Business Transactions

Traditional M&A due diligence often misses the legal risks embedded in a target company's data practices and AI systems. Specialized tech due diligence covers: how the company collects and uses personal data, whether their privacy practices comply with applicable regulations (GDPR, CCPA, PIPEDA), the provenance and licensing of training data used in AI systems, potential algorithmic bias liability, data breach history and incident response capacity, and whether data assets are actually owned and transferable. These issues can significantly affect transaction value, deal structure, and post-closing integration costs.

For straightforward software licensing, a general commercial lawyer is often sufficient. But AI licensing presents issues that standard software licensing agreements are simply not designed to address. Who owns the training data — and does the licensor actually have the rights to license it? What can the licensee do with the model: fine-tune it, build on it, deploy it in regulated industries? Who owns derivative works like fine-tuned models? What are the output ownership and liability positions? Which emerging AI regulations — the EU AI Act, Canada's proposed AIDA — create compliance obligations that need to be allocated between the parties? Getting these wrong in the contract creates disputes and liability down the line that are expensive to resolve. We draft AI licensing arrangements that clearly address all of these questions.

Sophisticated investors in AI and data companies increasingly treat data governance as a material diligence category. Common questions include: What personal data does the company collect and on what legal basis? How is training data sourced, licensed, and documented? Has the company experienced any data breaches or regulatory investigations? What are the company's contractual obligations to customers around data use, and do current AI practices comply with those obligations? Is there a privacy program, and who owns it internally? What AI governance policies exist, and how are they enforced? How does the company's AI use personal data, and is this disclosed to users? Companies that can answer these questions clearly and produce supporting documentation move through diligence faster and with less friction.

Standard SaaS agreements were designed for deterministic software that does what it is configured to do. AI products introduce a different set of legal issues that require tailored contract language. Key differences include: output liability (who is responsible if the AI produces incorrect or harmful outputs?), training data disclosure and restrictions (can the vendor use customer data to train or improve its models?), explainability and audit rights (can the customer understand and audit how the AI reached a decision?), regulatory compliance obligations under AI-specific legislation, and performance standards that account for the probabilistic nature of AI outputs. Enterprise customers are increasingly asking for these provisions explicitly. We draft and negotiate AI product agreements that address these issues clearly on both the vendor and customer side.