IP in a Startup: Why Investors Want to Audit Your Code and Why AI Complicates Legal DD

IP in a Startup

A tech startup is a bundle of IP assets.

When investors buy a start-up or shares therein, they are actually buying the assets. What are the startup’s assets? They are the people and the product they build. In a tech startup, the main part of the product is the source code.

In the early stages of fundraising, investors want a successful future exit opportunity. Indeed, clear, protected, and well-structured IP over the assets is the warranty and assurance of that exit opportunity. The clearer and better protected the IP around the assets, the greater the assurance that the product will remain intact, protected, and valuable until that very exit.

In simple words, without proper IP, there is no guarantee for investors that:

a) the product will not be copied or otherwise used by third parties (ex-employees, competitors, etc.);

b) the product itself is legit and does not infringe third-party rights;

c) the product can be licensed, sold, and otherwise monetized;

d) on a broader view, the product can be managed (e.g., put on the balance sheet of a company and used for various IP boxes and tax planning).

This is why IP matters. This is why IP due diligence often consumes time and effort. Sometimes, investors are ready to buy a cat in a bag. More often, however, they are not.

IP Due Diligence

While the overall DD list can consist of hundreds of questions and rows in Excel, the IP part is only one of them, usually somewhere in the middle. In most cases, the IP checklist will include the following areas:

● IPRs owned: Investors usually ask for a general list of IP rights owned by the target on/over the assets, including source code (copyright, trademark, design, patent, etc.), and all registrations/certificates related thereto.

● Contractual chains: Investors also ask for all or some contracts with key employees and contractors under which the IP is transferred to the target company.

● Open-source AI models: This is where it gets complicated, as in AI-powered startups, investors are particularly keen to verify what licenses and conditions were used when developing AI models and products based on them, since many are open-source.

● Training materials: This is another AI-related area where investors may look, since data and materials used for training may bring certain legal risks.

We expand a little below on points © and (d) as they are specific to AI startups.

Open-Source: Watch Out for Viral Licenses

To begin, when you take an open-source AI model or code from GitHub, Hugging Face, or other platforms (e.g., Mixtral-8x7B), you agree to their license. Open-source licenses can be permissive or restrictive (copyleft or viral).

Permissive licenses such as MIT, BSD, and Apache 2.0 require only attribution and impose minimal restrictions, allowing the code to remain proprietary.

Copyleft licenses, such as GPL and AGPL, are different. For example, the GNU GPL v2 license imposes a reciprocity requirement: distributed derivative works (source code) must be licensed on the same terms (with source provided). This means that, in theory, your distributed product (derivative code) must be open-sourced, including to competitors. This is called copyleft. A breach brings risk of damages to the author of the preexisting work (see e.g., Entr’Ouvert v. Orange (France, Feb 2024), where a court awarded around 1 million euros for failure to distribute GPL software publicly).

When a product includes AI/ML components, the IP DD centers on licenses used and their terms.

Most ML models use permissive licenses (Mistral, Gemma, Llama). However, there is still some room for lawyers to check:

● Some smaller models (code) which are available based on copyleft licenses.

● Code from suspicious/indie sources which may contain copyleft.

● Copyleft components in training materials.

Training Data Examination

If the startup is ambitious and trains its own models, investors examine training materials and sources to ensure no infringement of third-party rights or other violations (e.g. unauthorized access, trespass, ToS breaches, privacy, etc.). There are many ongoing billion-dollar proceedings in US courts against AI giants (such as NYT v. OpenAI) regarding the legality of training AI models on public data.

These are complicated legal issues, but investors definitely want to avoid them.

Preparation Before the Round

Yes, we do not live in an ideal world. Not every startup has a clean register of IP rights and assets and ensures the whole IP chain for every piece of source code.

Good news is that most IP issues and oversights are solvable. It is rarely a deal-breaker. Among other things, this is where carefully drafted indemnities, representations, and warranties in the Term Sheet/SPA/SSPA can be helpful.

Anyway, it is advisable for startups to maintain a live register of open-source components and training data records. Along with privacy and security policies, it may also be worthwhile to build an internal AI policy explaining, in simple words, what development and training processes are in place.

*Aliaksandr Struzhko, Senior Associate, REVERA law group*

*Hleb Shumilau, Junior Associate, REVERA law group*