RWI underwriting call questions: data, privacy and AI topics to prepare

What do RWI underwriters ask on the underwriting call?

On the underwriting call, the insurer's underwriters walk through the buyer's diligence and ask the deal team and sometimes the seller's advisors about the areas where the insurer will price risk or add exclusions. In the data, privacy and AI area they typically ask how personal data is collected and used, who owns the code and content, whether any third-party or open-source material is embedded, and whether the company uses or licenses data for AI. A signed or planned data license should be described plainly so it is not treated as an unknown.

Representations and warranties insurance (RWI) is a buyer-side policy that covers losses from unknown breaches of the seller's representations. The underwriting call comes after the buyer's diligence reports are shared and before binding. The seller is rarely the main speaker, but the advisor who prepared the data room often sits in. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

How the call fits in the timeline

Confirmatory work after the LOI is where the facts are tested; see confirmatory due diligence. Time-limits on claims are covered in survival periods for reps and warranties.

Questions to prepare: data and privacy

Underwriters work from the buyer counsel's report, so answers must match what the data room already says.

• A description of the personal data the company holds, who it relates to and where it sits
• The privacy notices in force, and any change in how data has been used since they were issued
• Third-party processors with access, and the contracts that cover them
• Security incidents, regulatory inquiries or consumer complaints over the lookback period, even if minor
• Retention and deletion practice, including what happens to old system archives
• Whether customer contracts restrict use of customer data beyond delivering the service

The cybersecurity due diligence checklist gives the control-level view that sits behind these answers.

Questions to prepare: IP ownership and software

• Who wrote the code and content: employees, contractors, agencies
• Assignment agreements for every contributor, including former ones
• Open-source components and the licenses attached
• Any third-party material embedded in products or training sets
• Ownership of records created in customer engagements

For service businesses, the last item matters: the company may own its own work records but not client-confidential content. See how to redact customer contracts for a data room for the practical side.

Questions to prepare: AI use

Expect detailed questions here, since insurer positions on AI exposure are still developing and vary by insurer.

• Which AI tools employees use, whether a policy exists, and whether customer data goes into external tools
• Whether the company trains, fine-tunes or evaluates any model on customer or third-party data
• Whether the company has licensed or plans to license its records to others for AI development
• Any customer notice or consent relating to AI use of their content

How to describe a data license so it is not carved out

A policy usually excludes matters that the deal team knew about before signing. A data license disclosed late, or described vaguely, risks being treated as a known issue or as a pending matter. Disclosed early and plainly, it is a contract to be reviewed like any other.

1. State what it is. The company grants a time-limited right to use a defined dataset to a buyer, usually exclusive for AI training for an agreed term, and keeps ownership. It is a license, not a sale.
2. State what it is not. It does not transfer the company, change customer contracts, or involve the company training models.
3. Give the dates. Signed, in negotiation, or only being explored. If nothing is signed, say so; nothing is binding until the company agrees price and terms and signs.
4. Explain the scope controls. Redaction and de-identification rules are agreed before any work begins, and data is delivered only after an executed agreement and the company's authorization.
5. List the diligence done. Rights review, customer-contract check and the inventory of systems.
6. Connect it to the agreement. Counsel decides how the purchase agreement treats the license, including any covenant limiting new licenses before closing.

Adjust the wording to the facts; counsel approves anything said to an underwriter. For a primer on the counterparty, see what is an AI data buyer.

Common mistakes

What it means for a referral partner

Advisors who raise records early help the seller avoid a late surprise in underwriting. Run the baseline in who qualifies first, and use the company fit checker for a preliminary, non-binding screen. The wider guide to building an M&A buyer list shows where AI data buyers sit relative to acquirers, and questions to ask a buyer when selling your business is the companion for the other side of the table.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. Licensed advisors should check their own rules on referral fees and disclosure; see referral opportunities for M&A advisors.

Next step

If a client has a license under discussion, prepare the plain description above before the call. To introduce a company, register as a partner or have the owner apply at sourcex.si/apply.