AI Liabilities and the M&A Due Diligence Process

According to a Shumaker article by Wendy Byrne, as artificial intelligence (AI) becomes embedded in business strategy, it is increasingly central to mergers and acquisitions (M&A). Byrne examines the latent liabilities in AI models that can affect mergers and acquisitions (M&A) transactions and the M&A due diligence process.

The author says that AI carries unique legal and operational risks for M&A transactions, particularly when AI training data or governance lacks transparency. Potential liabilities stemming from how AI models are trained, stored, and deployed are assessed as part of the due diligence process.

A recent case has highlighted the high stakes of data provenance with a proposed $1.5 billion settlement. As a result, acquiring companies’ legal ops professionals must now scrutinize whether AI training data was legally acquired, how it is retained, and whether copyrighted or sensitive material can be traced within outputs or model weights.

Beyond copyright concerns, the M&A due diligence process encompasses privacy compliance, contractual safeguards, and evolving global regulations such as the European Union AI Act. This requires deep inquiry into data lineage, model behavior, and governance frameworks, as well as clear audit trails and destruction certificates for infringing datasets. The acquiring company’s legal ops professionals are expected to review vendor contracts for indemnities, data-mining carve-outs, and audit rights, details that can shift substantial risk between the parties.

Pre-close diligence recommendations from legal ops professionals should include destroying infringing datasets, disabling training on customer/client data, and implementing guardrails. Post-close, legal operations needs to ensure that AI model integration strengthens AI governance policies, remediates data practices, implements technical controls to prevent data leakage, provides training and supervision, and ensures that teams understand the limits of AI models.

AI’s rapid adoption doesn’t absolve organizations from the need for foundational diligence. Understanding data provenance, governance, and regulatory obligations is essential to the M&A due diligence process in managing risk and preserving value in AI-driven acquisitions.