Key considerations for AI in M&A transactions

Artificial intelligence (AI) technologies are attracting significant attention—including from large “serial acquirer” technology companies. Interest has accelerated with the emergence of “generative” AI – machine learning technologies that go beyond merely making predictions based on existing data and are trained to generate new content such as text, images, and even computer code based on user prompts. While acquisitions in the AI space are not particularly new, the acceleration and deployment of emerging technologies require acquirers to consider how due diligence and deal terms should be adjusted, particularly with respect to technology and related intellectual property rights. AI is quickly becoming ubiquitous. Some AI focus will likely become part of every technology company acquisition, with more comprehensive reviews and deal terms for targets that provide AI products or depend heavily on AI. While many aspects of AI are covered by existing diligence processes and agreement provisions, this column highlights some key AI focus areas for acquirers.

Have a conversation

In a fast-paced M&A transaction, the acquirer and its counsel are charged with developing, via the due diligence process, a detailed understanding of the target’s business and technology and issues that may result.

A well-structured conversation with the target’s technologists, businesspeople, and legal representatives is one of the most effective diligence tools – especially in emerging fields like AI, where business models, practices, and even vocabulary are not yet well-established. This provides a unique forum for real-time conversation, which for AI often includes discussion about development of the target’s AI technology and models, explainability and management of bias in modeling, and data collection and use. For these purposes, a live conversation is superior to merely reviewing documents or submitting written questions, but the acquisition team must prepare in advance, learn what they can from materials provided, and formulate questions and follow-ups that elicit new and useful information. When executed properly during initial diligence, the conversation can also allow acquirer’s counsel to front-load review of the most important materials.

Focus on data

Data is like fuel to AI. Data is needed to train AI models so that they can perform useful functions. “Data” in this context includes more than just numbers and statistics. It can include text, images, audiovisual works, and even personal information about individuals. Improper collection or use of data creates potentially-costly problems and can even cause a deal not to go forward. Each type of data may be subject to rights and restrictions enforceable by others – such as copyrights, personal privacy rights, contractual restrictions, and regulatory requirements. In diligence, the acquirer should ask about the target’s data sources. Are datasets “scraped”? Does the target license data on commercial terms? What policies and practices are in place to ensure compliance with laws and contracts? If the target is using third-party AI, the acquirer should also ask about the target’s diligence regarding those suppliers. In the acquisition agreement, the acquirer will want to include tailored representations and warranties to confirm diligence disclosures and cover risks that may arise from improper data collection or use. Representations and warranties in the AI space are evolving, and while acquirers will not want to take on undue risks from activities before transaction closing, targets may resist assuming risks that are viewed as inherent in the use of AI and not specific to the target’s practices.

Question IP protection for target technology

When technology is core to deal value, acquirers are interested in the strength of the target’s intellectual property portfolio and protections. Not all uses of AI will affect IP protection, but where a target has actually used AI to create key technology, interesting questions arise about the scope and strength of the IP rights available to protect that technology. Legal rules vary by jurisdiction and are still developing. While a detailed analysis is beyond the scope of this column, it is notable that the U.S. Copyright Office has published guidance that copyright registration of a work requires sufficient human authorship, and the U.S. Patent and Trademark Office has published guidance that a patentable invention requires a significant contribution from a natural person. In diligence, acquirers will want to understand the sources of the target’s innovation and competitive advantage and to what extent AI generated key technology. For example, the source code underlying an AI system may be protected by copyright, but an AI model that is the result of training by a machine may not be. Knowledgeable legal advisers will develop provisions to bolster standard IP representations and warranties in order to address these questions and confirm statements made in diligence.

Consider regulatory compliance

For technology companies using AI, a changing regulatory environment will require a focus on compliance. Regulation relating to technology has long existed in certain industries such as healthcare and consumer finance, and in recent years comprehensive data privacy and digital services regulations have come into effect. The newly-enacted EU AI Act regulates AI technologies and businesses directly, establishing certain categories of AI-technology-based risks and imposing requirements for each category. The act seeks to cover products sold to EU citizens – which in practice reaches very far. This EU law will likely not be the last attempt to regulate AI. As these regulations emerge, acquirers will need to ask questions about compliance policies and practices and evaluate AI technologies against existing regulations. Acquirers will also need to understand the use of AI for purposes considered “high risk,” whether under new regulations or existing laws. Any ongoing investigations, audits, and complaints will be scrutinized, and acquirers will likely seek risk-allocation provisions related to noncompliance. Given that many M&A targets are small companies with limited resources, acquirers can expect to discover violations for which remediations will be required. Since penalties for noncompliance can scale with the revenue of the violator, larger acquirers have much at stake.

Developments in AI promise exciting new products and ways of conducting business. While these technologies create new risks and will attract new regulations for companies to navigate, lawyers with a good understanding of how AI works and how existing and new laws apply to it will be in a strong position to help their clients get deals done in this changing environment.