By Armin Ghiam and Senna Hahn

Getty Images is suing Stability AI for allegedly infringing upon Getty's intellectual property to train Stability's artificial intelligence model.

Suppose another company had acquired Stability AI without conducting proper due diligence on its training data. AI systems' integration into business operations creates new considerations for intellectual property due diligence in mergers and acquisitions and financing transactions involving AI to avoid such litigation and losses.

We suggest a practical approach to identifying AI assets, as well as assessing the preexisting protection, ownership and use of such assets, as part of your routine transaction diligence process prior to any acquisition.

First, identify all relevant assets incorporating AI. In an IP-acquisition transaction, a request should be submitted asking the target to disclose all AI technologies in use, including generative AI technologies.

In general, most AI assets should be protected as trade secrets, potentially including an entire AI model, or some combination of an AI algorithm, neural network, training data, weights and AI-created outcomes.

Once AI assets are identified, ensure that these assets are adequately protected as trade secrets. Inquire about any measures in place to protect trade secrets and prevent leakage of confidential information.

Does the target implement adequate digital, physical and legal safeguards to protect the AI assets and, therefore, value? This would ideally include a trade secret policy and confidentiality agreements, which are typically implemented through employment agreements. Robust digital security measures may be especially important for transactions involving companies that own significant data that can be used to train AI models.

Next, assess the target's ownership and control of the AI assets, and investigate any third-party contribution to the development of the AI assets. Rapid change in the AI sphere has been accelerated by financial support from third-party organizations, as well as by collaborative development; funding is often received from third parties like government entities, research centers and academic institutions.

Attached to this funding, organizations may retain certain rights relating to the sale or commercial use of an AI asset. Similarly, third parties providing the data for AI asset development may claim ownership of the asset.

Therefore, it is important to inquire about any third-party or joint ownership arrangements related to AI assets. The diligence process should also include reviewing any relevant agreements with these third parties.

A sensible diligence review will also include an evaluation of the target's competitive intelligence policy, employee ownership rights, and whether all components of an AI system are being used legally to avoid infringement or misappropriation issues. Relevant areas of inquiry include the AI's code and training data, both of which may incorporate proprietary or publicly available material.

The review should establish whether any AI assets were built using open-source software, which, while free to use, is often subject to license requirements. AI training data can also be proprietary and should thus be evaluated to ensure legal acquisition of the data. Internet data scraping and use of user input for training purposes could create ownership issues if a company has not obtained the proper permissions to do so.

Related licenses, i.e., for use of open-source software or other code or data, should not only be analyzed to avoid disclosure obligations, but anyone acquiring AI assets should also obtain any licenses and agreements relevant to all data or code used to develop the target's AI systems.

Finally, a due diligence review should determine the legal status of employee contributions to AI development. The inquiry should establish whether the target company wholly owns employee contributions or whether employees retain some rights.

Last, scrutinize any indemnification clauses that implicate AI assets to ensure that such clauses either adequately cover liabilities that may arise from use of an AI asset or do not create unnecessary liability in the event of use of the system by downstream users. Indemnification clauses protect against third-party infringement claims, losses and legal fees.

These assurances are critical where the target has acquired AI assets from third parties. However, they can also be a source of liability if the target has offered indemnification to users of its AI products. Accordingly, it is important to evaluate the scope and limitations of the target's indemnification provisions related to IP infringement, including any caps on liability.

Integration of AI into business operations presents both new challenges and opportunities. Developing a proactive approach to IP due diligence for AI assets is important for identifying and navigating the risks posed by the collaborative nature and rapid innovation of AI.

---

Senna Hahn is a Summer Associate in the New York office. 

The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.