In recent years, the field of artificial intelligence (AI) has undergone significant advancements capturing the attention of businesses across all industries. This surge in interest and use of AI has prompted lawmakers to introduce stringent regulation culminating in this month’s entry into force of the EU Artificial Intelligence Act (AI Act).

Against this backdrop, AI-related risks and challenges are increasingly coming to the forefront of our M&A practice. In one of our previous blog posts, we have explored the legal intricacies of generative AI with respect to intellectual property protection. This article will highlight some of the characteristics and requirements of the new regulatory framework and how they may affect an M&A project. 

What to watch out for

Applying to providers, deployers, importers, and distributors of AI, the AI Act addresses different actors all along the AI value chain and irrespective of the industry concerned. Therefore, the AI Act may also play a role in transactions that are not tech-related at all – at least at first glance. The new rules can be pertinent with respect to virtually any sector and any area of a business.

An AI system as is subject to the AI Act is defined in Art. 3 (1) of the AI Act as:

“a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”. 

When requesting information on the target company in the beginning of a legal due diligence, it is advisable to not only ask for “artificial intelligence” but inquire information on data usage and analytics more broadly. Due to the yet varying understanding of what exactly constitutes an AI system, such systems may otherwise be overlooked. At times, in fact, a closer examination will be needed to verify an AI system, in particular to distinguish it from software that may be sophisticated but, instead of “inferring” how to create output from the input it was fed with, is following man-made programming rules. 

Apart from AI systems, obligations of companies under the AI Act also are triggered by the use of general-purpose AI (GPAI) models. A GPAI model, e.g., a large language model (LLM), is characterized by its “generality and the capability to competently perform a wide range of distinct tasks” (Recital 97 AI Act). It can also be an underlying component of an AI system in which case the legal regimes for both AI systems and GPAI models apply at the same time.  

Categorizing AI

The identification of any AI system and/or GPAI model is followed by assigning them to various legal categories. For both AI systems and GPAI models, the AI Act establishes a tiered approach based on the perceived risk of the technology. AI systems and GPAI models, thus, are subject to varying levels of regulation: 

Certain AI systems that, for instance, employ manipulative techniques or exploit a person’s vulnerabilities due to its age or social situation under certain circumstances are entirely prohibited (Art. 5 AI Act). In an M&A context, the operation of such AI systems would be particularly alarming as non-compliance with Art. 5 AI Act can result in the maximum fines available under the AI Act: 35m EUR or up to 7 % of the total worldwide annual revenues (Art. 97 (3) AI Act). By comparison, the largest fines for data protection violations under the General Data Protection Regulation (GDPR) are in the amount of 20m EUR or global revenues of up to 4 %.

Another category are high-risk AI systems: specific products or safety components of products or AI systems in eight distinct areas as listed in Annex III of the AI Act (e.g., employment or education). Other AI systems, in contrast, are believed to pose only limited risks, consequently being subject to fewer rules, or to present almost no risks (e.g., an email spam filter) and, hence, are not in scope of the AI Act altogether (while regulatory governance may still derive from, e.g., the Digital Services Act or the Data Governance Act). 

Differentiation also is required with respect to GPAI models. In a legal due diligence, it is particularly important to identify any models that, due to their high impact capabilities, entail a “systemic risk” (Art. 51 AI Act).

New regulatory hurdles 

As stated above, there are different sets of rules applying to AI systems and GPAI models in accordance with their presumed risk profile. These requirements range from basic transparency (a chatbot shall be recognizable as such), human oversight, technical documentation, and post-market monitoring to more complex duties such as the operation of a quality management system (Art. 17 AI Act). 

The latter may be of particular interest in a due diligence since a quality management system shall ensure nothing less than adherence to the AI Act in its entirety. The system shall incorporate, inter alia, a strategy, techniques, procedures, and actions to comply with the AI Act while all this has to be documented “in a systematic and orderly manner”. Reviewing the quality management system, thus, may often provide a good starting point for assessing overall AI compliance. 

For as long as the AI Act has not started to apply, a lack of AI compliance will rarely be a showstopper in a transaction. That being said, in many instances it will in fact be crucial to build confidence of the buyer in the target company’s prospective AI compliance.  

Comprehensive AI advisory service

That is why at Dentons we support you along every stage and facet of an AI-related M&A deal. Our services extend beyond the compliance assessment to include, in particular, guidance on how to cure AI-specific legal shortcomings and accounting for any remaining AI compliance risks within the terms of the purchase agreement.

Contact us today to find out how we can support you in your M&A deal including any AI-related matters.