Firms Must Update M&A Playbooks to Address Generative AI Risks
Generative artificial intelligence has evolved so quickly that many companies haven’t had time to adjust. Now acquirers and sellers of businesses need to update their M&A playbooks to address AI legal risks in enterprise environments.
Such changes are relevant for acquisitions of companies that offer AI-powered products and companies using AI solutions internally.
Buyers now routinely include AI-specific representations in purchase agreements. For sellers, this means preparing for detailed AI-specific diligence, the extent of which may be new to sell-side deal teams.
To properly address the new AI workstream in mergers and acquisitions, buyers and sellers must consider appropriate inquiry and risk mitigation measures at each stage of the deal.
Pre-Kickoff
Inventory of AI and applicable terms. Many companies don’t maintain a complete, up-to-date inventory of the AI development, usage, and distribution among their teams. Sellers should establish one, as well as tracking any applicable contractual terms. Sellers can reduce concerns in diligence by presenting clear and organized descriptions of the company’s use of AI.
Responsible use policies and oversight. Another core diligence consideration is whether the seller has a responsible use policy and a cross-functional AI governance structure within their company. Each is necessary to effectively surface AI use by individuals within the organization.
Even if a seller expects limited to no AI usage within the organization, sellers should pause before making broad statements to buyers that such considerations aren’t applicable.
Buyers want to see that sellers are actively managing new technology risks and have appropriate visibility into the workflows of the organization. Sellers can show this by implementing appropriate personnel obligations and procedures, which will later support the accuracy of AI-related representations and warranties.
Purchase Agreements
Buyers are enhancing traditional IP representations and adding new AI representations that focus on core considerations in the context of AI, such as: training data; compliance with laws and contractual commitments; confidentiality terms and data use restrictions with third parties, including vendors; and the adoption and compliance with internal policies, governance processes, and impact assessments.
One example of this broader trend is the National Venture Capital Association’s updates to its form Stock Purchase Agreement in late 2023, which added specific representations concerning generative AI technologies.
Even if certain AI-targeted terms somewhat overlap with customary agreement provisions, their inclusion forces sellers to—at minimum—make targeted disclosures and assess specific risks arising from their adoption of AI.
Post-Closing Integration
Updating AI use policies and practices. Once a transaction is complete, buyers should integrate an acquired business into buyer’s broader AI management and oversight framework while accounting for the target company’s specifics.
Business acquisitions may change the scope of applicable AI regulations for a company. The EU AI Act, for example, will also apply to businesses outside of the EU that are placing on the market or putting into service AI systems or general-purpose AI models in the EU (with certain limited exceptions).
Buyers must consider appropriate updates to their own AI risk profile on a regular cadence as their business evolves. They should prepare to respond to heightened AI due diligence conducted by lenders, acquirers in an exit, and other potential partners.
Updating customer and supplier terms. A comprehensive, cross-functional review will ensure internal stakeholders have the appropriate balance of rights and risk allocation under such agreements going forward. This is especially true when buyers intend to use the data of an acquired business in new ways or shift the business’ customers or suppliers onto the buyer’s own forms.
Buyers must ensure both the acquired business and legacy business have the rights from customers that they need to pursue the combined companies’ AI goals. They should also scope the rights of vendors—especially concerning use of confidential information or personal data held by the company—to match contractual commitments and standards.
Takeaways
The increasing prevalence of products and services featuring AI technologies means buyers and sellers must each consider the impact such innovations will have in a deal process.
AI-related issues are relevant during a deal’s entire lifecycle. All parties need to research and discuss such issues early to avoid last-minute transaction delays.
This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.
Author Information
Sarah Schaedler is global chair of technology transactions at Orrick.
Daniel Healow is managing associate at Orrick.
Zac Padgett is partner at Orrick and co-leads the firm’s energy tech team.
Write for Us: Author Guidelines
