How data, AI and digital regulation are reshaping M&A risk

In most jurisdictions, technology has become an extremely sensitive subject. From the personal data held by businesses to the safeguarding of nationally sensitive technologies in an increasingly febrile geopolitical landscape, regulators have a clear focus on tech. As a result, the range of deals likely to attract regulatory scrutiny thanks to tech issues has widened. Legal assessments must now start well before the formal filing stage.

Jean-Robert Bousquet, Partner, M&A and Private Capital, in Paris, at Eversheds Sutherland, explains how this works in practice: “We were working to acquire a division of a French company that sold training software for operators of a variety of equipment, including military hardware.

“This becomes very complicated because for the military part you have national security issues. It meant we’d need to make sure that the data could still be held by the target company after we had have bought it; but also that the acquirer would not be prevented from owning or managing that data. It might be as simple as having an in-country subsidiary to take effective ownership of it, but it was a big concern around the structure post-deal.”

Back to top

Why technology assets attract strategic regulatory scrutiny

The impact of regulation around ‘national securityrelated’ tech is obvious. But this definition increasingly encompasses not only military tech, but also digital infrastructure, AI capabilities, robotics, semiconductors, sensitive datasets, and technologies with cross-sector or dual-use applications. In many jurisdictions now, the definition of ‘strategic industrial capability’ goes well beyond arms.

Data and technology no longer sit only within privacy laws or sector regulation, either. There are also live issues in merger control, foreign direct investment screening, national security review (see next section) and emerging AI regulation. Good examples of this include the EU AI Act, which came into force on 1 August, 2024, and its Data Act, which has applied since 12 September, 2025. Together, these measures create a denser regulatory environment around who controls data, how AI systems are deployed and what cross-border transfers or access arrangements are acceptable.

“AI technology and data is increasingly fundamental to how competition and national security / foreign direct investment regulators assess M&A deals. Competition regulators look to assess how important access to AI technology and data is and how this impacts competitive dynamics. In a national security context, foreign direct investment regulators are focussed on protecting AI technology and access to sensitive data,” says Peter Harper, Partner in Eversheds Sutherland’s Competition, Trade and Foreign Investment team and International Head of Competition. “On the flipside, competition regulators, for example in the EU and UK, are looking at ways to change the way they assess some M&A deals to potentially allow more freedom to enable digital players to merge and create more national or regional champions. AI lies at the heart of that.”

The US has moved in a similar direction, albeit from a different angle. The Department of Justice’s Data Security Program came into effect in April 2025, with restrictions on certain data transactions involving Americans’ bulk sensitive personal data, as well as government-related data. That may not affect every deal, but it is precisely the sort of rule that can turn a previously routine diligence point into a transaction-structuring issue, especially in cross-border or private-capital-led processes involving portfolio companies with significant data assets.

In the UK, the ICO’s guidance is explicit that in any merger or acquisition involving transfer of personal data, buyers must examine the original purposes for which the data was obtained, the lawful basis for sharing it, and whether those bases remain valid after the change of control.

Back to top

Mapping regulatory risk before the filing stage

Technology and data issues, then, need to be mapped earlier and more systematically. That turns data diligence into more than a compliance checklist. It becomes part of determining whether the asset being bought can in fact be used in the way the buyer expects. If the value thesis depends on combining datasets, using customer information differently, training AI systems on acquired data, or centralizing operations internationally, there must be a legal view on whether the target’s permissions, notices, contracts and governance arrangements permit that use.

There’s also an important political dimension to consider. Screening regimes are no longer confined to classic antitrust logic. They increasingly reflect industrial policy, national resilience and competitiveness, and geopolitical concerns.

A fresh appetite to create national or regional ‘champions’ is now appearing in draft merger guidelines in a way they would not have done a few years ago, as regulations adapt to the political demands of their governments. That creates more uncertainty, but also more room for strategic advocacy. In practical terms, clients need counsel who can do more than identify whether a filing is required. They need advisers who understand how regulators are currently thinking about data, AI, infrastructure and strategic autonomy.

The cost of regulatory clearance for deals should also come under increasing pressure from the deployment of technology. Anecdotal evidence suggests that compliance is rapidly becoming a more significant workstream in the deal process.

This trend is particularly evident in cross-border deals, where growing geopolitical uncertainty has stiffened regimes and the resolve of regulators to deliver political outcomes. But, increasingly, emerging and precedent-lite regulations around data will demand a more nuanced legal perspective.

“In the European Union, the Foreign Subsidies Regulation requires parties to compile detailed data spanning the prior three years,” says Cristina Audran-Proca, Partner, M&A and Private Capital, in Paris, at Eversheds Sutherland. “That is a highly data-intensive process, and our colleagues on the regulatory side, as well as our clients, are leveraging technology to manage it far more efficiently. It’s a compelling use case - what was once an enormously manual exercise is becoming significantly more streamlined.”

There is clearly scope here for AI and related technologies to speed up the desk work of compliance and structuring deals around regulatory requirements. But it’s another example where any resultant increase in deal complexity magnifies the requirement to take a considered, informed and ultimately very human view of potential tech-related regulatory hurdles.

Back to top

Back to top