What AI work records do investors ask for in due diligence?
Diligence on an AI-heavy business asks four record questions: can you show what was delivered to customers, who approved consequential outputs, what the agents cost and what limits bound them, and who holds access to what. Review the receipt and actual deliverable before accepting a handover.
Investors are not auditing your AI for its own sake; they are pricing risk. Undocumented agent work reads as unpriced risk in three flavours: customer risk (deliveries nobody can evidence), conduct risk (outputs nobody approved), and cost risk (agents spending without visible controls). The records that answer diligence are the same records this cluster builds for clients and auditors, re-indexed for a data room.
File one, delivery records: a sample of customer jobs with their handovers, steps, and recorded acceptances, plus your retention schedule. File two, approval records: your policy for which outputs need a named human decision, with samples showing decisions on the record. File three, spend: agent costs by period, the caps in force, and refusal logs showing the caps working. File four, access: the inventory of agents and connections, owners named, reviewed on a cadence.
The data-room virtue is currency. A diligence request answered from maintained records, exported this quarter, reads as a company that runs its agents. The same company assembling the files in the diligence week reads as a company describing controls it hopes it has. Build the four files once, refresh them with the quarterly export, and the AI section of any data room becomes the shortest one.
Index: the AI records data room
1. Delivery records: 5 to 10 sample customer jobs (handover links, steps, acceptances) + retention schedule. 2. Approval records: the approval policy (one page) + samples with named decisions. 3. Spend records: agent costs by quarter; caps in force; refusal log summary. 4. Access records: agent and connection inventory with owners and review dates. 5. Incident file: incident records for the period, with control changes. 6. Format note: the record format is AER-1 (IETF Internet-draft-zambo-aer1-21), with a public verify path, stated on one line so a technical reviewer can test it.
Worked example
Item 6 invites a test, and the test is public: any sample job's receipt, for example from https://zambo.dev/handover/45434a17-4afc-486a-9646-e689bcee4297 , recomputes at https://zambo.dev/verify/ without an account. A diligence reviewer who can run that check in the first meeting prices the rest of the data room differently.
Frequently asked questions
We are pre-revenue. Do we need this?
At small scale the four files are four short documents, and building them now is what makes them cheap. The scramble investors remember is the one that happens during the round; the habit costs an afternoon a quarter.
Should the data room include raw chat logs?
No. Diligence wants evidence of control, not your raw internals. Step records with approvals and spend controls answer the questions; raw chats add exposure without adding assurance.
What if our records have gaps?
Include the gap page, bounded by period and system, with the fix and its date. A declared gap with a remediation reads as operational maturity; a discovered gap reads as the opposite, and diligence teams are paid to discover.
By Brennan Zambo, founder of Zambo.
Last verified: 2026-10-17.
Try a handover
A handover gives your client one proof link with verifiable receipts to review, then Accept or Flag.
try it: say 'use zambo to hand this over to <client>' in your ai