Before You Sign the Deal, Ask These AI Questions
Six questions non-executive directors should put in the deal room, because standard diligence checklists no longer cover the risks that matter.
Sign up for my Substack daily AI newsletter here.
See my AI Training course portfolio for corporate Business Leaders here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Boards are being asked to approve acquisitions in which the target’s value rests on artificial intelligence the company does not own, cannot fully audit, and licenses from a third party. The traditional diligence file, built for a world of tangible code and clear intellectual property, does not surface the risks that matter most. A model provider can change its terms overnight. Training data can turn out to be legally tainted. A “proprietary AI platform” can, on inspection, be a thin layer over someone else’s system. When a director signs off on the valuation, they are the person left holding those risks after closing. This piece sets out the questions the deal room must now answer before a board should feel comfortable saying yes.
CONTEXT AND BACKGROUND
AI has become the driver of the biggest technology transactions of the past two years, from Google’s acquisition of Wiz to Palo Alto’s purchase of CyberArk and Meta’s stake in Scale AI, and the pattern is reaching South African boardrooms too. Deal lawyers are already flagging that AI fundamentally alters the risk profile of an acquisition, warning that the gap between perceived value and validated value can be substantial, and that buyers need deeper technical diligence and tighter contractual protections.
The risks are no longer theoretical. Enforcement agencies are actively pursuing companies that overstate their AI capabilities, in what the Federal Trade Commission has branded Operation AI Comply, and criminal charges have been laid against founders who described businesses as fully AI-powered when in fact people were doing much of the work by hand. At the same time, courts are working through a wave of AI training-data litigation, with the $1.5 billion Bartz v Anthropic settlement giving both regulators and plaintiffs a template for pursuing those who trained models on unlicensed material.
INSIGHT AND ANALYSIS
Set against that backdrop, six questions belong in every deal room where a target’s value rests on AI.
First, where does the intellectual property actually sit? A real technology asset lives in model weights, fine-tuning checkpoints and data pipelines the target controls. A wrapper over a foundation model, held together by system prompts and API calls, is a moat that a single vendor update can drain.
Second, who is the upstream model provider and on what terms? Enterprise value can evaporate when an API is repriced, throttled or discontinued, and directors should not assume enterprise-grade contracts are in place until they have seen them.
Third, what data was the target’s own model trained on, and on what legal basis? Unlicensed data is not merely a copyright risk. In the United States, the Federal Trade Commission has repeatedly ordered algorithmic disgorgement, the destruction of models built on improperly obtained data, in cases from Cambridge Analytica onward.
Fourth, what is the switching cost if the current model provider changes course? Boards should require evidence of model-agnostic architecture and an honest estimate of the time and money needed to move.
Fifth, do the reps, warranties and indemnities in the sale agreement actually cover AI-specific exposures such as training-data provenance, third-party IP infringement and dependency on a named model provider? Standard clauses were not drafted with these risks in mind, and specialist representation-and-warranty insurance may be needed to close the gap.
Sixth, who owns the outputs, and can the vendor demonstrate what its model was trained on without waiting for a court to compel it? I have previously written that no serious enterprise should accept a vendor answer of “we cannot tell you.”
IMPLICATIONS
For South African directors, the message is not that AI acquisitions should be avoided. It is that the diligence has to be redesigned for what is actually being bought. Boards accustomed to inspecting tax records, environmental liabilities and employment contracts must now bring the same rigour to model provenance and vendor dependency. They cannot assume that clauses drafted under Delaware or English law will hold up in a Johannesburg court, and they must test whether the target has reused customer data for model training in ways that offend the Protection of Personal Information Act. The King IV Code already puts oversight of technology and information governance in the boardroom, not the server room, and it is not delegable to advisers.
This is cognitive governance at the deal table. A director cannot delegate accountability to a data room summary they did not question. If the target cannot answer these six questions clearly, the answer is not to lower the price. It is to slow down.
CLOSING TAKEAWAY
The uncomfortable truth is that in many AI acquisitions the buyer is not purchasing what it thinks it is purchasing. The moat is thinner, the data more contested and the dependency deeper than the pitch deck implies. Directors who insist on hard answers before signing will occasionally kill a deal they might otherwise have loved, and they will spare their organisations from paying, months later, for the questions they should have asked. In this market, the boards that ask well are the boards that buy well.
Author Bio: Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments