Synthetic Data Business Due Diligence

Due diligence on a synthetic-data business is largely an exercise in testing claims rather than reviewing documents that speak for themselves, because the central risks in this sub-sector — training-data provenance and re-identification exposure — are exactly the things a company’s own marketing has every incentive to present favourably. A buyer’s technical and legal teams need to independently verify what the business asserts about itself, not simply collect the assertions, and that verification is where most of the real findings in this kind of deal actually come from.

Documents to request

• Training-data licensing documentation for every generation model currently in production, including any real client or third-party data used at any stage of development.
• Re-identification and fidelity testing reports, with the methodology included, not just the summary conclusion the company presents to customers.
• Every customer contract containing an anonymity, fidelity or compliance warranty, listed individually rather than described in general terms.
• The foundation-model vendor agreement the business depends on, including its pricing terms and what happens if the vendor changes them or withdraws access.
• Patent filings, if any exist, along with their assignment history and confirmation that anyone who contributed to the filed work actually assigned their rights.

Registry and status searches worth running

A corporate status and good-standing check, an execution and judgment search, and a search at the Canadian Intellectual Property Office for any patents actually filed all belong in a standard diligence package here. The CIPO search specifically confirms who owns any filed intellectual property and whether it was properly assigned from everyone who helped build it, including contractors who may no longer be with the company — a gap here is common enough in early-stage technology businesses that it is worth checking directly rather than assuming the paperwork was handled correctly at the time.

Verify the benchmark and validation tooling actually transfers

The fidelity and utility figures a synthetic-data business presents to customers are only as trustworthy as the methodology and tooling that produced them, and that tooling deserves the same ownership scrutiny as the generation models themselves. Confirm who actually built the validation methodology and whether it is documented as a repeatable, owned process, rather than something that lived largely in one departed employee’s personal scripts or notebooks. Where the business relied on a third-party benchmarking service to produce its fidelity claims, check the terms of that arrangement specifically — some benchmarking services license their tooling for a single use or a limited term, and a business that quietly kept citing results from an arrangement that has since lapsed is presenting evidence it may no longer have the right to rely on. Ask the technical team to actually reproduce a benchmark result during diligence rather than accepting the reported figure, since a business whose fidelity claims cannot be independently reproduced under diligence conditions is telling a buyer something important about how solid those claims really are outside a sales conversation.

Findings that kill deals

• Generation models trained on real client data with no licence covering that use, which raises a direct question over whether the business actually owns the technology it is selling.
• No documented re-identification testing behind an anonymity claim that has already been made to a customer in a live contract.
• Customer contracts warranting anonymity or compliance the business cannot actually substantiate with evidence, rather than confidence.
• Total dependency on a single foundation model for the core generation engine, with no contractual protection against a pricing or access change.

What a finding actually means

Finding that a generation model was trained on real client data without a licence is not a paperwork gap to be resolved with a warranty at closing — it means the buyer inherits both an unresolved question over the model’s ownership and the exposure of every customer who was told the resulting output was safely synthetic. An unsubstantiated anonymity claim sitting in a live customer contract is inherited exposure under the Competition Bureau’s deceptive-marketing framework, not a marketing exaggeration that quietly disappears at closing, because the claim was made to the customer by the entity the buyer is now stepping into. Neither finding automatically ends a deal, but both should change the price, the structure, or the specific representations a seller is asked to stand behind.

Reading the customer contracts closely

Confirm exactly what each contract promises about anonymity, fidelity or compliance, and cross-check that promise directly against the actual testing evidence behind it — the two diverge more often than either party expects going into diligence, and that gap becomes the buyer’s problem the day after closing, not the seller’s. A contract that promises more than the current evidence supports needs either stronger evidence before closing or a clear-eyed adjustment to price and risk allocation, not simply a note to revisit the question later.