AI Roll-Up: Building a Group Through M&A and AI

An AI roll-up is a strategy in which a series of acquisitions of services businesses, combined with the rebuilding of their core process around artificial intelligence, forms a single production system. The acquisition gives the group clients, contracts, licences, a domain team and an operating history; the shared platform supplies capital, technology, data and deal discipline; AI changes cost, speed, quality and the very set of outcomes being sold. General Catalyst, which put the term into circulation, describes the model as applied AI combined with direct ownership of a services business and sets the group a "Rule of 60" benchmark: 30–40% margins at 10–20% growth.

The label is often stretched over neighbouring constructions. A portfolio of unrelated companies with a common shareholder, an ordinary buy-and-build in which staff have been handed an assistant, a software vendor with no control over the sales channel, and a run of purchases done for the arithmetic of EBITDA all fall outside it. The working test is stricter: the acquisition must deliver access to the client and to the workflow, and AI must change how the service itself is produced. The basic forms of ownership are covered in holding structures, fund capital in investment funds, and permanent family capital in the family office.

This page follows the order of the buyer's decisions: which roll-up models exist and where they make money, how a vertical and an integration model are chosen, how the group is put together legally, how acquisitions are funded, what data rights arrive with a company, what happens in the first hundred days, where a licence stays local, and which regulatory filters a series of deals has to pass.

What counts as an AI roll-up

Five models with different economics and different ways of failing live under a single label.

Why the model works now

The first condition is fragmentation combined with a generational change of owners. Accounting, property management, insurance distribution, IT support, medical administration, legal support and dozens of B2B niches remain markets of hundreds of independent firms. A founder-owned company has steady demand and no successor, no product team, no security function and no capital to rebuild its process. The seller wants liquidity and continuity; the buyer wants access to demand that has already been paid for: an acquired services business sits inside the client's process, whereas new software must first create a budget and clear procurement.

The second condition is that the work is machine-readable. Calls, letters, documents, invoices, tickets, schedules and case records turn into structured events. Technical availability is not legal permission: contracts, confidentiality, professional secrecy and purpose limitation determine which use cases are permissible.

The third is the nature of the effect. The main gain more often lies in removing a bottleneck: intake, reconciliation, document checking, quote preparation and quality control become faster and more consistent, and the same team serves more clients. Headcount reduction arrives later and on a smaller scale than the model promises. Real integration, meanwhile, first depresses margin — a central product team and a security team appear, along with duplicate systems, migrations and the remediation of defects found along the way. Patient capital carries that curve better than debt underwritten on the immediate realisation of synergies.

The vertical, the platform and the integration model

A suitable market passes the commercial, operational, legal and informational test at the same time.

A high aggregate score does not remove the grounds for walking away. A deal is killed when the licence or the ownership structure cannot survive the intended transaction; when key contracts terminate or require a consent that is not available; when the economics rest on systematic non-compliance or on misclassified staff; when the data cannot lawfully support a shared platform; when the liabilities are uninsurable; when the accounts are unreliable; when the founder is the sole performer and is leaving; or when the minimum cost of integration consumes the return.

A platform company is a business on which a system can be built: intelligible unit economics, a second layer of management, usable data, the right licence, disciplined accounting and a management team willing to change. Size is secondary here. The integration model is chosen for each target before the LOI is signed and is priced into the deal.

The legal structure of the group

There is no universally correct chart. A company is created when it separates ownership, risk, capital, a licence, contracts or decision rights.

Top HoldCo holds the cap table, the shareholders' agreement, the management incentive plan and the strategic reserved matters, and it raises equity. It does not sign client contracts and does not take decisions that the law leaves to the operating company.

BidCo is the buyer on a given transaction and often becomes the borrower under the acquisition financing. After a merger, a debt push-down or an upstream guarantee, corporate benefit, solvency, financial-assistance prohibitions and the rules on challenging a debtor's transactions are each tested separately.

Operating companies carry the client, employment, tax and tort liability. Several OpCos make sense where licences, contracts, brands, countries or insurance cover differ; multiplying companies without such a reason produces only extra invoices, extra filings and control failures.

Shared Services Co supplies finance, HR, procurement, IT and legal-operations services. Each service is documented with its scope, price, an SLA, data-processing terms, audit rights, subcontracting rules, a continuity plan and an exit procedure.

A technology or IP company is justified when it genuinely owns the technology and develops it: it hires developers, documents the assignment of rights, runs the repositories and licenses the product on arm's length terms. An empty company into which the IP was "moved" after the fact creates no ring-fence and adds tax and transfer-pricing risk.

Decision rights fall into four tiers. Shareholders and the board answer for capital allocation, entry into a new vertical and material transactions; the investment committee for the target, the valuation, the structure and the integration budget within its delegated authority; integration steering for Day 1 readiness, systems, people, clients and defect remediation; and the board of a separate company together with its licensed officers for local compliance, capital, client money, professional decisions and dealings with the regulator. Each decision is recorded with verified facts, seller statements, assumptions and accepted residual risk kept apart, and a year later the outcome is compared against those same assumptions.

Capital and deal structure

The choice of capital determines both the pace of acquisitions and the horizon for integration. A venture-backed HoldCo works while the platform and the product are being built, but it brings a conflict between liquidation preferences and seller rollover. A private equity fund brings discipline and firepower, yet the fund's life and target return sit awkwardly with a long rebuild of processes, so the integration budget and technology capex must sit inside the underwriting. Family offices and evergreen structures carry the J-curve better and need their own rules on minority liquidity and on valuing employee stakes. A regulated platform is funded with an eye on change-of-control approvals, capital adequacy and limits on a lender's ability to step into the asset.

Where the debt sits is a legal question: the borrower is the company that can lawfully service and secure it, and a licensed OpCo with capital requirements and client-money safeguards is normally kept out of the security package. Multiple arbitrage must not be the base case: the underwriting has to survive an unchanged exit multiple after integration costs, central overhead, technology, obligations to sellers and the normalisation of working capital.

Data, models and rights

The principal shared asset in an AI roll-up is more often the right to reuse operating data than the software. Diligence therefore does not stop at ticking off "the target owns the IP". For each data set and each use case the record captures the source and the controller, the categories of data and of data subjects, the contractual purpose, the right to store, analyse and disclose, the right to train and fine-tune models, the fate of embeddings and derived data, whether cross-client use is permissible, the model provider and the place of processing, the anonymisation standard, retention and deletion periods, the secrecy regime and the position on a change of control.

Chain of title in the code is checked through assignments from employees and contractors, former employers, universities, repositories and model accounts: the production build must be reproducible from components the group owns or has licensed. The SBOM covers not only packages but copied code, container images, model weights, data sets and abandoned repositories. The phrase "open weights" does not mean freedom to use commercially: model and data set licences restrict the field of use, the class of users, redistribution and fine-tuning. Separately, the AI claims made in pitch decks and tender submissions are reconciled with the way production actually works — a gap turns into a breach of warranty and sometimes into a regulatory claim.

Integration and synergy accounting

Integration planning starts before the LOI: the buyer has to understand the target's operating model, the cost of migration, the risk of losing clients and people, the need for a TSA and the regulatory constraints before naming a price. By Day 1, banking mandates and signing authorities, insurance, payroll, system access and entitlements, notices to clients and to the regulator, and licence and contractual consents are all closed out. The first thirty days go on stabilisation and on taking baseline measurements, the next thirty on selecting two or three processes to instrument and pilot, and the final forty on proving repeatability at a second site.

Synergies are tracked in a separate register in which every line has an owner, a baseline, a date and a method of confirmation.

The pace of acquisitions is limited by more than capital. A capacity model scores, for each live deal, the hours of the integration lead and the PMO, the accounting close and data mapping, regulatory approvals, remediation of security defects, HR and payroll operations, client migration and the attention of senior management. The programme sets a cap on simultaneous integrations, and the ability to pause buying for a quarter belongs to programme discipline.

Regulated industries: where the licence stays local

The group centralises support, technology and the execution of processes; the licence, the duty owed to the client and the reserved professional decision stay where the applicable law places them. A single HoldCo does not turn one OpCo's licence into a permission for the whole group.

The names of these constructions differ: in US healthcare it is the management services organisation; in legal services, a lawyer-owned firm or a licensed alternative business structure; in audit, an alternative practice structure; in engineering, the PC and the PLLC; in construction, an ordinary company with a licence and a qualifying individual. The model of separating platform from practice is set out in the article on the management services organisation for a regulated practice, and the US forms of professional company and the requirements for responsible officers in the article on the professional corporation in the United States. In wealth management the status is determined by the advisory entity's own activity: RIA, ERA or the family-office exclusion — and buying somebody else's book of clients usually takes the adviser outside its former exclusion.

Shared compliance is permissible at the level of execution. The EBA Guidelines on outsourcing arrangements expressly prohibit turning a regulated institution into an empty shell and leave responsibility with its management body; FCA SYSC 8 likewise preserves the firm's full responsibility for the critical functions it has outsourced. The centre may collect documents, run screening, work alerts and prepare reports; client acceptance, a material exception to policy, the filing of a suspicious activity report and the answer given to the regulator all remain with the individual company. The common set of controls is described in the compliance stack.

Regulatory filters on a series of deals

The small size of an individual deal does not work as a universal safe harbour: regulators increasingly assess the whole strategy, actual control and the combined data.

In the United States, Guideline 8 of the Merger Guidelines is headed "When a Merger Is Part of a Series of Multiple Acquisitions, the Agencies May Examine the Whole Series" and lets the DOJ and the FTC assess a run of acquisitions collectively. The evidence covers not only completed deals but the buyer's strategic approach to acquisitions, consummated or not, and internal documents on its plans and incentives across the industry as a whole. Wording in an investment memorandum, a fund deck or a seller CRM is later read as antitrust evidence. The FTC's final order against Welsh Carson, approved on 20 May 2025 after the case over the roll-up of Texas anaesthesia practices through U.S. Anesthesia Partners, requires the sponsor to limit its involvement with that company and to give the FTC prior notice of specified future acquisitions of, and investments in, anaesthesia and other hospital-based physician practices.

In the European Union the regime for below-threshold deals is set by two judgments of the Court of Justice. In Illumina/Grail (C-611/22 P) the Court limited the Commission's power to accept an Article 22 referral from a national authority that was not itself competent to review the transaction. But Towercast (C-449/21) confirmed that a completed below-threshold concentration may still be examined afterwards by a national authority under Article 102 TFEU where a dominant undertaking has abused its position. The absence of a filing obligation confers no final immunity.

Foreign investment screening runs on a separate track. The updated EU regime was signed off by the Council on 8 June 2026: it requires every member state to operate a screening mechanism covering a common minimum scope of sensitive sectors, among them artificial intelligence and digital infrastructure, and it extends to investments made through an EU-based subsidiary; the new rules apply eighteen months after entry into force, with national regimes governing until then. In the United Kingdom, mandatory notification under the NSI Act covers 17 sectors, among them Artificial Intelligence and Data Infrastructure; on the 2025–26 annual report, of the 1,220 notified acquisitions reviewed 4.4% received a call-in notice, and of nine final orders eight cleared the deal subject to conditions while one blocked it. In the United States the CFIUS regime reaches well beyond defence technology: under 31 CFR 800.241, sensitive personal data covers identifiable financial, geolocation, health and biometric data on more than one million individuals over the preceding twelve months — with the categories aggregated — as well as data held by companies that target personnel of the intelligence and defence agencies and by companies with a demonstrated business objective of reaching that volume; genetic test results count as sensitive whatever the number of individuals.

Subsidies and outbound investment are separate filters again. Under Article 20 of Regulation (EU) 2022/2560 a concentration must be notified to the Commission where the acquired or merging company is established in the EU and generates at least €500 million of EU turnover there, and the parties received more than €50 million in foreign financial contributions over the preceding three years; the concept of a contribution is broader than a subsidy and takes in loans, guarantees, tax measures and public contracts. For a sponsor-backed platform that means one register of foreign contributions covering the investor, the fund, the portfolio, the lender and the target. Since 2 January 2025 the US Outbound Investment Security Program (31 CFR Part 850) has prohibited, or required notification of, investments by US persons in semiconductors, quantum technologies and AI connected with China, Hong Kong and Macau; the regime catches not only a direct purchase but participation in a fund, convertible instruments and joint ventures.

Finally, combining processes after closing creates a regulated scenario of its own. The obligations of the AI Act switch on in stages: the prohibitions and the AI literacy requirement from 2 February 2025, the rules for general-purpose models from 2 August 2025, the Article 50 transparency obligations from 2 August 2026, and — under the AI Omnibus, in force since 27 July 2026 — the high-risk rules for Annex III use cases from 2 December 2027 and for AI inside regulated products from 2 August 2028. On integration the roles of provider, deployer, importer and distributor are reallocated, and changing a system's intended purpose after an acquisition redraws the whole map of roles. The EU Data Act has applied since 12 September 2025 and confers rights of access to connected-product data and of switching between data-processing providers; a technical export of data from a former vendor does not, however, create a right to use it for a shared model.

Common mistakes

Scenarios