Acquiring a technology company historically meant auditing software licenses, code repositories, patents, and data practices. AI tools and proprietary models add new layers of risk across intellectual property, privacy, cybersecurity, licensing, regulatory compliance, and operational governance. If a target uses AI to generate code or content, train or fine-tune models, make material decisions, or process customer data, undisclosed weaknesses may impair asset value, restrict post-closing use, or create remediation costs. For acquirers and private equity sponsors in middle-market transactions, AI-specific diligence should therefore be integrated into legal, technical, and commercial review rather than treated as a stand-alone checklist.
Key Legal Risks in AI-Driven Acquisitions
When evaluating a target company’s AI assets and workflows, deal teams need to focus on three distinct operational layers:
- Intellectual Property & Inventorship: Determining whether the target's primary software relies on AI-generated components that lack copyright or patent protection.
- Data Ingestion & Privacy Standards: Verifying that data used to train or fine-tune models was acquired legally without breaching commercial terms or consumer privacy rules.
- Open Source & Third-Party Licensing: Spotting copyleft or restrictive licenses hidden within open-source AI training sets and model weights.
Copyrightability and IP Ownership Gaps
One of the largest traps in AI due diligence is assuming a target company owns the code or creative assets it built using AI tools.
Under guidance from the U.S. Copyright Office, generative AI output is protectable only to the extent that a human author determines sufficient expressive elements; using AI as an assistive tool does not, by itself, prevent copyright protection. Patent law likewise requires all named inventors to be natural persons, although AI-assisted inventions may remain patentable when the claimed invention reflects human conception under ordinary inventorship principles.
If a target company relies heavily on AI coding assistants without documenting human authorship, review, and modification, it may face uncertainty about the scope and enforceability of intellectual property protection for portions of its software, as explored further in our analysis of AI copyright enforcement and data standards. Buyer counsel should examine development records, source-control history, review procedures, and other evidence showing the human contribution to material software builds.
Data Ingestion, Privacy, and Scraping Exposure
An AI model is only as clean as the data used to train it. Target companies often scrape third-party websites or funnel user data into internal models without evaluating terms of service or privacy disclosures.
- Breach of Contract: Scraping data in violation of enforceable website terms may create breach-of-contract exposure, depending on how the terms were presented, whether the target assented to them, and the governing law.
- Federal Trade Commission (FTC) Enforcement: The Federal Trade Commission has brought enforcement actions involving improperly collected or retained consumer data and, in certain matters, has required deletion of affected data and algorithms or models developed using that data. Buyers should therefore assess whether a target’s data practices could expose material AI assets to deletion or use restrictions.
- Privacy Compliance: Ingesting personal data without user consent can trigger significant state privacy penalties under frameworks like the California Consumer Privacy Act (CCPA).
Practical Due Diligence Checklist for Buyers
To identify these risks before signing and preserve leverage for deal protections, acquirers should incorporate the following steps into legal and technical diligence requests:
- Audit Vendor Terms and Zero-Data-Retention (ZDR) Policies: Review commercial agreements for all commercial AI tools used by the target company to confirm proprietary inputs were not logged or used for third-party model training.
- Review Open-Source and Model Licenses: Identify the licenses and use restrictions applicable to source code, training libraries, datasets, model architecture, and model weights. Determine separately whether any terms require source disclosure, attribution, notice, pass-through restrictions, limitations on particular uses, or release of modifications or derivative works.
- Inspect Reps, Warranties, and Risk Allocation in the Purchase Agreement: Require tailored representations addressing rights in training and input data, compliance with privacy and contractual restrictions, ownership and permissible use of models and outputs, third-party intellectual property claims, open-source and model-license obligations, and the target’s disclosure of material AI systems and incidents. Where diligence identifies material uncertainty, consider specific indemnities, escrows, covenants, or closing conditions rather than relying solely on general intellectual property representations — approaches that are vital for bridging valuation gaps when managing unquantifiable IP and tech liabilities in mid-market transactions.
- Examine Internal Developer Guidelines: Confirm that the target company maintains clear, enforceable corporate policies governing how and when employees can use generative AI in production workflows.
- Assess Model Governance and Regulatory Compliance: Determine whether the target has inventoried its AI systems, assigned responsibility for AI governance, classified higher-risk use cases, tested material models for accuracy and bias, documented human oversight, and monitored applicable sector-specific and jurisdictional requirements. These controls help identify operational and regulatory exposure that may not appear in an intellectual property or license review.
Next Steps
Navigating AI due diligence requires balancing commercial deal velocity with practical legal protections. To review target company IP portfolios or structure purchase agreement protections for an upcoming transaction, contact Bochner PLLC's Corporate / M&A practice group.
