07.07.2023 | KPMG Law Insights, KPMG Law Insights

Why AI compliance is part of every due diligence process

Artificial intelligence (AI) is already in use in most companies. Not only applications like ChatGPT and other Generative AI tools are used to write texts, presentations and concepts. AI also automates processes and analyzes data. It can revolutionize business models and accelerate growth. That’s why it’s important for potential corporate buyers and investors to consider AI technologies as part of their due diligence process. After all, AI harbors risks and challenges, not least in terms of legal and regulatory aspects.

AI Act will force companies into AI compliance

Probably the biggest regulatory challenge is the EU’s expected AI Regulation, in English AI Act, and the associated AI Liability Directive. The regulation is expected to take effect at the end of 2023. It aims to minimize the risks of AI. Violations of the regulation’s provisions could cost a lot of money: fines could amount to up to 40 million euros or 7% of total global annual turnover – more than under the GDPR.

The proposed AI Act has both supporters and opponents. In recent months, a number of prominent voices have warned of the dangers of AI. These are likely to be helped by the regulation of these technologies. To that end, more than 100 executives from prominent companies recently expressed concerns about the AI Act. They fear a threat to Europe’s competitiveness and technological sovereignty. Nevertheless, it could be that other countries will take the EU as a model and that regulation of AI will also occur at the international level.

The EU Commission’s draft available to date divides AI systems into different risk classes. These range from minimal risk to high risk, as well as unacceptable AI with risks deemed unacceptable. The draft proposes several measures to regulate artificial intelligence and, in particular, high-risk AI. Examples of measures in the regulation include transparency requirements, a catalog of prohibited actions, particularly through the discriminatory use of AI, and information obligations to users of AI.

In addition to the AI Act, there are a number of other laws that must be considered in connection with AI. These include, for example, the GDPR and other planned regulations as part of the European digital strategy. Questions of liability, copyright and intellectual property must also be considered and answered separately in connection with AI.

These topics should be part of the AI due diligence process

Legal due diligence involving AI will always be tailored to the individual case, depending on the level of use and type of activity of the target company (user or provider of AI), but will typically address the following topics:

  • Usage status: Extent to which the company’s AI systems are systematically used, either as a user or as a provider.
  • Liability: Liability as a user and in particular as a provider of AI systems.
  • Contracts and Licenses: Scope of contracts and licenses the company has in relation to its AI systems, including software licenses, data licenses, and service contracts.
  • Copyright and intellectual property: intellectual property in the works created by the AI owns and preserves third-party rights by the target company.
  • Malfunctions: Response plan in the event of (reportable) incidents and malfunctions
  • Quality management & conformity assessment: Quality management system with regard to the AI systems used as users or providers, as well as documentation on intended conformity assessment procedures.
  • Transparency: Transparency of the company with regard to AI systems used or offered.
  • AI & privacy/security: status of the target company’s collection, storage, and use of personal data when using or offering AI systems, the target company’s compliance with the requirements of the GDPR and other relevant data protection laws, the company’s data security practices related to AI systems, and the target company’s ability to manage cyber threats.

What should definitely be considered in due diligence with regard to AI

The use and offering of AI in the target company should be examined closely and in a specialized manner as part of legal due diligence.

In this context, it is important to understand AI from a technical perspective as well as to be able to classify the legal risks associated with using or offering AI. Only then is the legal due diligence an appropriately robust basis for the entrepreneurial decision on the pros and cons of the planned transaction. To the extent that an existing AI system is deemed legally risky, that doesn’t have to mean the deal is off. Rather, the extent to which the AI application can be adapted to legal requirements can now be examined.


AI should be a separate audit topic in legal due diligence today. This is because legal violations through the use of artificial intelligence will be able to result in heavy fines after the AI Act comes into force at the latest. But even today, AI harbors risks, the correct legal assessment of which is essential for a well-founded purchase or investment decision.



Explore #more

17.05.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: When the family business is to be sold

Around 38,000 family businesses are currently handed over each year. In most cases, the change of ownership takes place within the family. But more and…

03.05.2024 | KPMG Law Insights

Doubts about inability to work? What employers can do

The certificate of incapacity for work (AU certificate) serves as proof of incapacity for work due to illness. However, only if the certificate meets certain…

29.04.2024 | KPMG Law Insights

Agreement on ecodesign regulation: products to become more sustainable

After lengthy negotiations, the Council and Parliament of the European Union reached a provisional agreement on the Ecodesign Regulation on the night of December 5,…

27.03.2024 | KPMG Law Insights

EU Buildings Directive: life cycle greenhouse potential becomes relevant

On March 12, 2024, the EU Parliament approved the amendment to the EU Buildings Directive. The directive obliges member states and, indirectly, building owners and…

19.03.2024 | Business Performance & Resilience, KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

The EU member states agreed on the CSDDD, the EU Supply Chain Directive, on March 15, 2024. Germany abstained from the vote. Negotiators from the…

19.03.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | Business Performance & Resilience, PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…

09.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: The employment law function

In almost all German companies, the employment law function is located in the HR department and not in the legal department. One of the reasons…


Dr. Daniel Kaut, LL.M.

Solution Line Head Legal Deal Advisory
Head of Corporate Law, M&A

Bahnhofstraße 30
90402 Nürnberg

tel: +49 911 800929952

Francois Heynike, LL.M. (Stellenbosch)

Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

tel: +49-69-951195770

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.