The point currently only needs brief documentation.
Record the finding in the data room. If new information appears during the process, update the legal assessment.
Due diligence
AI systems and training data in acquisition due diligence
AI systems in a business acquisition: review training data, AI Act, rights, documentation, GDPR and liability risks.
Your law firm
BRANDAUER Rechtsanwälte
Salzburg law firm for corporate, company and transaction law
Every transaction is handled by a coordinated team of lawyers, legal staff and specialists. In company acquisition matters we look at structure, contract, tax and liability together.
21 July 2026 · Mag. Bernhard Brandauer, Rechtsanwalt
AI systems and training data are easily underestimated in business acquisitions. Buyers need to understand whether a target merely uses standard tools or whether AI is embedded in products, pricing, customer service, review workflows or decision processes. This article complements software and SaaS businesses IP and IT contracts data protection due diligence
Review AI risk
Is AI use in the target deal-relevant?
Answer two questions on systems and data.
Already know you want to get in touch? Go straight to the enquiry form.
Does the target use AI systems in a core process or product?
Generic office use differs from a system shaping product, pricing, review or customer interface.
All paths at a glance
Overview of all answers.
The finding is well prepared for negotiation and contract drafting.
If documents, economic relevance and responsibility are clear, the point can be reflected in warranties, pricing logic or closing plan.
Sharpening is needed before signing.
Unclear evidence should not be hidden behind generic wording. The point needs a specific contract effect or a clear delivery plan.
Why an AI inventory comes first
Why an AI inventory comes first
First, the parties must know which systems are used, who the provider is and whether the target is user, deployer, provider or integrator of an AI solution. Regulation (EU) 2024/1689 works with roles and risk logic.
For due diligence, the decisive point is the concrete function in the business. A marketing chatbot is different from a system evaluating creditworthiness, prices or sensitive data.
Training data, rights and data protection
Training data, rights and data protection
Training data and input data raise questions of origin, usage rights, personal data, trade secrets and deletion or blocking duties. The buyer should also see data sources, licence chains and technical documentation.
Where personal data is processed, the GDPR remains relevant in its own right. A technical model report does not replace review of legal basis, processors or data-subject rights.
Which warranties and closing points make sense
Which warranties and closing points make sense
The SPA can include warranties on system inventory, rights in training data, third-party dependencies, data-protection documentation and known incidents. Where uncertainty is high, closing deliverables or indemnities may be appropriate.
Cybersecurity should also be considered because AI systems often use interfaces, logs and external services.
Review grid
Review AI systems correctly in the data room
Typical questions before signing.
| Point | Why it matters | Contract effect |
|---|---|---|
| Role Role | User, deployer or provider? | Prepare AI Act analysis |
| Data Data | Where do training and input data come from? | Review rights and GDPR |
| Documentation Documentation | Is technical evidence available? | Closing deliverable |
| Liability Liability | Were there errors or complaints? | Warranty or disclosure |
The documents, economic relevance and contract structure in the individual case are decisive.
Practical note: The term AI in a pitch deck is not enough. The key is whether the system can be reviewed legally, technically and commercially.
FAQ
Frequent questions.
Does every AI tool require an AI Act review? +
The concrete role and use are decisive. The review should therefore start with a system inventory.
Are training data always an IP issue? +
Not only. Copyright and usage rights may matter, but so can data protection, trade secrets and contractual restrictions.
Should AI be covered in the SPA warranties? +
For business-critical AI, yes. System inventory, rights, documentation and known incidents should then be regulated specifically.
Topics
AI systemsAI ActTraining dataDue diligence
Structuring a deal, reviewing a contract, securing the risks?
When buying a company, structure, review and contract decide. Call us directly or send an email, callback within one business day.
Contact
A direct line to the firm.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg
Phone
+43 662 6280000