Tag Archives: due diligence

M&A AND “231” LIABILITY

Legal news, , ,

Legislative Decree No. 231/2001 (“Decree”) introduced into the Italian legal system a regime of administrative liability for entities in connection with certain offences committed, in their interest or for their benefit, by persons holding representative, administrative or management positions, or by persons under their direction or supervision. This liability exists alongside – rather than in place of – the criminal liability of the natural person who committed the offence. Alongside pecuniary sanctions, the Decree provides for disqualification measures capable of jeopardising business continuity and, consequently, the value of the investment.

IS YOUR TARGET AT RISK? When structuring an M&A transaction, the due diligence process conducted on the target company – which is essential to identify all risk factors likely to affect the value of the transaction and to define appropriate contractual safeguards – must also include a specific focus on administrative liability arising from the Decree.

BEYOND COSMETIC COMPLIANCE: WHAT TO LOOK FOR.  Due diligence investigations should not be limited to verifying the formal adoption of an organisation, management and control model pursuant to the Decree (the “Model“). Although the adoption of such a Model is certainly an essential factor, it is not in itself sufficient to ensure that the company is not subject to “231” liability. Instead, the Model’s effective implementation and regular updating must be assessed. Equal attention should also be paid to the functioning of the Supervisory Body, its composition, independence and practical operation, as well as to the adequacy of organisational safeguards in the areas most exposed to the risk of offences. Furthermore, it is particularly important to verify the existence of any criminal proceedings or significant allegations under the Decree, because such issues will not disappear as a result of the extraordinary transaction.

“231” LIABILITY AND EXTRAORDINARY TRANSACTIONS. Articles 28 et seq. of the Decree govern transformations, mergers and demergers. The legislator pursues a specific objective: to prevent extraordinary transactions from becoming a means of circumventing the liability regime established by the Decree. Therefore, any “231” liability under the Decree survives in the event of a transformation, merger or demerger. Is there anything that can be done to mitigate the risks of liability arising under the Decree? An entirely new risk assessment, Model and compliance structure may be a good solution.

WHAT ABOUT BUSINESS TRANSFERS?  A milder regime applies in the event of the transfer or contribution of a business in connection with which an offence giving rise to liability under the Decree has been committed. The transferee is jointly liable with the transferor, but only for pecuniary sanctions recorded in the accounting books or relating to an offence of which the transferee was aware.

KEY TAKEAWAYS.  Compliance issues arising under the Decree should not be regarded as a secondary aspect of legal due diligence, but as an essential component of the overall transaction assessment, capable of influencing the structure of the deal, the agreed financial terms and the rights and obligations of the parties post-closing.

Text and Data Mining, Copyright and M&A: Legal Risks in Acquiring AI Companies

Legal news, , , , , ,

Every time an AI model generates a text, an image or a melody, a powerful process has taken place behind the scenes: Text and Data Mining (“TDM“), any automated technique aimed at analysing large quantities of texts, sounds, images, data or metadata in digital format to generate information. Billions of web pages, photographs and musical works are ingested by algorithms, often without the authors’ knowledge. As AI companies become attractive acquisition targets, understanding the copyright risks in their training practices is essential for M&A practitioners. This article examines the Italian legal framework governing AI and copyright, from the TDM exceptions under the copyright act to the EU AI Act, and their M&A implications.

1. Regulatory Framework. Directive (EU) 2019/790 on copyright in the Digital Single Market Directive (“DSM“) was transposed into Italian law by Legislative Decree No. 177/2021, which amended Law No. 633/1941 (the “Italian Copyright Law“) by introducing two key TDM provisions: Articles 70-ter and 70-quater.

2. The TDM Exceptions. The two TDM provisions transposed into the Italian Copyright Act establish distinct regimes, each with its own scope, conditions and limitations. The distinction is critical in M&A, as it determines whether a target’s data acquisition practices are lawful and, consequently, the transaction’s risk profile:

2.1. Art. 70-ter LDA: TDM for Scientific Research (Art. 3 DSM). Art. 70-ter introduces a mandatory, non-derogable exception allowing research organisations and cultural heritage institutions to reproduce works or materials to which they have lawful access, for text and data extraction for scientific research. Copies must be stored securely and retained only for research purposes, including verification of results. Rightholders may apply proportionate security measures. Conflicting contractual terms are null and void.

2.2. Art. 70-quater LDA: TDM for Any Purpose (Art. 4 DSM). Art. 70-quater permits reproductions and extractions from works or materials to which the user has lawful access, for TDM purposes without limitation as to identity or purpose, including commercial use. However, TDM is only permitted where the use has not been expressly reserved by the relevant rightholders. Copies may only be retained as long as necessary for the TDM process, with security levels no lower than those under Art. 70-ter. This opt-out mechanism raises several concerns: (i) whether an opt-out can be enforced retroactively against prior scraping; (ii) whether rightholders may reserve only certain works or must cover their entire online corpus; (iii) the technical reliability of machine-readable reservations (robots.txt, metadata); and (iv) the unclear regime for works from physical archives or offline databases. Each open question may give rise to contingent liabilities for M&A investors.

These two TDM exceptions are particularly relevant to generative AI, as training such models typically involves mass reproduction of protected works. Art. 70-ter applies to research organisations for scientific purposes, with no opt-out. For commercial entities, Art. 70-quater applies only if rightholders have not expressly reserved their content. In M&A, identifying the applicable regime is a key question in IP due diligence.

3. AI-Generated Output and Copyright. Neither the DSM Directive nor its Italian transposition addresses the copyrightability of AI-generated output. Art. 1 of the Italian Copyright Act requires human creativity for protection; the prevailing view is that purely AI-generated works are not eligible for copyright, while the status of “AI-assisted works” remains debated. This uncertainty bears directly on M&A valuation: if a target’s core IP consists largely of AI-generated content, the enforceability and value of those assets may be materially lower than assumed.

4. Compliance with the EU AI Act. The EU AI Act (Regulation (EU) 2024/1689) requires providers of general-purpose AI models to publish a summary of training data used, including categories and sources, with particular regard to TDM compliance and any opt-out by rightholders (Art. 53(1)(d)). For M&A investors, non-compliance may expose the target to sanctions, while the required disclosures may reveal underlying IP vulnerabilities.

5. Implications on M&A Deals. The foregoing reflections raise a few red flags when a target develops or deploys AI systems. The lawfulness of the target’s data acquisition and training practices (including compliance with Articles 70-ter and 70-quater of the Italian Copyright Law, opt-out reservations, and the origin of training datasets. Equally, M&A investors should assess the enforceability of IP rights over AI-generated or AI-assisted output, given that purely AI-generated works are unlikely to qualify for copyright under the Italian Copyright Law. Overvaluation of such assets may result in a misalignment between the purchase price and the rights actually acquired. Representations, warranties and indemnities covering TDM compliance, IP ownership and AI Act obligations certainly help, but a rigorous IP due diligence remains essential to identifying risks.

New Obligations for Companies Under the Proposed CS3D

Legal news, , , ,

The proposed Corporate Sustainability Due Diligence Directive, so-called CS3D, may set new rules binding large EU or non-EU companies aimed at preventing adverse impacts on the environment and human rights resulting not only from their own operations, but also from those of their business partners.

CS3D has been criticized for its strong impact on the whole supply chain. While only large companies are in scope, vendors of such obligated entities will need to comply with such entities’ policies inspired by CS3D.

What Are the Proposed Obligations?

New due diligence requirements are supposed to be established by CS3D and may subsequently be implemented by each member state. According to the text under discussion, companies will have to identify, prevent, stop, mitigate and account for the adverse impacts on the environment and human rights caused by their activities. In addition, they will need to have a plan to ensure that their business strategy is compatible with limiting global warming to 1.5°C in line with the Paris Agreementand the climate neutrality goals set by Regulation (EU) 2021/1119.

Which Companies are In Scope of CS3D?

CS3D would apply to European companies that:

  • have, on average, more than 250 employees and a global net turnover of more than EUR 40 million in the last financial year for which the annual accounts were drawn up;
  • even if they do not meet the minimum thresholds, are the parent company of a group that had 500 employees and a global net turnover of more than EUR 150 million in the last financial year for which the annual accounts were drawn up.

It would also applty to third-country companies that:

  • generated a global net turnover of more than EUR 150 million, provided that at least EUR 40 million of that turnover was generated in the European Union in the financial year preceding the last financial year, including turnover generated by third-country companies with which the company and/or its subsidiaries have concluded a vertical agreement in the Union in exchange for licensing rights;
  • even if they do not meet the minimum thresholds mentioned in point (a), are the parent company of a group that had 500 employees and a global net turnover of more than EUR 150 million, of which at least EUR 40 million was generated in the European Union in the last financial year for which the annual accounts were drawn up, including turnover generated by third-country companies with which the company and/or its subsidiaries have concluded a vertical agreement in the Union in exchange for licensing rights.

When Will It Enter into Force?

CS3D is still under discussion. The proposal for the Directive was presented by the European Commission on February 23, 2022, and the Parliament adopted the amended text on December 14, 2023. The proposal must be formally approved by the Commission, the Parliament and the Council before it can officially enter into force.