Deal Series - Due Diligence In The Age Of AI: What Every Buyer Should Be Asking

Artificial intelligence continues to transform the way we do most things and how businesses operate across all industries. Companies are using AI to automate their workflows, screen candidates for recruitment, develop software, analyze customer data and perform a growing range of other functions. Technologies such as generative AI, large language models (LLMs), machine learning and agentic AI are rapidly evolving and expanding the ways in which AI is integrated into day-to-day business operations.

For buyers and investors, in addition to presenting opportunities, AI presents a new category of risks that is no longer reserved for technology companies. A company’s use of AI may create legal, regulatory, operational and commercial risks that must be explored by asking the right questions before making any acquisition or investment. These risks may include issues relating to intellectual property ownership and infringement, privacy and data protection, data sovereignty, cybersecurity and contractual restrictions.

While traditional areas of due diligence continue to be highly relevant, they may no longer tell the whole story. As AI becomes increasingly embedded in how companies operate, understanding how it is being used is an integral part of understanding the business itself. To that end, buyers should consider incorporating AI-specific questions into their due diligence request lists, including questions relating to the following:

1. Use of AI: Identify where AI, machine learning or generative AI tools are used by the target. Be sure to include key service providers and consider not only internal AI tools but also external tools and platforms.
2. Products and Services: Are there any products or services offered by the target that incorporate, rely on or are materially supported by AI? If so, identify whether the underlying technology is proprietary to the target or provided by a third-party platform.
3. Policies and Governance: Does the target have any policies for the use of AI by its employees and contractors? At a minimum, targets should have policies in place concerning permitted and prohibited uses of AI tools and verification of AI outputs.
4. Third-Party Data: Does the target use any customer data, personal information or third-party data that is entered into or otherwise processed using AI tools? Is any of the information personal health information? Is the data stored locally or internationally? Are there any ethical or other guidelines or policies in place concerning how the AI tools are trained or used?
5. Contractual and Regulatory Restrictions: Is the target bound by any material contracts that restrict its ability to use AI tools? Are there any existing or emerging laws or regulations applicable to the target’s use or development of AI?
6. AI Reliance: Are there any material internal business functions that are dependent on AI tools? Consider functions such as finance, recruitment, customer service and internal decision-making. What processes are in place to verify AI-generated outputs and ensure appropriate human oversight, accuracy and reliability?
7. Intellectual Property: Does the target have any intellectual property developed using AI in any material respect? How is that intellectual property protected? Is there a risk that AI tools used by the target may infringe on third-party copyright or other intellectual property rights?
8. Cost: What is the cost of internal and external AI tools to the business? Are those costs fixed or variable? How much notice must vendors provide of price increases? 

Relatedly, as the use of AI tools becomes increasingly common in buy-side due diligence practices, target companies and sellers should carefully consider the extent to which the use of AI tools should be permitted under their non-disclosure agreements with potential bidders in order to reduce the risk that sensitive financial, commercial or other information may be inadvertently disclosed or used for competitive purposes after being input into an AI algorithm.

From the buyer’s perspective, it is important to be mindful of any covenants in non-disclosure agreements that may unduly limit the use of AI tools if these tools are used in due diligence workflows. A potential middle-ground compromise for targets and buyers is to restrict the use of publicly available generative AI tools to enterprise-grade tools that are subject to confidentiality, security and data protection safeguards, including protections that prohibit the use of the target’s confidential information from being used to train or improve the provider’s models or from being made available to third parties.

As AI continues to evolve and reshape the ways businesses operate, understanding how it may be embedded in day-to-day business operations and the opportunities and risks associated with its use can no longer be an afterthought. Effective due diligence can help buyers identify any potential risks and better understand how AI can be leveraged to drive efficiency, innovation and create value within a target’s business. A PDF version is available for download here.