Private equity's AI blind spot is in the portfolio | Optima Partners

By: Greg Worsfold, Optima Partners · Published: 2026-09-15

Greg Worsfold of Optima Partners on why sponsor reporting misses AI deployments inside portfolio companies, why questionnaires are a baseline rather than assurance, how AI vendor exposure is correlated across a portfolio, and what a minimum viable operating model looks like.

Private equity's AI blind spot is in the portfolio. Written by Greg Worsfold, Partner at Optima Partners, September 2026.

Sponsor reporting was designed around revenue, EBITDA, cash and the value-creation plan, not to identify when an AI deployment changes legal, operational or exit risk.

Section 1, The blind spot in the portfolio. Many private equity firms now have at least basic controls over their own use of artificial intelligence: formal policies, approved enterprise tools, confidentiality briefings for investment teams and cross-functional oversight. The larger blind spot may sit within the portfolio.

AI is entering portfolio companies through ordinary business activity: functionality switched on inside an existing SaaS platform, customer-service tools, coding assistants, recruitment systems and AI-enabled products. Yet sponsor reporting was designed around revenue, EBITDA, cash and the value-creation plan, not to identify when an AI deployment changes legal, operational or exit risk.

A material use may appear as an IT cost, headcount saving or margin improvement. It may not be labelled as AI at all, particularly where functionality is activated inside an existing platform. Financial reporting captures the economic effect, but not necessarily what data entered the system, whether the output affects consequential decisions, or whether the company can suspend the use.

AI also often enters through the value-creation plan. Management and operating teams sponsor the initiative, while success is measured through adoption, revenue or EBITDA. Control functions may be consulted, but not always when the use case, data flow and contract are first determined. Governance follows the budget, while risk follows the data.

Section 2, Board visibility is not board assurance. AI is more likely to reach the board as a growth initiative than as a risk item. The board may hear that a deployment has increased conversion or reduced costs. Unless it also asks about data rights, vendor dependency, testing, human oversight, incidents and stop authority, it has received a performance update rather than assurance.

The incentives are asymmetric. Management is rewarded for improving EBITDA and exit value over a finite hold period. The benefit of an AI deployment is current and measurable; the liability may be contingent and capable of crystallising later. This is the predictable result of a system in which the upside is reported monthly while the downside has no reporting field. It is a control-design problem.

Section 3, A questionnaire is a baseline, not assurance. Many private equity firms have responded by sending AI questionnaires to portfolio management. That is a sensible starting point, but it captures only what management knows, recognises as AI and reports. It may miss embedded functionality, informal pilots, employee use outside procurement and changes introduced by vendors after the contract was signed.

A stronger review uses three sources of evidence. Management explanation: the business process, accountable owner, data involved, controls and authority to stop the use. Contract review: data-retention and reuse rights, model-training terms, sub-processors, intellectual-property protections and change notifications. System configuration: what is actually enabled, who can use it and what information flows through it.

Section 4, Portfolio exposure is correlated. A forty-company portfolio may not contain forty separate AI risks. It may contain a small number of shared dependencies repeated across forty companies. The same SaaS platforms, foundation models and implementation partners often appear across multiple companies. A change in one vendor's terms, model, security or availability can therefore affect several investments at once. The concentration may not be visible in any individual company's reporting because no single company sees the vendor's importance across the portfolio.

The most efficient first review is not forty identical company reviews. It is one portfolio dependency map, followed by targeted reviews where the consequences are highest. Identify recurring AI-enabled vendors and establish what functionality is active, whether company data may be retained or reused, which providers receive it, and what happens when the vendor changes its model or terms. The same vendor may still present a different risk in two companies, depending on the contract, configuration, data and use case. Central review identifies concentration and establishes a common baseline; it does not replace company-level judgement.

Section 5, A minimum viable operating model. Private equity firms should not approve every AI model or install an AI committee at every portfolio company. They should instead ensure that each material AI use has an accountable owner, proportionate controls, a named person with authority to suspend it, and a route for significant exceptions to reach the board and, where appropriate, the sponsor.

An AI use should be treated as material if it involves sensitive or proprietary data, influences consequential decisions, produces regulated or customer-facing outputs, supports a revenue-critical process, or underpins a material element of the value-creation plan.

Portfolio-company management owns deployment and outcomes. The board oversees high-consequence uses and exceptions. Portfolio operations coordinates reporting and common vendor reviews. The private equity CCO and legal team define thresholds and provide independent challenge without becoming the approval gate for every deployment.

In practice, the private equity firm needs three disciplines: carry material findings from diligence into the 100-day plan; require exception-based reporting of new uses, control gaps and incidents; and review common vendors and model dependencies at portfolio level. The supporting evidence, approvals, contracts, testing and incident records, should be maintained from year one, not assembled when the exit process begins.

The purpose is not to slow AI adoption. It is to avoid discovering in year four that an EBITDA improvement depends on a data right, model or vendor arrangement that a buyer cannot underwrite.

Section 6, About Optima Partners. Optima Partners is a global compliance and regulatory advisory firm for investment managers. They work with hedge funds, private equity funds, fund-of-funds, and investment advisers across the US, UK, Europe, and APAC to navigate complex regulatory environments. This article was written by Greg Worsfold, Partner at Optima Partners. Contact Greg at mailto:Greg.Worsfold@optima-partners.com or email mailto:info@optima-partners.com.

Published as part of ALTALLO's Member Insights series. Optima Partners is an ALTALLO member. This article is provided for information only. It is not legal or compliance advice, not a recommendation, and not guidance on cost. View the Optima Partners profile on ALTALLO at https://www.altallo.com/marketplace/vendors/optima. Original alert: https://optima-partners.com/documents/FG/optima_partners/insights/656734_Regulatory_Alert_9.15.pdf.