Any software company you assess today is likely shipping code that was partly written by AI. Google and Microsoft both stated in 2025 that AI now writes more than 20 percent of their code, and GitHub reports that more than 1.1 million public code repositories adopted AI coding tools between 2024 and 2025, both cited in Liu et al. (2026).
The question is no longer whether a target uses AI in development. The more useful questions are how much AI-assisted code is in the product, where it is used and what controls exist around it.
That changes what a Technical Due Diligence needs to answer. It is no longer safe to assume that all code was written by people who fully understand it.
Technical Due Diligence is not necessary in every transaction. But when software is a material part of enterprise value, it helps buyers, sellers and advisers understand what supports that value, what may weaken it and what needs to be addressed before the deal moves forward.
Technical debt that does not disappear on its own
A research team at Singapore Management University (Liu et al., 2026) examined more than 300,000 code changes that were verifiably made by AI across 6,299 open source software projects and five widely used AI coding tools. For each change, they ran automated quality and security scans on the code before and after.
They found more than 484,000 issues that could be traced directly to the AI-generated changes. Most were maintainability issues: code that works today but is harder and more expensive to change tomorrow.
The security findings were more concerning. The AI introduced roughly 1.5 times as many security issues as it fixed. And 22.7 percent of all identified issues were still present in the latest version of the code. Some had remained for more than nine months.
What this means for you: if AI introduces defects or maintainability issues and they are not identified early, they become part of what you acquire. In a transaction, that affects both valuation and post-close planning.
AI can help detect problems. It does not remove the need for review.
Researchers at Edinburgh Napier University (Belozerov et al.) examined code taken from real conversations between developers and ChatGPT, covering more than 2,300 files in C, C++ and C#. Among the most common security weaknesses were failures to validate incoming data and memory-handling flaws, both long-established vulnerability classes.
The researchers also tested whether newer AI models could find and fix these weaknesses themselves. Results improved significantly over the course of a year, from around half to roughly 75 to 80 percent.
That still leaves a meaningful gap. Around one in five vulnerabilities remained undetected. The models also reported issues that were not actually present, with the same confidence they used when they were correct. The researchers’ conclusion was clear: AI can be useful as an initial filter, but security-critical code still requires human review.
What this means for you: using AI to review AI-generated code is not, by itself, a sufficient control. Independent judgement and human verification still matter.
The confidence problem may be as important as the code problem
In a Stanford study presented at the ACM CCS security conference (Perry et al., 2023), developers completed security-related programming tasks with and without an AI assistant. Those who used AI produced less secure code. They were also more likely to believe their code was secure.
The study used an earlier generation of AI tools, and the tools have improved since. But the human pattern is still relevant: AI makes code faster to produce and can increase confidence in the result at the same time. In the study, participants who were more sceptical of the AI and more deliberate in how they used it produced more secure code.
What this means for you: management assurances that the codebase is well understood or technically sound are no longer enough on their own. In an AI-enabled development environment, those claims need stronger evidence.
Five questions that should affect the deal
If the target uses AI in software development, these are the questions a Tech DD should answer. And the answers should lead somewhere concrete: into valuation, transaction terms or post-close priorities.
-
Does the company know how much of its code is AI-assisted?
If not, you are dealing with avoidable uncertainty. That should either be priced as risk or clarified before signing.
2. Is AI-written code reviewed before it reaches production?
If not, expect future remediation costs. Those costs belong in the deal logic, not as a surprise after closing.
3. Is AI-generated or AI-assisted code covered by automated tests?
If not, future changes carry more risk. That affects both delivery capacity and the timeline behind the growth case.
4. Is technical debt increasing or being reduced over time?
If debt is accumulating, the cost of owning and evolving the business rises with it. That belongs in the investment case.
5. Could someone other than the current team take over the codebase?
If not, key-person dependency becomes a transaction issue, not just a staffing issue. McKinsey’s review of 40 technology acquisitions found that engineer attrition was closely linked to deal failure.
AI does not reduce the need for due diligence.
It raises the standard for it.
AI-generated code is not inherently poor quality. It can be useful and productive. The issue is that software is now produced at a pace that can exceed an organisation’s ability to review, verify and govern it properly. And many weaknesses are not obvious simply because the software appears to work.
That is why Tech DD matters more, not less. Buyers are not only assessing what the company built. They are assessing how it was built, how well it is understood and what that means for valuation, scalability and post-close execution.
At System Verification, we provide independent assessment of software, code quality and technical risk. In a Tech DD, that means showing where AI-accelerated development may affect value, what may require further investment and what should be clarified before the deal is signed. That gives buyers a stronger basis for valuation, negotiation and day-one planning.