Data Separation as a Deal Workstream: Carving Out Training Data, Models and Customer Rights

1. Define the business the buyer can actually operate

A data separation plan should begin with the services that the buyer expects to sell after completion. Identify each product, the customer obligation it fulfils, the information it consumes and the environment in which it runs. The acquisition case can then distinguish a functioning service from assets that are technically delivered but cannot yet support the intended use. The approval question is whether the buyer can operate the agreed business within the rights and dependencies established by diligence.

This paper proposes a workstream for an acquirer purchasing a business whose products depend on training data, analytical models or customer information shared with a seller. It is relevant to a corporate buyer, investment fund or family office assessing a technology-enabled acquisition. The example assumes a UK operating business and a Gulf-based buyer. Those locations define questions for review; they confer no permission to move information between jurisdictions or to continue a seller's arrangements unchanged.

The workstream should produce an asset schedule with a commercial purpose attached to every material item. A training corpus may support a scoring engine, a customer document store may support search, and a usage history may support account administration. Ask the product owner to identify which service stops if the asset is unavailable. Ask finance to identify the associated contribution and cash collections. Ask legal and technical reviewers to explain the conditions under which the dependency can be used or replaced.

All transaction amounts, periods, margins and outcomes below are hypothetical editorial assumptions. No acquisition agreement, customer contract, dataset, system access or management forecast was supplied for this analysis. The original framework is intended to structure an investment decision and a paid advisory scope. It makes no claim about current buyer demand, Matchpoint's completed mandates, achievable fees or the return available from a particular acquisition.

2. Establish the evidence boundary before diligence expands

The ICO's M&A guidance asks organisations to identify transferred personal data, original purposes, lawful basis, transparency obligations and security arrangements. It also addresses record accuracy and retention after a change of controller. The page expressly states that it is under review following the Data (Use and Access) Act. A transaction team should use those published diligence questions while obtaining current legal advice on the actual processing arrangement. The guidance supplies no automatic approval for a sale or subsequent training use. ^[1]

Create an evidence register with separate entries for a contract, a system observation, a customer confirmation and a legal conclusion. A signed licence is evidence of its recorded terms. A successful export is evidence that a particular technical action was possible. Neither should be promoted into a wider finding without the missing review. Each conclusion in the separation memorandum should identify the document or test on which it depends, its date and any condition still outstanding.

Request representative evidence before asking the seller to place entire datasets in the diligence room. A schema, record count, lineage extract and redacted agreement may be sufficient for an initial assessment. Counsel should define permitted disclosure, including any restrictions arising from competition, confidentiality or personal-data obligations. Limit reviewer access to the purpose approved for that stage. This proposed approach reduces the amount of material exposed during an assessment whose outcome is still uncertain.

Maintain a decision log when evidence conflicts. For example, a product description might state that a model was developed entirely internally, while its build record identifies a third-party base model. Record both sources and assign the discrepancy for resolution. Avoid replacing a specific conflict with a general seller assurance. The investment committee needs to know which part of its operating case depends on a statement that has not yet been reconciled.

3. Trace each product through its data and model lineage

The proposed lineage map starts at the source and ends at the service delivered to a customer. Give every material dataset and model version a stable reference. Record how source material is filtered, labelled, combined, transformed and incorporated into the deployed product. Where the seller cannot establish a connection, keep it as an open dependency. The buyer should be able to select a production model and work backwards to the records supporting its permitted development and use.

Separate a trained model from a retrieval system that supplies documents when a user asks a question. In the proposed inventory, model weights, fine-tuning adapters, retrieval indexes, source documents, prompts and evaluation sets are individual items. This permits different treatment where, for example, the model can transfer but one customer document collection remains restricted. It also identifies whether a proposed deletion concerns source records, an index, a model version or several linked components.

NIST's Generative AI Profile recommends documenting data curation, examining third-party intellectual-property and privacy risks, and reassessing fine-tuned models. Its suggested actions also address provenance and changes to datasets. These are voluntary risk-management practices. They support asking for development records and testing changes; they establish no ownership right or transaction-specific legal conclusion. The lineage register proposed here adapts those technical questions to an acquisition handover. ^[3]

Retain evidence of the actual deployed version at the reference date. An engineering demonstration built after diligence began may use a different corpus or configuration. Reconcile the production identifier with the handover package, licence record and evaluation results. Changes between signing and completion should be logged and reviewed for their effect on rights, performance and the separation timetable. The agreed change-control process should identify who may approve a replacement and what evidence must accompany it.

4. Build a rights matrix around permitted actions

The rights matrix should describe what each party may do with each asset. Proposed actions include disclosure to advisers, copying into a buyer environment, inference, further training, customer delivery, onward licensing and retention after exit. A single field labelled ownership cannot answer all those questions. Record the contractual clause or reviewed legal basis that supports the proposed action, the beneficiary, applicable geography and any condition that must be satisfied first.

UK copyright legislation provides a useful specific diligence question. Section 29A of the Copyright, Designs and Patents Act addresses copying for computational analysis for non-commercial research by a person with lawful access. It also restricts transfer of a copy and use for another purpose without the copyright owner's authorisation. A buyer examining a corpus created under that provision should obtain specialist advice on the proposed commercial acquisition and reuse. This example establishes no general rule for every jurisdiction or training dataset. ^[4]

Questions for transaction-specific review. No permission, title or transferability is assumed.

Where a licence requires a consent, identify the person entitled to give it and the precise action requiring approval. A consent to assign a contract may have a different scope from permission to use data for new training. Record effective dates and conditions, including any continuing charge or restriction. The seller's willingness to request a consent is a task to complete. The signed response is the evidence needed to change the associated operating assumption.

The same review should cover restrictions retained by the seller. A seller may need certain records to meet a documented legal obligation or support an ongoing service. Specify the proposed retained copy, custodian, purpose and expiry or review condition. Counsel should determine which obligations actually apply. Technical teams can then implement access restrictions and monitoring consistent with that decision. A broad statement that both parties may retain everything leaves the buyer's independence and the customer's expectations unresolved.

5. Keep customer rights visible throughout the transition

For each material customer relationship, connect the commercial agreement with the product's actual data use. Identify the contracting entities, authorised users, service description, confidentiality provisions and any restrictions on processing or subcontracting. A commercial account handover should include the obligations that affect data handling. The separation team should obtain a clear interpretation of any change-of-control, assignment or notification provision before relying on continued revenue from that customer.

Distinguish customer approval under a contract from an individual's consent under applicable data-protection law. The proposed matrix records both where relevant, together with any other legal basis reviewed by counsel. A customer business may be able to authorise a supplier change while individual rights remain subject to separate requirements. The paper gives no general instruction to collect fresh consent from every individual. The required action depends on the actual relationship, information and processing purpose.

Prepare a customer communication plan using the final operating arrangement. It should explain any relevant change in contracting entity, support channel, processing location or service functionality in language consistent with the reviewed terms. Assign responsibility for answering questions and recording responses. Where a customer's decision affects continued service, connect the response to the migration schedule. An unanswered request should remain visible as an unresolved dependency with its own commercial consequence.

Test whether customer restrictions can be implemented in the separated system. For example, a contractual limitation on cross-customer learning requires an identified technical treatment in the proposed design. Ask the team to demonstrate how the relevant data is isolated and how exceptions are detected. Retain the test conditions and results. A clause and a system setting should be reconciled before the operating case assumes that the promised restriction will be respected.

The customer register should preserve the difference between an active contract and a prospect record. A buyer may receive both within a customer-management export, although their permitted uses and contribution to the investment case can differ. Request a reconciliation to the actual contracted revenue. For each material restriction, identify the affected service and the action required from the customer or supplier. Maintain the original response and avoid treating a discussion with an account manager as approval from an authorised signatory.

Consider changes made during the separation itself. A customer may correct a record, end a service or request restricted processing while copies are being prepared. The migration specification should describe how those changes reach both environments and who resolves conflicting versions. Test the proposed mechanism using authorised sample records. An export timestamp provides a reference point; the team also needs an approved process for transactions and requests received after that point.

6. Examine what remains inside the model

The EDPB's December 2024 announcement on Opinion 28/2024 explains that model anonymity requires case-by-case assessment. It considers the likelihood of identifying individuals and extracting personal data through queries. It also discusses legitimate-interest assessment and the potential consequences of unlawful processing during development for later deployment. This supports a specific diligence request for the seller's analysis and evidence. The opinion does not establish that every model is anonymous or that every model necessarily contains identifiable personal data. ^[2]

Ask the model owner to describe what testing has been performed, against which version and under which access conditions. Include the tested interfaces, attacker capabilities, relevant data categories and limitations of the assessment. A buyer should understand whether the evidence covers only the ordinary user interface or also access to weights, logs and administrative tools proposed for the acquisition. The reviewed legal conclusion should be tied to that defined technical situation.

An assertion that source records have been deleted leaves questions about downstream copies and derived components. The proposed response is a lineage-based investigation. Locate the datasets, versions and deployed services affected by the deletion decision, then obtain an approved treatment for each. Possible technical responses can be evaluated, including replacement data, retraining, restricted operation or retirement. Their effectiveness and legal sufficiency require case-specific evidence; the paper supplies no universal method for removing information from a model.

Include an economic consequence for any model that remains unavailable. A model may support several products, and a single product may use several models. Finance should identify those connections before estimating contribution at risk. Counting every affected model as a separate lost product can overstate exposure. Counting only the first affected product can understate it. A product-level reconciliation should explain which revenues are distinct and which share the same customer payment obligation.

7. Review model supply contracts and provider responsibilities

For a third-party model, obtain the exact licence or service agreement used by the target. The review should cover the relevant model version, commercial-use conditions, transfer arrangements, usage restrictions and support dependency. If the service is accessed through an account controlled by the seller, include the account and contracting entity in the separation plan. A downloaded component and a remotely supplied service require different handover arrangements and different continuity tests.

The European Commission's GPAI guidance describes documentation, copyright-policy and training-content-summary obligations for relevant providers. It also explains conditional exemptions for certain open-source models and states that copyright and training-summary obligations remain. The Commission's materials distinguish actors and circumstances across the model value chain. An acquirer should obtain a specific assessment of its role after completion and any modification. This paper makes no automatic classification of the buyer as a provider or deployer. ^[6]

The handover request should include available upstream documentation and the target's own modifications. Record adapter files, configuration, training inputs, evaluation reports and dependencies needed to reproduce the service. Where an upstream supplier restricts information, record the limitation and the operational alternative. Avoid assuming that a model's public availability establishes complete visibility into its development history or unrestricted access to the data used to create it.

Check the continuing service economics after separation. A group licence may be replaced with a standalone contract, or a service may require a new account, committed capacity or different support tier. Obtain quotations where available and label management estimates where quotations are missing. The acquisition model should show the applicable recurring expense, one-off migration cost and termination exposure separately. None of the example costs in this paper represents a supplier quotation.

8. Map the locations and parties that can access the assets

The proposed location map records where information is stored, processed, backed up and accessed for support. Include the legal entities operating the systems and the proposed administrators. A storage-region label alone does not describe every relevant movement or disclosure. Ask counsel to assess the actual arrangement, including remote access and onward processing, against each applicable legal regime and contract. Retain the resulting restrictions in the technical migration specification.

SDAIA's published English transfer-regulation material addresses limits on transfer, safeguards and risk assessment in specified circumstances. It also addresses cases in which transfers must stop. The portal is a useful source of diligence questions, but this paper does not establish that its combined English text is the latest consolidated instrument for a proposed transaction. The team should obtain the current applicable Saudi requirements and document the approved route before moving or disclosing affected information. ^[7]

For a UAE acquisition structure, request an applicability analysis identifying the relevant federal, free-zone and sector-specific requirements. Extend that review to every other country implicated by the actual customers, processing entities and access arrangements, including Saudi Arabia, Qatar or Kuwait where relevant. This paper supplies no country-wide adequacy finding, regulatory approval or universal Gulf transfer permission. An investment committee should receive the specific advice supporting its proposed operating geography.

Design a practical fallback for any movement that remains unresolved. Options for assessment include continued operation in the existing environment, a restricted service, a segregated local environment or exclusion of an affected dataset. Each option requires legal and technical review, a funded operating plan and a customer-impact assessment. Compare the time needed to make the alternative operational with the actual expiry of the seller's support. An unapproved alternative should remain outside the base completion case.

9. Convert transitional access into an exit plan

A transitional services agreement, or TSA, should identify the service the seller will provide, its boundaries and the evidence required for exit. For the proposed workstream, specify the permitted users, datasets, processing purposes and technical interfaces. Define responsibility for incident handling, customer requests, change control and retained information. Legal advisers should determine enforceable terms. The operating team should translate the agreed terms into an access configuration and a measurable handover plan.

The exit plan should work backwards from the last permissible day of access. Record dependencies that must finish before migration testing can begin. A corpus that cannot yet be used in the buyer environment cannot be treated as ready for a production cutover merely because the export routine is available. Set internal decision dates early enough to fund and implement an approved alternative. The original timetable below uses hypothetical weeks to show that dependency.

Separate expiry from successful exit. The agreement may end on a date even if a technical dependency remains unresolved. The proposed committee paper therefore identifies the consequence of missing the internal decision date, the person authorised to negotiate an extension and the evidence needed to rely on that extension. A draft request or an assumed seller accommodation should not be entered as an agreed contractual entitlement.

Define residual access after the principal cutover. Examples for review include a time-limited support account, a documented archive or an interface used for outstanding customer requests. Give each one a named custodian and an approved purpose. Test that the separated operation can function when the principal seller accounts are disabled, using a controlled environment and an agreed rollback procedure. Record any continuing dependency explicitly before declaring the service independent.

Maintain a separate schedule of resources required for exit. Identify the personnel who understand the data transformations, the supplier support needed for a new environment and the reviewers required to accept the results. Check their availability against the hypothetical timetable before using it in an actual plan. A contractual deadline alone establishes no engineering capacity. Where the seller's team supports several separations, request an agreed allocation and escalation process for the services on which this acquisition depends.

The final migration rehearsal should include a reconciliation of changes since the initial export, the approved cutover sequence and a defined decision point for proceeding. Record any limitation that could make the rehearsal unrepresentative, such as smaller data volumes or unavailable external interfaces. The project owner should explain how the limitation affects confidence in the production cutover and what additional test or approved restriction addresses it. That explanation belongs in the acceptance evidence supplied to the buyer.

10. Set Day-1 tests that correspond to customer obligations

Day 1 should have a defined operating scope approved by the parties responsible for the transaction. Identify the products available, authorised customers, supported functions and temporary restrictions. The test plan should exercise those services using permitted data and the intended production configuration. Retain evidence of both successful actions and denied actions. An access test that demonstrates a buyer can retrieve its own records should also examine whether it can retrieve records outside the approved perimeter.

The proposed checklist connects a control to the evidence required for acceptance. Assign each test to a named responsible function and retain an independent reviewer where appropriate. A completion percentage can support project administration, but the decision should identify any unresolved test that prevents an essential service from operating within its approved conditions. Define the consequence and the permitted fallback for that specific failure.

Original acceptance framework. Test owners and thresholds must be agreed for the actual transaction.

Record tolerances before running the tests. For a data reconciliation, define which records should transfer, which should remain and how duplicates, damaged records or pending updates are handled. For model performance, choose metrics that reflect the customer service and retain any material subgroup limitations. A favourable aggregate result may leave an important service failure unresolved. The acceptance memorandum should state the observed outcome against the agreed criterion, with the actual limitations preserved.

Include a controlled rollback decision. Define the conditions under which the team may return to a previous configuration, which data changes must be reconciled and whether the rollback remains permitted under the agreements. An emergency procedure can create additional copies and access paths. Those effects should be included in the rights and retention review before the procedure is relied upon as a continuity measure.

11. Quantify a restricted product line without double counting

Consider a wholly hypothetical acquisition for USD 80 million. Assume annual revenue of USD 24 million, divided equally among three product lines, and a 50% contribution margin on each line. One line depends on a corpus whose intended use remains unresolved at completion. The scenario assumes that line is unavailable for four months and that the missed revenue is permanently forgone. These are modelling choices, with no claim about actual transaction size, profitability or remediation duration.

The affected line generates assumed monthly revenue of USD 0.666667 million. Four unavailable months therefore produce USD 2.666667 million of revenue forgone. At the assumed contribution margin, contribution forgone is USD 1.333333 million. That margin represents the revenue less the variable operating costs assumed to be avoided. Fixed costs remain unchanged in the example. The contribution calculation should be revised if staff, hosting or other costs cannot vary as assumed.

Assume incremental cash expenditure of USD 0.45 million for rights work, USD 0.75 million for replacement data and retraining, USD 0.25 million for technical revalidation, USD 0.36 million for an agreed TSA extension and USD 0.20 million for dual running. These distinct categories total USD 2.01 million. They are hypothetical expenditure assumptions, not professional fee quotations. The example assumes the extension is available and agreed; an actual investment case must establish that fact.

USD millions. Rounded to two decimals. Revenue forgone is shown for context and is not added again to contribution forgone.

The combined incremental exposure is USD 3.343333 million before rounding. The original USD 1.20 million separation budget is already included in the base acquisition case, so it is excluded from that incremental figure. Including the original budget, total separation and remediation expenditure is USD 3.21 million. Including that budget and contribution forgone produces USD 4.543333 million of total modelled burden. The committee should state which comparison it is using and retain the underlying categories.

12. Test timing and replacement choices separately

The scenario's contribution effect increases with the duration of the product interruption. At a 50% contribution margin, two unavailable months imply USD 0.666667 million of contribution forgone, four months imply USD 1.333333 million and six months imply USD 2 million. Adding the assumed USD 2.01 million incremental expenditure gives combined exposures of USD 2.676667 million, USD 3.343333 million and USD 4.01 million respectively. The figure varies margin and duration while holding that expenditure fixed.

The fixed-expenditure assumption deliberately isolates the contribution sensitivity. In practice, an extension charge or dual-running cost may increase with time. Build those contractual increments into a separate version once the terms are known. Avoid quietly adding a duration-dependent charge to a table labelled fixed. The reader should be able to reproduce each case from a clearly stated formula and see which input changed between cases.

Liquidity requires its own schedule. Contribution forgone is an operating measure; it does not state when customer receipts stop or when supplier payments fall due. Prepare a monthly cash forecast using the affected contracts' billing and collection terms, remedial payment milestones and the actual debt-service schedule. Compare the lowest cash balance with available committed funding. This paper supplies no opening cash balance or collection profile from which a funding requirement could be verified.

Compare the proposed replacement with continued restricted operation, a permitted third-party service or product retirement. Identify the specific rights and tests required for each alternative. Include customer acceptance, migration effort, recurring costs and any material change in performance. The lowest numerical cost cannot establish that an alternative is lawful or commercially acceptable. Present the viable choices after their prerequisites have been reviewed, with unresolved conditions retained in the decision.

13. Translate findings into the transaction documents

The proposed diligence output should connect every material unresolved asset to the transaction decision. Some matters may require resolution before signing or completion. Others may support a price adjustment, a defined post-completion obligation or exclusion from the acquired perimeter. Legal advisers should determine the appropriate contractual mechanism and its enforceability. The financial analysis should identify what the mechanism covers, when recovery could occur and which exposure remains with the buyer.

An indemnity proposal should have a specified factual subject. For example, the identified issue may concern the permitted use of one corpus in one model version, together with the costs of an agreed remedy. The committee should review limitations, claim procedures and the counterparty's ability to pay. A proposed recovery should remain separate from the operating case until its terms and collectability have been assessed. The paper assumes no recoverable amount from a seller.

The FTC's final Everalbum order illustrates why diligence can extend to derived assets. It defined affected work product by reference to models or algorithms developed using specified biometric information and required its deletion, subject to stated retention exceptions. The consent order recorded that the respondent neither admitted nor denied the allegations except as specified. This is a dated, fact-specific enforcement example. It establishes no universal deletion remedy for an acquisition or a different training-data issue. ^[5]

Retain an asset-specific remedy plan alongside any proposed protection. A buyer may need to suspend a service before a contractual claim can be resolved. Identify who can authorise the operational response and where its cash funding comes from. Ask the committee to approve the residual exposure that remains after the proposed protections, including the possibility that a replacement product fails its evaluation or a customer declines the revised service.

14. Specify the advisory mandate and accountable outputs

A buyer commissioning this workstream should request defined deliverables. The proposed initial scope comprises a product dependency inventory, a rights matrix, a review of the separation timetable and a quantified register of unresolved commercial consequences. Technical specialists should assess lineage and migration evidence. Legal advisers should determine applicable rights and obligations. The transaction adviser should reconcile those findings with the acquisition case and the decisions required from the buyer.

Agree the information needed to begin and the limits of the engagement. A desktop review of supplied records has a different evidential scope from testing production systems or obtaining counterparty confirmations. Record access permissions and any restrictions before work starts. The mandate should identify which outputs are findings, which are recommendations and which require another specialist's conclusion. Describe the evidence still needed for the next decision without representing an incomplete review as clearance.

For a retainer-based engagement, define the period, deliverables, responsible personnel and change-control arrangements in an agreed contract. Additional datasets, jurisdictions or product lines may change the work required. The fee should be agreed from the actual scope and required expertise. None of the scenario's rights-work expenditure represents a Matchpoint fee proposal, and this paper offers no claim about the amount a client will pay or the timing of collected revenue.

The final committee memorandum should identify the decision requested and the conditions attached to it. Attach the detailed registers as supporting evidence while keeping the principal commercial consequences readable. A useful recommendation identifies which products can operate, the cash committed to separation, unresolved dependencies and the date by which each must be resolved. The buyer should be able to connect every proposed condition to a documented asset, customer obligation or operating test.

15. Close the workstream with evidence of independent operation

Closing the workstream should require an agreed acceptance record. Reconcile the delivered asset manifest with the approved rights matrix and the production configuration. Confirm that the agreed tests have been completed and retain their results. The report should distinguish a successful test from an exception accepted by an authorised decision-maker. Each continuing exception needs an owner, a permitted operating arrangement and a date or event that triggers review.

Document retained copies on both sides. Include the agreed purpose, applicable restriction and retention or deletion decision for backups, logs and archives. Obtain evidence appropriate to the actual environment, which may include configuration records, deletion logs or controlled access tests. Counsel should resolve conflicts between deletion requests and legal retention duties. A certificate should state what was examined and performed, avoiding a broader assurance than the evidence supports.

Transfer responsibility for customer requests and incidents to the ongoing operating team. Run a handover exercise that follows a request from receipt through identification of the affected records and coordination with any continuing service provider. Check that contacts and escalation paths remain available after the project team leaves. This exercise is a proposed operational check; its success and any unresolved issues should be documented before the project is administratively closed.

Review the acquisition case after the first operating period agreed by the buyer. Compare actual separation expenditure, product availability and customer outcomes with the approved assumptions. Explain changes using the evidence retained during the workstream. The purpose is to update the investment decision and ongoing controls with observed results. Any conclusion about realised savings, revenue retention or investment performance requires those actual records, which are outside the hypothetical example presented here.

16. Investment conclusion

The proposed acquisition discipline is to establish a supported chain from permitted source material to the independently operated customer service. An asset schedule should identify both the delivered item and the conditions governing its use. A migration plan should identify the prerequisite decisions and the evidence required for acceptance. The acquisition case should include distinct operating and cash consequences when a dependency remains unresolved.

In the hypothetical example, a four-month interruption and specified remedial expenditure create USD 3.34 million of incremental exposure. The amount depends entirely on the selected assumptions and excludes the original separation budget. It shows how a rights question can be translated into a decision requiring a funded response. Actual approval should depend on the transaction's contracts, current applicable law, technical tests and customer commitments, with the remaining uncertainty presented explicitly to the buyer.

Appendix A. Evidence request for a data-dependent acquisition

Request a product catalogue reconciled to the financial model, including each material revenue stream and its data or model dependencies. Obtain the legal-entity map, customer contracting entities and the proposed post-completion service structure. Ask management to identify any product whose continued operation relies on seller access, a group licence or a shared dataset. Keep the management response attributed until supporting records and tests have been reviewed.

For source data, request the inventory, collection history, version identifiers, contractual rights and purpose records. Include acquisition dates and the licence terms that applied at those dates. For personal data, obtain the reviewed controller and processor analysis, relevant notices, applicable legal-basis assessment and arrangements for exercising individual rights. Request the actual documents supporting the proposed transfer or disclosure route, including the current jurisdiction-specific advice relied upon by the parties.

For models and retrieval systems, request deployment manifests, upstream licences, training and fine-tuning records, index construction records, evaluation reports and known limitations. Identify dependencies on libraries, model services, credentials or infrastructure that remain with the seller. Obtain the seller's evidence supporting any claim of anonymity or permissible reuse. Review whether the evidence addresses the version and access conditions that the buyer expects to receive.

For separation execution, request the TSA schedules, migration specification, control design, test results and rollback plan. Include the customer-consent or notification register where applicable and all unresolved exceptions. Ask finance for the original separation budget, incremental remediation estimates, payment milestones and monthly cash forecast. Reconcile any expenditure already included in the base model before estimating additional funding or proposing a transaction-price response.

Appendix B. Committee questions and reproducible scenario

Which customer services are included in the approved Day-1 scope, and which specific dataset or model can stop each service? What evidence supports the intended use after completion? Which permissions remain conditional, and what operating alternative has been reviewed if a condition is unresolved? Who is accountable for deciding whether the alternative is acceptable, funded and ready before transitional access ends?

Can the proposed operating company deploy the documented model version with the acquired rights and infrastructure? What information remains with the seller, and for what approved purpose? Has the team tested restrictions as well as permitted access? Which customer obligations change, and what evidence supports the customer's continued participation? These questions require responses tied to records and tests rather than a single project-completion percentage.

The numerical example uses annual affected revenue of USD 8 million. Divide by twelve and multiply by four unavailable months to obtain USD 2.666667 million of revenue forgone. Multiply by the assumed 50% contribution margin to obtain USD 1.333333 million of contribution forgone. Add the five incremental expenditure assumptions, USD 0.45 million, USD 0.75 million, USD 0.25 million, USD 0.36 million and USD 0.20 million, to obtain USD 2.01 million of remedial expenditure.

Adding contribution forgone to remedial expenditure gives USD 3.343333 million of incremental exposure. Rounded presentation gives USD 3.34 million. The USD 1.20 million original separation budget remains outside that incremental comparison. The example assumes no revenue catch-up, tax effect, financing effect, indemnity recovery or continuing terminal-value loss. It provides no probability-weighted expected loss. Those omissions should be addressed with actual evidence before the framework is used to approve an acquisition.

Sources

1. Information Commissioner's Office. Due diligence when sharing data following mergers and acquisitions. Page carries a notice that guidance is under review following the Data (Use and Access) Act. Accessed 10 September 2026. Read the primary source
2. European Data Protection Board. EDPB opinion on AI models: GDPR principles support responsible AI. 18 December 2024. Accessed 10 September 2026. Read the primary source
3. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1, July 2024. Particularly MAP 4.1 and dataset provenance actions. Accessed 10 September 2026. Read the primary source
4. United Kingdom. Copyright, Designs and Patents Act 1988, section 29A. Official legislation text, subsections 1-5. Accessed 10 September 2026. Read the primary source
5. Federal Trade Commission. In the Matter of Everalbum, Inc. Decision and Order. 2021. Definitions and Part III, Deletion. Accessed 10 September 2026. Read the primary source
6. European Commission. Guidelines on obligations for General-Purpose AI providers. FAQ updated 11 November 2025. Used for provider-role, documentation and copyright concepts; historical implementation wording should be checked against current instruments. Accessed 10 September 2026. Read the primary source
7. Saudi Data and AI Authority. Personal Data Protection implementing regulation and Regulation on Personal Data Transfer outside the Kingdom. Published English portal text; current consolidated applicability requires transaction-specific confirmation. Accessed 10 September 2026. Read the primary source