First 100 days after acquisition: secure, stabilise, then add AI

Picture it: the deal closed this morning. The seller's founder still holds the admin password to the cloud account, and the model API is billed to a personal card. Only two engineers know how to deploy. For the first 100 days after acquisition of a software or AI-using business, we recommend a strict order. In days 0 to 30, secure access, secrets, data rights, model contracts and the people the product depends on. Stabilise in days 31 to 60, and only then improve the business with AI in days 61 to 100. This is general information, not investment, legal or tax advice, and it does not discuss valuation.

We put control first because a leaked API key, a model contract that did not move to the new owner, or the loss of the only engineer who can ship a fix can stop the product within days. Starting AI work a month later costs a month. The trade-off is momentum: a quiet first month can look like drift. Share the 100-day plan with the team on day 1, so the order reads as a decision.

What should a new owner lock down in the first 48 hours?

Five actions, each with one named person responsible and a written confirmation:

1. Admin accounts. List every admin on the cloud provider, code hosting, domain registrar and DNS, email, payment gateway and app stores. Add the new owner's admins with multi-factor sign-in, then remove the seller's personal accounts once handover is confirmed in writing.
2. Secrets. Reissue API keys for model providers, payment and messaging services, then revoke the old ones. Treat any key that ever sat in code, a shared drive or a chat thread as exposed. GitHub's documentation on removing sensitive data says the first step for a committed secret is to revoke or rotate it. Rewriting the history comes after, if at all.
3. Billing. Move model API, cloud and SaaS subscriptions from personal cards to a company account, so a card that expires does not switch the product off.
4. Backups. Confirm a recent backup exists and that someone on the new team has restored it once.
5. Change freeze. Agree a short freeze on production changes, except security fixes, until the access and secrets work is finished.

Rotate keys with the engineer who deploys: revoking a key the live system still uses causes an outage.

Days 0 to 30: secure access, data rights, contracts and people

Access and secrets

Responsible: the interim CTO. Done when: an access register lists every system, its admins and their sign-in method, and a secrets inventory lists each key, what it is for and who to contact. The OWASP Secrets Management Cheat Sheet says it should be clear what each secret is used for and where to find it. It also says secrets no longer needed or possibly compromised must be revoked. If the product or its internal tools were built with Lovable, Bolt, Replit or Cursor, run the outsider tests in our vibe coding security checklist before you rely on them.

Data rights

Responsible: legal counsel with the privacy lead. Done when: each dataset has a line showing where it came from, the purpose stated when it was collected, the contract or consent terms, and where it is hosted. Jordan's Personal Data Protection Law No. (24) of 2023 requires processing to be in line with the purposes for which the data were collected (Article 7). It also says prior consent does not count if the nature, type or objectives of the processing change without consent for that change (Article 5).

In an asset purchase, also ask counsel whether Article 14 (no transfer of data to another person without consent) covers moving customer data to the buyer. A plan to train a model on support tickets collected for customer service therefore needs a legal review first. Data protection laws in GCC countries differ in scope and exemptions. This is general information, not legal advice; obligations depend on the organisation's sector and data.

Model and API contracts

Responsible: the finance lead with counsel. Done when: every model provider is listed with the contracting entity, the terms version, the assignment clause, the model IDs in use and their retirement dates. Anthropic's Commercial Terms (effective 17 June 2025), for example, say that neither party may assign its rights without the other's prior written consent. The exceptions are written for Anthropic only. In an asset purchase, where a new company takes over the product, ask the provider in writing how the account transfers. In a share purchase the contracting company stays the same, but read the terms anyway.

Model retirement is the second contract risk. Anthropic's model deprecations page says it gives at least 60 days' notice before retiring a publicly released model, and that requests to retired models fail. Its Claude Console usage export, broken down by API key and model, is a quick way to build the inventory. These dates cover Anthropic-operated platforms; Amazon Bedrock, Google Cloud and other providers set their own.

The people the product depends on

Responsible: the new CEO. Done when: there is a named list of who can deploy, who holds supplier and customer relationships, and who understands the data, including any Arabic-specific cleaning rules. Hold a retention conversation with each in the first two weeks, and have a second person shadow every task only one person can do today. Our AI due diligence guide covers the same areas before signing; after closing, the job is to turn its findings into names and dates.

Days 31 to 60: stabilise before you change the product

Stabilising means knowing, in numbers, how the business runs today. Without that, no one can say later whether an AI change helped.

• Baselines. Record uptime, error rate, response time, monthly model and cloud cost, cost per customer request and ticket volume.
• An evaluation set. Collect a few dozen real, redacted requests in Arabic and English with the answer you expect, so any model or prompt change can be tested before release.
• Model migrations with a date. Move any model with a retirement date to its replacement, tested on the evaluation set.
• Findings by severity. Close the issues from due diligence and the first month, worst first.
• Runbooks. Write down how to deploy, how to roll back and who to call in an incident.

Responsible: the interim CTO with the product lead. Done when: a one-page weekly operations report exists, and the new team has shipped at least two releases with a tested rollback.

Days 61 to 100: improve with AI, one measured change at a time

Pick one or two improvements, each tied to a number from the baselines. Examples: route simple requests to a smaller, cheaper model; add AI-assisted triage to the support queue with human review of every reply; or give engineers a coding agent with review gates. Set the success figure and the stop rule before work starts, and treat effects as expected until measured against the baseline.

Responsible: the operating partner with the product lead. Done when: a day-100 review records a keep, change or stop decision for each change, and the plan for the next six months is written. In our Venture Lab, the related service is Post-Acquisition AI Operations, in which GET runs AI-led improvement as embedded fractional CTO and operating partner.

The first 100 days after acquisition on one page

Two illustrative examples from Jordan and the GCC

An Amman chatbot company bought through an asset purchase

Illustrative: a Jordanian retail group buys the product and team of a 30-person Amman company that sells an Arabic customer-service chatbot. The model API account is in the founder's name, billed to his card, and one key sits in a configuration file in the repository. In week one the new owner asks the provider in writing how the account transfers, opens a company account, moves the app to new keys and revokes the old ones. The data review finds the support tickets were collected to answer customers. So the group's plan to train a product-recommendation model on them goes to counsel under Article 7 first. Days 61 to 100 focus instead on answering only from approved product information.

A Dubai property software firm with a model about to retire

Illustrative: a Gulf holding company buys a Dubai property management software firm whose lease-summary feature calls claude-sonnet-4-5-20250929. Anthropic's deprecations page lists that model as deprecated on 30 September 2026, retiring on 30 November 2026, with claude-sonnet-5-5 as the recommended replacement. The deal closes in October 2026, so the migration moves from days 31 to 60 into days 0 to 30, tested on Arabic and English leases before the switch.

How to start

If you have just closed a deal, or expect to soon, your first 100 days after acquisition start today: write a name next to each item on the 48-hour list. To see whether Post-Acquisition AI Operations fits your deal, start with a conversation. If you are still looking for a business, our Vetted Opportunities profiles describe what each business does, its state and why we back it.

Related lab: Venture Lab ↗