An AI disruption risk assessment asks one question of a target: over the hold period, how much of what customers pay for could AI do instead, and what stops that from happening? Answered properly, it gives the deal team a score, a revenue-at-risk number and a view on what that should do to price, structure and the 100-day plan. Answered badly, it gives the committee "AI is both a risk and an opportunity", which nobody can price.
I've written before about AI washing, where the target overclaims its AI and the buyer pays for capability that isn't there. This is the mirror image, and in the lower mid-market it is the more common problem. Most targets I look at have little AI of their own. What they have is a service, a pricing model and a customer base that AI may quietly reshape. AI washing asks whether the target's AI is real. This asks whether the target's customers will still need it.
AI washing asks whether the target's AI is real. This asks whether the target's customers will still need it.
Why buyers now ask "will AI disrupt this business?"
Because the exposure is broad and the market has started pricing it. Skills England's 2026 annual skills report puts it at 70% of UK workers in occupations containing tasks that AI could potentially perform or enhance. The same report notes that exposure is highest in professional, analytical and clerical work, and that sectors centred on physical activity or human interaction, including construction and hospitality, remain less exposed.
Adoption is catching up with exposure. The ONS survey of AI in UK businesses found AI use among firms with ten or more employees rose from around 12% in late 2023 to around 35% by June 2026, with information and communication at 58% and construction at 13%. Around half of adopters report no impact on headcount so far. That is the point: the effect hasn't reached most P&Ls yet, which means it will arrive during your hold, not before it.
And investors are already moving. Bain's Private Equity Midyear Report 2026 describes a near 30% drop in public software valuations in February 2026 on uncertainty about AI's impact, software valuations in PE portfolios down roughly 8%, and buyers showing greater interest in companies "with physical or labor-intensive components that are less susceptible to automation". Your exit buyer will run some version of this test. Better to run it first, at entry.
If you want the wider context of how this fits with claims testing and the upside case, it's the first of the three jobs in AI due diligence for private equity. This article is the working detail of that first job.
An AI disruption risk framework: eight factors
The grid below is the one I use. Seven factors measure threat. The eighth measures upside, and I score it separately, because mixing the two lets a large cost-saving opportunity disguise a revenue line that is about to shrink.
Each threat factor is scored 1 to 5, where 5 is resilient and 1 is exposed. The seven add up to a threat score between 7 and 35.
| # | Factor | 1 (exposed) | 5 (resilient) | Evidence to request |
|---|---|---|---|---|
| 1 | Replicability of the core service by AI | Output is a document, summary or analysis a current model drafts acceptably today | Physical, on-site or judgement work carrying personal liability | Ten anonymised past deliverables, scope documents, quality review records |
| 2 | Revenue from hours billed or seats | Over 70% billed on time and materials or per user | Under 10%; priced on outcome, asset, visit or contract | Revenue by pricing basis, rate cards, top 20 contracts, utilisation reports |
| 3 | Data and proprietary workflow | Works on the client's data with generic tools | Owns years of structured data and a workflow competitors can't see | Data inventory, rights in contracts, systems map, process documentation |
| 4 | Switching costs and embeddedness | Project work, re-tendered annually, easy to split | Integrated into client operations, multi-year, painful to unpick | Retention cohorts, contract terms, churn reasons, integrations per client |
| 5 | Regulatory and trust barriers | Anyone can do it; no sign-off required | Licensed, accredited or insured activity with named accountability | Licences, accreditations, PI insurance terms, regulatory correspondence |
| 6 | Distribution and relationship ownership | Wins work through search, aggregators or price-led tenders | Owns relationships, frameworks or referral channels | New business by source, concentration, framework agreements, win rates |
| 7 | Management speed to adopt | No AI in delivery, no budget, no owner | Live AI tools in delivery with measured results and a named owner | 12 months of AI vendor invoices, tool usage data, interviews below board level |
| 8 | Cost base upside (scored separately) | Little repetitive back-office or delivery work to automate | Large, measurable volume of repetitive work not yet automated | Headcount by function, process volumes, time-per-unit samples |
As a rough guide, 28 to 35 is low threat, 20 to 27 is medium, and below 20 is high. Don't let the total hide a single 1. A business scoring 4s everywhere and a 1 on factor 2 has a pricing problem whatever the arithmetic says.
How to score each factor without guessing
The grid is only as good as the evidence behind each number. A few notes from practice.
- Replicability: test it, don't debate it. Take ten anonymised past deliverables and the briefs that produced them. Have someone competent run the briefs through current models with sensible prompting, then have a practitioner from the sector grade the output blind against the originals. If seven of ten come back as "would send with light edits", score it 1 or 2. This takes a day and settles arguments that otherwise eat a management meeting.
- Hours and seats: follow the invoices. Management will describe pricing as "value-based". The sales ledger will tell you whether it is. Split revenue by how it is actually billed, then work out what share of billed hours goes on the replicable work from factor 1.
- Data: check the rights, not the volume. Plenty of firms hold years of client data they have no right to reuse. A data moat counts only if the contracts let the business use it.
- Switching costs: look at behaviour. Cohort retention and the reasons clients left matter more than contract length. A five-year contract with a termination-for-convenience clause is a one-year contract.
- Regulation and trust: ask who signs. If a named, insured professional has to put their name to the output, AI shortens the work but rarely removes the firm. That protects revenue, though not necessarily price.
- Distribution: ask how the last 20 clients arrived. Businesses that win through search or price comparison are exposed twice: AI cuts the cost of the work and changes how buyers find suppliers.
- Management: interview below the board. The CEO will say the right things. A team lead showing you a tool they use every week is evidence. The vendor invoices tell you whether anything is actually running.
- Upside: time a sample. Don't accept "we could automate 30% of the back office". Time a week of real work in two or three processes and size it properly. The method is in measuring AI ROI.
From the score, build one number: revenue at risk. Take the revenue in exposed service lines, apply a realistic compression of hours over the hold, then a view on how much of that saving clients capture through lower fees. That figure goes in the model.
AI and business valuation: what the score should do to the deal
A score that doesn't change anything is decoration. Here's how I'd expect it to move the deal.
| Threat score | Price | Structure | 100-day plan |
|---|---|---|---|
| 28 to 35 (low) | Price on the business plan; don't pay an extra premium for being "AI-proof" | Standard terms | Focus on factor 8: capture the cost upside |
| 20 to 27 (medium) | Haircut growth in exposed service lines by the revenue-at-risk figure | Earn-out or deferred consideration linked to pricing migration or retention | Reprice exposed lines, put AI into delivery, protect margin |
| Below 20 (high) | Price on post-compression revenue, or walk | Larger deferred element; management rollover weighted to delivery of the pricing change | A funded, sequenced plan to change the business model, owned by a named executive |
Two cautions. First, a low threat score is not a reason to overpay. If buyers are rotating into physical and labour-intensive businesses, you'll be competing for them at full prices, and the return has to come from the upside you actually deliver. Second, a high score is not automatically a walk. A firm whose clients will capture the savings from AI unless it moves first can be a good buy for an owner who will make it move first. That is a value-creation case, and it belongs in the AI value creation plan rather than a risk appendix.
Two illustrative cases
Both are illustrative composites, with numbers chosen to show the arithmetic, not real targets.
A document-heavy professional services firm
A £9m revenue compliance consultancy writes policies, audit reports and regulatory submissions for financial services clients. 80% of revenue, £7.2m, is billed on time and materials. Sampling timesheets shows about 40% of billed hours go on drafting and review that AI already does well, so £2.88m of revenue sits on replicable work.
Scores: replicability 2, hours billed 1, data 2, switching costs 3, regulation and trust 3 (clients want a named firm, but no licence is required), distribution 4 (referral-led, long relationships), management 2. Threat score 17: high.
Revenue at risk: assume AI halves the time on that drafting work over three years, and clients capture 60% of the saving through lower fees or tougher procurement. That's £2.88m × 50% × 60%, about £0.86m, or roughly 10% of revenue, falling at close to full margin if the firm keeps the same team.
What I'd recommend: price on the post-compression revenue in the base case, with an earn-out tied to the share of revenue moved onto fixed fees by year two. The 100-day plan puts AI into the drafting workflow immediately and starts converting the top 20 clients to fixed-fee pricing, so the firm keeps the saving rather than handing it over.
A field-services business
A £15m revenue fire and security maintenance contractor runs 90 engineers doing statutory inspections and repairs under multi-year contracts. Revenue is billed per visit and per contract. Accreditation and named sign-off are required.
Scores: replicability 5, hours billed 4, data 3, switching costs 4, regulation and trust 5, distribution 3, management 2. Threat score 26, medium, with the weakness concentrated in management and distribution rather than the service itself. Upside score: 5. Around 30 office staff handle scheduling, quoting, compliance reports and invoicing, much of it repetitive.
The risk here is paying a premium for being "AI-proof" and then not capturing the upside. The 100-day plan targets engineer report writing, scheduling and quote turnaround, each with a baseline and a payback test. Structure stays standard. The return comes from delivery.
Is there such a thing as an AI-proof business?
Not really, and I'd be wary of anyone selling one. Every business has some exposure, if only in how its customers find it and what they'll pay. What exists is a business whose core value sits behind something AI doesn't easily remove: physical work, licensed accountability, owned data, deep integration or relationships. Those businesses are AI-resilient, which is a narrower and more useful claim.
The phrase also hides a second risk. A resilient business with slow management still loses ground to a resilient competitor that uses AI to quote faster and run leaner. Factor 7 matters in every case, which is why I'd never let it be averaged away.
Will AI disrupt my business? Preparing for buyers who ask
If you own a business and are thinking about a sale in the next two or three years, assume every serious buyer will ask this question, and that some will score you on a grid like the one above. Prepare for it the way you'd prepare the accounts.
- Score yourself honestly, now. Run the eight factors with your own numbers. Do the factor 1 test on your own deliverables. If you score below 20, you have time to change it. Buyers won't give you that time.
- Move pricing away from pure hours where you can. Fixed fees, subscriptions and outcome pricing turn AI from a threat to your revenue into a gain in your margin. Even moving a third of revenue changes the conversation.
- Put AI into your own delivery and measure it. A buyer who sees live tools, usage data and a before-and-after on cost per job scores factor 7 as a strength. Slides don't count.
- Write down what you own. Data, workflows, integrations, accreditations, frameworks. Check your contracts give you the rights you think they do.
- Evidence the stickiness. Retention cohorts, churn reasons and integration depth, presented the way a buyer will want them.
- Answer the question in the IM. One page, plain language: where AI touches the business, what you've done about it, and what the numbers show. Then make sure the evidence pack backs every sentence, for the reasons set out in the seller section of the AI washing piece.
An owner who can show a falling cost per job and a rising share of fixed-fee revenue doesn't need to argue about AI.
Running it inside exclusivity
For a lower-mid-market deal, the assessment fits inside a week as a focused strand, or alongside claims testing and the upside case in a wider diligence of one to three weeks. The technology due diligence checklist covers the platform side. The output should be short: the scored grid with evidence against every number, the revenue-at-risk figure, a recommendation on price and structure, and the first moves for the 100-day plan.
That is what the exposure strand of my AI due diligence work produces, fixed-price and quoted the same week, and it is written by someone who will happily stay on to deliver the plan it recommends.
Questions
What is an AI disruption risk assessment?
It is a structured test of how exposed a business is to AI over a normal hold period: whether AI can do what customers pay for, how much revenue is tied to hours or headcount, and what protects the business (data, switching costs, regulation, distribution). It ends in a score, a revenue-at-risk number and a clear view on what the score should do to price, deal structure and the 100-day plan.
How does AI affect business valuation?
Buyers now discount revenue they think AI will compress, particularly hours billed for document-heavy work and software priced per seat. They pay up for businesses with physical delivery, regulated sign-off or owned data. The effect shows up in the multiple, in the growth assumptions behind the price, and in structure such as earn-outs tied to pricing changes. A credible, evidenced answer to the AI question protects value.
Which businesses are most at risk from AI disruption?
Those selling hours for work that ends in a document, a summary, a translation, a piece of code or a routine analysis, with no regulated sign-off and weak switching costs. Businesses with seat-based pricing tied to customers' headcount are also exposed. Lower risk sits with physical, on-site or licensed work, deeply embedded services and firms that own data and relationships rather than renting them.
How can I make my business more attractive to buyers worried about AI?
Score yourself on the same grid a buyer will use, a year or more before a sale. Move pricing away from pure hours where you can, show live AI tools in your own delivery with measured results, document the workflows and data you own, and evidence retention and switching costs. Then write a plain answer to the AI question into the information memorandum, backed by a pack a buyer can check.
