M&A IP Diligence Guide for Founders

You’re Not Just Buying a Company, You’re Buying Its IP

You’ve signed the LOI. The price is agreed upon. But the most dangerous phase of your acquisition is just beginning: due diligence. In a tech M&A deal, you are primarily buying intellectual property. The code, the patents, the brand, the data—this is the foundation of the company’s valuation.

Assuming this IP is clean is a catastrophic error. IP diligence isn’t a checkbox for lawyers to handle in a back room. It’s a foundational audit of the asset you’re buying, and it’s where deals get repriced or fall apart. A botched process means you could be buying a ticking time bomb—a lawsuit, a worthless patent, or a product built with code you don’t have the rights to use.

The Goal: Answer Two Questions

Your objective during IP diligence is simple. You must answer two questions:

Do they actually own it? You need to verify that the legal ownership of every asset—code, patents, trademarks—is held by the company, not the founders personally, their former employers, or a litany of ex-contractors. · What liabilities are attached? You’re hunting for landmines. This includes patent infringement risks, open-source license obligations that could force your proprietary code into the public domain, and disputes over brand rights.

The Diligence Playbook: What to Look For

After the LOI is signed, the seller will open a "virtual data room" (VDR) containing thousands of documents. This is where you and your team—lawyers and engineers—go to work. Here’s what matters most.

1. Software and Copyrights (The Crown Jewels)

For nearly every tech company, the software is the most valuable asset and the most common source of deal-killing problems. This is not just a legal review; your CTO or senior engineering leader must be involved here.

Open Source Software (OSS) Audit

This is your first and most urgent priority. You must get a complete software bill of materials (SBOM) and analyze the licenses of all open-source components. Tools like Snyk, Black Duck, or FOSSA can automate the scan, but a human analysis is required.

The "Copyleft" Threat: Pay excruciating attention to "viral" or "copyleft" licenses, particularly the GNU General Public License (GPL) in its various versions (GPLv2, GPLv3, AGPL). Using a single GPL-licensed component can, under certain conditions, legally obligate you to make your entire proprietary codebase available as open source. This is a five-alarm fire. · Permissive vs. Restrictive: Permissive licenses like MIT, Apache 2.0, and BSD are your best friends. They require attribution but don’t infect your own code. Your goal is to see a sea of permissive licenses and zero, or near-zero, copyleft ones.

Real-World Cost: Discovering a core component is under a GPL license isn't a theoretical problem. A rewrite to replace it can cost anywhere from $200,000 to over $1 million and delay product integration by 6-12 months. This is a direct, tangible cost you should deduct from the purchase price.

Code Ownership and CIIAAs

A company does not automatically own the code its employees or contractors write. Ownership must be legally transferred via a written agreement. This is the single most litigated issue in tech M&A.

The Document You Need: You are looking for a signed Confidential Information and Invention Assignment Agreement (CIIAA) from every single person who ever contributed to the IP. This includes founders, full-time employees, part-time employees, interns, and, most critically, contractors. · 100% Coverage is the Goal: Create a spreadsheet listing every person on the cap table, every past and present employee from their HR system, and every contractor from their payment records. Your job is to fill the adjacent column with a link to their signed CIIAA. Every blank is a gap in ownership and a red flag.

Common Mistake: Believing a GitHub repo proves ownership. It doesn't. Legal title is established by signed contracts (CIIAAs), not code commits. No CIIAA, no ownership. It’s that simple. Three missing agreements from early engineers can put the entire value of your acquisition at risk.

Founder IP Provenance

Where and when did the founders create the initial product? If they built the MVP while employed at a large tech company (like Google, Meta, or Microsoft), their former employer might have a legal claim to the IP under their old employment agreement.

Where were you employed when you began writing code for this project? · Can we review your departure agreements from those jobs? · Did you use any company-owned equipment (laptops, software licenses) to build the initial prototype? · Was any code written during your previous employer’s business hours?

Murky answers are a giant red flag. A claim from a FAANG company will kill your deal and the target company.

2. Patents

Don't be dazzled by a long list of patent numbers. Your job is to determine if they are valuable, defensible, and relevant.

Ownership & Chain of Title: Confirm every patent is assigned to the target company, not an individual founder or a prior LLC. The chain of title from the inventor to the company must be clean. · Strategic Value: Do the patent claims actually cover the commercial product and its core revenue streams? It's surprisingly common for companies to have patents on secondary features while the core technology remains unprotected. · Status and Remaining Life: Are the patents granted or pending? In which countries? Have maintenance fees been paid on time? When do they expire? A patent expiring in two years is far less valuable than one with 15 years left. · Freedom to Operate (FTO): Ask if the seller has ever commissioned an FTO analysis. This is a report assessing whether their commercial product infringes on existing patents held by others. The absence of an FTO means they might be exposing you to an infringement lawsuit you will inherit.

3. Trademarks and Brand Assets

This is usually less perilous than code and patents, but mistakes can be costly and annoying.

Registration: Are the company name and key product names registered trademarks? In what countries? · Ownership: Ensure the registrations, along with critical domain names and social media handles, are owned by the company, not a founder’s personal GoDaddy or Twitter account. Cleaning this up can be a bureaucratic headache. · Infringement: Have they been monitoring for others infringing on their brand? Are there any active disputes or cease-and-desist letters?

Step 3: From Red Flags to Deal Terms

Finding problems doesn’t automatically kill the deal. It gives you leverage to negotiate protections and re-price the risk. This is where your findings become financial tools.

Purchase Price Adjustments: This is the simplest tool. If you discover the core product requires a $500,000 rewrite to remove GPL code, you should argue for a $500,000 (or greater) reduction in the purchase price. The problem reduces the value of the asset, and the price should reflect that. · Specific Escrows or Holdbacks: If you uncover a specific, quantifiable risk, demand that a portion of the purchase price be held in escrow. For example, for two missing CIIAAs from key engineers, you could demand $250,000 per engineer be held back for 24 months. The seller only gets the money if they find the engineers and secure the signatures. If they can’t, the money becomes yours to cover potential damages. · Enhanced Indemnification: In your purchase agreement, the seller makes "representations and warranties" (promises) about the IP. Indemnification is the "so what"—if they breach a promise and you suffer a loss, they have to pay you back. For high-risk IP issues, you can negotiate a specific indemnity with a higher liability cap and a longer survival period than standard claims.

Get Your House in Order: IP Diligence Readiness

Whether you’re a buyer or a future seller, the best defense is a good offense. Don’t wait for a diligence request to find your own problems.

Your Day-One IP Checklist

CIIAA Discipline: Make signing a CIIAA a non-negotiable part of onboarding for every single person who touches your product. Store them in a secure, centralized folder. No exceptions. · Automate OSS Scanning: Integrate a tool like Snyk or FOSSA into your development pipeline from day one. Block any commits that introduce restrictive licenses. · Create an IP Inventory: Maintain a simple spreadsheet listing all your patents (pending and granted), trademarks, essential domain names, and key licensed third-party software. Update it quarterly. · Document Trade Secrets: If your competitive advantage lies in know-how, document it. This makes its value tangible and proves you take its protection seriously, which is critical if an employee leaves and tries to replicate it.

How to Apply This This Week

Don’t just file this article away. Take 30 minutes this week to pressure-test your own company:

Pull the Files: Go to your HR or legal folder. Can you immediately find the signed CIIAA for your first-ever engineer and your most recent hire? If it takes you more than 5 minutes, your system is broken. · Run a Scan: Ask your engineering lead to run a one-time OSS scan on your primary codebase. What does the report say? Do you have any GPL or AGPL licenses you didn't know about? · Check Your Domains: Log in to your domain registrar. Is the legal owner of your main ".com" domain the company itself, or is it still under a founder’s personal name?

Fixing these small things now will save you millions of dollars and existential stress when you’re facing an acquisition of your own.