Data rights in M&A due diligence: what buyers now check because of AI

What do acquirers check about data rights now?#

Acquirers now check data rights in three directions: data coming into the target, data the target uses internally, including with AI tools, and data going out under licenses or partnerships. Privacy and security used to dominate this workstream; AI has added questions about training, model use and licensing.

Operating partners and general counsel see the pattern from both sides. As buyers, they want to know the target can keep doing what it does with data after closing. As sellers, they need to show it with documents rather than assurances.

The questions arrive earlier than they used to. Some buyers raise data and AI topics in the first management meeting, because the answers can change how they view the target's product roadmap, its customer relationships and the work needed after closing.

What is on the core data rights diligence checklist?#

The core data rights checklist covers nine areas that now commonly appear in the data and AI sections of diligence request lists. Not every item applies to every target; a field service company and a vertical SaaS platform will weight them differently.

Answering these items is easier when one person owns the response and every answer points to a document. Verbal assurances in a management meeting do not survive the confirmatory phase.

How outbound data licenses are reviewed#

Outbound data licenses are reviewed like any material contract, with extra attention to what the buyer can do with the records after closing. A clean, non-exclusive license with a fixed term reads as revenue; a vague one reads as risk.

• 1Exclusivity: whether any field, record family or buyer category is locked up, and for how long.
• 2Permitted use: training, evaluation or both, and whether redistribution is barred.
• 3Term, renewal and termination rights, including what happens on a change of control.
• 4Assignment: whether the license can move with the business without the licensee's consent.
• 5Deletion: what the licensee must delete at the end and whether it certifies deletion.
• 6Warranties and indemnities the target gave about rights and privacy, and their caps.
• 7Revenue recognition: how license fees were recognized and over what period, which the buyer's accountants will test.

Provenance records that answer questions early#

Provenance records answer diligence questions early because they show where each dataset came from and what it may be used for. They matter most for any dataset the target licensed out or used to train its own models.

Published standards offer a ready-made structure. The Data & Trust Alliance's Data Provenance Standards sort dataset metadata into Source, Provenance and Use groups, and the Use group covers points such as confidentiality classification, where consent documentation is kept, license to use and intended data use. A target need not adopt the standard formally; records organized along those lines simply answer diligence requests faster.

In practice, a short datasheet per dataset is enough: what it contains, which systems and years it came from, which contracts and notices govern it, what was removed during preparation, and who approved its use or release. Keep each datasheet next to the related license, so counsel can read them together.

AI representations and warranties buyers ask for#

AI representations and warranties extend the usual data and IP reps to cover training and model use. Wording is negotiated deal by deal, but the topics are becoming familiar to deal counsel, and sellers can prepare the support for each in advance.

What should sellers put in the data rights folder of the data room?#

Sellers should put the documents behind every data answer into one data rights folder, so buyer's counsel can test claims without a round of follow-up requests. Building it before the process starts also shows the seller where its own gaps are.

• 1Data inventory: systems, record families, owners, date ranges and export routes.
• 2Customer contract matrix: data use, aggregated data and confidentiality clauses by customer tier and paper version.
• 3Privacy notice archive: each version with its effective dates.
• 4AI vendor register: tools that touch customer or employee data, their terms and their data-use settings.
• 5Outbound license schedule: every license, pilot and design partnership, with delivery logs and deletion certificates.
• 6IP assignment register: employee and contractor agreements, with gaps flagged.
• 7Request and incident log: deletion requests, how they reached archives and licensed copies, and any breaches.

Illustrative: a platform acquisition finds a loose design partnership#

Illustrative: a fictional buy-and-build platform is acquiring a vertical SaaS company that serves property managers. Diligence shows the target shared support transcripts and work-order histories with an AI startup under a design partner agreement. The agreement's feedback clause let the startup use anything shared to improve its products, with no deletion obligation.

Buyer's counsel asks for the agreement to be fixed before signing. The target negotiates an amendment requiring the startup to delete the records and confirm in writing that they were not used to train models offered to others, then updates its license schedule. The buyer accepts the amended position with a specific representation covering the matter rather than a broader indemnity.

How does SourceX support sellers in diligence?#

SourceX supports sellers by producing a SourceX Evidence Packet for every package licensed through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The packet records provenance, licensing rights, permitted use, the privacy record and release authorization, which lines up with what buyer's counsel asks in a data rights review.

For portfolio owners preparing companies for sale, the same discipline applies before any license is signed: inventory first, rights map second, and the supplier's approval recorded at each step.