What To Look For In An AI Startup's Legal Docs Before You Wire The Money
A VC's Due Diligence Checklist for AI Startup Investments
You've found an AI startup with a sharp team and a model that actually works. Your lawyers run the standard diligence playbook and everything checks out: a clean cap table, Delaware corporation in good standing, no litigation. You wire the money.
Six months later, a demand letter lands. The company trained its core model on data it had no clear right to use. Nobody flagged it before closing because nobody asked.
That's the problem. Standard diligence wasn't built for AI companies. Here's what to add to yours.
1. Training Data Rights
The threshold question for any AI investment: where did the training data come from, and did the company have a legal right to use it?
Ask for a complete inventory of every dataset used to train or fine-tune the model, along with the license, data purchase agreement, or documented legal basis for each one.
Red flag:
The company trained on scraped web data with no license and no fair use analysis. "Publicly available" does not mean "free to use for commercial model training." The wave of copyright litigation against AI companies, (from publishers, artists, and code repositories) has established this as a real and growing exposure. A company without a documented answer to this question is carrying undisclosed liability.
What you want to see:
A training data inventory that maps each material dataset to a specific legal basis. If the company can't produce one, treat it the way you'd treat a cap table with missing entries.
2. IP Ownership Chain
Two issues surface in nearly every AI startup diligence.
Prior employer claims.
If the founders developed the model or its underlying research while employed elsewhere, the prior employer may have a colorable claim to the IP. Review each founder's prior employment agreements and invention assignment clauses. A clean assignment from the company doesn't solve the problem if the underlying IP was never the founder's to assign.
Open-source and foundation model dependencies.
Most AI startups fine-tune a base model or incorporate open-source components. Many of those components carry license terms that restrict commercialization or impose copyleft obligations on derivative outputs. A startup that built on a foundation model with a non-commercial license and is now selling enterprise software has a structural problem.
Red flag:
Missing IP assignment agreements from key technical contributors, or a foundation model license that conflicts with the company's current business model.
What you want to see:
Clean IP assignments from every founder and key technical contributor, plus a documented audit of all third-party model and open-source dependencies — including the specific license terms for each.
3. Regulatory and Compliance Exposure
AI regulation is accelerating at both the state and federal level. Statutes targeting AI use in hiring, insurance, healthcare, lending, and consumer-facing applications have passed or are pending in multiple jurisdictions. If the startup's product touches any regulated industry, ask whether they've mapped their use cases against applicable law.
This matters more than most investors realize. A company that sells into healthcare, financial services, or employment without a compliance assessment is building a product roadmap that may require material redesign to survive regulatory scrutiny.
Red flag:
No regulatory mapping, no engagement with privacy or AI compliance counsel, and a product roadmap that targets regulated sectors.
What you want to see:
A compliance assessment that identifies which AI and privacy laws apply to the company's current product and planned use cases — and a legal team or outside counsel that can keep it current as the regulatory environment evolves.
4. Output Liability
When an AI model produces a wrong answer (eg: a hallucinated fact, an inaccurate diagnosis, a flawed legal interpretation, etc.), who bears the loss? Pull a sample of customer agreements and look for three things: warranty disclaimers on output accuracy, clear limitations of liability, and explicit language stating that AI outputs do not constitute professional advice.
Red flag:
Marketing materials that promise accuracy or reliability that the actual contract terms don't support. The gap between what the sales team says and what the legal terms guarantee is where liability concentrates and where plaintiff lawyers look first.
What you want to see:
Consistent, defensible disclaimers across all customer-facing terms, and no implied performance guarantees anywhere in the company's commercial materials.
5. Customer Indemnification Scope
If the company broadly indemnifies customers for IP infringement in AI-generated outputs, that commitment is only as solid as the underlying data rights in Item 1. Broad indemnification with weak data sourcing is one of the most common structural risks in AI startup deal documents and one of the least examined in standard diligence.
Red flag:
Uncapped IP indemnification in customer agreements, or inconsistency between the company's standard template terms and its signed enterprise contracts. Either means the exposure is larger and less defined than it appears.
What you want to see:
A reasonable aggregate liability cap, defensible indemnity carve-outs for customer-contributed content, and a full schedule of any customer contracts with non-standard indemnification terms.
Frequently Asked Questions
Why doesn't standard VC due diligence cover AI-specific legal risks?
Standard diligence frameworks were developed for software and technology companies before AI model training, foundation model licensing, and AI-specific regulation became material issues. The NVCA model reps, for example, address a company's use of third-party AI tools, but not what data the company used to train its own models or whether it has valid rights to that data. AI investments require a supplemental diligence layer that most generalist deal teams don't have built into their process.
What is training data due diligence and why does it matter?
Training data due diligence is the process of verifying that an AI company had valid legal rights to every dataset used to train or fine-tune its models. Copyright holders (including publishers, artists, and software repositories) have filed significant litigation against AI companies for training on their content without a license. A company without a documented data rights inventory is carrying potential liability that doesn't appear in a standard legal review.
What should a VC look for in an AI startup's customer contracts?
Focus on three areas: output liability disclaimers (does the company disclaim responsibility for inaccurate AI outputs?), indemnification scope (is the company indemnifying customers for IP infringement in AI-generated content, and is that exposure capped?), and consistency between template terms and signed enterprise agreements. Non-standard terms in signed contracts can represent material off-balance-sheet exposure.
How is AI regulation affecting venture capital due diligence?
State AI laws targeting hiring, insurance, healthcare, and lending have passed in multiple jurisdictions. A startup selling into regulated industries without a compliance assessment may face mandatory product changes, regulatory penalties, or customer contract disputes. VCs evaluating AI companies should treat regulatory mapping as a standard diligence requirement, not an optional add-on.
Three Things to Add to Your Next AI Deal
Standard diligence catches corporate housekeeping. It doesn't catch the risks unique to AI companies. Before you close your next AI investment, add these three steps:
- Ask for the training data inventory. Where did the data come from, and is there a documented legal basis for each dataset? If the company doesn't have one, that tells you something about how they think about legal risk generally.
- Push for AI-specific IP representations. The standard NVCA reps don't cover what data the company used to build its own models or whether it has valid rights to that data. Your deal documents should address this explicitly.
- Audit the customer contracts for output liability. If the company is indemnifying customers for IP infringement in AI-generated outputs, that exposure is directly downstream of the data rights question. Weak sourcing plus broad indemnification is a combination to catch before closing, not after.
If you're evaluating an AI investment and want a second set of eyes on the legal documents, book a consultation at www.venturepointlegal.com.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For guidance specific to your situation, consult a qualified attorney.
