Technical due diligence checklist

Every rule in the technical due diligence playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. An Expert can check it for you.

Scope and conduct

• Required TDD-1 Never sign a review of code you have changed
• Required TDD-2 Work from read-only access and delete copies afterwards
• Recommended TDD-3 Tie every finding to a rule ID and evidence
• Recommended TDD-16 Rate every finding on a fixed severity scale

Code and ownership

• Required TDD-4 Build the product from the company's own repository
• Required TDD-5 Confirm the company owns the code
• Required TDD-7 Scan the whole history for secrets
• Recommended TDD-6 List the licences of the code and every dependency
• Recommended TDD-8 Find every part that depends on one person or one tool
• Recommended TDD-9 Ask the team to explain the critical paths without AI
• Recommended TDD-10 Check how the team reviews AI-written code
• Recommended TDD-17 Run the tests yourself and read 90 days of pipeline history

Security, data and law

• Required TDD-11 Test the access rules on the running product
• Recommended TDD-12 Check how personal data is handled
• Recommended TDD-13 Record the product's Cyber Resilience Act duties
• Recommended TDD-18 List every AI model the product depends on and its AI Act role
• Recommended TDD-19 Time how long it takes to leave each sub-processor

Operations and growth

• Recommended TDD-14 Measure cost per customer over the last 12 months
• Recommended TDD-15 List what must be rebuilt to grow
• Recommended TDD-20 Measure delivery with the DORA metrics over 90 days
• Recommended TDD-21 Read 12 months of incidents and measured availability
• Recommended TDD-22 Compare customer service levels with what the system delivers

Preparing to sell

• Recommended TDD-23 Run the buyer's checks on yourself before the review
• Recommended TDD-24 Keep a technical data room ready

Related playbooks

• Triage

  In the Codebase takeover playbook. After the deal closes, take over access, secrets and backups in a fixed order before any change.

• Using open source

  In the Open source maintenance playbook. Licence findings start from the dependency policy. See how a team should vet and track what it uses.

• AI Act

  In the Compliance and governance playbook. An AI feature can carry AI Act duties. Check which role the company has and what it must document.

• Service levels

  In the Operations and observability playbook. Availability promises need targets and measurements. Compare what the team tracks with what customers were told.

Show the badge on your project

When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.

<a href="https://agentwranglers.se/playbook/due-diligence/checklist"><img src="https://agentwranglers.se/badge.svg" alt="Checked against the Agent Wranglers technical due diligence playbook" width="214" height="20"></a>

[![Checked against the Agent Wranglers technical due diligence playbook](https://agentwranglers.se/badge.svg)](https://agentwranglers.se/playbook/due-diligence/checklist)