Investing in an AI Company: Does It Actually Own Its Technology?

Key takeaways

• Chain of title: Founders, contractors and external CTOs own what they create unless they have signed a written assignment. Gaps are common in early-stage AI companies and are best closed before completion.
• What is really owned: Much of an AI company’s technology may be licensed rather than owned, including foundation models, open-weight models and open-source software. Their terms can restrict how the product is used and developed.
• Training data: How training data was obtained matters. Copyright, contractual and data protection risks in training data can affect both the value of the models and the company’s exposure to claims.
• Deal protection: Targeted diligence, AI-specific warranties, conditions requiring gaps to be fixed and, in the UK, a check for mandatory national security notification all help protect investors.

Investors in AI companies are often investing primarily in technology: proprietary models, the data used to train them, and the team that built them. Yet early-stage AI companies frequently develop their products quickly, with founders, contractors and external advisers, on top of third-party models and open-source software, and using data from a variety of sources. Before investing, it is important to establish what the company actually owns, what it licenses, and whether there are risks that could undermine the value of its technology.

This article considers the key intellectual property and related questions for investors in AI companies, from a UK perspective, with reference to the EU and US where relevant. The same issues arise for acquirers, and for companies preparing for investment that wish to anticipate investors’ questions.

Why is AI technology diligence different?

In a conventional software business, diligence focuses largely on whether the company owns its code. In an AI business, value is spread across a wider range of assets, including models and weights, training data, data pipelines, prompts and evaluation methods, as well as the code. Some of these assets may not be protected by copyright at all, and some depend on third-party licences. Diligence therefore needs to map the company’s technology stack and identify, for each component, whether the company owns it, licenses it or simply uses it, and on what terms.

Has the company secured ownership from everyone who built the technology?

Founders

Founders often begin developing technology before the company is incorporated, or work on it in a personal capacity. Under the Copyright, Designs and Patents Act 1988, the author of a work is its first owner, and copyright passes to the company only if it is assigned in writing and signed by the founder. A founder who is not an employee will not be caught by the rule in section 11(2) that the employer owns works made by employees in the course of employment. Investors will usually expect to see signed founder IP assignments covering both pre-incorporation work and future work.

Employees

An employer is generally the first owner of copyright in works made by employees in the course of their employment, and of inventions made in the course of their normal duties under section 39 of the Patents Act 1977. Whether a work was made in the course of employment can be disputed, for example where an employee developed tools in their own time or before joining. Employment contracts should contain clear IP and confidentiality provisions, and the scope of any work done outside the employee’s duties should be checked.

Contractors and external CTOs

Contractors, freelance developers, agencies and external CTOs are a frequent source of ownership gaps. Paying a contractor does not transfer ownership, and a court will usually imply only a licence to use the work for its intended purpose, not an assignment. As we discuss in our article on developing an AI product with an external CTO, a signed assignment from each contractor (and from any company through which they work) is needed to establish clear title.

Prior employers and universities

Founders may have developed their ideas while employed elsewhere or at a university. A former employer may claim ownership of work done in the course of that employment, or that the company is using its confidential information. University spin-outs typically depend on an assignment or licence from the university, and the terms of any licence (including exclusivity, field of use and revenue sharing) should be reviewed.

US and EU differences

Where the company has US contractors or operations, investors should check that assignments use present-tense wording. In Stanford v Roche (2011), the US Supreme Court left in place a ruling that a researcher who had “agreed to assign” inventions had only promised a future assignment, which was overtaken by a later agreement under which he “does hereby assign” his rights to another party. A US contract that describes software created by a non-employee as a “work made for hire” will not usually transfer copyright on its own. In the EU, the employer rule for computer programs in the Software Directive applies only to employees, and some member states, such as Germany, do not allow copyright itself to be assigned, so an exclusive grant of exploitation rights is needed instead.

What does the company really own, and what does it license?

Third-party and open-weight models

Many AI products are built on foundation models accessed through an API, or on open-weight models that the company has fine-tuned. In either case, the company does not own the underlying model and its rights are defined by the provider’s terms or licence. These may restrict particular uses, impose acceptable use policies, require attribution, limit use above certain thresholds, or prohibit using outputs to develop competing models. Terms can usually be changed by the provider, and a model may be withdrawn or replaced. Investors should understand how dependent the product is on a single provider and how easily it could switch.

Open-source software

Open-source software is used in almost all AI products. Most licences are permissive, but some “copyleft” licences require that software distributed with or derived from the licensed code is made available on the same terms, and some apply to software made available over a network. An open-source audit or review of the company’s software composition records can identify licences that may be inconsistent with the company’s business model.

Models, weights and outputs

It is uncertain whether trained model weights are protected by copyright, and the protection available for AI-generated outputs varies significantly between the UK, EU and US, as we consider in our article on ownership of AI-generated content. For many AI companies, the most important protection for models, training methods and data is confidentiality. Investors should therefore consider how the company protects its trade secrets in practice, including access controls, confidentiality agreements and where the weights are stored, as well as any patents and registered rights.

How was the training data obtained?

The way in which a company has obtained its training data may affect both its exposure to claims and the value of its models. Questions to consider include whether the data was licensed, collected from the company’s own customers, scraped from the internet or obtained from data brokers, and whether its use for training was permitted. As we discuss in our article on AI training and copyright, the law on training AI models on copyright material is unsettled and differs between jurisdictions: the UK has no general commercial text and data mining exception, the EU allows rightsholders to reserve their rights, and in the US the application of fair use is being determined case by case, as illustrated by the US$1.5 billion settlement in Bartz v Anthropic. Website terms and data licences may also impose contractual restrictions on use for training.

Where training data includes personal data, the company will need a lawful basis for processing it under the UK GDPR and, where applicable, the EU GDPR, and to meet transparency requirements. Personal data issues can be difficult to remedy after a model has been trained, so they are best identified early in diligence. Customer data is a related concern: investors should check whether the company’s customer contracts permit it to use customer data to train or improve its models.

Are there regulatory issues?

AI regulation

Where the company places AI systems on the EU market or their outputs are used in the EU, the EU AI Act may apply. Investors should consider whether the company is a provider or deployer of any high-risk AI systems, which will become subject to their main obligations from 2 December 2027 for systems listed in Annex III, or from 2 August 2028 for AI embedded in regulated products, following the changes made by the Digital Omnibus on AI. Transparency obligations under Article 50 already apply, and providers of general-purpose AI models have been subject to obligations since August 2025. The UK has no AI-specific legislation, but existing data protection, consumer protection and sector-specific rules apply.

National security screening

Under the UK National Security and Investment Act 2021, acquisitions of certain shareholdings or voting rights (crossing thresholds of more than 25%, more than 50% or 75% or more) in entities carrying on specified activities in sensitive sectors, including artificial intelligence, must be notified and approved before completion. A notifiable acquisition completed without approval is void, and civil and criminal penalties may apply. In March 2026, the Government confirmed that it would narrow the AI sector definition to focus on entities that develop or modify AI systems, excluding most businesses that only use off-the-shelf or licensed third-party AI, with secondary legislation expected later in 2026. Until any amendments take effect, the existing definitions apply. Investors acquiring a significant stake in an AI company should assess whether a mandatory notification is required at an early stage.

How can investors protect themselves in the transaction?

The findings of diligence are typically addressed in the investment documents through a combination of measures:

• Conditions and pre-completion fixes. Requiring confirmatory IP assignments from founders, contractors and external CTOs, corrections to open-source compliance, or new licences to be in place before completion.
• AI-specific warranties. Warranties covering ownership of the company’s technology, disclosure of third-party models and open-source software, compliance with provider terms, the lawful collection and use of training data, data protection compliance and compliance with applicable AI regulation.
• Careful review of the disclosure letter, since general disclosures can significantly limit the protection provided by the warranties.
• Specific indemnities. Where a particular risk has been identified, such as a dispute with a former contractor, a specific indemnity may be more effective than a warranty.
• Post-completion undertakings. Covenants to adopt IP, open-source and AI governance policies, keep records of training data, and ensure all new personnel sign appropriate agreements.

In early-stage rounds, warranties are often given by the founders as well as the company, subject to caps, and investors may rely more on pre-completion fixes than on the prospect of a claim. Warranty and indemnity insurance, where used, will usually exclude risks identified in diligence, so known issues need to be addressed directly.

AI technology diligence: a practical checklist

When investing in an AI company, diligence is likely to involve:

• Technology map. Identifying each component of the technology stack and whether it is owned, licensed or used under third-party terms.
• Chain of title. Reviewing signed IP assignments from founders, employees, contractors and external CTOs, including any service companies, and checking present-tense wording for US contracts.
• Third-party models. Reviewing API terms and open-weight model licences for restrictions on use, competition, changes and withdrawal.
• Open source. Reviewing open-source licences and the company’s compliance processes.
• Training data. Establishing the sources of training data, the rights to use them, and data protection compliance, including use of customer data.
• Trade secrets. Assessing how the company protects its models, weights and know-how in practice.
• Considering the company’s position under the EU AI Act and other applicable rules, and whether a UK national security notification is required.
• Deal terms. Using conditions, warranties, specific indemnities and undertakings to address the issues identified.

At Maybrook Law, we advise investors, acquirers and AI businesses on the legal and commercial issues arising in investments in and acquisitions of AI companies, including technology and intellectual property due diligence, transaction documents and the use of third-party models, software and data. If you are considering an investment in an AI company, or are preparing your business for investment, we would be pleased to advise on your position.

This article reflects the law as at 3 October 2026. Our insights, articles and guides do not, and are not intended to, constitute legal advice or be an exhaustive review of all legal developments. Although every effort is made to ensure that the information provided in this article is accurate as of the publication date, please be aware that this area of law is developing rapidly and may be subject to change. Please seek legal advice before applying the information provided to any specific circumstances, transactions or legal issues.