AI in M&A Due Diligence: Evaluating IP Ownership, Data Privacy, and Licensing in 2026

AI M&A due diligence for IP now turns on three questions the standard checklist never asks: what the model was trained on, who owns the model and its outputs, and whether the data was lawfully used. If the target cannot document those chains of right, treat the AI asset as unpriced risk, not value.

The market has noticed the gap. Hogan Lovells has published on the rise of AI assets and what it means for intellectual property due diligence in M&A transactions, Hunton has issued IP due diligence tips for AI assets in M&A transactions, and Bochner PLLC released a guide to AI due diligence in M&A covering IP ownership, data privacy, and licensing on October 14, 2026. Three major firms writing playbooks for the same hole in one deal cycle tells you the hole is real: a traditional schedule of assets does not reach AI risk.

Key takeaways

• Registrable IP is the wrong lens. An AI target's value sits in weights, datasets, and pipelines that are usually protected — if at all — by contract and trade secret, not by patent or copyright.
• Training data provenance is the largest single risk. No license chain, no deal price you can defend.
• Model ownership lives in employment, contractor, and foundation-model agreements. Verify assignments, not job titles.
• Privacy obligations do not transfer cleanly. Consent given in 2021 rarely covers model training in 2026.
• Verify claims against public records — USPTO assignments, CourtListener dockets, SEC EDGAR filings — before the IC sees the deal.

Why does AI break the standard M&A IP diligence playbook?

Traditional IP diligence verifies that registered assets — patents, trademarks, copyrights — have a clean chain of title. AI targets rarely fit that frame. Their core value sits in models, datasets, and pipelines that are often unregistered, partly built by contractors, and governed by licenses nobody renegotiated. The diligence question shifts from "is the assignment signed?" to "can the seller prove provenance?"

We learned this the slow way. The first AI schedule of assets we requested came back listing "the model" as one line item — no training data inventory, no license chain, no contributor records. It would have passed a standard review. It should not have passed ours. That experience is why AI intellectual property risk in M&A now gets its own workstream on our side, gated before signing rather than folded into the general IP schedule.

What counts as IP in an AI company?

In an AI company, the IP stack is source code, model weights, training datasets, architectures, evaluation harnesses, prompts, and brand. Only parts of it are registrable. Weights and datasets usually live or die as trade secrets and contract rights, and purely AI-generated outputs may attract no copyright at all without meaningful human authorship.

The US Copyright Office's January 2025 report on copyrightability reaffirmed that human authorship is required, and the D.C. Circuit's March 2025 ruling in Thaler v. Perlmutter (docket available via CourtListener) upheld that line for a work claimed to be autonomously AI-generated. On the patent side, the USPTO's February 2024 inventorship guidance requires a human's significant contribution to each claimed invention. The practical consequence for AI-generated assets due diligence: ask what the seller's moat actually is. If exclusivity is unavailable, the defensible value is proprietary data, know-how, and contract terms — so diligence must test those instead.

How do you assess training data provenance and licensing risk?

Ask for a data inventory before anything else: for every training corpus, the source, date acquired, license terms, and lawful basis for any personal data. The risk is simple. The target's headline model may rest on data it has no commercial right to use, and that right usually cannot be retrofitted after closing. The training-data copyright cases filed in US courts since 2023 have not, as of this writing, produced a clean rule the market can price — so diligence cannot outsource the question to the courts.

Our minimum request list:

• Data inventory: every corpus, its origin, acquisition date, and license reference
• License restrictions: clauses barring model training, derivative works, or competitive use
• Consent basis: what personal data was collected for, and whether training was within scope
• Flow-downs: obligations that transfer to you as acquirer, including attribution and deletion
• Conflict check: deletion and retention duties versus weights that cannot "unlearn"

Hunton's dedicated AI asset diligence tips make the same structural point: licensing agreements in an AI target are not boilerplate. They are the title documents for the asset you are buying.

Who owns the model? AI model ownership in M&A

Model ownership is decided by contracts, not by who trained the model. Establish who employed the builders, whether IP assignments and waivers were signed, what any foundation-model license permits, and whether weights or code sit outside the seller's control. A model fine-tuned by a contractor without a written assignment is a model the seller may not own — and neither, at close, will you.

Separate three layers. The foundation model's license (community licenses often carry field-of-use or attribution limits). The fine-tune and weights the target added (owned only if the underlying agreement allows it). And the serving stack (routinely assembled from open source — see below). If the target publishes weights publicly, check the release terms; an unlicensed dump is a value leak.

How does patent due diligence differ for AI companies?

Check USPTO records for filings and — critically — recorded assignments; an unrecorded assignment is a closing condition, not a footnote. Confirm inventorship against the USPTO's 2024 guidance, since AI-assisted inventions still need a named human's significant contribution. Expect eligibility scrutiny on algorithm-heavy claims, and value the portfolio accordingly: a patent on an ineligible method is a wall poster.

What does data privacy due diligence look like in an AI acquisition?

Privacy diligence for an AI target asks four things: what personal data entered training, on what lawful basis, whether consents covered model training at all, and how deletion rights square with weights that cannot unlearn. Add cross-border transfer terms, breach history, and — for EU exposure — the AI Act's obligations for most high-risk systems, which began applying in August 2026 under Regulation (EU) 2024/1689.

Verification is partly public. For US-listed or reporting targets, pull cybersecurity incident disclosures from EDGAR before you rely on management's breach history. For the rest, the work is contractual: representations on lawful processing, specific indemnities for training-data violations, and a pre-closing remediation plan. Bochner's October 14, 2026 guide to AI due diligence in M&A frames the same triad — IP ownership, data privacy, licensing — as inseparable