Technical due diligence playbook

A technical due diligence playbook for buyers, investors and the reviewers they hire. It turns a review of someone else's software into rules, so a signed report can cite each finding by its rule ID and evidence.

It starts with how to run the review. Work from read-only access, stay independent, and rate each finding on one scale that says which ones stop the deal. Then it checks the code and who owns it, security and personal data, and the AI providers the product depends on. It ends with how the team ships and runs it.

The last chapter is for the seller. A company that runs these checks on itself first fixes the deal-breakers before a buyer finds them.

After the deal closes, the codebase takeover playbook covers the first weeks with the code.

Chapters

1. Scope and conduct

   Work from read-only access and stay independent of the code you judge. Rate every finding on one fixed scale and tie it to a rule ID and evidence.

   • Required 2
   • Recommended 2

2. Code and ownership

   Build the product yourself, confirm who owns the code, list licences and secrets, and check tests, the pipeline and the people the code depends on.

   • Required 3
   • Recommended 5

3. Security, data and law

   Test the access rules on the running product, check personal data and sub-processors, and record AI provider, AI Act and Cyber Resilience Act duties.

   • Required 1
   • Recommended 4

4. Operations and growth

   Measure delivery, incidents and availability against the promises made to customers, and list the cost per customer and what must be rebuilt to grow.

   • Recommended 5

5. Preparing to sell

   Run the same checks a buyer will run before the buyer does. Fix the deal-breakers early and hand over a data room that answers the questions at once.

   • Recommended 2

All 24 rules on one page

This is a lot to check. An Expert can check it for you.

Related playbooks

• Triage

  In the Codebase takeover playbook. After the deal closes, take over access, secrets and backups in a fixed order before any change.

• Using open source

  In the Open source maintenance playbook. Licence findings start from the dependency policy. See how a team should vet and track what it uses.

• AI Act

  In the Compliance and governance playbook. An AI feature can carry AI Act duties. Check which role the company has and what it must document.

• Service levels

  In the Operations and observability playbook. Availability promises need targets and measurements. Compare what the team tracks with what customers were told.