call the model without limit has a margin that only they control. The cap is entry LLM10 in the OWASP list, and its absence is both a security and a margin flag.

A single pinned model and no migration plan. Anthropic retired Claude Sonnet 4 and Claude Opus 4 on 15 June 2026 after notice on 14 April, and states at least 60 days' notice as its rule; OpenAI states at least 6 months for generally available models [7] [8]. A company at Series A has been through at least one of these or is about to be. Ask what happened. "We have not had to migrate yet" is the flag.

A wrapper priced as a product. Growth from a product whose value is the model's output, with churned customers moving to the provider's own app. AI feature or AI wrapper is the test; the flag is that nobody ran it before the price was set.

What are the flags at growth and buyout?

At growth and buyout the flags are about whether the company can be handed over, because the buyer is paying for an asset and the asset is the codebase, the evals and the data, all of which have to survive a change of hands.

A green eval suite that has never failed. A suite that has never blocked a release has never been used as a gate. At growth, the company has shipped hundreds of changes; if none failed the suite, the suite does not touch what changes. The eval suite as a diligence artefact explains how to read the history.

No provenance record for a generated codebase. The company cannot say which tool wrote which files under which terms, or which modules a person shaped. The US Copyright Office's January 2025 conclusion that purely AI-generated material is not protected by copyright makes this a question about what the buyer is buying [9]. Code provenance and licence exposure is the check.

A scan that has never been run. Veracode's July 2025 report found 45 percent of AI-generated code samples failed security tests, Java at 72 percent, with no improvement from newer models [10]. A growth-stage company with a generated codebase and no scan has that rate in production. Security of AI-written code in diligence covers what to run.

A data moat on a slide with no curve. By growth, the company has enough data to plot quality against volume. If it cannot, the moat has never been measured. Data moat claims gives the four tests.

One person who directs all the agents. The generated codebase looks like a team built it. Ask who writes the specs and who judges the output. If it is one name, the bus factor is one, whatever the commit history says.

The flags in one table

Stage	AI-specific flag	Evidence that clears it
Every stage	AI claim with no test	One held-out input processed live, trace visible
Pre-seed	"AI" in the pitch, no model in the product	One input processed end to end by the model
Pre-seed	Founder cannot name the model, version or price	A model inventory, even of one line
Seed / Series A	Blended gross margin, no per-customer table	The table, rebuilt from invoices and usage logs
Seed / Series A	Flat-fee contracts with no consumption cap	The cap in the code, with the number
Seed / Series A	One pinned model, no migration plan	Inventory with retirement dates and a tested migration target
Seed / Series A	Wrapper priced as a product	The wrapper test run and written down
Growth / buyout	Eval suite that has never failed	Failure history with resolutions
Growth / buyout	No provenance record	Record by module, tool, terms and human contribution
Growth / buyout	No security scan	Scan from the last quarter, triaged, fixes merged
Growth / buyout	Data moat with no curve	Quality-against-data curve from the suite
Growth / buyout	One person directs all agents	Two named people who write specs and judge output

What to do with a flag

A flag is a finding with a cost, and the report should give the cost. An untested claim costs a screen share. A missing margin table costs an afternoon with the invoices. A missing eval suite costs weeks of senior engineering after close and belongs in the price. An untested migration is a project on the day the provider sends the notice. A missing provenance record is a lawyer's review before the code can be sold on.

Each of these on its own is a cost line. The reason to walk away is the pattern: a company that has several of them at once has been growing without looking, and the diligence is the first time anyone has. Technical due diligence scope by stage covers how much general review a given cheque can carry, questions for the management meeting turns each flag into something to ask in the room, and the AI startup due diligence guide puts the flags in the order the review meets them.