Key Takeaways
- LPs are checking control. The AI questions in DDQs and operational due diligence test whether a firm has AI under control. Sophistication is a distant second.
- Use has outrun policy. In Cambridge Associates' 2025 review, 80% of managers used AI in some form and only 49% had a formal AI policy.
- Overclaiming is the bigger risk. The SEC has already penalized advisers for AI claims they could not back up. Say less, and be able to prove all of it.
- A good answer is specific and bounded. A named owner, approved tools, a written policy, human review, and logs that show the review happened.
- The answer is only as good as what sits under it. Build the controls first, then write the paragraph.
The AI section of a due diligence questionnaire used to be a formality. A line about "exploring use cases," maybe a mention of a pilot, and everyone moved on to the next tab. That window is closing.
Cambridge Associates runs a few hundred operational due diligence reviews of private fund managers every year. In its 2025 Private Investment Operational DDQ Analysis, 80% of managers reported using AI in some form, with the highest uptake among PE managers. Only 49% had adopted a formal AI policy. And 38% said they use proprietary information in AI tools. The same report says AI oversight, governance and data security are becoming distinct diligence considerations.
Read those three numbers together. Most firms use AI. About half have written down how. More than a third are putting confidential information into it. That gap is exactly what an LP's operations team is paid to find.
The pull from the allocation side is just as strong. In Edelman Smithfield's 2026 Global LP Survey, every LP said it matters that GPs demonstrate AI capabilities when they make allocation decisions, and they expect concrete evidence without anyone overstating AI's role in decisions.
So GPs get two asks at once. Show us you use AI. Show us you have it under control. I think most firms are much better prepared for the first ask than the second. This post is about the second one.
LPs Want Control Before Cleverness
When an AI question lands in a DDQ, the instinct is to show off. List the tools. Mention the copilot pilot. Add a sentence about "AI-driven insights" across the deal cycle.
That answer misreads who is asking. An operational due diligence team scores risk. Their job is to find the thing that blows up in year four of a ten-year fund. With AI, the failure modes are familiar ones: confidential data ends up somewhere it shouldn't, a wrong number makes it into an investment committee memo, nobody can say who approved a tool or who is watching it.
Cambridge's own list of focus areas lines up with this. Formal AI policy. Handling of confidential information. Third-party vendor risk. Outputs that were not reviewed carefully enough. Nothing on that list asks how advanced your models are.
Read the question behind the question
Every AI question in a DDQ traces back to one of four worries. The wording changes from LP to LP. The worries don't.
- Data and confidentiality. "Where does our data go?" They want to know whether LP, deal or portfolio data can leave your control or end up training someone else's model.
- Ownership and supervision. "Who owns AI at the firm?" They want one named person who answers for it, plus a written policy and a consequence for breaking it.
- Accuracy and oversight. "Does a human review the output?" They want to know a confident, wrong answer can't walk straight into an investment decision.
- Use and claims. "What do you actually use it for?" They want your description of AI to match what your team does on a Tuesday.
If you can answer those four plainly, you can answer almost any version of the AI question an LP sends you.
Saying Less Is Safer Than Saying More
Here's the part that surprises people. The biggest risk in your AI answer is claiming too much.
In March 2024 the SEC settled charges against two investment advisers, Delphia and Global Predictions, for false and misleading statements about their use of AI. The penalties totaled $400,000. Delphia said it used AI and machine learning on client data to pick companies before others did, and the SEC found it did not have those capabilities. Global Predictions called itself the "first regulated AI financial advisor."
Neither firm was a PE fund, and the penalties were small. That doesn't matter much. The pattern is set: a regulator will read a statement about AI the same way it reads any other material statement. If it's in your marketing, your DDQ or your LP letter, you need to be able to back it up. (People call this "AI washing." I think of it as writing a check your tech stack can't cash.)
The LP survey data points the same way. LPs want evidence of AI capability, and they explicitly don't want the role of AI overstated. An inflated answer fails both tests.
Claim only what you can show
A simple test for every sentence about AI in your DDQ: could you hand the LP the evidence within a week? A tool list. A contract clause. A policy with a date on it. A review log. If the answer is no, either cut the sentence or build the evidence. Those are the only two options.
A Good Answer Is Specific and Bounded
Vague answers feel safe to write and read badly. Compare these two. Both are illustrative, not from any real firm.
The weak version: "We are actively exploring AI across the investment lifecycle and have implemented appropriate safeguards."
The good version:
Sample answer, illustrative. Our COO owns AI use at the firm. Staff may use two approved tools, an enterprise AI assistant and a document review tool, both under contracts that bar training on our data. LP information and material non-public information may not be entered into any other tool. Any AI-assisted analysis that feeds an investment memo is reviewed and signed off by the deal lead. Our written AI policy was adopted in [month, year], every employee attests to it annually, and usage logs are retained and reviewed each quarter.
Look at what the second one does. It names a person. It draws a boundary around which tools are allowed and which data is off limits. It says where a human checks the work. It points at evidence an LP could ask to see. And it makes zero claims about AI driving returns.
That last point matters. You can talk about value elsewhere, in the parts of the pitch where you show deal work. The governance answer should read like a control description, because that is what the reader is grading.
Write the standing answer once
Treat your AI answer like any other standing DDQ section. One owner. One version. Updated every quarter as tools and policies change. Then pull your annual LP letter language and your pitch materials from that same source.
Consistency matters more than polish here. If the DDQ says two approved tools and the pitch deck talks about a firmwide AI platform, an ODD analyst will notice, and the next call will be about the mismatch.
Governance Has to Exist Before the Answer Does
An answer is a description of something. If the something doesn't exist yet, a well-written paragraph is a liability with good grammar.
This is where most firms actually are. Half the managers in the Cambridge review had no formal AI policy. So the honest first step for a lot of GPs is to stop drafting the answer and build the thing it describes. The minimum foundation looks like this:
| Control | What it means | Evidence an LP can see |
|---|---|---|
| Named owner | One person accountable for AI use and policy | Policy document naming the role |
| Approved tools | A short list of tools staff may use, and the data each may touch | Tool list plus contract terms on training and retention |
| Written policy | Acceptable use, data classification, what is prohibited | Dated policy and staff attestations |
| Human review | Where a person must check AI output before it informs a decision | Sign-off records on memos and models |
| Access and logs | SSO, role-based access, retained audit logs | Log exports and quarterly review notes |
None of this is exotic. It is the same discipline firms already apply to email retention or trading controls, pointed at a newer set of tools.
Make the evidence boring and exportable
The best governance evidence is dull. A log export. A policy PDF with a date. A quarterly review note that says what was checked and what changed. If producing it takes a fire drill, it won't hold up across a full fundraise.
This is the work behind PressW's AI Security, Compliance & Governance practice: usage policies covering acceptable use and data classification, SSO and role-based access, retention and data loss prevention rules, guardrails that require human approval before an agent takes a destructive action, and audit logs that are exported and reviewed on a schedule. Every control is documented and mapped to a requirement, so the answer to an LP question is a file you can send.
We've seen why auditability matters in regulated work. For Encore Compliance, we refined an AI system that flags possible MNPI disclosures in expert network calls, using step-by-step reasoning a compliance reviewer can follow and audit. The platform's reliability was part of the story when ACA Group acquired Encore. The lesson carries over directly: if a reviewer can't follow how the AI got to its answer, the answer won't survive scrutiny.
The Question Will Reach the Portfolio Next
Today most AI questions in diligence focus on the management company. Your tools, your staff, your data. I expect that to widen.
The portfolio is where AI touches customer data, employee data and regulated processes at scale. Sooner or later an LP will ask how you know your portfolio companies are handling AI responsibly, and "we leave that to management" will land about as well as it did for cybersecurity a few years ago.
I'll be honest that this is a prediction. I don't have a survey that proves the timing. But the logic is hard to argue with. An LP's exposure sits in the portfolio, and the governance questions will follow the exposure.
Use one template across the portfolio
The firms that will handle this well are the ones that set a common baseline now. Same policy template. Same minimum controls. Same quarterly reporting format. A portfolio company can go further than the baseline. It just shouldn't fall below it, and you should be able to show where each company stands on one page.
The Best Answer Describes Something Real
I'm convinced the AI question in diligence is here to stay and will get sharper. What I can't tell you is how fast it standardizes. As far as I can see, there is no industry-standard AI section in the common DDQ templates yet, and LPs are asking in their own words. That will probably change. When it does, the firms with real controls will update a document. Everyone else will start a project under deadline.
So here's a specific next step. Pull the AI answer from your most recent DDQ. Read each sentence and ask whether you could hand over the evidence within a week. Where the answer is no, that's your governance roadmap.
If you want a second set of eyes on that answer, or help building the controls behind it, we do this through AI Security, Compliance & Governance. Book a Discovery Call and we'll walk through it together.
FAQ
Most AI questions in DDQs and operational due diligence fall into four areas: where firm and LP data goes, who owns AI at the firm, whether a human reviews AI output before it informs a decision, and what the firm actually uses AI for. A strong AI governance answer addresses all four with specifics and evidence.
Increasingly, yes. Cambridge Associates found that 80% of private investment managers it reviewed in 2025 used AI, but only 49% had a formal AI policy, and it says it prefers to see a standalone AI usage policy. A written, dated policy is one of the first things an ODD reviewer will ask for.
AI washing means overstating how much or how well a firm uses AI. The SEC settled charges against two investment advisers in 2024 for misleading AI claims, under the same rules that govern any other material statement. For GPs, every AI claim in a DDQ, pitch deck or LP letter should be backed by evidence.
A short, factual paragraph is usually enough. Describe the approved uses, the governance in place and any material changes since the last letter, and keep it consistent with your DDQ answer. Avoid claims about AI driving returns unless you can substantiate them.
One named person, usually the COO, CCO or CTO, depending on how the firm is organized. What matters to an LP is that ownership is clear and written into the AI policy, with a defined process for approving tools and handling violations.
Expect requests for the AI policy, the list of approved tools, the contract terms covering data training and retention, records showing human review of AI-assisted work, and audit or usage logs. Evidence that can be exported on request carries far more weight than a written assurance.
