The new due diligence: why VCs are walking away from AI startups with hidden legal risk

Legal risk used to be a lawyer’s problem, discovered after the term sheet. In 2026, it has become an investor’s problem, priced in before the first meeting ends. Founders who cannot answer one question – where did your training data come from? – are watching rounds die in diligence.

For years, venture capital and legal rigour lived in different rooms. In 2025, investors poured more than $97 billion into AI companies globally, roughly 40% of all venture funding, yet fewer than 15% of firms had any formal framework for assessing how those companies actually sourced and handled data. Capital was deployed at unprecedented scale into businesses whose single greatest legal exposure was examined less carefully than a seed-stage cap table.

That gap is now closing, fast. The wave of viral litigation hitting AI companies has done what no compliance seminar ever could: it has given legal risk a price tag. Anthropic’s $1.5 billion settlement over pirated training data turned an abstract debate about fair use into a line item every investment committee can understand. And once a risk has a number, it enters the diligence checklist – permanently.

The question that kills rounds

The new deal-defining question is deceptively simple: can you prove where every piece of your training data came from, and that you obtained it lawfully?

It is becoming a familiar pattern in the market: a startup sails through partner meetings on the strength of impressive traction, then stalls in technical diligence over a single finding – part of the model turns out to have been fine-tuned on a dataset scraped in breach of a platform’s terms of service. Nobody at the company had flagged it as a legal issue. The fund considers it uninsurable. The deal does not recover.

This is the shift founders keep missing. The realistic risk for an early-stage AI company was never a billion-dollar judgment – it was always going to be a deal-killing diligence finding. Investors are not waiting for you to be sued. They are pricing the possibility that you could be, and walking away when you cannot disprove it.

What the checklist looks like now

Diligence on AI startups has quietly professionalised. As the industry itself has noted, due diligence is becoming dynamic rather than static – an ongoing view of risk, not a snapshot taken at onboarding. For AI companies raising in 2026, the practical consequences are concrete:

• Data provenance documentation. Not a verbal assurance – records showing the origin, licence and acquisition method of every training source. “We used publicly available data” is no longer an answer; it is a red flag
• Compliance evidence at seed, not Series B. SOC 2 progress and AI bias audits, once growth-stage concerns, are now appearing in seed-stage checklists. The bar moved down the funnel
• Contractual allocation of output risk. Who is liable when your model defames someone, leaks personal data or reproduces copyrighted work? If your customer contracts are silent, your investors will not be
• Shadow AI exposure. How your own team uses public AI tools internally – and whether confidential material or client data has already leaked into systems you do not control
• EU AI Act readiness. Training-data transparency obligations for general-purpose models are phasing in through 2026. Any startup with European exposure will be asked how it plans to comply, and “we’ll deal with it later” reads as “we haven’t thought about it”

Roughly a third of deals already collapse at the final hurdle over preventable gaps. For AI startups, legal architecture has simply joined the list of things that can be wrong.

Why UK founders should care most

This matters disproportionately here. UK AI startups raised £3.4 billion in 2025 – 30% of all British venture funding, the highest share ever recorded. The domestic ecosystem is structurally overweight in exactly the category now facing the harshest diligence. British founders are also selling into the sectors – financial services, healthcare, legal – where enterprise buyers run their own vendor diligence on top of investor scrutiny. Fail one, and you have usually failed both.

There is a compounding effect, too. As I argued in a previous piece on defensible IP, most AI startups are building on borrowed infrastructure with little genuine ownership underneath. When an investor finds thin IP and murky data provenance in the same data room, the conversation is no longer about valuation. It is about whether there is a company there at all.

See Also

It’s 2025: stop running your company on spreadsheets

Turning diligence into an asset

The founders navigating this well have made one mental shift: they treat the diligence checklist as a product specification, not an exam to cram for. They maintain provenance records from the first dataset, not the first term sheet. They put data processing agreements in place before an investor asks. They can produce an audit trail in hours, not weeks.

The reward is not merely a smoother raise. In a market where most AI startups cannot answer the provenance question cleanly, the ones that can are converting legal hygiene into negotiating leverage – shorter diligence cycles, fewer escrow holdbacks, better terms. Clean architecture is starting to command a premium for the simplest of reasons: it is rare.

The uncomfortable truth for founders is that the era of raising on a demo and a growth curve is ending for AI companies. Investors have learned, expensively, that the most dangerous risks in this category are the ones that do not show up in the metrics. The next generation of winning AI startups will be the ones that made legal defensibility a design decision – long before anyone opened the data room.