With all of the ongoing excitement surrounding AI companies and the AI industry generally, how can prospective investors and acquirors properly assess risk and determine which AI companies are truly valuable?

In Part 1 of this series, we proposed key factors that lawyers and dealmakers should consider when drafting M&A transaction documents to address some of the unique issues involved in acquiring an AI company. In this article, Part 2, we discuss important legal questions that prospective investors and acquirors should consider during their respective due diligence processes, to properly assess the value and risk of acquiring or investing in an AI company.

The value of AI companies

To delve into this nuanced subject, we connected with Edoardo de Martin, CEO and Founder of Industrio AI, and former GM of Microsoft Dynamics, Vancouver for his thoughts on what key factors dealmakers and investors should consider when assessing these opportunities. Edoardo highlighted that while there is a clear race to monetize AI technology (in all its forms) across industries and geographies, there will inevitably be massive winners and losers in this competition. In Edoardo’s view, the most valuable AI companies will most likely be the ones who develop the sophisticated tooling infrastructure that help traditional businesses build their own AI solutions to address their particular business challenges and needs, echoing the apt lesson learned by many during the 19th century Gold Rush:

“When everybody is digging for gold, it’s good to be in the pick and shovel business.”

Edoardo also noted infrastructure and security considerations as key factors in scalability and adaptability of AI solutions. On a macro level, as AI becomes increasingly integrated into various industries, data centers must be equipped with the latest hardware to meet computational requirements. This is propelling the need for high-performance servers, advanced networking equipment, and efficient cooling solutions, thus driving market growth. On a micro level, an AI company’s decision to create on-premises or cloud-based systems, or where the AI company chooses to store its data, may also have a significant impact on the AI company’s ability to attract customers in a given industry.

A very important distinction between traditional software companies, which develop tooling infrastructure and platforms tailored to specific industry environments, and AI companies can be seen most noticeably in the value of their respective intellectual property (IP). A traditional software company’s primary IP asset is typically the software code it develops to perform certain functions. On the other hand, the main driver of value for AI companies is often either their “data moat”—the company’s ownership of, or exclusive right to, underlying datasets—or the proprietary model(s) developed by the company to manipulate that data. The way in which an AI company develops and utilizes its pipeline of data inputs and outputs will necessarily have major legal and risk implications that prospective acquirors and investors need to be mindful of.

Due diligence considerations

The list below outlines important diligence requests and questions that prospective acquirors and investors should consider as part of their legal due diligence processes to properly assess a target AI company’s value and risk profile:

Intellectual property

• Registered IP: Provide a list of all intellectual property (filed, registered, in process, or applied for), including patents, trademarks, domain names, copyrights, service marks and applications, trade names owned by the AI company, including description of items and the jurisdictions where they are registered.
• Non-registered IP: Provide a list of non-patented proprietary information, including trade secrets, processes, and programs.
• Collection of training data: Describe how the AI company obtains training data and the type of training data used. Provide a list of all data sources and any licenses obtained by owners of the training data
• Third-party AI inputs and outputs: Identify the owner(s) of the AI technology, and all inputs and outputs. Provide all contracts that may establish such third-party rights. This includes agreements relating to escrow of the AI company’s code, as well as all third party beneficiary forms or other grants of any rights, contingent or otherwise, for release of code to/from third parties.
• Company AI outputs: Identify the owner of the AI outputs provided to clients or other recipients by the AI company.

Technology matters

• AI technology: Provide an overview of AI technology that the target company develops or uses, such as machine learning, deep learning or any others that may reasonably be considered as AI technology, including a list of each of these AI technology types and describe how they work.
• Software development processes: Provide an overview of the AI company’s general software development processes, policies and procedures.
• Technology stack and architecture: Provide a diagram depiction of the infrastructure deployment architecture including an inventory of the full technology stack.
• Data architecture: Provide an overview of the data architecture including a view of the schema related to customers.
• Bias: Describe and provide evidence of any steps taken by the AI company to detect and remediate algorithm biases.

Privacy and data protection

• Policies: Provide copies of all internal and external privacy policies, statements or notices.
• Types of personal information collected: Describe the types of personal information collected by or on behalf of the AI company.
• Safeguards for personal information: Describe all internal practices, procedures and systems dealing with current or past management of personal information, including a description of protective measures relating to electronic and physical data security, IT systems management and data encryption, retention and destruction.
• Third-party disclosures: Provide a list of all agreements entered into with third parties to whom personal information has been disclosed such as outsourcing agreements, joint alliance or marketing agreements. This list should include: (a) general type of service, such as advertising, analytics, facilities, etc.; (b) type of personal information disclosed; and (c) where data is stored and processed by the third party.
• Breaches: Describe any known instances of past or ongoing unauthorized use of or access to the AI company’s AI, including details of any general data security breach in the last two years.

Regulatory matters

• Regulatory approvals: Provide copies of any key documents relating to material regulatory approvals for the AI company and/or copies of any correspondence with any regulator.
• Licenses: Provide copies of all AI licenses or authorizations provided to, or obtained by, the AI company and the terms under which such licenses were provided to or obtained by the target company. For each of the licenses, describe how and for what purposes the AI is used, specifying whether it is (a) used internally or (b) used to generate outputs which are provided to or used by clients or other recipients.

Taking a strategic approach

AI technology and business is developing at a rapid pace and applicable laws and regulations are changing faster than most industry bystanders can keep track. As a consequence, prospective investors and acquirors must keep current with the myriad of changes happening in the industry, as well as the legal and regulatory landscape more generally, to ensure they have a well-tailored and focused approach to properly assess a target AI company’s business, industry-focus, and unique value proposition. Asking the right questions and understanding the key drivers of risk are imperative to avoiding unwelcome surprises and ensuring a sound investment or acquisition decision.

For more information on this topic or any questions related to the legal or regulatory implications of potential investments or acquisitions involving AI companies, please contact the authors, Mark Mahoney, Arik Broadbent or Noah Walters.