IP due diligence in 2026: is the IP actually theirs to sell?

IP due diligence is the verification that a target actually owns, and can lawfully transfer, the intellectual property the deal is paying for. It covers patents, trademarks, copyright, trade secrets and licences, and it answers one question above all others: if the buyer wires the money, does the IP move with it?

Quick recap

• Under 35 U.S.C. § 261, a patent assignment is void against a later good-faith purchaser unless recorded at the USPTO within three months of execution.
• The most common chain-of-title break is contractor-created work with no written assignment, because in most jurisdictions the contractor keeps copyright even though the company paid.
• Freedom to operate and patentability differ: a granted patent confirms an invention was novel, not that the product can ship without infringing someone else.
• Copyleft licences such as GPL and AGPL can require source disclosure for the shipped product, so reviewers ask for a software bill of materials in SPDX or CycloneDX format.
• US Copyright Office guidance issued in March 2023 requires applicants to disclose more than a de minimis amount of AI-generated material, and purely machine-generated output is not registrable.
• A petition for inter partes review at the PTAB must be filed within one year of an infringement complaint being served, under 35 U.S.C. § 315(b).
• Trademark protection is territorial, so a brand sold in 14 countries and registered in 6 has eight markets where a squatter can file first.
• A focused IP review runs 2 to 4 weeks, a multi-jurisdiction portfolio takes 6 to 8 weeks, and a mid-market IP audit typically costs $15,000 to $50,000.
• A data room for IP due diligence keeps prosecution files and trade-secret documentation on different permissions from the financial pack, since the two sets have different audiences.
• Papermark hosts a data room for IP due diligence with granular file-level permissions, dynamic watermarking and per-visitor analytics from €99/month.

Buyers treat IP as a schedule to the purchase agreement rather than a workstream. That works until the week before signing, when someone notices that the three inventors on the core patent family left in 2021, two never signed anything, and the assignment that was executed was never recorded.

Running it means putting prosecution files, contractor agreements, trade-secret evidence and licence economics in front of five reviewers who should not all see the same folders. A data room for IP due diligence solves that with one scoped link per party.

Start 7-day data room trial

1. What is IP due diligence?

IP due diligence is a legal and technical review of the intangible assets a target claims to own: patents and pending applications, registered and unregistered trademarks, copyright in software and content, trade secrets, domains and handles, registered designs, and the licences that let it use other people's IP or let others use its own. It is commissioned by an acquirer, an investor or a licensing counterparty after a letter of intent, and delivered as a report saying what is owned, what is encumbered and what is at risk.

The work splits into three questions that get confused constantly. Ownership asks whether title runs cleanly from the person who created the asset to the entity being bought. Validity asks whether the registered right would survive a challenge. Freedom to operate asks whether the product infringes somebody else's rights. A company can own a portfolio of valid patents and still be unable to sell its product.

The workstream matters most where the IP is the business. In software, biotech and consumer brands the intangibles carry most of the enterprise value, so an ownership defect is a hole in the model rather than a schedule footnote.

It also differs from the adjacent workstreams. Technical due diligence assesses whether the product works and whether the engineering team can maintain it. Legal due diligence covers corporate records, material contracts and litigation. IP diligence sits between them and is run by specialist IP counsel with a patent agent alongside.

2. The 7 IP asset classes and what each one has to prove

Each asset class has its own proof standard, its own evidence, and its own way of going wrong. Grouping the review by asset class rather than by document makes findings comparable, because a lapsed annuity and an unregistered trademark are both ownership failures.

Patents are the most document-heavy class. The reviewer wants the docketing report showing every family, every member, the jurisdiction, the status, the next annuity date and any terminal disclaimer, since a terminal disclaimer ties a patent's life to a parent and can shorten the runway the model assumed. Trademarks are where territory does the damage: registration is national or regional, so the question is whether the mark is registered in every market the product is sold in.

Copyright and trade secrets are where the paperwork thins out. Software copyright is unregistered in most of the world and depends entirely on written assignments from every contributor. Trade secrets are protectable only if the company treated them as secret, which under the Defend Trade Secrets Act and the EU Trade Secrets Directive means reasonable measures: marking, access restriction, NDAs and an offboarding process that recovers material.

What each asset class asks the seller to produce

The evidence column above is also the folder structure. Sellers who build the room around those seven headings before the first request arrives save two weeks. Volume varies enormously: a seed-stage software company might produce 40 IP documents, while a biotech with a 19-family portfolio across 11 jurisdictions produces several hundred.

Two folders behave differently and should be set up that way from day one. Patent prosecution files contain attorney opinions, prior-art analysis and invalidity assessments that are commercially damaging in the wrong hands and sometimes privileged. Trade-secret documentation is worse, because the evidence that a secret is protected describes the secret. Neither belongs on the same permission set as the financial pack.

3. Chain of title: the problem that breaks the most deals

Chain of title is the documented line of ownership from the human being who created an asset to the legal entity being acquired. It has to be unbroken and it has to be written. Inventors and authors own what they create unless something transfers it, and the assumption that employment or payment does that by itself is wrong often enough to be the most reliable source of findings in the review.

Five failure patterns account for most of it. Unassigned inventions, where an inventor named on a filing never signed. Contractor-created work, where an agency built part of the shipped product under a contract silent on IP, leaving copyright with the contractor. Employee IP clauses that fail under local law, in jurisdictions with statutory inventor compensation regimes where a blanket present assignment is unenforceable. University or grant-funded IP, where a sponsored research agreement, a Bayh-Dole march-in right or a reach-through royalty sits behind an invention the target lists as its own. And founder inventions conceived before incorporation.

Then there is the recording problem, which gets conflated with the assignment problem. An assignment can be validly executed and still leave the buyer exposed, because under 35 U.S.C. § 261 an unrecorded assignment is void against a subsequent purchaser for value without notice unless recorded within three months of its date. The EPO keeps its own register, and a title search returning the wrong assignee is a finding regardless of what the internal file says.

Prosecution files and title searches go to IP counsel and the patent agent, not to the lender or the commercial deal team.

Chain-of-title work also generates documents rather than only consuming them. Confirmatory assignments get drafted, signed and recorded while the review is still running, and each has to reach the right reviewers and be version-controlled against the draft it replaced. This is where email-based diligence falls apart fastest.

4. Encumbrances, freedom to operate, and the dispute record

Owning an asset and being free to exploit it are separate things, and the gap is where most commercial damage lives. Encumbrance review asks who else already has rights in the IP the buyer thinks it is acquiring: security interests granted to lenders, exclusive licences that carve out a field of use or a territory, most-favoured-nation clauses that reprice an outbound licence when a better deal is offered elsewhere, and change-of-control provisions letting a counterparty terminate on the transaction.

Outbound licences cap the upside. An exclusive licence granted to a regional distributor, or a field-of-use carve-out conceded to settle a dispute, permanently removes revenue the buyer may have modelled. Inbound licences create dependency: if a core component is licensed in rather than owned, the review has to establish the term, the assignability, the royalty basis, and whether the licence survives a change of control at all.

Freedom to operate is the analysis buyers most often skip and most often confuse with patentability. Patentability asks whether an invention was novel and non-obvious enough to be granted. Freedom to operate asks whether making, using or selling the product infringes a live third-party claim where it is sold. The two are independent: a company can hold a granted patent on its improvement and still infringe a broader patent covering the underlying method.

The dispute record closes the section. Reviewers want the history of litigation, oppositions filed at the EUIPO or EPO, inter partes review petitions at the PTAB, and cease-and-desist correspondence both sent and received. A letter received three years ago and never answered is a live risk, and under 35 U.S.C. § 315(b) a target served with an infringement complaint more than a year ago has already lost the option of challenging that patent by IPR.

5. Open source and AI-generated content in the shipped product

Open-source compliance is the most quantifiable finding in software IP diligence, because the answer is either a notices file that takes a week to produce or an architectural change that takes a quarter. The review starts with a software bill of materials, generated by a scanning tool in SPDX or CycloneDX format, listing every third-party component in the shipped artefact with its declared licence. A hand-maintained list is not acceptable evidence, because the components that cause problems are transitive.

Obligations sort by licence family. Permissive licences such as MIT, BSD and Apache 2.0 mostly require attribution and notice preservation, which is administrative work rather than business risk. Copyleft licences change deal terms. GPL can require the source of a derived work to be made available to anyone receiving the binary, and AGPL extends that trigger to users reaching the software over a network, which is how SaaS is delivered. A single AGPL component in a proprietary backend is a genuine finding.

AI-generated material is the newer version of the same question and now appears in almost every software and content review. US Copyright Office guidance published in March 2023 confirmed that human authorship is required for registration, that applicants must disclose more than a de minimis amount of AI-generated material, and that only the human contribution is protectable. A district court affirmed the position in August 2023 in the Thaler litigation. For a buyer, that means code and content produced substantially by a model may sit outside copyright entirely.

There is a second exposure on the input side. If engineers used an AI coding assistant trained on copyleft repositories, or a marketing team generated imagery from a model whose training data is in litigation, the target has ownership uncertainty it may not have documented. Reviewers now ask which assistants were used and whether the vendor offers an IP indemnity.

Component inventories and contributor logs are competitively sensitive, so they are shared view-only with a dynamic watermark carrying the reviewer identity.

6. Worked scenario: acquiring Nordvik Optics

A listed industrial group agrees to acquire Nordvik Optics, a €38M revenue machine-vision sensor maker with 210 employees across Norway and Poland. The thesis is the patent estate: 64 patent assets across 19 families in 11 jurisdictions, covering the sensor calibration method that lets Nordvik price at a premium.

The title search is where the deal changes shape. Of the 64 assets, 41 have assignments executed and recorded at the USPTO and EPO. Fifteen were signed but never recorded, several well outside the three-month window in 35 U.S.C. § 261. Eight have no written assignment at all: five trace to a contract engineering firm Nordvik used between 2019 and 2021, and three name a co-inventor from a Norwegian university whose sponsored research agreement includes a reach-through royalty nobody had read.

64patent assets

• Assignment executed and recorded41 · 64%

  Title runs cleanly to Nordvik
• Executed but never recorded15 · 23%

  Recordal completed before signing
• No written assignment on file8 · 13%

  Contractor and university inventions

Worked scenario. The 8 assets with no written assignment are the ones that set the condition precedent, because Nordvik cannot convey what it cannot show it owns.

Two other findings land in the same fortnight. The brand is sold in 14 countries and registered in 6, and a distributor in one unregistered market has already filed a similar mark. The software bill of materials for the calibration firmware lists 412 components, three of them AGPL, in a module Nordvik ships on an appliance.

The outcome is not a walk. The buyer takes a €1.9M price reduction for the trademark refiling programme and the AGPL remediation, a specific indemnity capped at €4M for the university reach-through, and a condition precedent requiring 23 confirmatory assignments to be recorded before completion. Diligence runs through a room holding 380 IP documents across seven asset folders.

7. How findings convert into price, an indemnity, or a walk

An IP finding is only useful once it has a commercial handle attached, and there are four. A price adjustment works when the exposure is quantifiable today: a trademark refiling programme across eight countries has a number, and so does replacing three AGPL components. A specific indemnity works when the exposure is real but unquantified, the standard treatment for a reach-through royalty, an open cease-and-desist letter, or a title defect the seller cannot cure.

A condition precedent works when the problem is fixable and the buyer refuses to close until it is fixed. Confirmatory assignments are the classic case: the seller obtains and records them before completion, and the buyer's counsel re-runs the title search on the day. Sellers usually accept, because the alternative is a permanent price cut for something that costs a few thousand euros in filing fees.

A walk is rare, and happens for two reasons. The asset the deal is built on turns out to be owned by somebody else, most often a university or a former joint-venture partner. Or there is a live infringement exposure in the primary market with no design-around.

Leverage depends on timing. A finding raised in week two of a six-week review gets remediated at the seller's cost. The same finding raised the day before signing gets argued about. Our M&A due diligence checklist covers how the IP workstream sequences against the rest of the process.

8. Cost, timeline, and who does the work

IP due diligence is almost always run by specialist counsel rather than the generalist team handling the share purchase agreement, because reading a file wrapper, running a title search and assessing an FTO position are distinct disciplines. A typical engagement pairs IP counsel with a registered patent agent, plus a technical reviewer on the buyer side for the source code and the SBOM.

Timing follows portfolio complexity rather than deal size. A focused review of a single-product company with a handful of families takes 2 to 4 weeks. A multi-jurisdiction portfolio with extensive in-licensing runs 6 to 8 weeks, and a global estate with active litigation can take several months. The binding constraint is rarely reviewer capacity. It is how fast the seller can produce file wrappers, assignment records and contractor agreements.

Cost tracks the same curve. Corporate IP counsel in major US markets bills $500 to $1,200 an hour, and a standard mid-market IP audit lands between $15,000 and $50,000 depending on portfolio size and jurisdiction count. Freedom-to-operate opinions are quoted separately per market, and chain-of-title remediation is another line, since filing and recordal fees are charged per asset. Sellers who run the audit six months ahead of a process pay a fraction of what the same findings cost during exclusivity.

9. Common mistakes in IP due diligence

The most expensive mistake is checking the register instead of the chain. A docketing report showing 64 assets in the company name proves almost nothing, because the register reflects what was filed, not what was validly assigned. The check that matters is inventor and author lists reconciled against executed assignments, and those assignments reconciled against recorded title at each office.

The second is treating trade secrets as an asset class you can simply list. A trade secret exists only while it is treated as secret, so the evidence is procedural: access controls, marking, NDA coverage, and an offboarding process that recovers material from leavers.

The third is scoping open-source review to declared dependencies, when the components that cause problems are transitive and appear only in a generated SBOM against the shipped artefact.

The fourth is circulating prosecution files, invalidity assessments and trade-secret documentation over email to five reviewers with no access control. That material is competitively useful to anyone who receives it, it sometimes carries privilege a careless distribution waives, and the seller carries the exposure whether or not the deal completes. Our data room checklist covers how to structure this.

10. Data room for your IP due diligence

A data room for IP due diligence is not the same artifact as the one finance uses, and building it as though it were creates most of the friction. The financial pack holds numbers that are commercially sensitive but broadly understood by everyone in the deal. The IP folders hold prosecution strategy, prior-art analysis, invalidity opinions and trade-secret evidence, which are useful to a competitor and relevant to only two of the five reviewers.

That difference should change the folder structure, the permission model and what happens after closing: seven asset-class folders rather than a flat pile, a scoped link per reviewer rather than one shared password, download switched off on the two folders that would hurt most, and an immutable archive that proves what was disclosed.

Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

An IP due diligence data room with one folder per asset class, so permissions differ by folder rather than by individual document.

Why you need a data room for IP due diligence

Most IP reviews still run over email and a shared drive, and IP is the workstream where that habit is hardest to defend. There are four reasons a dedicated data room for IP due diligence earns its place. If you are choosing a platform, our comparison of the best virtual data rooms covers pricing, bidder management and compliance across the main providers.

Prosecution files and trade-secret evidence cannot share permissions with the financial pack. A file wrapper contains the arguments the company made to get a claim allowed, which is a roadmap for anyone later trying to invalidate it. Trade-secret documentation is worse, because the evidence that a secret is protected describes the secret. Those folders need to be view-only, watermarked and scoped to the reviewers whose engagement covers them.

Five reviewers need five different slices of the same room. IP diligence is unusually asymmetric. IP counsel needs everything. The patent agent needs prosecution files and title searches, and nothing commercial. The technical reviewer needs the SBOM and contributor logs but no licence economics. The lender needs encumbrances alone. A data room for IP due diligence sets that per link over one document set.

Chain-of-title remediation happens while the review is running. Confirmatory assignments get drafted, signed and recorded during diligence, so the document set is moving rather than static. Every signature has to reach the right reviewers, supersede the draft it replaced and stay traceable, which is what email threads handle worst.

The disclosure record decides the indemnity claim years later. IP indemnities have long tails. When a reach-through royalty claim surfaces two or three years after closing, the argument is about what was disclosed, to whom and on what date. A room with a per-visitor audit log and an immutable archive answers that in an afternoon.

Step 1: build the room by asset class, not by document

Create one folder per asset class from the table in section 2: patents, trademarks, software copyright, content copyright, trade secrets, domains and designs, and licences. Add an eighth for disputes and correspondence, since litigation, oppositions and cease-and-desist letters cut across every class. That structure is what makes differentiated access possible later, because permissions attach to folders, and a flat pile of 380 files leaves you giving everyone everything.

Upload in bulk by dragging the folder tree straight in. Automatic file indexing on the Data Rooms Plus plan maintains the index as documents arrive, which matters because IP request lists grow in waves.

Step 2: give each reviewer their own scoped link

This is where an IP room differs most from a financial one, and it is worth setting up before anyone gets access.

Granular file-level permissions are set per link rather than per user account, so each party gets its own link carrying its folder scope, email allowlist or domain restriction, and download rule. Access is link-based, so no reviewer creates an account, which removes the friction that makes busy outside counsel ask for everything by email.

Permissions are set per link, so the patent agent and the lender open the same room and see entirely different folders.

Step 3: lock the two folders that would hurt most

Switch the prosecution files and the trade-secret folders to view-only and turn on dynamic watermarking, which renders the viewer email, IP address and timestamp onto every page as it is displayed. Screenshot protection adds a further deterrent on the invalidity assessments and the trade-secret evidence specifically.

The honest limit is worth stating. A downloaded file is legally treated as read and no platform can recall it, which is why download is switched off rather than merely discouraged on those two folders. Watermarking makes a leak attributable to a named viewer rather than preventing it.

Step 4: run confirmatory assignments and request waves through Q&A

IP requests arrive in waves and generate documents as they go. The reviewer reads the docketing report, asks for eleven file wrappers, spots two families with no recorded assignment, and asks for confirmatory assignments that do not exist yet. Over email that thread fragments across four people and nobody can say which of forty open items is outstanding.

The Q&A module attaches each question to the document that prompted it, with permissions controlling who sees which threads, so the lender never sees the patent agent's questions. Request files from visitors collects executed assignments and consent letters straight into the right folder.

Step 5: read the analytics, then close the room properly

Page-level analytics show which reviewer opened which document, when and for how long. In IP diligence this is an early warning: a patent agent who has spent fifty minutes inside one file wrapper has found something, and you will hear about it before the report lands.

Per-visitor analytics show which asset folders each reviewer opened and how long they spent inside each document.

After completion, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate. When an IP indemnity claim surfaces years later, that archive is the record of what was disclosed and to whom.

What it costs

The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Premium at €549/month adds 10 team members, AI redaction, the public API, SSO and white-labelling. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. For an auction where the same IP pack goes to several bidders, unlimited data rooms means one room per bidder with no per-project fee.

Start 7-day data room trial

No credit card required.

FAQ

Related resources

• Best virtual data rooms in 2026
• Technical due diligence
• IT due diligence
• Legal due diligence checklist
• Virtual data room for biotech
• M&A due diligence checklist