In this blog post we set out key practical steps for technology-focused deal-making, having regard to the regulatory, antitrust and foreign investment screening issues identified in our earlier blogs here and here.

Key impacts of technology regulation on deal outcomes

The evolving regulatory landscape is having a significant impact on deal outcomes, including (i) longer timelines due to complex regulatory approval requirements; (ii) higher diligence burden, especially around data, AI and ownership transparency; (iii) greater risk allocation pressure in deal terms; and (iv) increased use of creative structures to mitigate regulatory exposure. 

Front-load regulatory mapping

In M&A deals, front-loading the analysis of required regulatory approvals is critical to deal execution and timeline certainty. As discussed in our earlier blogs, this multi-jurisdictional analysis needs to consider antitrust, foreign direct investment, FSR and other regulatory approvals that may be required — and identify potential “red flags” that may impact deal timelines. Red flags may be raised for particular technologies that are most likely to attract regulatory review, e.g. privacy and cybersecurity, data access and sharing, digital markets and (of course) AI technologies. Or the flag may be raised because a particular buyer profile is more likely to be challenged by regulators. Early identification of these issues means that transaction structuring can be optimised to mitigate risks that have the most potential to disrupt deal execution or certainty.   

Diligence

Targeted and risk-focused approaches yield better information

Approaches to diligence need to evolve and be sensitive to relevant risks (including those identified as part of a regulatory mapping exercise). Diligence is essential not just for identifying and mitigating key legal risks, but increasingly to stress-test valuation and forward-looking business projections. It will clearly still be important to identify hidden liabilities, such as unresolved data privacy breaches or non-compliance with customer contracts. But, as the tech regulatory landscape evolves, it is equally as important to question the assumptions that underlie valuations and business models.

For example, if a target relies heavily on monetization of AI technologies, has the technology been developed in accordance with the requirements of the EU AI Act, notably those requiring transparency, documentation, risk management or human oversight? If not, in addition to the potential risk of significant monetary fines, it may be necessary to remediate specific compliance gaps within the target’s AI systems — and that, in turn, may significantly impact future cashflow projections or valuations. Careful collaboration between the business, financial advisers and lawyers will be critical to developing targeted diligence work streams that focus on high-risk issues that may impact deal outcomes. 

Technology

It follows that it is critical to conduct a deep dive into any technology at the core of an M&A or strategic transaction. Depending on the technology at issue, this may include a combination of factors:

Deal terms; papering the risk

Deal terms also need to evolve and be tailored to account for the unique issues new technology presents. Whilst each deal is different, the following types of terms should be considered:

• Tailored representations and warranties that focus on specific areas of risk (e.g., cybersecurity and AI), including with respect to accuracy, ethical use, compliance and localization, as well as assurances that key technologies, products and services have been developed in compliance with new regulatory standards, including any approval requirements. Relatedly, disclosure should be reasonable; it should not unfairly undercut risk allocation resulting from a lack of regulatory compliance approaches.
• Include targeted risk allocation terms. This means including appropriate indemnities and thinking about fair qualifiers for key risks. For example, a “knowledge” qualification may not necessarily be appropriate for cybersecurity or AI incidents. Similarly, careful consideration should be given to determining an appropriate lookback period for such matters.
• Stress test “standard” concepts like MAC. A broader approach to defining a MAC event — one which includes cyber incidences and AI bans, along with the relevant consequences — may be appropriate, especially given the new regulatory risks associated with emerging technologies.   
• Increasingly, complex and nuanced solutions may be required to address the need for regulatory authorisations. For example, we have seen transactions where, clients have proactively negotiated entirely bespoke cybersecurity and source code testing arrangements to pre-empt likely concerns about cybersecurity risk from foreign investment regulators.
• Structure incentives for compliance and operational support. Consider more detailed interim cooperation covenants that preserve a target’s regulatory posture.  Also, if there are pending regulator authorisations, such as those that may exist under the AI Act, or if ongoing co-operation and support is required to ensure the technology can be used in a compliant manner, consider tying parts of consideration/earn-outs to key approvals and milestones.  Conversely, for targets, consider whether there should be cost caps on mitigation efforts, or whether “hell or high water” obligations should be scoped by jurisdiction.
• Finally, consider budget and resource planning for pre- and post-closing compliance obligations. As the regulatory landscape evolves, regularly refreshing internal M&A and investment protocols to align with current regulatory realities will be essential to effective deal planning and execution.