The legal due diligence process is a structured review of a company’s contracts, corporate records, intellectual property, disputes, and regulatory standing before a deal is completed. Buyers, investors, and lenders use it in M&A, capital raising, and private equity transactions to confirm what the target owns and what could be claimed against it.
In practice, M&A legal due diligence often begins after a letter of intent and continues through signing and, where relevant, completion.
In Global Legal Post’s coverage of BRG’s M&A Disputes Report 2026, 46% of more than 200 surveyed lawyers, private equity professionals, and corporate finance advisors cited it as the most frequently cited deal-term factor behind disputes in 2025, up nine percentage points from 2024.
This guide is for founders, corporate development professionals, and private equity associates who need to prepare documents and ask informed questions of outside counsel. The guide is general information, not legal advice.
What is legal due diligence?
It is the review that a buyer, investor, or lender conducts to confirm what a target company legally owns, what it has promised to others, and what claims it faces. Cornell Law School’s Legal Information Institute defines due diligence as the level of reasonable care expected to avoid liability, and notes that it commonly involves reviewing records before a business acquisition.
Legal review is one key part of due diligence in M&A. Financial diligence checks the numbers. Commercial due diligence tests the target’s market position. Operational due diligence tests whether the business can deliver what it promises. Legal diligence tests ownership and exposure: what the company legally holds, and which claims or obligations could follow it into the deal.
Deloitte’s legal advisers add that the review examines a target’s legal position before price and conditions are set, and that scope follows the buyer’s reasons for the deal. A buyer acquiring intellectual property, for example, places most weight on patents, trademarks, copyrights, and trade secrets.
Legal due diligence asks one question: does this company legally own what it claims to own, and is it free of undisclosed legal exposure?
Legal risk is hard to see early on because it rarely resides in a single document. It tends to appear in several places:
- Litigation that is threatened in correspondence but not yet filed.
- Informal agreements, such as side arrangements in emails, that were never put into a contract.
- Intellectual property created by contractors without a written assignment.
- Change-of-control clauses inside customer, supplier, and lender contracts.
- Approvals that a deal needs before it can be completed, such as regulatory clearances.
As a result, a company can pass a financial review and still have ownership gaps or contract limitations surface after signing.
Who performs it, and when does it happen?
Outside law firms usually lead, supported by in-house counsel and specialists in intellectual property, employment, and regulation. These firms provide legal due diligence services under an agreed scope that sets the deadline, budget, and reporting format. Thomson Reuters notes that a private deal team usually includes legal, business, accounting, and tax specialists, with one point person coordinating requests.
How to use the checklist
A checklist works best as a request list and a tracking tool. Management teams describe their position in presentations, whereas documents show what happened. Those documents also contain sensitive information, so access needs to be controlled. Typical examples include:
- Litigation history and threatened claims.
- Ownership of intellectual property and licenses.
- Employment disputes and executive terms.
- Regulatory correspondence and notices.
- Contract terms, pricing, and customer names.
For this reason, sellers share legal material through a structured due diligence data room, where permissions, redaction, and activity records are controlled. Thomson Reuters notes that private sellers may ask to redact sensitive information, and that in US practice a buyer sharing its report with a third party, such as a financing bank, cannot assume privilege is preserved.
Legal due diligence checklist: documents to request
The tables below group the core documents by risk area. Counsel often converts them into a due diligence legal request list that the seller answers item by item. They use Australian terms; other jurisdictions have local equivalents, such as bylaws in place of a company’s constitution.
Use each table as a working tool:
- Start with core documents to form a baseline view of ownership and obligations.
- Flag inconsistencies, gaps, and outdated materials.
- Use follow-up questions to test whether an issue is isolated or systemic.
- Prioritize issues that affect price, structure, or the timing of completion.
Corporate and governance documents
Each legal due diligence M&A review should begin with corporate records, because they show who owns the company and who can approve the deal.
| Document | What it reveals | Legal risk signals | Follow-up questions |
|---|---|---|---|
| Constitution (or bylaws or operating agreement) and ASIC extract | Who governs the company and what limits apply to share transfers | Transfer restrictions or pre-emptive rights missing from the deal planRegistered details that differ from company records | Does any shareholder hold consent or pre-emptive rights over this sale? |
| Board and shareholder resolutions and minutes (3 to 5 years) | Major decisions, approvals, and related-party dealings | Gaps in minutesDecisions taken without a required approval | Which decisions needed shareholder approval, and where is the evidence? |
| Cap table, share register, and option agreements | Who owns the equity and what could dilute it | Register and cap table do not matchEquity promised without documents | Has anyone been promised equity outside the register? |
| Group structure chart and subsidiary records | Which entity holds the contracts, licenses, and assets | Assets held in the wrong entityDormant subsidiaries with unknown liabilities | Which entity signed each material contract? |
Material contracts
Contracts show what the company has promised and what a counterparty can do when ownership changes.
| Document | What it reveals | Legal risk signals | Follow-up questions |
|---|---|---|---|
| Top customer and supplier agreements | Revenue dependence, term, and termination rights | Termination for convenience on short noticeLargest contract ends within 12 months | How much revenue sits under contracts either party can end on 30 days’ notice? |
| Change-of-control and assignment clauses | Whether a sale lets a counterparty consent, terminate, or reprice | Consent rights in several top contractsPayment or termination triggered by an ownership change | Which contracts need consent before completion, and has anyone approached those counterparties? |
| Exclusivity, non-compete, and most-favored-customer terms | Limits on future operations and pricing | Restrictions that could bind the buyer’s wider groupNo end date or unlimited geography | Would these restrictions apply to our group after completion? |
| Debt, financing, and security documents | Debt, guarantees, and security over assets | Security over all assetsDefault events triggered by a sale | Which lenders must consent or be repaid, and do PPSR registrations match the disclosed facilities? |
Litigation and disputes
Dispute records show current exposure and how the company behaves when claims arise.
| Document | What it reveals | Legal risk signals | Follow-up questions |
|---|---|---|---|
| Register of active and threatened claims | Current legal exposure and its likely size | Threats in correspondence but absent from disclosuresNo estimate of claim value | Has anyone threatened proceedings in the past three years? |
| Settled matters and settlement agreements | Patterns of dispute and continuing obligations | Repeated disputes on one issueOngoing payment or confidentiality duties | Do any settlements impose obligations after completion? |
| Regulator notices, investigations, and correspondence | How regulators view the company and what remains open | Open inquiries or infringement noticesUndertakings given to a regulator | Which regulators contacted the company in the past five years, and why? |
| Court, insolvency, and PPSR searches | Judgments, security interests, and unpaid debts | Unsatisfied judgmentsRegistrations that do not match disclosed debt | Which registrations are current, and what do they secure? |
Intellectual property and regulatory compliance
These records show whether the company owns its core assets and is authorized to operate.
| Document | What it reveals | Legal risk signals | Follow-up questions |
|---|---|---|---|
| Registered IP: patents, trade marks, designs, and domain names | What is registered and in whose name | Registered owner is not the target entityLapsed renewals | Is every registration held by the target, and which renewals fall due within 12 months? |
| IP assignment and contractor agreements | Whether the company owns work created by staff, founders, and contractors | No written assignment from contractors or foundersOpen-source licences with restrictive terms | Who created the core product, and where is the signed assignment? |
| Licenses in and out | Dependence on third-party technology and rights granted to others | Essential license cannot transfer on a saleBroad perpetual licenses granted to customers | Which licenses are essential, and can they transfer? |
| Industry licenses, permits, and privacy compliance records | Whether the company is authorized to operate and how it handles personal information | License needs regulator approval to transferNo data breach register | Has the company assessed or notified any breach under the Notifiable Data Breaches scheme? |
Employment and labor
Employment records show the cost of keeping key people and the risk of workplace claims.
| Document | What it reveals | Legal risk signals | Follow-up questions |
|---|---|---|---|
| Senior executive and key employee agreements | Notice periods and payments triggered by a sale | Large payments triggered by a change of controlInformal promises of bonuses or equity | What would the company owe if key executives leave after completion? |
| Restraint of trade and confidentiality terms | Whether the company protects customers, staff, and know-how | No restraints for key sales or technical staffMissing confidentiality terms | Which key staff have restraints, and when did counsel last review them? |
| Equity, option, and employee share plan documents | Who holds or expects equity and how vesting changes on a sale | Vesting accelerates on a saleGrants promised but not documented | How many unvested grants accelerate at completion? |
| Worker classification and wage compliance records | Whether people are engaged and paid correctly | Long-term contractors who work like employeesNotices from the Fair Work Ombudsman | Which workers are engaged as contractors, and why? |
Legal due diligence example: acquiring a software company
This scenario is illustrative, not a real transaction. A private equity associate in Sydney reviews a Melbourne software company, and the data room produces four findings.
- Two contractors wrote the core product, and no written IP assignment is in the data room. Counsel requests signed assignments before signing.
- The largest customer, about a third of revenue, can terminate on 60 days’ notice if ownership changes. The team asks the seller to seek the customer’s consent before completion.
- A PPSR search shows a lender’s registration that is missing from the disclosure schedule. The team asks which facility it secures and whether it will be repaid at completion.
- Counsel checks the ACCC notification thresholds and, if they are met, adds clearance time to the timetable.
None of these findings ends the deal. Instead, each changes the plan: a condition to completion, a price adjustment, or a specific warranty.
Common legal red flags found in diligence
Every deal differs, yet the same patterns recur. In Axial’s analysis of deals on its platform that fell apart in 2025, non-QoE diligence findings accounted for 25.3% of Axial-sourced executed LOIs that failed to close, the most common single reason. These findings included undisclosed legal or compliance risks, customer concentration, and contract issues. Four legal patterns deserve early attention:
- Litigation that surfaces late. Threatened or settled claims appear in correspondence or insurer notices instead of the disclosure schedule. Late discovery can force repricing, an indemnity request, or a delay.
- IP ownership that does not trace cleanly. Deloitte notes that diligence must concentrate on patents, trademarks, copyrights, and trade secrets when intellectual property drives the deal. Gaps appear when founders or contractors created assets without written assignments.
- Contracts that trigger on change of control. Thomson Reuters explains that a change-of-control clause grants a party rights such as consent, payment, or termination in connection with a merger or acquisition. Counsel checks whether the planned deal triggers each clause.
- Compliance and approval gaps treated as one-offs. From 1 January 2026, Australian acquisitions that meet the applicable notification thresholds generally must be notified to the ACCC before they are put into effect.
Allens’ July 2025 summary lists combined Australian revenue of at least $200 million, with target revenue of at least $50 million, as one of the monetary notification thresholds. Allens also reports that certain clearances may lapse after 16 September 2026 unless extended. Counsel confirms current thresholds for each deal.
How a data room supports legal review
A data room supports legal review by controlling who can access privileged and sensitive documents, recording which documents each reviewer opens, and maintaining a single, current version of every file. These controls matter because legal review involves outside counsel, several bidders, and documents a seller may need to redact. Relevant features include:
- Granular permissions. Access can be limited by reviewer, workstream, and bidder, for example by restricting employee data to counsel.
- Redaction tools. Personal information and commercially sensitive terms can be removed before access is granted. Deloitte notes that when the buyer competes with the seller, a clean team can review restricted data.
- Structured Q&A. Questions link to specific documents, so counsel can find each answer in one place.
- Audit trails. Logs show who opened which files and when, which helps confirm what was reviewed before signing.
- Version control. Reviewers read the latest contract or disclosure schedule, not an outdated draft.
Some teams add legal due diligence software to the data room. Thomson Reuters describes properly trained AI tools that identify documents by date, language, or type and extract relevant clauses. It also warns that general-purpose AI tools can produce unreliable results in complex legal searches. To compare providers, start with these data room reviews.
How to evaluate data rooms for legal review
Not every data room suits legal work. Some handle financial files well but offer limited redaction. Focus on these questions:
- Can documents be redacted before outside access is granted?
- Can permissions be scoped by workstream, such as legal, financial, and operational reviewers?
- Is there a structured, auditable Q&A for counsel?
- Can privileged materials be flagged or restricted separately?
- Can the room export a document index and a Q&A log for the final report?
What a strong answer looks like. A strong provider response is a live demonstration on a sample legal folder. The provider redacts a document, restricts it to one reviewer group, and then shows the matching audit log entry.
FAQ
What are red flags in due diligence?
Red flags in due diligence are findings that change the price, structure, or timing of a deal, or end it. In legal reviews, common issues include undisclosed litigation, unclear ownership of intellectual property, contracts that trigger upon a change of control, and missing regulatory approvals. A red flag does not always end a deal, because buyers often address it through price, conditions, or warranties.
Who typically performs due diligence?
Deal teams perform due diligence with specialist advisers. Lawyers lead the legal workstream, accountants and financial advisers lead financial and tax review, and consultants or internal teams cover commercial and operational questions. A coordinator tracks requests, and the buyer’s deal lead decides how findings affect the transaction.
What are examples of due diligence?
Common examples include financial due diligence (reviewing financial statements), commercial due diligence (assessing market position), operational due diligence (assessing delivery capability), and legal due diligence (assessing ownership and exposure). Tax, technology and cyber, and environmental reviews are also common. Each asks a different question of the target.
What should be included in a due diligence checklist?
A due diligence checklist should cover each workstream: corporate records, financial statements and tax filings, material contracts, litigation, intellectual property, employment, regulatory compliance, technology and data security, and operations. Each item needs an owner, a due date, and a status, so the team can see what remains outstanding before signing.
What are the key components of a legal due diligence checklist?
A legal checklist has five core components: corporate and governance documents, material contracts, litigation and disputes, intellectual property and regulatory compliance, and employment and labor records. Each component lists the documents to request, the potential risks they reveal, and follow-up questions for the seller.
Key takeaways: legal review done right
- Legal review checks whether the target legally owns what it claims to own, and whether undisclosed claims, contract terms, or approvals could affect the deal. Because those facts are in different documents, a risk-based checklist gives the team a consistent way to request, compare, and prioritize them.
- Findings should change the deal, not only describe it: they feed price, conditions, warranties, and the timetable. Because gaps in diligence are a leading source of later disputes in the BRG survey, each finding needs an owner and a documented outcome.
- Teams choosing a data room for the next transaction can start with independent provider comparisons and test each shortlisted platform against the evaluation questions above.