AI acquisitions and the dawn of a new era

To navigate legal complexities and mitigate unknown risks, buyers must address specific legal issues associated with acquiring AI assets. This involves assessing potential target liabilities and risks, with a focus on AI inputs, the relevant AI system(s), AI outputs and evolving AI regulation.

Below are some examples of the related legal risks buyers should due diligence and address:

The crucial issue of data ownership and protection 

Statutory laws have not yet established comprehensive protection for data rights. Consequently, the target company’s approach to protecting data assets is pivotal. Buyers should identify business-critical data and evaluate its protection through:

• potential IP rights (including database rights); 
• contractual means; and 
• technical and organisational measures to protect the data from access and usage by third parties, including malicious access (such as use of secure interfaces and use of encryption techniques).  

Buyers will often want to ensure they can prevent:  

• sellers from reusing critical data for new ventures; and 
• undesired third-party access that could impact the business and its competitive position.

In particular, attention should be paid to:  

• prior rights which may have been granted when assessing how the transaction should be priced; and
• reviewing agreements which may grant ongoing access, including after the close. 

Facilitating cross-border transatlantic and Chinese M&A deals 

While cross-border data transfers have become increasingly challenging, for transatlantic M&A, 2023 represents something of a turning point. The European Commission’s adequacy decision for the EU-US Data Privacy Framework (the DPF) in July 2023, and the agreement between the US and UK governments on a UK extension to the DPF (the UK Extension), have the potential to better facilitate personal data transfers from the EU and UK to the US. Subject to detailed requirements of the respective regimes, reliance on the DPF and the UK Extension will be possible for M&A deals if the data importer is certified under the DPF or the UK Extension, eliminating the need for additional transfer instruments or measures.  

However, because of uncertainty about potential legal challenges, many companies are continuing to rely on existing mechanisms (such as Standard Contract Clauses (SCCs) for the EU, and International Data Transfer Agreements and the UK Addendum to the EU SCCs for the UK) for now. The DPF and UK Extension unfortunately will also not simplify data transfers from the EU/UK to countries other than the US. 

On the other hand, China’s strict rules on cross-border data transfer continue to create headaches at all stages of an M&A transaction. These rules require specific notification to be given, and consent obtained, for a cross-border data transfer of personal data—with the notification to include the name and contact information of the overseas recipient; a rule that is incompatible with deal confidentiality during a diligence phase. The same requirement applies on a domestic transfer.

Depending on the volumes of data held by the target and being transferred out of China, a cross-border transfer of personal data will need to be supported by a standard contract (in a mandatory form) or to undergo an onerous and time-consuming government security assessment process, with an uncertain outcome. The standard contract itself needs to be filed with the government, along with a detailed impact assessment report.

These rules are leading to more aspects of diligence processes being conducted solely onshore in China and to very close attention being paid to redaction of personal particulars in disclosed materials. An additional layer of national security-type concerns will also arise when conducting diligence in sensitive sectors of the economy that may involve the new categories of ‘important data’ or ‘core data’ that are regulated by the Data Security Law.

Cybersecurity risks on transactions 

(Source: Link to Allianz Risk Barometer 2023 Allianz Risk
Barometer 2023 - Cyber incidents | AGCSs)

Cybersecurity continues to be a significant issue for businesses. Organisations are processing increasing volumes of data, which elevates the risk of a data breach occurring in the context of a cyber attack. Where such an attack comes to light after an M&A transaction has completed, privacy regulators are increasingly willing to investigate the due diligence and post-closing steps taken by the buyer, and take enforcement action.  

Shortcomings in this area can lead to unexpected material financial exposure, including review and remediation costs, regulatory fines, and potentially mass claims, as well as reputational data. Therefore, it is important for buyers to properly identify, assess, and remediate cyber issues during and after M&A transactions.  

A first step for buyers is to assess the risk profile associated with the target, in order to properly scope cyber and data due diligence. Enhanced due diligence is more likely to be required where the target: 

• processed large volumes of customer data;
• undertakes high-risk processing activities (such as analytics and profiling); 
• is subject to more onerous privacy regimes (such as the EU’s GDPR); or
• has a history of cyber incidents.  

Buyers should look to align their due diligence with areas of regulatory focus, such as relevant technical and organisational measures identified in regulatory guidance and decisions, which include:

• multi-factor authentication;
• system monitoring and logging;
• encryption;
• data/cyber policies; and
• procedures and assessments.

Depending on the findings, a buyer might require the seller to remedy security issues before closing and/or seek indemnities in respect of regulatory fines and compensation claims for disclosed incidents. 

Regulators are also likely to review what steps were taken post-closing to identify and remediate cyber issues. For example, if in-depth cyber and data due diligence was not possible before signing (eg, where the buyer and seller are competitors), then regulators will generally expect greater due diligence to take place after closing of the transaction.

Buyers will also need to ensure that the target complies with privacy laws post-closing. For example, under the UK and EU GDPRs this may include the data security principle when integrating the target’s IT systems and data, the data minimisation principle when deciding whether to retain all acquired data, and the transparency principle if the buyer wishes to use the target’s data for new purposes.

Looking ahead

Companies face extremely varied and complex challenges while carrying out data-related transactions. Despite those challenges, investment and transactional operations relating to data remain very numerous.

Companies should, therefore, continue to prepare as far as possible to be able to tackle all issues likely to arise at every stage. While pursuing the ‘new gold’ of data, organisations should:

• think globally;
• secure appropriate rights;
• not forget about cybersecurity risks and privacy laws; and
• consider any post-closing issues.

Back to top.