Cap table, intellectual property, contracts, AI compliance and governance: how to prepare a technology startup for a funding round without discovering critical issues when the deal is already underway.
The pitch opens the door.
Due diligence determines whether the investment gets through.
An investor does not fund merely a product or a presentation: the investment is made into a corporate, technological and contractual structure that must be capable of scaling, scrutiny and change.
Una startup AI ha un prototipo funzionante, primi clienti e un term sheet interessante. Durante la due diligence emergono però tre criticità: il software iniziale è stato sviluppato da un consulente senza una cessione scritta dei diritti; il cap table non considera una promessa di equity fatta a un ex co-founder; i dati utilizzati nel prodotto non sono accompagnati da una documentazione sufficientemente chiara sul loro utilizzo.
Il prodotto continua a funzionare. Il round, invece, può rallentare, richiedere condizioni più severe, subire una riduzione della valutazione o, nei casi più complessi, non chiudersi. La due diligence non è quindi un rito burocratico successivo al term sheet: è il momento in cui la narrazione commerciale dell’impresa viene sottoposta a verifica documentale.
Due diligence is not about checking whether a startup has accumulated a large number of documents. It is about determining whether what the company claims to own — technology, assets, revenues, customers, talent and growth capacity — is legally attributable to it, controllable and financeable.
The investor’s seven lenses
No startup is “risk-free”. The objective is to make material risks identifiable, documented and manageable before they are reflected in the deal economics.
Corporate
Company records, articles, resolutions, authority and registers.
Cap table
Equity, SAFEs, convertibles, warrants and option pools.
IP e software
Code, licences, datasets, brand, cloud and repositories.
Founder e team
Vesting, assignments, continuity and key agreements.
Contratti
Customers, SLAs, liability, data and termination.
AI e dati
Privacy, security, AI supply chain and governance.
Cross-border
Regulation, markets, contracts and local risk.
What questions is the investor really trying to answer?
Documentation matters, but it is not the purpose of due diligence. Ogni documento deve consentire di rispondere a una domanda economica o strategica: who actually controls the company?, is the technology transferable?, are the revenues defensible?, what risks may emerge after the investment?
| Investor question | Area to verify | Risk if the answer is uncertain |
|---|---|---|
| Who actually owns the product? | Code, IP assignments, datasets, licences, domains and cloud | Technology may be challenged, non-transferable or difficult to value |
| Who owns and controls the company? | Cap table, articles, shareholder agreements, SAFEs, warrants and resolutions | Unexpected dilution, hidden rights, vetoes or inability to close |
| Are the revenues genuinely defensible? | Customer contracts, renewals, termination, SLAs and change-of-control provisions | Fragile revenues, customer concentration or contractual liabilities |
| Is the team properly tied to the business? | Founder agreements, vesting, employment, consultancy and confidentiality | Departure of key people or loss of essential assets after the round |
| Can the product scale in the relevant markets? | Privacy, AI, cybersecurity, sector regulation and target countries | Commercial delays, costly remediation, enforcement or operational blocks |
From the pitch promise to the investment decision
Due diligence turns commercial assertions into verifiable evidence.
The seven due diligence workstreams
For founders and CEOs, it is more useful to think in terms of workstreams — areas where documentation, structure and risk must be coherent — rather than pursuing an undifferentiated list of files.
Corporate hygiene: does the company exist as represented?
The review starts with the fundamentals: incorporation documents, articles, corporate books and registers, delegations, powers of attorney, shareholder and board resolutions, shareholder agreements and group-company arrangements.
- Were the equity interests properly issued and transferred?
- Do the resolutions support the corporate acts and financings already completed?
- Who has authority to sign, incur obligations and approve the funding round?
Cap table: can dilution actually be calculated?
The cap table must be current, reconcilable with the corporate records and presented on a fully diluted basis. It is not merely a table: it is a snapshot of control, incentives and future dilution.
- Shares or equity interests held by founders, employees, advisers and investors
- Option pool, grants already made and equity promises
- SAFEs, convertible notes, warrants and MFN provisions
- Pro rata rights, preferences and side letters
- Vesting, reverse vesting and repurchase rights
Intellectual property: does the company own what it sells?
For software, AI and deep-tech startups, this is often the most sensitive area. The investor wants to trace an unbroken chain of title: from founders and developers to the company, from the company to its products and from those products to the market.
| Asset | Critical question |
|---|---|
| Proprietary code | Was it created by the company or validly assigned by the person who developed it? |
| Open source | Do the licences impose obligations incompatible with the distribution model or commercial strategy? |
| Dataset | Is there a documented basis for using, analysing, training on or sharing the data? |
| AI model | Who controls the weights, fine-tuning, pipeline, prompts and relevant outputs? |
| Strategic accounts | Are cloud accounts, repositories, stores and domains held in the company’s name and subject to controlled access? |
| Brand and know-how | Are trademarks, domains and trade secrets protected in the markets where value is created? |
Founders and team: can value walk out the door?
An investor does not assess only the quality of the people. The investor assesses the stability of the relationship between those people and the company: anyone who created essential technology, commercial relationships or know-how must be contractually tied to the business in a manner consistent with the project.
- Founder agreements, roles, delegations and reserved matters
- Vesting, cliff and good-leaver / bad-leaver provisions
- Employment, consultancy, confidentiality and IP assignment agreements
- Stock options and other incentive instruments
- Position of former founders, advisers and key developers
Contracts and revenues: are the revenues defensible?
Revenue is not assessed by amount alone. The investor examines how repeatable, transferable and sustainable it is. For a SaaS or AI startup, a customer contract may be an asset or a deferred liability.
- Renewals, term, termination and revenue concentration
- SLAs, service credits, penalties and support obligations
- Limitations of liability and indemnities
- Audit, security and data-use provisions
- Consents required for an investment, change of control or exit
- Agreements with cloud providers, subcontractors and technology partners
AI, privacy and cybersecurity: compliance is part of the product
For an AI startup, privacy, security and system governance are not legal appendices. They affect the ability to enter into enterprise contracts, deploy the product and withstand scrutiny by investors, partners or regulated customers.
- Roles and legal bases for processing personal data
- Data processing agreements, international transfers and retention
- Access management, incident response and cloud-provider assessment
- The startup’s role in the AI value chain: provider, deployer or other operator
- Transparency, documentation, traceability and human oversight where applicable
- Contracts and controls for third-party models, APIs or datasets
Regulatory risk and cross-border operations
When a startup sells in multiple countries, hires abroad or relies on international infrastructure and partners, due diligence extends to the sustainability of the operating model in the relevant markets.
- Pending disputes, complaints, inspections and potential liabilities
- Licences and authorisations for regulated sectors
- Local presence, employment, permanent establishment and group governance
- International contracts: governing law, forum and arbitration
- Export controls, sanctions, AML and sector-specific obligations, where applicable
Red flags: when a problem changes the deal
Unassigned IP
Core code or know-how was created by a founder, freelancer or software house without a verifiable transfer of rights.
Opaque cap table
SAFEs, equity promises, warrants or side arrangements are not reflected in a current, fully diluted picture.
Data without governance
The startup cannot document the origin, lawful usability or safeguards applicable to data essential to the product.
Open-source licensing
Software dependencies may be incompatible with the commercial strategy or enterprise-customer requirements.
Contracts requiring remediation
Standard terms need improvement on liability, SLAs, data and termination: often a remediable risk if identified in time.
Founder dependency
Value is concentrated in a key person without vesting, IP assignment, contractual continuity or appropriate allocation of authority.
An investable startup does not prepare its data room in a week
The most effective preparation begins before the fundraising process. An organised data room reduces repetitive requests, accelerates responses to investors and enables management to retain control of the narrative throughout the round.
Put the foundations and title in order
Review corporate records, the cap table, founder agreements, IP assignments, developer agreements and control of domains, repositories and accounts.
Strengthen contracts and compliance
Map material commercial, employment and consultancy agreements, privacy, security, open-source components, cloud providers and data flows.
Build an intelligible data room
Organise documents by workstream, prepare consistent versions and maintain a question log. Known issues should be addressed through a documented plan.
Manage disclosure, remedies and negotiation
Maintain version control, respond consistently, quantify material risks and define remedies that can realistically be implemented.
Quick Investor Readiness checklist
An orientation tool: select the activities already completed. The result is saved only in the visitor’s browser and does not constitute a legal assessment.
Important notice. This article is provided for general information only. It does not constitute legal advice and does not replace an analysis of any specific transaction, company, investment or jurisdiction. The scope and intensity of due diligence should be proportionate to the company’s stage, sector, transaction and countries involved.
// Commenti