AI Prototype Due Diligence: An Evidence Ladder

Why AI Prototypes Raise the Diligence Bar

AI prototype due diligence should determine what the product has actually proved. A polished demo can establish that an interaction is possible. It cannot establish sustained customer value, lawful data use, reliable performance, production controls, viable economics, or compliance within a specific regulated activity.

The faster a team can make the first artifact, the more important it becomes to classify the evidence behind it.

Two demos can hide different companies

Imagine two products that answer the same financial question in the same clean interface.

The first uses a small set of hand-selected documents, a generous model, and a human quietly correcting failures before every presentation. The second is connected to permissioned customer data, records its sources, routes uncertain cases for review, logs model and prompt versions, measures error rates, and has been used in a controlled customer workflow.

They may look identical for five minutes. They are not at the same stage.

In episode 101 of Venture Step, Matt Ober argues that AI is reducing the time and technical effort needed to reach a proof of concept. That can be good for founders and customers. It also makes surface polish a weaker signal.

Use an evidence ladder, not an AI label

The ladder below separates what a product can show from what it can support.

The categories are a Venture Step framework, not a certification. A company can have production-grade infrastructure and weak customer evidence. Another can have strong demand and immature controls. Diligence should record both.

flowchart TD
    A["What did the demo prove?"] --> B["Customer evidence"]
    A --> C["Data and rights"]
    A --> D["Failure behavior"]
    A --> E["Governance and accountability"]
    A --> F["Economics and operations"]
    B --> G["Current evidence level"]
    C --> G
    D --> G
    E --> G
    F --> G

Customer evidence has to move beyond enthusiasm

A demo audience can be impressed without having a costly problem. A pilot can begin because an executive is curious. Early revenue can come from services work or a discount that will not survive renewal.

Steve Blank's Investment Readiness Level essay argues for evidence and learning rather than judging a venture from a presentation and short demo. The practical record should preserve the hypothesis, test, observed behavior, result, and resulting decision.

Ask what users did without assistance. Identify the consequential task, the prior method, the frequency of use, and the cost of failure. Separate a signed pilot from active usage. Separate booked revenue from retained revenue. Record churn and the reasons behind it.

None of these measures proves product-market fit alone. Together they show whether the company is learning from the market rather than performing progress.

Data rights come before data advantage

An AI product may depend on customer records, licensed datasets, public information, generated data, or vendor outputs. Diligence should trace each important input to a right, permission, retention rule, and intended use.

“The customer gave us access” is incomplete. The customer may not have the right to authorize every downstream use. A vendor agreement may restrict model training. A dataset may permit research but not commercial deployment. Personal or confidential information may require stronger controls and deletion processes.

The team should be able to explain where data enters, where it is stored, which providers receive it, whether it is used to improve shared models, how it is removed, and what happens when a customer revokes access.

For a claimed data moat, ask one more question: how does lawful access produce an outcome a customer values? Volume without relevance, freshness, quality, or reinforcement is not defensibility.

Failure behavior is part of the product

AI systems can produce confident errors, omit important facts, follow malicious instructions embedded in retrieved content, expose sensitive information, or behave differently after a model change.

The NIST Generative AI Profile is voluntary, cross-sector guidance. It organizes risk work around governance, context, measurement, and management. It is not a seal of approval. It does provide a strong diligence prompt: what risks has the company identified for this use, how are they measured, and who acts when the result exceeds tolerance?

Test cases should include ordinary use, edge conditions, adversarial inputs, missing data, stale data, conflicting sources, provider failure, and attempted misuse. Results should be saved with enough context to reproduce them. A percentage without the test population, threshold, version, and failure definition says little.

The product also needs a safe response when it does not know. That may be refusal, retrieval of a source, human review, reduced authority, or a fallback workflow.

The regulatory perimeter must be named

“Fintech” is not a regulatory category with one checklist.

A member broker-dealer using GenAI may need to consider FINRA rules governing supervision, communications, recordkeeping, and fair dealing. FINRA's 2026 report discusses formal review, testing, monitoring, prompt and output logs, model versions, and human review for firms within its remit.

A registered robo-adviser has different obligations. The SEC's robo-adviser guidance says registered robo-advisers remain subject to the substantive and fiduciary obligations of the Advisers Act.

The Federal Reserve, OCC, and FDIC issued revised model risk guidance in 2026. It is expected to be most relevant to larger regulated banking organizations and excludes generative and agentic AI from its direct scope, while noting that broader governance should guide tools outside the document.

These sources should not be blended into one universal rule. Diligence needs the actual entity, activity, customer, jurisdiction, and role of the system.

Production requires observable control

A team should be able to show who can change the system, who can approve a release, and who can stop it. The record should connect a customer-facing result to the model, prompt, retrieval sources, configuration, permissions, and human actions that produced it.

Monitoring should reflect the real harm. Accuracy may matter, but so can unsupported recommendations, privacy events, unfair outcomes, missed deadlines, escalation volume, support burden, and customer correction rates.

A human in the loop is not automatically a control. The reviewer needs enough time, information, authority, and sampling coverage to catch the relevant failure. If a system produces ten thousand outputs and a person glances at ten, the company should explain why that sample is adequate.

Economics are evidence too

An AI workflow can look efficient while hiding expensive inference, manual review, implementation labor, support, data licensing, customer-specific configuration, or liability.

Record gross margin at the current usage level, not only the expected margin after scale. Separate recurring software revenue from services and pass-through costs. Measure how much human correction the product needs and whether difficult customers create more work than the price covers.

Early numbers will be noisy. The goal is not false precision. It is an honest model that reveals which assumptions would break the business.

Match the next question to the current level

A mockup needs evidence that the problem and interaction are worth pursuing. A functional prototype needs observed customer use and a failure record. A pilot needs a path to repeatable value, contractual clarity, and production controls. Controlled production needs monitoring, support, incident response, and economics that survive real variation.

Do not ask a prototype to prove scale. Do not let a demo pretend it already has.

For the adjacent defensibility question, read [[What Makes a Fintech Moat in the AI Era]]. [[E104 Content Plan|Episode 104]] offers a useful companion on evidence and assessments, while [[E103 Content Plan|episode 103]] covers AI-assisted work, measurement, and accountable operations.

This guide is a Venture Step synthesis of the E101 interview, current NIST guidance, current FINRA material, SEC robo-adviser guidance, 2026 interagency banking guidance, and customer-development practice. It is not legal, compliance, investment, or procurement advice. Review the exact product and activity with qualified specialists before deployment.