AI Due Diligence in M&A: What 5 Filed Merger Agreements Make Targets Warrant

We read the AI representations in 5 public merger agreements filed on EDGAR between May 2025 and October 2026, from Salesforce buying Informatica to Proofpoint buying Varonis. All 5 make the target warrant that it runs AI governance policies. None of the 5 makes the target warrant that its models perform as claimed. AI due diligence now has its own clauses, and they protect the acquirer on rights and conduct, not on quality.

Why AI due diligence moved from the data room into the merger agreement

For most of the last decade, AI in a software deal was a line in the investor deck. The merger agreement covered it through the standard intellectual property, privacy and open-source representations.

That changed when AI claims started to carry valuation. If a target's price rests partly on a model, the acquirer needs to know three things. Who owns the model, whether the data behind it was lawfully used, and whether a regulator or plaintiff can force it offline.

A representation is a statement of fact the seller makes in the contract. If it proves false, the buyer may be able to walk away before closing or recover money after it. Diligence is how the buyer finds out what is true. The representations are how the buyer allocates the risk of what it could not find out.

Mayer Brown partners wrote in May 2024 that the core IP representations already cover, "with a few notable exceptions", many of the relevant AI issues. The agreements filed since then show the exceptions have grown into their own subsection, with defined terms, disclosure schedules and covenants.

We think this is the right direction, but the drafting has run ahead of the diligence in one place. The contracts now describe training data rights in careful detail. They say almost nothing about whether the model works.

What five filed merger agreements make targets warrant about AI

We pulled the AI language from 5 agreements filed as Exhibit 2.1 to Form 8-K on SEC EDGAR. They cover a large public software target, three mid-sized public targets and one private robotics target. We then sorted every AI-specific sentence into the risk it addresses.

The sample was chosen for availability, not randomness. An EDGAR full-text search for 8-K filings since January 2023 containing both "AI Technologies" and "Training Data" returned 85 documents. Many are press releases and investor decks, so that number shows the vocabulary spreading, not the deal count.

"No" means not found in the AI and IP representation sections we read. It does not mean absent from the full agreement. Buyers named in full: Salesforce (Informatica), Serve Robotics (Diligent Robotics), SoundHound AI (LivePerson), Autodesk (MaintainX), Proofpoint (Varonis).

Governance: the one AI rep in all five agreements

Every agreement asks the target to warrant that it has AI policies and follows them. Salesforce's version says Informatica "maintains or adheres to policies and procedures that are compliant with Laws" covering the training, testing and deployment of AI Systems. Autodesk's version goes further and names bias, requiring procedures "for identifying and mitigating illicit bias in Training Data".

The governance rep is the cheapest one for a seller to give. Warranting that a document exists is very different from warranting what the model does.

Training data rights: the rep that carries the money

Informatica warranted that it "had legally enforceable and sufficient rights to use or process the Training Data" in the way it was used. SoundHound got a similar promise from LivePerson about licences, consents and notices for all Training Data and AI Inputs. Serve Robotics took a different route, requiring Diligent to list the sources of its training data and say whether each set was licensed, generated or scraped.

We think the Serve approach is the better tool for a buyer. A schedule forces the seller to write down facts that diligence can then test. A broad rights warranty only tells you who pays if those facts turn out to be wrong.

Third-party AI tools and what goes into prompts

Three agreements address the target's use of other companies' AI. Varonis warranted that it uses all AI Technology "in compliance in all material respects with the applicable license terms". It also warranted, to its knowledge, that it has not put personal information or trade secrets into prompts for tools that train on those inputs.

This is the clause aimed at employee behaviour. It exists because the most likely AI leak at a software company is an engineer pasting source code into a public chatbot, not a breach of a training pipeline.

The AI clause library: representations quoted from EDGAR filings

The quotes below are verbatim from the filed agreements.

Inventory and disclosure schedules

The MaintainX agreement requires a schedule listing all AI Technology the target sold, built or used internally in the four years before signing. Its definition of AI Technology is wide. It covers neural networks, transformers and large language models, and also "linear and logistic regressions" and "random forests".

A definition that sweeps in a logistic regression means a forecasting model in the finance team is now an AI asset you must schedule. If your inventory is incomplete, the inventory rep is false on signing day. A working AI bill of materials template is the practical way to build that schedule before a buyer asks.

The MaintainX agreement also deals with a quieter problem. Where a model was trained on data supplied by a customer, or customised to a customer's specification, the target warrants that it still owns the result and faces no restriction on commercialising it.

This clause targets enterprise contracts that hand model improvements back to the customer. In an acquisition, it can mean part of the model the buyer is paying for belongs to someone else.

High-risk use and the covenant between signing and closing

Autodesk also obtained a warranty that MaintainX has not used AI for "High Risk Activities". The agreement defines these to include aircraft control, life support systems and autonomous driving.

Salesforce added a covenant as well as representations. Under Section 5.1(b), Informatica agreed not to "terminate or materially amend or modify" its written policies on the use of AI Systems before closing, except to comply with law. A buyer that relied on a policy during diligence wants it frozen until the deal closes.

The AI due diligence checklist acquirers work from

The requests that come before these clauses are published in law firm guidance. We compared checklists from Haynes Boone (July 2026), Shumaker (October 2025), Hunton Andrews Kurth (July 2025) and an ABA Business Law Today article (January 2024).

The table below merges those request lists with the representation that backs each one in the filed agreements. Where a diligence request has no matching rep in our sample, that gap is the point of the row.

Two rows deserve attention if you are buying. Open-weight models carry their own licence terms, including use restrictions and attribution duties, and those terms are covered in detail in the review of open-weight model licence clauses. A standard open-source rep written for libraries may not reach a model file. Ask for the model licences by name.

The second row to watch is customer indemnities. Hunton's guidance warns that indemnities "can also be a source of liability if the target has offered indemnification to users of its AI products". No rep in our sample targets that exposure, so read the target's customer paper.

Model performance and evals: the AI warranty nobody gives

The topic most acquirers say they care about is whether the model works. It is also the topic missing from every agreement we read. No target in our sample warranted an accuracy figure, a benchmark score, an error rate or a result on its own eval suite.

Model performance depends on the data a customer feeds it, so a single number rarely holds across use cases. Sellers will not warrant a figure that moves every time a vendor updates an underlying model.

The closest any agreement comes is reproducibility. SoundHound obtained a promise that LivePerson has processes "designed to ensure that the Company AI Products can be reproduced, retrained, debugged and modified". That protects the buyer's ability to keep improving the model, not its quality today.

We think this is the most important practical gap in AI due diligence. If performance is not in the contract, it has to be proven in the data room. The method for building your own eval is laid out in the guide to building an LLM eval suite. Treat the target's internal benchmark slides as marketing until you have reproduced them.

Three tools fill the space a warranty would occupy. The first is a pre-signing eval run by the buyer's own team on held-out data the target has never seen. The second is a price mechanism, such as an earnout tied to AI revenue, that shares the risk of underperformance. The third is a covenant to preserve model weights, training code and data lineage so the buyer can retrain if needed.

Haynes Boone's sample transition services language calls for delivery of "passwords, models, weights, training data" when a transition agreement expires. If you cannot get a promise about quality, get the assets you need to fix quality yourself.

Why training data provenance became an acquisition risk with a price

Three developments since 2021 turned data provenance from a compliance question into a liability that can follow the model to its new owner.

Regulators can order the model deleted

The US Federal Trade Commission has required companies to delete algorithms built on improperly collected data. Legal commentary traces the remedy to the Everalbum order of 2021, then the WW International and Kurbo settlement of 2022. The Rite Aid order announced in December 2023 went further, covering models derived "in whole or in part" from the affected images. It also required Rite Aid to tell third parties to delete them too.

For an acquirer, this is the worst case. You can price a fine. You cannot easily price an order to destroy the asset you paid for. That is why the personal data representations in the MaintainX and LivePerson agreements are framed around the model, not the database.

Copyright exposure follows the weights, not the team

The settlement in Bartz v. Anthropic put a number on pirated training data: about $1.5 billion, or roughly $3,000 per work for around 500,000 books. The court granted final approval on 20 July 2026. Shumaker's October 2025 analysis draws the lesson for deals. Stopping a practice does not erase historical exposure, and keeping infringing copies can itself be actionable.

The wider litigation picture is tracked in the tracker of AI copyright cases on training data. The deal point is narrower. If the target ever trained on a shadow library, the acquirer inherits the question along with the weights.

In Europe, the stakes are set by statute. Article 99 of the EU AI Act allows fines of up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, whichever is higher. How those obligations reach companies that build on general-purpose models is covered in the analysis of downstream obligations under the GPAI rules.

Where this argument is weakest

The evidence base here is thinner than the framing suggests, and you should know exactly where.

Five agreements are a sample, not a market

We read 5 agreements, chosen because they were findable and recent. They skew toward software targets and toward US public company buyers. Most M&A is private, and private deal documents are not filed.

We also read the AI and IP sections, not every page. An accuracy warranty could sit in a commercial representation we did not reach. We think that unlikely, but have not ruled it out. The same caveat applies to the Cisco and Splunk comparison, where we covered the IP and privacy representations but roughly 60% of the document was not read.

A representation in a public deal is mostly a disclosure tool

In public company acquisitions, representations usually do not survive closing. Informatica, LivePerson and Varonis shareholders will not pay anything back if an AI rep proves false later. The rep mainly forces disclosure before signing and gives the buyer a possible walk right.

That is why the private target agreements matter more than their size suggests. MaintainX and Diligent had securityholder representatives, which signals a post-closing claims process. Those are the deals where the flat language, such as "has ever contained Personal Data", can actually move money. The honest summary is that AI representations protect buyers in private deals and inform them in public ones.

Frequently asked questions

Where to start, depending on which side of the table you sit

If you may be acquired in the next two years, build the schedule a buyer will ask for now. List every model, dataset and AI tool, with the source and licence of each dataset. If a single dataset has no paper trail, fix that first, because it will move your price.

If you are buying, open the agreements in the references below and copy the training data and inventory clauses into your next term sheet. Then add one step none of them contains. Run your own eval on the target's model, on data it has never seen, before you sign.

Related reading