IP due diligence asks whether the target owns or can use the assets on which its business depends. Start with the products, services and brand that generate value, then trace the rights supporting them. A long list of registrations does not answer whether the core software or content is properly controlled.
Review employees, contractors, founders and suppliers who contributed to key assets. Check licences, open source conditions, disputes and transaction-related consents. Translate findings into specific completion actions or contractual protections rather than leaving them as observations in a report.
Start with the assets that generate the purchase value
Identify the products, services, brands and technology on which the target's revenue depends. Trace the rights supporting those assets before reviewing every minor registration with equal depth. A large portfolio can look impressive while the core software or content remains under an unsuitable licence. The diligence plan should reflect the actual investment thesis.
Ask the target to explain how each material asset was created, acquired and used. Distinguish ownership from permission and practical access. The buyer needs to know whether the business can continue operating after completion, including any dependency on a founder, developer or external platform not included in the transaction.
Trace contributors and the ownership chain
Review employment, contractor and founder agreements for the important work. Copyright ownership depends on creation circumstances and contractual arrangements; commissioned work does not automatically belong to the paying customer. [1] Identify gaps in assignments or licences before accepting a general statement that all IP is company-owned.
Include subcontractors and earlier group entities. An operating company may use assets developed elsewhere without a complete transfer record. Obtain the relevant documents and explain any uncertainty. A warranty can allocate transaction risk, but it cannot create rights missing from the chain or guarantee that a third party will cooperate after completion.
Assess registered rights and actual coverage
Reconcile the portfolio with owner details, territories, specifications, renewals and pending proceedings. Check whether the registrations cover the current brand and offering rather than an obsolete version. Identify deadlines during the transaction and assign responsibility so rights are not lost while the parties negotiate.
Review disputes, threatened claims and coexistence arrangements. Ask about restrictions on future use and markets. The absence of active litigation does not establish that the target has unrestricted freedom to operate. Record the evidence and scope of the assessment rather than describing a clean register search as comprehensive legal clearance.
Examine licences and software dependencies
List material inbound and outbound licences, including exclusivity, field, territory and transfer or change-of-control conditions. A business can remain dependent on third-party permission after a share acquisition even though its corporate owner changes. Identify consent requirements and the consequence if a licence cannot continue on the proposed terms.
For software, review contributor rights, open-source components, proprietary tools and hosted-service dependencies. Ask the technical team to assess access, build and deployment continuity. A working demonstration does not show that the buyer can maintain the product independently, and a source-code archive does not prove unrestricted legal use. Connect the technical and legal findings without treating either as a substitute for the other.
Handle diligence data proportionately
The review may involve employee, customer or other personal data. The ICO provides guidance on due diligence when data is shared in mergers and acquisitions. [2] Assess the purpose, necessary information and appropriate safeguards for the stage of the transaction. An NDA alone does not answer every data-sharing question.
Use staged access or redaction where suitable and retain a record of what was disclosed. Avoid requesting personal identity documents or full customer datasets merely because they exist in the target's files. The buyer should obtain enough evidence to assess the asset and obligations while respecting the distinct data-protection responsibilities of the process.
Translate findings into completion decisions
Classify each material issue by commercial effect and required response. A missing contractor assignment may need a signed agreement before completion; a consent may need the licensor's approval; an obsolete registration may require a different protection plan. Assign an owner, document and deadline to each action rather than leaving the finding as a paragraph in a report.
Distinguish remediation from contractual protection. Price adjustment, warranty or indemnity may be considered, but the buyer should understand the exposure that remains and whether recovery would be practical. Do not present acceptance of risk as proof that the ownership or permission problem has been fixed.
Verify the handover the buyer will receive
Specify registrations, source materials, licence records, accounts and administration rights included at completion. Check the final status of required assignments and consents and preserve evidence. A well-organised closing record should explain both the legal rights acquired and the operational materials needed to use them.
Read Selling a business with registered IP for registered-IP sale preparation. IP ownership review can help assess ownership and permission evidence, with specialist technical, data and transaction advice coordinated around the assets central to the acquisition.
Illustrative scenario
A buyer reviews a software company whose main product includes code created by an early freelancer. The contract is missing and access to the original repository is uncertain. The buyer investigates the rights and technical handover together, then decides what must be resolved before committing to completion.
Preparation checklist
- Identify assets essential to revenue and continued operation.
- Trace ownership and material third party permissions.
- Check transaction restrictions, disputes and renewal dates.
- Link each material finding to an owner and a completion decision.
Frequently asked questions
Is a list of registrations enough for IP due diligence?
No. Review the assets generating value, their ownership chain, licences and practical dependencies. Core software or content may be important without appearing in a registration list.
Do warranties solve a missing contractor assignment?
They may allocate risk but do not create missing rights. Decide whether the gap must be remedied before completion and assess the practical value of any remaining protection.
Why involve the technical team in software diligence?
They can assess access, build and operating continuity. That work complements the legal rights review; a functioning demonstration or code copy alone does not answer both questions.
Can all customer data be shared because the buyer signed an NDA?
No. Assess necessary data, purpose and safeguards under the applicable data-protection framework. Confidentiality supports the process but does not replace its separate legal requirements.
Official sources
Sources checked: 8 September 2026. Check the linked guidance for subsequent changes.
General information only. The appropriate action depends on your circumstances and the applicable jurisdiction.
Report a correction