Technology and IP Due Diligence for Mergers and Acquisitions

Start with a technology and IP asset map

The first diligence problem is usually incompleteness. A target may have patents and trademarks on a schedule while the commercially important value sits in source code, APIs, cloud configuration, proprietary datasets, models, documentation, domain names, product designs, internal tools, customer integrations or know-how. The review should therefore begin with an operating asset map rather than a list of registered rights.

Ownership diligence requires more than registration records

Patent and copyright recordation systems can help identify ownership history, but diligence should reconcile those public records with the contracts that created or transferred the rights. The USPTO states that patent ownership may be transferred by assignment and provides Assignment Center and patent-assignment search tools. The U.S. Copyright Office likewise accepts recordation of transfers and other documents under 17 U.S.C. § 205 and notes that recordation can provide legal advantages in specified circumstances.

The transaction team should compare the target's current legal name and predecessor entities against inventor, founder, employee, contractor and acquisition records. Particular attention is warranted where material code or inventions were developed before incorporation, by overseas contractors, through joint ventures, at universities, or while founders were employed elsewhere. A clean cap table does not establish clean IP title.

Where a chain-of-title gap appears curable, the practical question becomes whether it can be fixed before closing and whether the counterparty has the legal and practical ability to execute the necessary assignment. A missing signature discovered after closing can be far harder to repair than one addressed as a condition to closing.

Data, cybersecurity and AI can change the value of the IP portfolio

A technology company's assets can be legally owned yet commercially constrained. Data rights may limit whether datasets can be transferred, combined or reused after closing. Customer contracts may prohibit using data for model training. Security incidents may create remediation costs or customer-notification issues. A model may depend on an API or cloud service that the buyer cannot assume on the same terms.

For software security, diligence can use evidence such as vulnerability-management records, secure-development controls, penetration-test reports, incident history, dependency management and SBOM practices. NIST SP 800-218 is particularly useful as a vocabulary for evaluating the target's development practices, while CISA's SBOM materials can help assess software-component transparency.

For AI assets, a useful diligence file should identify the model and provider, ownership of custom code and fine-tuning materials, rights to training and evaluation data, contractual restrictions, governance records, known limitations, and how the system is used in regulated or customer-facing workflows. NIST's AI Risk Management Framework is voluntary, but it provides a structured vocabulary for examining governance and risk-management maturity. The framework itself is under revision in 2026, so the current version and any applicable profile should be checked at the time of a transaction.

How findings should change the transaction

The purpose of diligence is not to produce a long exception list. Findings should be prioritized according to whether they affect ownership, continuity of operations, legal exposure, economics or integration. A missing recordation that can be corrected quickly is different from a founder retaining ownership of core code. An isolated unsupported dependency is different from a product architecture built around components whose license terms conflict with the buyer's distribution model.

Deal teams should therefore connect each material issue to a proposed response. The response may be remediation before signing or closing, a third-party consent, a new assignment, an amendment to a key license, a representation and warranty, a covenant, a specific indemnity, escrow, purchase-price adjustment or a post-closing integration workstream. Some findings may instead change the acquisition thesis and require deeper technical or commercial validation.

Buyers and sellers benefit from the same discipline. A seller that performs readiness diligence before going to market can resolve ownership gaps, organize software provenance, identify consent requirements and reduce avoidable friction. Buyers gain a clearer record for deciding which risks are acceptable and which must be allocated through the transaction documents.