M&A in the era of AI
Compliance officers are no strangers to performing due diligence on merger and acquisition targets. These days, however, you do have a challenging new risk that needs to fit into your due diligence procedures somehow.
Artificial intelligence.
Specifically, as every company everywhere weaves AI into its operations, sooner or later your company will end up acquiring a business that already has its own AI operations humming along nicely. Then your business will need to assess the AI risks of that target – and given all the compliance, privacy, and litigation risks that AI can pose, compliance leaders should prepare now to be pulled into that exercise.
It’s an easy point to grasp in theory. Putting it into practice is much more nettlesome.
‘Wait; is this even my problem?’
Compliance officers aren’t wrong to ask that question. Many of the AI-related risks that lurk within an acquisition target are more the concern of IT, cybersecurity, or business operations teams – but those issues can become compliance risks if they’re not properly addressed.
For example, your acquisition target might not have sufficient business continuity procedures in case the AI goes haywire and needs to be shut down. (An issue we explored in a previous post earlier this year.) Those poor continuity procedures are an operations risk more than anything else. But if your business is a broker-dealer firm, FINRA rules require that your firm can keep providing services to customers even amid disruption. If your business is critical infrastructure, that operational risk would absolutely lead to a regulatory investigation (and probably lots of private litigation too).
So even though many AI-related risks in an acquisition will foremost be a problem for the IT and cybersecurity teams, the compliance officer will need to understand what those risks are and how to translate your regulatory concerns into terms that IT and business acquisition teams will be able to understand.
Plus, there still are plenty of compliance risks you’ll need to assess anyway. Like it or not – yes, AI due diligence in an acquisition target is something a compliance officer needs to address.
Preparing for the Risks of ‘Rogue AI’
This article discusses how you can prepare for the risks of ‘rogue AI’ in your organization.
5 questions for an AI-focused risk assessment
An effective risk assessment is always the most important step in due diligence. Fundamentally, you want to know whether the acquisition target is using AI in ways that might increase your company’s compliance risks. That would lead to questions such as:
- Do we know all the jurisdictions where the target operates, and all the AI laws or regulations in those places?
- Do we know all the relevant privacy, cybersecurity, or discrimination laws that might also apply to the target and its use of AI?
- Does the target have a complete inventory of all its AI use cases?
- Has the target documented its approach to AI governance? Has anyone tested those governance procedures to make sure they work?
- Is the target using AI in ways that we currently don’t, where our own AI governance procedures might not address the risks those use-cases pose?
The good news is that AI itself can help you formulate the right questions and even find some of the answers. For example, AI could take template questionnaires you already have and tailor them to more AI-specific privacy and security risks. AI could also help you research relevant laws and regulations that you’d need to keep in mind as you evaluate the target’s controls and procedures.
That said, many issues here could be compliance risks, but you’ll need other business functions’ help to understand and address them.
For example, to address privacy or discrimination risks, you might want to understand the data quality controls the target has in place to train its AI models properly. But unless you’re a compliance officer with an impressive technical background (and let’s be honest; most CCOs don’t), then you’ll need to depend on help from an IT auditor.
Even though you might be able to draft a thorough and thoughtful AI risk assessment, the actual work of evaluating those risks might depend greatly on help and expertise from other business functions. Are you sure you’ll have access to those?
4 Questions to Ask About AI Risk Assessments
AI can create security, operational, financial and compliance risks. Explore four questions that can help your organization build a more effective, accountable AI risk assessment.
Remediation for an acquisition’s AI risks
Assuming your risk assessment goes well, then comes the equally daunting challenge of remediating the risks you find. That won’t be easy.
The issue with AI is that to remediate its risks, you typically need to change how the AI is used – which might not be popular with other operating teams in your business, or even with senior management if they see the target’s AI as part of the overall value your company is buying.
For example, if the target’s sales team uses certain third-party AI tools to help set prices, that could trigger “algorithmic antitrust” concerns from the U.S. Justice Department. The necessary remediation step might be to cease using the AI price-setting tool. Or if the target’s HR team is using AI for hiring, you might need to tighten data governance or model training procedures to prevent AI-induced discrimination.
Is your management team, and the target’s management team, ready to have those conversations? Are you, as a compliance officer, ready with reasonable remediation steps the business could implement?
Maybe your company wants to acquire a certain target because it could turbo-charge your own company’s growth – but the target’s AI usage is problematic. If a business-unit leader then says, “Who cares, we need this done,” how would you respond?
You could give that team leader a risk acceptance certification of some kind, to put responsibility on their desk rather than yours. You could audit the target’s controls to quantify the risk in more precise terms and present that to the board or management team. These ideas are not new; compliance officers have employed them (and others) to help integrate acquisition targets with high anti-corruption risks for years. But AI risks aren’t the same as corruption risks, or even privacy and cybersecurity risks.
AI risks run deeper into a target’s operations, and will require more thoughtful remediation, and will cut across more business functions’ daily routines as they try to integrate the target post-acquisition. Compliance officers will have their hands full here.
And that due diligence future is going to arrive sooner than we think.
5 AI Takeaways from NAVEX's State of Risk & Compliance Survey
AI is becoming a core part of modern compliance programs. Explore five key findings on AI adoption, governance and how organizations are balancing innovation with accountability.
