AI Due Diligence in a Business Acquisition: What Buyers and Sellers Should Review Before Closing
Artificial intelligence is no longer relevant only when the acquisition target is an AI startup.
A manufacturing company may use AI for quality control. A professional-services firm may use it to prepare client work. A retailer may use it for pricing and marketing. A software company may depend on third-party AI models inside its product.
If AI contributes meaningfully to revenue, efficiency, customer experience, intellectual property, or future growth, buyers should understand exactly what they are acquiring.
The appropriate diligence depends on the transaction, technology, jurisdiction, and industry. Qualified legal, technical, cybersecurity, privacy, and other professional advice may be necessary.
Why AI Changes M&A Due Diligence
Traditional technology diligence often focuses on software ownership, licenses, cybersecurity, intellectual property, and data privacy.
AI can add questions involving:
- Training and input data
- Third-party models
- Generated content
- Automated decisions
- Model performance
- Prompt and workflow design
- AI-specific vendor restrictions
1. Identify Every Material AI Use Case
Buyers should first understand where AI is used.
Possible areas include:
- Customer service
- Product functionality
- Sales
- Marketing
- Pricing
- Software development
- Employee productivity
- Decision support
Undocumented employee usage can be just as important as formally approved systems.
2. Determine Whether AI Is Core to the Purchase Price
If the seller claims that proprietary AI creates a meaningful competitive advantage, the buyer should determine what actually belongs to the target.
The value may be in:
- Proprietary models
- Fine-tuning
- Data
- Workflow design
- Customer adoption
- Integration
- Specialized expertise
3. Review Ownership of AI-Related Intellectual Property
Questions can include:
- Who created the technology?
- Were employees or contractors involved?
- Are invention-assignment agreements in place?
- Is third-party code included?
- Are open-source components used?
4. Review Training and Input Data Rights
A company may have created value using large quantities of information.
The buyer should understand whether the target had appropriate rights to use that data for the relevant purpose.
Potential sources can include:
- Customer data
- Licensed datasets
- Public information
- Internally generated data
- Third-party content
5. Examine Third-Party AI Providers
Many companies do not own the underlying model.
They rely on external providers through APIs, cloud services, or commercial software.
Diligence can review:
- Vendor contracts
- Pricing
- Usage restrictions
- Data terms
- Service availability
- Termination rights
- Change-of-control provisions
6. Understand Vendor Concentration
A business depending almost entirely on one AI provider may face operational risk if:
- Pricing changes
- Access changes
- Service quality changes
- The vendor terminates support
The buyer should understand whether reasonable alternatives exist.
7. Review Customer Contracts
Customers may have contractual requirements concerning:
- Confidentiality
- Data processing
- AI use
- Security
- Automated decision-making
The buyer should identify commitments the business has already made.
8. Examine Employee Use of Public AI Tools
Employees may enter information into external AI systems without management realizing it.
This may involve:
- Customer data
- Source code
- Contracts
- Financial information
- Trade secrets
Policies and actual employee practices should both be reviewed.
9. Review Cybersecurity
AI systems can create additional data flows, integrations, credentials, and access points.
Diligence may consider:
- API access
- User permissions
- Logging
- Third-party integrations
- Incident history
- Security controls
10. Understand Automated Decision-Making
If AI influences decisions involving employees, customers, pricing, lending, healthcare, safety, or other regulated activities, additional legal and compliance considerations may arise.
The buyer should understand where human review exists and how decisions are documented.
11. Test Whether Claimed AI Capabilities Actually Work
Legal diligence should be coordinated with technical and commercial review.
A company may market a product as AI-enabled while relying heavily on manual employee work behind the scenes.
The buyer should understand the real operating model.
12. Review AI-Generated Content and Code
Where employees use AI to create software, marketing, designs, reports, or other content, the buyer may need to understand applicable ownership, licensing, confidentiality, and quality issues.
13. Identify Regulatory Exposure
Applicable requirements depend on:
- Industry
- Geography
- Data involved
- How the AI is used
- Who is affected by its decisions
A generic AI policy cannot replace transaction-specific regulatory analysis.
14. Review Representations and Warranties
Where AI is material to the transaction, purchase-agreement representations may need to address relevant areas such as:
- Intellectual property
- Data rights
- Privacy
- Cybersecurity
- Material contracts
- Compliance
15. Consider Whether AI Risks Affect Valuation
An unresolved issue does not always mean the transaction should stop.
Depending on the problem, parties may address risk through:
- Price
- Closing conditions
- Remediation
- Covenants
- Indemnification
- Escrow
Sellers Should Prepare AI Information Before Diligence Begins
A seller using AI materially should be prepared to explain:
- Which tools are used
- What they do
- Who owns relevant technology
- What data is involved
- Which vendors are required
- What customer commitments exist
- What internal controls are in place
AI Diligence Is Becoming Part of Business Diligence
A buyer should not treat AI as an isolated technology checklist if it materially influences how the company earns revenue, delivers services, controls costs, or differentiates itself.
Transaction counsel can help coordinate the legal review of intellectual property, data, contracts, privacy, cybersecurity, vendor dependence, and acquisition documentation around the target’s actual AI use.
Review ownership, data rights, vendors, customer commitments, cybersecurity, employee use, compliance, and post-closing continuity before the transaction closes.
Consult EIN Legal Counsel →
Frequently Asked Questions
Why should buyers conduct AI-specific due diligence?
If AI materially affects products, operations, data, intellectual property, customers, or valuation, traditional diligence may not fully address ownership, licensing, vendor, data, cybersecurity, and operational risks associated with the technology.
What should sellers disclose about AI use?
Relevant disclosure may include material AI tools, vendors, intellectual-property ownership, data sources, customer commitments, employee usage, security controls, and how AI contributes to products or operations.
Can AI problems affect the purchase price of a business?
Potentially. Issues involving ownership, licensing, data rights, vendor dependence, compliance, cybersecurity, or the reliability of claimed AI capabilities can affect value, transaction structure, remediation requirements, or contractual protections.
AI-related acquisition diligence can involve intellectual property, data rights, vendors, customer commitments, cybersecurity, employee use, and regulatory considerations.
