--- title: "The AI Due-Diligence Gap: Investing in India’s AI Companies" date: 2026-09-23 author: "Puneet Bhatia" url: https://ksandk.com/private-equity/ai-due-diligence-venture-capital-india-2026/ --- # The AI Due-Diligence Gap: Investing in India’s AI Companies Posted On - 23 September, 2026 • By - Puneet Bhatia ![Investing in India’s AI Companies](https://ksandk.com/wp-content/uploads/Investing-in-Indias-AI-Companies.webp) ### Data, IP, models and the new legal architecture of venture capital in India --- ## Introduction: The asset being funded is more than software Venture capital due diligence has long been built around a familiar set of questions. Who owns the source code? Does the company own its intellectual property? Are its customer contracts assignable? Are its employees and contractors properly engaged? Is there material litigation or regulatory exposure? For a conventional software business, those questions give a reasonably reliable picture of the legal quality of an investment. For an AI company they are no longer enough. Its competitive advantage often sits in the interaction between training data, model architecture, proprietary algorithms, fine-tuning techniques, model weights, prompts, customer data, synthetic data, third-party models and the systems through which all of these are deployed. Each layer can carry a different legal status and a different risk profile, and a gap in any one of them can reach the value of the whole. The Indian legal position has also moved. India has no single horizontal AI statute comparable to the EU AI Act. AI systems are governed through existing laws, sectoral regulation and targeted interventions. The Ministry of Electronics and Information Technology released the India AI Governance Guidelines on 5 November 2025, setting out a principles-based framework. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026 and in force from 20 February 2026, introduced binding obligations for intermediaries concerning synthetically generated information. And the Digital Personal Data Protection Act, 2023 is now operational through the DPDP Rules notified on 14 November 2025, which brings a further layer of scrutiny to any company whose models are trained, fine-tuned or deployed using personal data. For [venture capital investors](https://ksandk.com/practice-areas/private-equity-vc-investment-in-india/), the consequence is that legal due diligence on an AI company increasingly becomes an examination of its technology stack. Asking who owns the software is a starting point. The harder question is whether the company has the legal right to use, train on, modify, commercialise and monetise everything that makes its product valuable. ## 1. AI has changed what intellectual property means in a startup The legal architecture of a conventional technology company is easy to map: source code, perhaps some patents, trademarks, databases, confidential information, and the employment and contractor agreements through which that IP was created. An AI company may have all of these, but its value is spread across several additional layers. Take a hypothetical Indian company building a healthcare diagnostic model. Its stack could combine publicly available datasets, licensed datasets, hospital-provided patient data and synthetic training data; open-source software and an open-weight foundation model; a proprietary fine-tuned model with internally developed weights and prompts; inference infrastructure; and a customer-facing application. Each component raises its own legal question. The company may own the application but only license the underlying model. It may own its fine-tuning methodology but not the training data. It may have a contractual right to use customer data to deliver a service but no right to use that data for training. It may have access to an open-weight model whose licence restricts commercial use or derivative works. An IP ownership schedule cannot capture this. The investor needs to understand the architecture through which the IP was created, and which rights attach to each layer. ## 2. A three-layer model for AI due diligence A practical way to analyse an AI company is to divide its technology into three layers. The first is data: what was used to train or fine-tune the model, and on what legal basis. The second is the model: who owns or controls the underlying model, its weights, algorithms and technical architecture. The third is output: what legal and contractual rights exist in what the system generates. The layers depend on each other. A highly capable model is exposed if the data used to train it was obtained without adequate rights. A company with cleanly sourced data may still depend entirely on a third-party foundation model whose terms can change. And even where both data and model are properly licensed, customers may raise questions about ownership, confidentiality, accuracy or infringement in the outputs. The investor is buying into an interdependent legal and technical system, and the diligence methodology has to follow that structure. ## 3. Training data may be the most valuable and least understood asset The first question in an AI investment should often be where the training data came from. It may have been generated internally, licensed commercially, supplied by customers, scraped from publicly accessible sources, bought from data vendors, obtained from government sources, generated synthetically or collected through the company’s own application. These sources confer very different rights. Public availability does not mean unrestricted commercial use. A website that can be read without logging in has not thereby licensed its content to be copied, processed and built into a commercial training dataset. In the same way, consent to process personal data for one purpose does not settle whether that data can train a model used for another purpose. Diligence therefore has to separate access to data from rights in data. A startup can hold enormous volumes of data and still lack the legal rights needed to commercialise a model trained on it. ## 4. The DPDP framework changes the investment analysis The [DPDP framework](https://ksandk.com/privacy-review/) matters to any AI business that processes personal data, whether to train or fine-tune models, personalise outputs, power recommendation systems, run automated analysis, detect fraud or build customer-specific models. Whether the company has a privacy policy is the least of it. The investor needs to compare the purpose for which personal data was collected with the purpose for which the AI system now uses it. That comparison becomes acute when the commercial model depends on using customer data to improve a general-purpose model. A customer who agreed to data processing to receive a service has not necessarily agreed to that data training a model later sold to other customers. We have examined [how the DPDP Act applies to AI training and automated decision-making](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-ai-training-automated-decision-making/) in more detail elsewhere. For an investor, the point is that a purpose-limitation problem can go directly to the value of the company’s principal asset. ## 5. Can the model be retrained? Conventional diligence asks whether a company may use a dataset. AI diligence should go further and ask whether the company has a continuing right to use that data to train, retrain, fine-tune and improve its models. Suppose a company receives five years of historical customer data under a commercial contract that permits processing to provide services. The company uses the data to improve its model, and the customer later terminates. What happens to the model? Can the company keep the learned weights and continue using them? Must it delete the underlying data, and can the customer demand deletion of information that has already shaped the model? Does the contract say anything about derived datasets, embeddings or model parameters? These questions sit where privacy, contract, intellectual property and technology law meet, and their answers can move enterprise value. They belong in investment diligence. ## 6. Model weights are becoming a distinct legal asset The legal character of model weights is still developing, but commercially they can represent a large share of an AI company’s value. A company may have spent heavily developing or fine-tuning a model that outperforms competitors because of proprietary training techniques, and yet ownership of the resulting weights can be less clear than ownership of conventional source code. The investment team should establish who developed the model, under what employment or contractual arrangements, on whose infrastructure, using which datasets, on top of which foundation model, under what licence and restrictions, and whether any third party retains rights. This matters most where the development team has come from another AI company. A founder with deep technical knowledge from a previous employer creates a potential trade-secret issue, and the investor needs assurance that the startup’s model does not incorporate that employer’s confidential information. ## 7. Open-source AI creates a new diligence problem Open-source software has been part of technology diligence for decades, and [open-source licence compliance](https://ksandk.com/intellectual-property-rights/open-source-licence-compliance-software-copyright-india/) is well understood. Open-weight AI models raise a related but harder issue. A startup may build on open-source code, open-weight models, public datasets, third-party APIs and commercial foundation models at once, and each dependency can carry licence or contractual conditions. So the diligence question is what exactly the company depends on, and what happens if the relevant licence or commercial terms change. A startup that appears to own a sophisticated model may in fact rely on third parties for its base model, inference, training infrastructure, embeddings, vector databases, safety filters, content moderation or data pipelines. The investor needs to separate the parts of the stack that are genuinely proprietary from the parts that are replaceable third-party dependencies, because valuation should rest only on the former. ## 8. Foundation models create concentration risk Many AI startups do not train foundation models themselves. They build applications on models supplied by large technology companies, which cuts development cost sharply and creates a new category of dependency. Where a product relies on a third-party model provider, investors should review pricing, API availability, service levels, model-version changes, data-use terms, confidentiality, indemnities, output restrictions, termination rights, geographic availability, security obligations and portability. The commercial test is simple to state: if the model provider changed its terms tomorrow, could the startup keep operating? If it could not, the company carries a technology dependency that is material to valuation, the AI equivalent of customer or supplier concentration. ## 9. AI contracts need to be read differently An AI company’s customer contracts should not be reviewed like ordinary SaaS agreements. The diligence team should look closely at provisions on customer data, model training, data retention and deletion, model improvement, generated outputs, confidentiality, IP ownership, infringement, liability, indemnities, acceptable use, human oversight, performance standards and regulatory compliance. The provision that often matters most is whether the company may use customer-generated content to improve its models. If it may not, the model-development strategy depends entirely on other data sources. If it may, the scope of that licence needs careful review. Language that once looked like a minor data-processing clause can now carry a large part of the company’s commercial value. ## 10. Copyright is becoming a core venture capital question India’s Copyright Act, 1957 protects original literary, artistic and other works, but the treatment of training data, machine-generated content and [AI-generated outputs](https://ksandk.com/intellectual-property-rights/ai-generated-content-copyright-ownership-india/) is still developing, and there is no statutory regime that allocates ownership of generative-AI outputs. Consider a company selling a platform that generates advertising copy, images, music, software code, video, legal documents or educational material. Who owns the output: the customer or the AI company? Can the output infringe third-party rights? Can the customer obtain meaningful exclusivity? Does the answer change depending on whether the underlying model is proprietary or licensed? Enterprise customers increasingly demand contractual assurances on ownership and non-infringement, so unresolved IP questions quickly become commercial risk. ## 11. AI litigation risk looks different from traditional technology disputes A traditional technology dispute usually asks whether someone copied software or breached a contract. AI disputes can involve claims that copyrighted material was used in training, that confidential information entered a model, that personal data was processed improperly, that an output infringed third-party rights, that a model produced discriminatory results, that an automated decision caused economic loss, that a model generated false material information, or that the system failed to meet contractual representations. That makes liability allocation important. Investors should examine contractual disclaimers, customer indemnities, model-performance representations, limitation-of-liability provisions, professional indemnity and cyber insurance, product liability exposure and incident-response procedures, and then ask whether the customer contracts allocate these risks in a way the business can sustain. ## 12. India is regulating AI through existing law and targeted rules India has chosen a different path from the European Union. The India AI Governance Guidelines set out seven principles: trust; people first; innovation over restraint; fairness and equity; accountability; understandable by design; and safety, resilience and sustainability. They also contemplate new institutional mechanisms and further regulatory development. For venture investors, this means regulatory risk cannot be assessed by checking the company against a single AI statute. Counsel has to map the business model against several regimes at once. Depending on the product, these may include the DPDP Act, the [Information Technology Act and the IT Rules](https://ksandk.com/practice-areas/information-technology-law-firm-in-india/), copyright, contract law, consumer protection, sector-specific regulation, cybersecurity requirements, competition law and any future AI-specific legislation. Regulatory mapping is a central part of AI investment diligence. ## 13. The February 2026 IT Rules matter for generative AI The 2026 amendments to the IT Rules introduced a definition of synthetically generated information and India’s first binding AI-specific compliance obligations. Intermediaries that enable the creation or modification of such content must take reasonable technical measures against unlawful use, label it prominently and embed identifying metadata, and platforms must obtain user declarations on whether content is synthetic. Our [analysis of the 2026 IT Rules on synthetic media](https://ksandk.com/information-technology/indias-2026-it-rules-on-synthetic-media-explained/) covers the obligations in detail. For investors, the key point is that exposure depends on the role the company plays in distributing the technology as well as on what it builds. A model provider, an application developer, a hosting platform and an intermediary may carry quite different obligations. Diligence should establish where the company sits in the AI value chain, because that classification determines which obligations follow. ## 14. Sector matters more than the AI label AI companies do not all present the same regulatory risk. A tool that generates marketing copy is a different proposition from a system used in healthcare, lending, insurance, securities trading, employment, education, defence or critical infrastructure. In regulated sectors, AI deployment may attract requirements from the sectoral regulator on top of general technology, privacy and contract law, and India already has extensive sector-specific frameworks in several of these areas. An investor should therefore look past the “AI company” label and ask what decision the system makes, whose interests that decision affects, and which regulator governs the underlying activity. The answers usually matter more than the technical classification of the model. ## 15. Competition law and the data and compute advantage Some AI businesses owe their competitive position to access to very large datasets, specialised computing infrastructure, foundation models, cloud capacity or distribution platforms. That can create concentration concerns in both directions: a startup may depend on one cloud provider, one source of training data or one dominant platform for distribution, and the investor should consider whether that access could become restricted or expensive. The issue is sharper in strategic investments by large technology companies. A minority investment can carry significant commercial rights without formal control, so [competition-law analysis](https://ksandk.com/competition-review/) should look at the economic and strategic rights actually acquired as well as at voting control. The Competition Commission of India has already examined these dynamics in its [market study on AI and competition](https://ksandk.com/competition/cci-issues-landmark-study-on-ai-and-competition/). ## 16. The pitch deck and the rights chain can tell different stories An AI startup may present itself as owning a proprietary model, and the legal team may then find that the underlying model is licensed, the training data belongs to customers, the weights were produced on third-party infrastructure, key algorithms were written by contractors, critical code sits under an open-source licence, employee IP assignments are incomplete, or customer contracts restrict training. The reverse also happens. A company with little conventional IP may hold genuinely valuable proprietary datasets, fine-tuning techniques, evaluation systems and deployment infrastructure. Diligence has to distinguish what the company says is proprietary from what it can demonstrate it has the legal right to control, and that distinction feeds directly into valuation. ## 17. The AI data room needs to be different A conventional technology data room holds incorporation documents, IP registrations, employment agreements, material contracts, litigation records and licences. An AI company should also be able to show where its training and fine-tuning datasets came from and on what legal basis they are used; which components of its model architecture are proprietary; which foundation models and open-source licences it relies on; who performed the training and under what arrangements; whether customer data may be used for training; what rights customers receive in outputs; whether there have been material incidents involving inaccurate outputs, privacy, security or IP; and who inside the company is responsible for AI risk. Assembling that material is the start of a due-diligence process built for AI businesses. ## 18. Trace the rights chain backwards A useful method is to work backwards from revenue. Start with what the customer pays for, then identify the model that produces it, who owns the weights, how the model was trained, what rights the company had in the training data, who actually built the technology, and who supplied the computing and third-party technology. The chain runs from product to model, weights, training, data, people and infrastructure. The aim is to establish whether a legally defensible chain connects the company’s revenue to the assets on which that revenue depends. A break anywhere in the chain is a potential material investment risk and should be priced, remediated before closing or covered in the transaction documents. ## 19. Founder and employee agreements carry more weight AI companies depend heavily on a small number of researchers and engineers, so [employment and contractor documentation](https://ksandk.com/employment-law/) deserves close review. Investors should examine IP and invention assignment, confidentiality, trade-secret protection, post-employment obligations, the use of materials from previous employers, contractor ownership terms, open-source contributions and restrictions on outside work. One engineer’s departure should never put ownership of a core model in doubt. The issue is most sensitive where founders previously worked at large technology companies or research institutions. As we have noted in our guide on [why founders should assign IP to the company before a funding round](https://ksandk.com/intellectual-property-rights/why-founders-must-assign-ip-before-funding-round/), a clean provenance chain is far easier to establish before investors arrive than during diligence. ## 20. AI governance is becoming an investment question Investors increasingly ask whether a startup has an internal process for managing AI risk. For an early-stage company this does not require a large compliance function. Proportionate governance may mean an AI-use policy, a model inventory, data-provenance records, approval procedures for high-risk use cases, human oversight, incident reporting, vendor review, customer disclosures and model-testing procedures. The India AI Governance Guidelines emphasise accountability, safety, transparency and responsible deployment while keeping an innovation-oriented posture. A startup that can show it has thought systematically about its models, data and risks is better placed with enterprise customers and with future regulation, and investors can reasonably treat that as evidence of institutional maturity. ## 21. Five questions for AI investment committees in 2026 An investment committee evaluating an Indian AI company should work through at least five questions. First, what is genuinely proprietary: the data, the model, the application, distribution, workflow or customer relationships? Second, can the company legally use its data, with the contractual, privacy and IP rights established? Third, how dependent is it on third parties, and could a change in model-provider pricing or licence terms impair the business? Fourth, can the product adapt to regulatory change without the business model breaking? Fifth, if a competitor or former employer challenged its IP, confidentiality or data rights, would the company have a credible defence? These questions now sit alongside revenue, margin and customer-concentration analysis. ## 22. What founders should prepare before raising capital AI founders can improve fundraising readiness considerably by dealing with these issues before approaching institutional investors. The company should be able to document the provenance of its training data and its rights to use it, model ownership, third-party model licences, open-source dependencies, employee IP assignments, contractor arrangements, customer data rights, output terms, privacy compliance, cybersecurity controls and AI governance. Much of this overlaps with baseline [DPDP compliance for startups](https://ksandk.com/data-protection-and-data-privacy/dpdp-compliance-for-startups-msmes/). A startup that can demonstrate a clean technology rights chain shows investors exactly what they are buying, and that is a real advantage in an institutional round. ## 23. What this means for term sheets and investment agreements AI-related legal risk is starting to shape the transaction documents. Investors may seek representations on data provenance, IP and model ownership, third-party AI dependencies, open-source and privacy compliance, infringement claims, regulatory investigations and AI incidents. They may also seek covenants covering material changes in model architecture, licensing of core technology, use of customer data for training, acquisition of third-party datasets and responses to significant regulatory change. The investment agreement should not become an AI compliance manual. It should identify the risks central enough to the business to justify contractual protection and leave the rest to governance. ## 24. AI due diligence will increasingly influence valuation Legal due diligence has traditionally been treated as a risk exercise. For AI companies it is becoming a valuation exercise. Consider two startups with identical revenue. Startup A owns its dataset, controls its model weights, has strong employee IP assignments and can switch between foundation-model providers. Startup B depends on a single third-party model, uses customer data under narrow licences and has unresolved IP questions over its training datasets. Their financial metrics match, but their legal asset bases do not, and that difference can reasonably show up in valuation, investment conditions, indemnities, escrow, closing conditions, investor protections and the terms of future financing. ## 25. AI deals need combined technical and legal teams Venture transactions often run technical diligence and legal diligence separately. With AI that separation works poorly. A lawyer may understand the contract but not the significance of the model weights; an engineer may understand the model but not the licence under which it was trained. Effective diligence brings AI engineers together with IP, privacy, technology, regulatory and commercial lawyers, so that technical architecture can be translated into legal ownership and commercial risk. The advisers who add most value connect AI law with IP, data, technology, corporate and M&A, regulatory, employment and competition work. ## 26. The KSK perspective: advising on the AI business being funded At King Stubb & Kasiva, AI investment draws on several established practices at once. Corporate and VC lawyers structure the investment, governance and documentation. The [intellectual property team](https://ksandk.com/practice-areas/intellectual-property-lawyers-in-india/) advises on ownership and licensing of models, datasets, algorithms, software and outputs. Data privacy lawyers deal with DPDP compliance, data provenance, consent and processing architecture. Technology lawyers handle cloud, SaaS, API, model-provider and infrastructure agreements. Employment lawyers secure ownership of technology created by founders, employees and contractors. Competition lawyers assess platform dependency, strategic investments and data concentration. Regulatory lawyers cover sector-specific AI deployment and emerging governance requirements, and the [M&A team](https://ksandk.com/practice-areas/mergers-and-acquisition/) handles acquisitions of AI businesses. Working together, these teams can advise on the investment transaction and on the legal architecture of the AI business behind it. ## 27. India’s AI ambitions raise the stakes for legal infrastructure India is building an AI ecosystem that combines innovation, compute infrastructure, talent and responsible deployment, through the IndiaAI Mission and the governance framework now in place. That creates a significant opportunity for Indian startups. Institutional capital, however, will expect more than technical capability: it will expect demonstrable data rights, IP ownership, contractual resilience and regulatory readiness. As AI businesses move from experimentation to enterprise deployment, legal infrastructure becomes part of their ability to scale, and the companies that do best may be those combining strong technology with data rights, distribution and legal defensibility. ## Conclusion The legal risks around AI investment are often described as emerging issues. For an AI company seeking institutional capital in 2026, data rights, model ownership, third-party dependencies, privacy, copyright and AI governance are already investment issues. India’s approach remains deliberately less prescriptive than some other jurisdictions. There is no horizontal AI statute, and the framework continues to develop through principles, existing legislation and targeted rules. That does not leave AI companies in a legal vacuum. Because AI systems combine data, software, automated decision-making and content generation, several existing regimes apply to them at once. For investors, the question to ask of any AI startup is whether it has the legal right to build, train, deploy, commercialise and defend the AI that makes the business valuable. Answering it well is the work of AI due diligence, and as India’s AI ecosystem matures it is likely to become one of the core disciplines of technology investment. *Last Updated on 23 September, 2026* Get King Stubb & Kasiva’s legal updates in your Google feed[![Add King Stubb & Kasiva as a preferred source on Google](https://ksandk.com/wp-content/uploads/google_preferred_source_badge_light_en@2x.png)](https://www.google.com/preferences/source?q=https://ksandk.com/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)