M&A: AI Act Compliance Enters Due Diligence Phase
On 1 August 2024, the European Union Regulation on Artificial Intelligence (known as the AI Act) officially came into force, with phased implementation planned between 2025 and 2026.
As of 2 February last year, the rules on unsustainable AI practices and literacy obligations apply. Starting from 2 August, rules concerning General Artificial Intelligence models (GPAI) will take effect, with regulations on High Risk AI becoming operational by 2 August this year (with certain products allowed an extension to 2027).
Transforming AI into a Regulated Entity
This new risk-based regulatory framework transforms AI from a mere innovative technology into an object of precise regulation. It introduces requirements for traceability, human oversight, and accountability, with potential fines reaching up to EUR 35 million or 7% of global turnover.
In parallel, Italy has enacted L.132/2025 in alignment with the AI Act, aiming to enhance principles of humanity, transparency, and security—particularly in critical sectors. The law mandates traceability of algorithmic decisions, human control, increased protection of minors, specific information obligations, and criminalizes illegal practices such as deepfakes.
AI in Extraordinary Transactions
Since last year, artificial intelligence has emerged as a significant factor in extraordinary transactions. It is now a critical subject of evaluation during the due diligence process. The shift from traditional technological due diligence to AI risk due diligence signifies that it is no longer sufficient to assess whether a target utilizes AI systems. Instead, it is essential to:
- Map the types and purposes of AI systems
- Understand the role of the company (supplier, integrator, or user)
- Analyze the technological supply chain
- Examine the models and datasets used
- Identify rights of use and dependencies on third parties
This comprehensive mapping allows for the classification of systems according to the taxonomy of the AI Act (unacceptable, high, limited, minimal risk), enabling an estimation of compliance obligations, costs, and timelines that directly impact the post-acquisition business plan.
Emerging Red Flags
In light of this new regulatory environment, several red flags have emerged:
- The use of AI systems in critical decisions without adequate governance and human oversight
- Poorly documented historical datasets regarding provenance, licenses, and quality
- Critical dependence on third-party suppliers without sufficient contractual safeguards
- Absence of procedures for monitoring and managing AI-related incidents
These issues pose legal, reputational, and operational risks, which can affect asset valuation, potentially leading to price discounts or even the abandonment of a transaction.
Necessity of AI Due Diligence
Conducting AI due diligence, which includes audits of training data, verification of consents, licenses, and analysis of code and documentation, is now indispensable. This process cannot be postponed until the post-closing phase.
Adapting Contractual Terms
Contractual agreements are also evolving. In addition to traditional Representations and Warranties, new clauses are being introduced to ensure proper classification and compliance of systems under the AI Act. These clauses address:
- The absence of prohibited practices under Section 5
- Ownership of rights to the data and technologies used
- Any hidden dependencies in the supply chain
- The absence of regulatory violations
In cases of compliance gaps, measures such as remediation covenants, conditions precedent, and price adjustments are employed to allocate regulatory risk. Pre-closing governance constraints are also implemented to preserve compliance and transaction value.
AI Readiness in Venture Capital
The focus on AI readiness is growing in the venture capital sector. Enhanced disclosure rights, governance clauses, and obligations to allocate resources to compliance are becoming standard in term sheets. AI compliance is increasingly viewed as an indicator of management maturity and a protective measure at exit.
Conclusion: AI Compliance as a Value Lever
In conclusion, AI compliance serves as a significant value lever. It reduces discounts and penalties, expedites negotiations, increases attractiveness to investors (including cross-border investors), and enhances market confidence. The value of a tech company is now determined not just by its algorithms but by its ability to develop them sustainably and compliantly, transforming compliance from a regulatory obligation into a competitive advantage.
