Key takeaways
- Scope: architecture, code quality, security, IP and licences, team and process, infrastructure and cost, plus AI-code provenance.
- Every finding should carry a severity and a remediation estimate your deal team can turn into a price adjustment, an indemnity or a 100-day-plan item.
- Architectural and legal findings change the price; local defects belong in the 100-day plan.
- AI-written code adds four questions: who wrote what, can the seller show it owns it, can anyone staying explain it, and can the quality signals be trusted.
- Published durations run from two to five weeks, depending on scope and deal size.
What does technical due diligence of a software company cover?
Technical due diligence (TDD) is the pre-transaction assessment of a software asset. KPMG describes it as assessing “technology platforms, products, and applications across software architecture, technology stack, deployment models, cybersecurity, and development practices”, with outputs that feed the price bridge, remediation investment and purchase-agreement terms (KPMG Denmark). Deloitte’s software diligence adds quantified technical debt, R&D team efficiency against best practice, patents and IP, open-source use, hosting and cloud, and source-code analysis for robustness, modularity and licence risk (Deloitte Germany).
| Area | Question it answers |
|---|---|
| Architecture and scalability | Can the product grow, change and be integrated without a rewrite? |
| Code quality and technical debt | What will it cost to maintain and extend, in people and months? |
| Security | What is the exposure today, and is it local or architectural? |
| IP and open-source licensing | Does the seller own what it is selling, and can it be sold on? |
| Team, process and roadmap | Who can change the code, how do releases work, is the backlog credible? |
| Infrastructure and running cost | What does it cost to run, and does cost scale with revenue? |
| Data, privacy and regulatory | Is personal data mapped, and are new obligations covered? |
| AI assets and AI-written code | What did AI write, which models does the product depend on, and is that documented? |
On regulation, the EU Cyber Resilience Act entered into force on 10 December 2024; its reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027 (European Commission). For a buyer of software sold in the EU, that is a diligence item, not a footnote.
How long does technical due diligence take, and what does it cost?
Deloitte states the average duration of a software due diligence is three to five weeks (Deloitte Germany; vendor claim). A specialist provider aimed at smaller deals publishes fixed fees of US$5,000 to 30,000 and two to four weeks (MEV, July 2026). A data-room provider’s compiled ranges put Big Four technical diligence at US$50,000 to 150,000 a project and specialist firms at US$35,000 to 95,000, with a worked example of US$22,000 for the code, architecture and security review of a US$12 million SaaS deal, under 0.2% of the price (Papermark, 2026; industry estimates, not quotes). No authoritative source publishes mid- or large-cap fee benchmarks, so treat every cost figure as vendor-supplied.
Why the stakes are rising: PitchBook’s Q2 2026 US PE Breakdown shows software private-equity deal value of US$10.7 billion, down 65.7% year on year and 90.3% below its Q3 2025 peak. Fewer deals mean each one carries more scrutiny.
What changes when AI wrote the code?
Classic code diligence assumes code written at human speed by people who can explain it. Neither holds any more. AI now writes 42% of committed code by developers’ own estimate, which they expect to reach 65% by 2027, and only 48% always verify it before committing (Sonar, 2026). The audit therefore adds four questions to the traditional list: who or what wrote each part, whether the seller can show it owns it, whether anyone staying after closing can explain and change it, and whether quality signals can be trusted when the tests may have been generated too.
- 68% of 947 commercial codebases had open-source licence conflicts, up from 56% (Black Duck OSSRA, 2026).
- 56% security pass rate for AI-generated code, virtually unchanged (Veracode, July 2026).
- 28.65 million new hard-coded secrets appeared in public GitHub commits in 2025; AI-assisted commits leak at about twice the baseline (GitGuardian, 2026).
- 3 to 4 times more code, but 10 times more security findings, in one Fortune 50 dataset (Apiiro via The Register, 2025).
Coverage has stopped meaning what it did. When an assistant writes the code and the tests, coverage measures what the tests execute, not what they check.
The 12-point checklist for an AI-built codebase
Each check is marked by where its red flag usually lands: in the price (price adjustment, specific indemnity or condition precedent) or in the 100-day plan.
| # | Check | Why it matters | Red flag | Lands in |
|---|---|---|---|---|
| 1 | AI-tool and authorship map | Sets the sample and weights risk by module. | Nobody knows which tools wrote what; personal AI accounts. | 100-day plan |
| 2 | Licence and provenance scan | Copyleft fragments change what you can sell. | Copyleft matches in the core product; no record of tool terms. | Price |
| 3 | Human contribution to core IP | Prompt-only output may not be protected by copyright; ask counsel. | Differentiating logic generated and never materially modified. | Price |
| 4 | Secrets in code and git history | Leaked keys outlive the leak. | Live keys in history; no rotation. | Price |
| 5 | Dependency hygiene | Models invent package names that attackers can register. | Unresolvable or brand-new packages from unknown maintainers; no lockfile. | 100-day plan |
| 6 | Security pass rate on a sample | About 44% of AI-generated code fails security tests when unprompted. | Authorisation enforced only in the client; injection flaws in core paths. | Price |
| 7 | Tests that assert behaviour | Coverage can be high while testing nothing. | Tests still pass when the code is deliberately broken; no CI gate. | 100-day plan |
| 8 | Churn and duplication | Rewrites and copies are future cost. | Rising duplication; five patterns for one job. | 100-day plan |
| 9 | Architecture and data model | Where AI-built systems most often cannot be extended. | Logic spread across user interface, API and database; schema shaped by the first prompt. | Price |
| 10 | Reproducible build and deploy | Proves someone else can run the asset. | The demo works; the team cannot run it locally. | 100-day plan |
| 11 | Ownership and bus factor | You are buying the ability to change the code. | Nobody staying after closing can explain a critical module. | Price |
| 12 | Operations and running cost | Unreviewed infrastructure and AI spend hit the margin. | Infrastructure changed without review; AI-API costs outgrowing users. | 100-day plan |
Who owns code nobody wrote?
In the United States the courts have answered the authorship question for now. The D.C. Circuit affirmed in 2025 that copyright requires a human author, and on 2 March 2026 the Supreme Court declined to review Thaler v. Perlmutter (Mayer Brown, 2026). The case concerned an image, not code, and how far it reaches into software is a question for counsel. The Copyright Office’s January 2025 report says “prompts essentially function as instructions that convey unprotectable ideas”. The consequence sits in the purchase agreement: a warranty that the seller owns all copyright in the software is harder to give, and to rely on, when parts of the product were generated with little human modification. Other jurisdictions differ. The diligence job is to give counsel the facts: which modules, which tools, which terms, and what a human changed. Nothing here is legal advice.
Sema proposed a “Generative AI Bill of Materials” recording which code came from which tool (Sema, 2024). Ask for the equivalent in the data room: a tool inventory, whether company or personal accounts were used, and the agent context files that steered the work.
Secrets, dependencies and the bus factor
Secrets. GitGuardian counted 28,649,024 new secrets in public GitHub commits in 2025 and found AI-assisted commits leaking at roughly twice the baseline rate (GitGuardian, 2026). Scan the full git history and test whether anything found still works.
Dependencies. A USENIX Security 2025 study of 16 code-generating models found commercial models recommending non-existent packages about 5% of the time and open-source models about 21%, across 205,474 unique invented names, and about 45% recurred when a prompt was repeated (Spracklen et al., 2025). A recurring name is an invitation: an attacker registers it and waits. The check is mechanical: resolve every dependency against its registry and flag anything new, obscure or single-maintainer.
Ownership. The bus factor is the number of people who would have to leave before a project stalls. In an AI-built codebase it can be zero before anyone leaves, because nobody ever held the module in their head. Test it directly: pick three critical modules, ask the engineers who will stay to explain them, then have them make and deploy a small change to each under observation.
Why the market has not repriced trust
Buyers have repriced software, but diligence budgets were set when codebases grew at human speed and their authors could explain them. The same fee now buys a thinner sample of a larger, less understood asset, and the difference is paid after closing. Three changes follow. Scope by risk, not hours, weighting the sample towards the modules the authorship map flags. Fix the fee, so findings are not a sales document for remediation. And require every finding to carry a remediation estimate your deal team can turn into a price adjustment, a specific indemnity or a 100-day-plan condition.
Where we fit
Our code assessment is technical due diligence of a software product in ten business days from access: six areas, debt costed in person-days, who the product depends on, and a fixed fee sized by the inventory. The code stays where its owner wants it. You can see what the read-out looks like in the sample read-out.
Sources
- KPMG Denmark, Technology M&A and technical due diligence (undated, accessed 12 October 2026). kpmg.com
- Deloitte Germany, Software Due Diligence (undated; duration is a vendor claim). deloitte.com
- MEV (2026) “Pre-LOI vs post-LOI technical due diligence”, updated 20 July 2026 (specialist vendor; small-deal fees). mev.com
- Papermark (2026) “Due diligence cost”, updated 19 August 2026 (industry estimates, not quotes). papermark.com
- PitchBook (2026) Q2 2026 US PE Breakdown, 6 July 2026. pitchbook.com (PDF)
- Sonar (2026) State of Code Developer Survey, 8 January 2026; more than 1,100 developers, vendor survey. sonarsource.com
- Black Duck (2026) Open Source Security and Risk Analysis 2026, press release 25 February 2026; 947 commercial codebases. blackduck.com
- Veracode (2026) 2026 GenAI Code Security Report, 28 July 2026. veracode.com
- GitGuardian (2026) State of Secrets Sprawl 2026 (vendor report; headline figures only). gitguardian.com
- The Register (2025) “AI code assistants: 4x velocity, 10x vulnerabilities” (Apiiro research), 5 September 2025. theregister.com
- Spracklen, J. et al. (2025) “We Have a Package for You!”, USENIX Security 2025. usenix.org
- Mayer Brown (2026) “Supreme Court Denies Review in AI Authorship Case”, March 2026. mayerbrown.com
- Sema (2024) “18 technical due diligence questions to assess GenAI code risk”, 9 January 2024. semasoftware.com
- European Commission, Cyber Resilience Act policy page (accessed 12 October 2026). digital-strategy.ec.europa.eu
Figures were checked against each publisher’s own page on 12 October 2026 unless marked as secondary. Vendor-commissioned and single-firm figures are labelled as such. This article is general information, not legal or investment advice.
technical due diligenceM&AAI-written code
