AI-Specific Representations in M&A: Best Practices

Recent advancements in artificial intelligence (AI), particularly generative AI (GenAI), have increased merger and acquisition (M&A) activity across industries such as software, healthcare, and financial services. Companies developing, commercializing, or significantly utilizing AI technology are becoming prime targets for acquisition. As a result, AI-specific representations in tech M&A transactions have gained prominence, and both buyers and sellers rely on them to protect their interests and maximize deal value. This article covers AI-specific representations in tech M&A: their significance, common types, legal considerations, and best practices.

AI-specific representations in M&A transactions are crucial assurances provided by the seller about the status, performance, and compliance of AI technologies within the company being acquired. These representations serve several vital functions: they help mitigate risks associated with the complex nature of AI, such as algorithmic biases, data privacy concerns, and regulatory adherence; they ensure operational continuity by confirming that AI technologies will function effectively post-acquisition, facilitating seamless integration with the buyer’s existing systems; and they affirm regulatory compliance, ensuring that AI components meet all legal requirements, thus minimizing the risk of legal complications after the acquisition.

In transactions involving AI technologies, several specific issues need to be addressed to ensure a smooth and legally compliant integration, some of which include:

Ownership and Licensing of AI Models: Clearly defining who owns and licenses the AI models used in the product or service, ensuring the target company has the necessary rights and licenses to use, modify, and commercialize the AI models.

Data Usage: Understanding how the acquiring company intends to use the data collected from the AI-powered product or service, ensuring data usage complies with privacy laws and ethical standards.

Liability and Insurance: Determining liability and insurance coverage for any harm or losses caused by the AI-powered product or service, assessing whether the parties can limit their liability, and ensuring adequate insurance coverage is in place.

In tech M&A transactions, AI-specific representations typically cover several critical areas:

AI usage in a target company raises unique risks, necessitating specific representations and warranties. These ensure that the company owns or has sufficient rights to AI algorithms, models, and the data used in training, deployment, or operation. The agreements confirm the ownership of content created by AI and emphasize the need for transparency and reproducibility in AI development processes. Protecting trade secrets, confidential, and proprietary information is crucial, and the agreements ensure these are safeguarded effectively.

Agreements often contain detailed representations and warranties related to intellectual property (IP) and technology matters, especially for companies that develop or utilize software, cloud services, or other IT assets. These agreements typically address:

Ownership and Rights:

Ensuring ownership and rights to use intellectual property (IP) assets is fundamental in AI-related M&A transactions. This involves confirming the sufficiency and validity of these assets while verifying that they do not infringe on third-party IP. It is imperative to provide clear assurances that the target company holds legitimate and enforceable rights to its IP, covering all algorithms, models, and datasets integral to its AI technologies.

Absence of Breaches:

Assurances regarding the absence of breaches in IP licenses or related agreements are crucial. These representations safeguard the integrity of trade secrets and confidential information. Ensuring that there are no existing violations or lapses in compliance with IP-related contracts fortifies the transaction, mitigating risks associated with potential legal disputes or intellectual property challenges.

Software and IT Systems:

Warranties related to software and IT systems encompass several critical aspects, including ensuring the proper use and licensing of open-source software, safeguarding the source code against unauthorized access to maintain its integrity, and guaranteeing the absence of viruses and malicious code within the software. Additionally, these warranties confirm that IT systems perform reliably and are secure from external threats, thereby providing a stable and secure foundation for AI operations.

Privacy and Data Security:

Privacy and data security warranties are critical, ensuring compliance with relevant laws and standards in data collection, processing, and transfer practices. These representations confirm that AI tools do not violate data privacy regulations, such as GDPR and CCPA, and that personal data is handled responsibly and securely. Robust data security measures must be in place to protect against breaches and unauthorized access, addressing the enhanced risks posed by sophisticated AI-driven cyber threats.

The representations and warranties also need to cover scenarios where the target company has used third-party AI tools. In such cases, it must be verified that the target company holds the necessary licenses to utilize these AI tools and that the AI outputs generated from these tools are legally compliant for business use. Even if the target company owns the AI outputs, these outputs might not always be protectable under IP laws. For example, the U.S. Copyright Office has specified that copyright protection is only extended to material that is a product of human creativity, not machine-generated content. Therefore, whether IP protection for AI outputs is a concern needs to be evaluated based on how the target company uses these outputs in its business operations.

The most recent NVCA Model Documents, updated in April 2024, include representations specific to “Generative AI Tools,” defined as AI technologies capable of automatically producing various content types. Investors are now actively seeking assurance that the target company has not used these tools in ways that would materially affect the ownership or rights of any proprietary IP. They also require confirmation that no sensitive personal information, trade secrets, or other confidential information has been included in prompts or inputs for these AI tools.

These AI-specific clauses are designed to ensure that the AI technologies, including algorithms, software, and datasets, are owned by the seller and are free from any infringement claims. The complex nature of AI systems means that there may not be a single form of IP protection that applies universally to the entire system. For instance, copyright might be used to protect the source code, while trade secrets could cover confidential information. Therefore, it is imperative for the buyer to ensure they acquire all necessary rights to fully own and utilize the system.

Additionally, the company must demonstrate a commitment to ethical and responsible AI development and use, addressing potential biases and ensuring compliance with relevant laws. Compliance and performance warranties ensure that AI technologies adhere to regulations and standards while meeting specified performance metrics, including accuracy, efficiency, and reliability benchmarks. Disclosure of third-party dependencies is vital, ensuring that any third-party technologies, data sources, or services relied upon by AI systems are secure and legally compliant. Indemnification clauses protect the buyer from liabilities related to IP infringement, misuse of data, and other AI-related issues, safeguarding against potential risks.

AI tools require large amounts of data, often including personal information. Compliance with data privacy laws, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), is crucial. Representations and warranties should ensure that AI tools do not violate these data privacy laws and that personal data used by AI tools is handled in compliance with legal and policy requirements. The agreements should address the security and integrity of AI tools, implementing robust data security measures to protect against breaches and unauthorized access. Additionally, they should consider the enhanced risks posed by AI tools, such as the potential for more sophisticated attacks by threat actors.

Currently, there are no specific AI representations beyond the general data-related ones. The AI-specific representations could address governance aspects of AI use and development, requiring companies to adopt and implement written policies, procedures, technical documentation, and logs based on commercially reasonable AI governance frameworks. Such representations would encompass risk management, impact assessments, continuous monitoring, and AI ethics principles, such as fairness and accuracy.

The importance of robust representations and warranties cannot be overstated in purchase agreements involving AI components. These provisions serve as critical safeguards for both parties in the event of disputes. For example, a seller may guarantee the AI model’s accuracy, reliability, and performance, while recognizing potential risks like hallucination and ensuring strict quality control, while a buyer may commit to using AI-collected data in accordance with laws, safeguarding sensitive information. These detailed representations and warranties help to establish a clear understanding and agreement between the parties, mitigating risks and protecting interests in M&A transactions involving AI technology, which are increasingly complex and still evolving.

Several other key AI-specific representations include:

Algorithmic Integrity:

Ensuring that AI algorithms are free from biases, errors, or defects is vital to maintaining their performance and fairness. These representations confirm the reliability and ethical soundness of AI systems, safeguarding against discriminatory or flawed outcomes.

Performance Metrics:

Performance metrics warranties assure that AI systems meet specified benchmarks for accuracy, efficiency, and reliability. These metrics are critical for evaluating the operational effectiveness of AI technologies and ensuring they deliver value post-acquisition.

Third-Party Dependencies:

Disclosures about third-party dependencies are essential, ensuring that all external technologies, data sources, or services relied upon by AI systems are secure and legally compliant. These representations address potential vulnerabilities and legal implications associated with third-party components.

Indemnification:

Indemnification provisions allocate liability and protect buyers against third-party claims related to IP infringement, unauthorized use of datasets, and other issues. These clauses safeguard the buyer from unforeseen legal challenges, ensuring a smoother integration and operation of acquired AI technologies.

Ethical and Responsible AI Use:

Representations regarding ethical and responsible AI use ensure that the target company has implemented robust policies and procedures to mitigate bias and promote fairness. These warranties address any pending or threatened claims, audits, investigations, or enforcement actions related to AI development and use. A commitment to ethical AI practices reinforces the company’s reputation and compliance with evolving regulatory standards.

To effectively manage AI-specific representations in tech M&A transactions, it is essential to follow several best practices:

Collaborate with Experts:

Work with AI experts, legal professionals, and technical consultants to thoroughly assess AI technologies and draft precise representations.

Maintain Comprehensive Documentation:

Keep detailed records of AI systems, including source code, data sources, performance metrics, and compliance documents to support the accuracy and reliability of the representations.

Conduct Regular Audits:

Identify and address issues related to IP ownership, data privacy, algorithmic integrity, and regulatory compliance through regular audits.

Tailor Representations:

Ensure representations are relevant and meaningful by tailoring them to the specific AI technologies and business context of the transaction.

Implement Continuous Monitoring:

Post-acquisition, establish continuous monitoring and reporting mechanisms to track the performance and compliance of AI systems, ensuring they remain robust and legally compliant.

AI-specific representations play a crucial role in tech M&A transactions, providing assurance and mitigating risks associated with AI technologies. By understanding the importance of these representations, recognizing common types, addressing legal considerations, and following best practices, companies can navigate the complexities of AI in M&A with confidence and achieve successful outcomes. As AI continues to evolve, the significance of these representations will only grow, and every transaction will need diligent assessment and accurate documentation.

Connect with Ajay Mago or any member of EM³’s Artificial Intelligence practice for professional support.

Ajay Mago is a former AmLaw 100 partner, with more than 16 years of experience in technology transactions, including at Jones Day, Mayer Brown, and Duane Morris. Mr. Mago advises on a wide array of sourcing, technology and other commercial transactions and helps companies navigate legal issues raised by data, emerging technologies, and digital transformation, both on the buyer and provider side. He routinely advises clients on IP strategy, management, and monetization arrangements, leveraging his technology background and business experience.