If an investor asks about your AI governance, they're probably working from one of two published documents, or from nothing at all. Both documents are free to read. Build your answers against them and you'll be better prepared than most of the room.
The first is the Voluntary Responsible AI Commitments from Responsible Innovation Labs, a nonprofit whose coalition lists General Catalyst, Base10, Bessemer Ventures and Khosla Ventures among its investors. VC firms that sign agree to "consult the commitments when conducting diligence on potential investments in AI startups". The second is the RAIS Framework from Radical Ventures, an open spreadsheet for early-stage investors that scores AI risks before and after mitigation.
The earlier version of this page cited portfolio guidance from Andreessen Horowitz and Sequoia, insurer requirements and failed M&A deals. We couldn't find any of it in a primary source, so it's gone. What follows maps every item to a clause in one of the two frameworks or to the law.
Screenshot: Voluntary Responsible AI Commitments for Startups & Investors, Responsible Innovation Labs.
The honest picture at seed
Two comments from a r/venturecapital thread on technical diligence capture the range. One investor described a two-stage process:
"Pre Termsheet we usually do lightweight tech dd as we are not engineers. ... Post Termsheet we hire external CTOs to do in-depth tech DD" (u/moosrain)
Another was blunter:
"I'm at an early stage VC and have never seen them do true technical diligence on seed / series A investments" (u/zorrr225)
So you may not get asked. We'd still prepare, because the same documents answer the customer security questionnaire, the enterprise procurement review and, for EU sales, the regulator. The post-term-sheet CTO review is where a missing inventory hurts.
The 18-item checklist
Group 1: Decisions and ownership
1. A one-page AI policy
Which tools staff may use, which data can go into prompts, who approves new tools. It's the first thing anyone asks for and the cheapest to produce. Our AI acceptable use policy template is a starting point.
2. An AI system inventory
The RIL commitment is to "document decisions about how and why AI systems are built and/or adopted (including the use of third party AI products)". A spreadsheet works: tool, purpose, data it touches, vendor, date you last read the terms.
3. A named owner and a standing review
The RIL Protocol asks for internal governance with "a forum for diverse stakeholders" and "a single owner for scheduling and running meetings", with notes kept. At ten people that's a monthly half hour with product, engineering and whoever handles legal.
4. A responsible AI document in the data room
This one is in the Protocol almost word for word: "add a responsible AI document to your data room for investors who are conducting diligence", covering your philosophy, implementation plan, and evidence of progress and testing. Everything else on this list is what goes in it.
5. A board slide and an investor-update section
The Protocol also suggests a responsible AI slide in the standard board deck and a section in emailed investor updates. VC firms that signed the Commitments agreed to make reasonable efforts to "foster responsible AI practices among portfolio companies", so give them something to point to.
Screenshot: Responsible AI Protocol, Responsible Innovation Labs.
Group 2: Testing and oversight
6. Bias and output testing, written down
The Protocol says to "test and audit data and system outputs, including harmful bias and discrimination, and document the results". The documented part is what diligence checks. A test log with date, method and result beats a paragraph of intent.
7. A red-team or adversarial test
Also in the Protocol: "Use adversarial testing, such as red teaming". For an LLM feature, a day of trying to make it leak data, ignore instructions or produce harmful output counts. Keep the prompts and what you fixed.
8. Human oversight, defined
The Protocol splits it into "in the loop" (a human approves before the AI acts) and "on the loop" (a human can review after). Say which applies to each AI feature and why.
9. Monitoring for drift and errors
The Protocol describes monitoring as "systems for spotting errors, drift, hallucinations". A dashboard, an alert threshold and a weekly glance is enough at seed.
10. A user feedback route
The Commitments ask you to "adopt feedback mechanisms". A report button that lands in a named person's queue, plus a log of what you changed, answers it.
Group 3: Data and models
11. Data provenance
The Protocol's risk assessment asks, "Where is the data coming from and what risks does it create for the product?" For anything you train or fine-tune, list the sources and their licenses.
12. Rights to the data
Document consent for training data and confirm "you have rights to it (IP, confidentiality)", in the Protocol's words. If counsel has signed off, include the memo.
13. Vendor training terms
For each AI vendor, note whether your customers' data can be used to train the vendor's models, and where the contract says so. Founders sign these terms fast. Investors who read them notice.
14. Model cards and datasheets
The Protocol says to release a model card "for each model you build" stating purpose and limitations. RAIS adds that investors should ask for "datasheets and model cards", AI principles, stakeholder maps and design history files.
15. Usage limits that actually bind
One line in the Protocol is worth quoting to your own team: "Burying a usage limitation in your terms and conditions, without other technical limitations or safeguards, isn't an adequate way to mitigate a risk." Show the technical control, not just the clause.
Group 4: Law
16. Data processing agreements
Under GDPR Article 28(3), processing by a processor "shall be governed by a contract" binding the processor. For every AI vendor that touches personal data, have the DPA on file and a column in your inventory saying so.
17. An EU AI Act classification
If you sell into the EU, write down which risk tier each AI feature falls in. Annex III puts tools that "analyse and filter job applications" and credit scoring in the high-risk tier. Those rules now apply from December 2, 2027 under the Digital Omnibus. Breaching the operator obligations listed in Article 99(4) can cost up to EUR 15 million or 3% of worldwide turnover, and for SMEs and start-ups Article 99(6) applies whichever is lower. A one-page classification memo is cheap. Our EU AI Act guide for small teams walks through it.
18. An employment-law check, if AI touches hiring
The EEOC's 2023 AI guidance came off its website on January 27, 2025, so don't cite it as current. The specific duties now sit in state and city rules such as Connecticut SB 5 and NYC Local Law 144. A short memo listing which ones apply to you is enough.
Score yourself the way RAIS would
Screenshot: RAIS Framework README, Radical Ventures, via GitHub.
RAIS splits risk into three areas: social and ethical, industry-specific and regulatory, and technical. Each risk is likelihood times impact, with likelihood scored from 0 to 7, and you score it twice: before mitigation and after. Bands run in 10-point intervals from low to severe. The framework also tells investors to keep the exercise focused on "the company's initial product and beachhead market or pilot".
That's a useful constraint for founders too. Score your one shipping product, not your roadmap. A sheet showing three high initial risks brought down by named mitigations reads better than a sheet of all-green scores nobody believes.
Our take
We'd build item 4 first and let it pull the rest along. One document, a dozen pages at most: inventory, test log, red-team notes, vendor terms and DPAs, the EU classification, the owner. It answers the light pre-term-sheet questions in minutes and gives the post-term-sheet CTO review something to verify. Skip the long "AI ethics charter". The Protocol asks for a values statement, not a treatise, and nobody in diligence will read it.
How we checked this: on October 13, 2026 we read the Responsible Innovation Labs Commitments and Protocol PDFs and the RAIS Framework README, and took the three screenshots above. Legal items were checked against the AI Act, the Digital Omnibus and the GDPR on EUR-Lex, and K&L Gates' note on the EEOC guidance. Community quotes come from one r/venturecapital thread; no official video or post fit as an embed. Earlier claims about a16z and Sequoia guidance, insurer requirements and M&A deals were removed because we found no primary source. Last reviewed: October 13, 2026.
