AI-Specific Legal Due Diligence: What Standard Tech DD Misses

AI-specific legal DD should begin as early as the initial data room review — ideally at the same time as standard IP and contract review, not as a separate phase after it. The reason is sequencing: the most consequential AI DD findings — training data provenance gaps, change-of-control triggers in API agreements — affect deal structure, escrow requirements and representations and warranties. These need to be identified before deal terms are finalised, not after signing.

In practice, commissioning AI DD as a standalone workstream after standard DD is complete means re-reviewing documents already reviewed, which wastes time and budget. Build AI-specific questions into the standard DD questionnaire from the outset.

A provenance gap — where there is insufficient evidence that training data was lawfully obtained and the company has commercial rights to use it — is typically addressed in one of three ways. First, representations and warranties from the seller about data ownership and licence chain, backed by W&I insurance if available. Second, an escrow arrangement sized to the estimated cost of re-training or re-curating the affected data. Third, a price reduction reflecting the contingent liability.

The worst outcome is discovering the gap post-close, when the acquirer bears the full cost of third-party copyright claims with no recourse. For detailed analysis of training data provenance requirements see our article on Training Data Provenance in M&A.

This depends on the specific clause wording. Some change-of-control provisions give the provider a right to terminate on notice — typically 30 to 90 days. Others require the acquirer to re-apply for access or re-negotiate pricing. In the most restrictive cases, the agreement terminates automatically on close, with no continued access to the API.

The practical risk for acquirers is that if the acquired company’s product runs on a single provider’s API and that agreement terminates, the product may be non-functional within days of close. Mitigation strategies include: pre-close consent from the provider, parallel deployment on an alternative provider before close, or contractual conditions that make closing contingent on provider consent. All of this requires identifying the clause before signing, not after. See our analysis of Change-of-Control Clauses in AI Contracts.

Yes. When you acquire a company that operates an AI system, you acquire its regulatory status — including any existing non-compliance with the EU AI Act. If the target operates a system that will be classified as high-risk under Annex III but has not completed the required conformity assessment, that obligation transfers to the acquirer at close.

Acquirers should obtain a legal opinion on EU AI Act classification as part of DD for any AI company with EU market exposure. If non-compliance is identified, the risk should be priced in, or the acquisition should be structured to give the acquirer time post-close to complete the conformity assessment before commercial deployment. For classification analysis, see our article on EU AI Act High-Risk SaaS Classification.

The scope of AI DD varies depending on the transaction type, but the core categories remain the same. For a majority acquisition or merger, the acquirer becomes the legal successor to all IP, contracts and regulatory obligations — making full AI DD essential. For a Series A or B minority investment, the investor’s primary concern is protecting the value of the investment, which means verifying that the IP chain is clean, key agreements are not terminable at exit, and the regulatory picture will not prevent a future acquisition or IPO.

In practice, the training data provenance, model weights assignment and EU AI Act classification questions apply with equal force at both stages. What changes is the remediation leverage: a pre-investment investor can make clean IP a condition of funding; a post-acquisition acquirer has fewer options if gaps are discovered late. Early-stage founders should treat these questions as a pre-emptive structuring exercise before their first institutional round.