Risk, the multiple and the platform: the six levers that decide what the company is worth at exit

Bain's 2026 report gives the reason this chapter exists: multiple expansion "powered over 50% of all buyout returns" in the prior cycle and is no longer available, so a deal now needs 10% to 12% annual EBITDA growth to earn what 5% once did.¹ That makes the multiple something to protect rather than something to expect, and four of the six levers here are protective. The other two, add-on integration and continuous diligence, are the platform levers, and they matter because platform buyouts in software fell to 41% of deal value in early 2026 while add-ons rose to about 45%; in Europe, add-ons reached 71.4% of buyout deal count, a decade high.² Buy-and-build is the default deal now, and its integration cost is the lever AI changes most.

X1 · Security and compliance posture

What it is. Certifications, evidence and incident readiness maintained as a condition of enterprise sales and as protection against the event that resets a multiple: the breach, the regulator's letter, the customer's audit finding. The operational side is O9; this card is the posture as an asset.

The line it moves. The multiple, through avoided events; win rate, through removed gates.

Typical range and the evidence. Medium. The enforcement side is measured: HHS's Office for Civil Rights announced in March 2026 its twelfth action under its risk-analysis initiative, a settlement with "a Maryland software company" and business associate after a breach affecting fifteen million people, for failure to conduct "an accurate and thorough risk analysis."³ The amount was $10,000; the precedent, a software business associate named for a missing risk analysis, is what to cite internally. Vanta's survey data that buyers spend nine working weeks a year on vendor security reviews establishes the friction; nothing independent establishes the conversion effect, and the card does not claim one.⁴ In Europe, a software company selling into financial services has been an ICT third-party provider under DORA since January 2025, with contractual, audit-access and incident-reporting obligations that smaller competitors will not clear.⁵

Conditions. O9 in place; the annual risk analysis done and documented; an incident plan that has been rehearsed; a named executive owner.

Kill criteria. None; the failure mode is an event, and the metric is that it does not happen.

Horizon and stage. Deploy. Year one.

How it translates. A: HIPAA business-associate posture is the license to operate. B: the company's own posture is its product's credibility. C: PCI. D: SOC 2 and ISO at scale. E: enterprise and, in Europe, DORA.

X2 · AI governance and product liability

What it is. Disclosure, human review, bias testing, accuracy substantiation and vendor terms for the AI the company ships to customers and the AI it uses internally, built to the statutes that already bind rather than to a framework, and maintained as a line in general and administrative expense rather than a project.

The line it moves. General and administrative expense; the risk retained; and, through liability, the multiple.

Typical range and the evidence. Strong, because it is law and case law. The EU's Digital Omnibus on AI entered into force on July 27, 2026, moving the stand-alone high-risk obligations to December 2, 2027, while Article 50 transparency, the duty to tell users they are dealing with an AI and to label AI-generated content, still applies from August 2, 2026, with watermarking for systems already on the market from December 2, 2026, and penalties up to "EUR 35 million or 7 percent of global annual turnover."⁶ A 2026 budget built on the old August 2026 high-risk deadline is overbuilt; a product without Article 50 disclosure is late. In the United States the exposure is product liability: in Mobley v. Workday a federal court certified in May 2025 a nationwide collective of applicants aged forty and over against the software vendor, on the theory that the vendor acted as its customers' agent.⁷ The FTC's Operation AI Comply produced the case that matters for accuracy claims: Workado advertised its detection software as "98% accurate" when it was "only 53%," and the order requires substantiation on file.⁸ The SEC's and DOJ's AI-washing cases (Delphia, Joonko, Nate, Presto) turn on two questions a buyer now asks a seller: is a human in the loop, and whose model is it.⁹ And the British Columbia tribunal in Moffatt v. Air Canada held that "it makes no difference whether the information comes from a static page or a chatbot," which settles who is liable for what an agent tells a customer.¹⁰ In healthcare the state rules are specific: California's disclaimer on generative-AI patient communications, its bar on AI denying care on medical-necessity grounds, Texas's disclosure duty and $200,000 per-violation penalties, Colorado's re-enacted act from January 2027 with covered entities largely exempt, and Utah's and Illinois's rules on mental-health chatbots.¹¹ Nobody has published a credible cost for an AI governance program, and the IAPP's 2025 finding that 77% of organizations are working on one is the only adoption figure worth citing.¹²

Conditions. The register (O13) as the inventory; a policy that names the human sign-off points (money, patients, employment, coverage); marketing claims about AI performance substantiated on file before publication; customer contracts updated to describe AI processing, sub-processors and retention before the first customer-facing agent ships.

Kill criteria. Any AI feature shipped without its disclosure, its evaluation set and its human sign-off point documented in the register.

Horizon and stage. Deploy. Day one hundred to year one.

How it translates. A: the healthcare statutes in full; a person signs every clinical document and every coverage outcome. B: the product makes regulatory determinations, so the sign-off and the audit trail are the product. C: consumer-facing disclosure and payments rules. D: Article 50 at scale, and employment-tool liability if the product touches hiring. E: enterprise customers will send their own AI questionnaires.

X3 · Data governance and rights

What it is. De-identification standards, retention terms, customer consent and data-use clauses turned from a constraint into an asset: the company knows which data it may use for which purpose, can prove it, and has written the rights it needs into the contracts it signs from now on.

The line it moves. The multiple, because an underwritten data asset is worth more than a claimed one; and the feasibility of R2 and R10.

Typical range and the evidence. Strong for the rules, and the rules are where the value hides. Under HIPAA, analytics, evaluation and any non-covered tool use data de-identified by removing the eighteen identifier classes at 45 CFR 164.514(b)(2) or under an expert determination that re-identification risk is "very small," and prompts and outputs containing protected health information are electronic protected health information.¹³ The provider terms are facts to record, not assumptions: Anthropic's covered models require thirty-day retention and cannot coexist with zero-data-retention on one organization; OpenAI's business associate agreement covers its API and enterprise products, not its Business plan.¹⁴ The diligence finding from P2 sits underneath this card: no published figure exists for how often a software target lacks the contractual right to use customer data for model training, and the buyer who counts it at diligence and fixes it in year one owns something the seller did not.

Conditions. The contract database from P2; the gateway from P7 enforcing data classes by model; a data-use clause approved by counsel in the standard paper; a de-identification method that survives an expert review.

Kill criteria. Any model call carrying regulated data to an endpoint without the right agreement is an incident and stops the agent.

Horizon and stage. Reshape. Day one hundred to year one.

How it translates. A: protected health information governs everything. B: the data-use right across customers' submissions is the asset being built. C: merchant and cardholder data under PCI, and consumer data under state privacy law. D: uniform terms make the fix a single change. E: bespoke paper makes it a negotiation per customer.

X4 · Add-on integration

What it is. Code, data, customer, support and back-office consolidation of acquired add-ons at a fraction of the historical cost and time: the acquired codebase migrated or retired with agents (O2), customers migrated with the onboarding tooling (G2), support desks merged behind one resolution agent (G1), finance and procurement folded into the platform's (O6, O12), and the acquired company's SaaS portfolio reclaimed on day one.

The line it moves. One-time integration cost; then every G and O lever at the combined scale.

Typical range and the evidence. Strong for the volume, medium for the cost, and the cost is where the public record is worst. The PitchBook figures above say add-ons are now the majority of software deals. No consultancy has published a 2023 to 2026 benchmark of integration cost as a share of deal value or months to integrate for software buy-and-build; the "1% to 3% of deal value" line that circulates online is unsourced and does not appear here. The evidence for the mechanism is Google's migration paper and Amazon's Java campaign (O2): the code half of an integration compresses, and the bottleneck moves to senior-reviewer capacity, which is the scarce resource in a sponsor-backed integration.¹⁵ No sponsor has published figures for AI-driven consolidation of support or finance across add-ons, so the non-code half is run as an internal measurement.

Conditions. A platform that is itself integrated (P7 done once, not per company); a migration playbook; senior reviewers reserved for the integration rather than borrowed from the roadmap; the acquired company's contracts read with P2 before close.

Kill criteria. Integration cost above 150% of plan at the halfway point pauses the program; customer migration with retention below the platform's own rate reverses it.

Horizon and stage. Reshape. Years one to three.

How it translates. A: a services or regional add-on, evaluated against the platform the company has become. B: content and framework add-ons, where the integration is the rules engine. C: the roll-up pattern, where each add-on brings merchants to the payments rail. D: tuck-ins of features; integration is a product decision. E: the business is the sum of prior add-ons, and this lever is the reason the codebases are still separate.

X5 · Continuous diligence

What it is. P1 through P4 run as a standing capability on the add-on pipeline, so that every target is read in full before the letter of intent and the platform's own data (churn reasons, pricing, product gaps) is compared against the target's.

The line it moves. Price paid on add-ons; integration risk.

Typical range and the evidence. Weak, and stated so. Blackstone's account of using models to replicate a target's own models within hours, which "contributed to a decision to pass on the deal," is the one concrete published example of AI diligence killing a deal; it names no target.¹⁶ EQT, the most-cited AI-native sponsor, has published no hit rates for its sourcing platform.¹⁷ No PE firm publishes its own diligence hours saved. The card exists because the platform lever (X4) is only as good as the price paid, and the tooling is the same tooling the company already runs.

Conditions. P1 to P4 tooling retained after close; a deal-team analyst who owns the pipeline; the platform's own warehouse as the comparison set.

Kill criteria. A target whose automated findings are not reproduced by a person on a sample before the letter of intent.

Horizon and stage. Reshape. Year one to exit.

How it translates. C and E, where the add-on pipeline is real; A where a regional add-on is contemplated; marginal for B and D.

X6 · Exit readiness

What it is. The lever ledger, the baselines, the register and the AI revenue disclosure built as the data room from day one, so that the buyer's diligence (which will be the tooling in P1 to P4) finds what the seller already knows, and the AI claims survive it. It includes the honest reporting of payments revenue on gross profit and net take, the seat-exposure figure from P4 updated annually, and the Rule of 40 position stated in the buyer's terms.

The line it moves. The multiple.

Typical range and the evidence. Strong for the multiples, medium for any AI premium. Software Equity Group's 2026 annual report gives the arithmetic: median EV to trailing revenue in the fourth quarter of 2025 of 2.4x for companies growing 10% or less, 5.8x for 10% to 20%, 12.7x for 20% to 30%; and by Rule of 40 band, 1.6x at 10% or under, 6.0x at 20% to 30%, 9.8x at 30% to 40% and 14.0x above 40%, with the note that "profitability provides valuation support, but growth is the primary driver of multiple expansion beyond 10.0x."¹⁸ (Its above-30%-growth band prints below the 20% to 30% band, an inversion that reads as sample noise and is not cited.) SaaS M&A in the same report averaged 6.9x and had a median of 4.0x, which is how much a handful of outliers distort market talk. Aventis's August 2026 update puts the median public multiple at 4.6x and the median Rule of 40 score at 26, with only fifteen percent of the index above 40 and the median company at 11.8% growth plus 14.6% margin: buying its score with margin, which is where these levers act.¹⁹ McKinsey's 130% premium for product-embedded AI is cited on the hub with its missing growth control; the a16z view that 85% to 90% gross margin is "an orange flag" is the counterweight, and for a seller both are true at once.²⁰ The AI-washing cases in X2 are the buyer's checklist. Bessemer's Rule of 40 framing, with top-decile cloud companies at around 48, is the language the buyer will use.²¹

Conditions. O13's register maintained from day one; P4's exposure judgment revisited annually; payments reported on gross profit; a data room that is the operating system's export rather than a project.

Kill criteria. Any AI claim in the exit materials without a substantiating measurement in the register.

Horizon and stage. Reshape. Year two to exit.

How it translates. A: from a 34 to a 52 on the Rule of 40, with product-embedded AI. B: a regulated-workflow multiple defended with retention and pricing power. C: an EV-to-gross-profit story, because payments compress EV to revenue mechanically. D: the seat-exposure story, told with the migration data. E: the mix story, services down and subscription up, told so that shrinking services revenue reads as improvement.