What Lawyers Actually Find in Startup Due Diligence And Why It Kills Deals
The term sheet is signed. The lawyers start looking. Here is what they find.
The pitch meeting went well. The founders impressed. Numbers held up under questioning. A term sheet arrived, and everyone shook hands. Then the lawyers started looking.
Thirty percent of deals fall apart during due diligence. Not during the pitch, not during valuation negotiations, but during the structured legal and financial review that follows the term sheet. For every ten founders who get to that stage, three watch the deal die on a problem they either did not know existed or assumed would not matter.
The problems that kill deals are rarely spectacular. They are not usually active fraud or concealed litigation. They are documentation gaps, structural decisions made in haste years earlier, IP chains that nobody traced all the way back, and regulatory exposure that seemed theoretical until a lawyer sat down to map it properly. A recent practitioner analysis found that 97% of companies report major challenges in transaction readiness. That figure is striking precisely because it covers companies that have attracted genuine investor interest. Getting to due diligence is hard. Failing it is surprisingly common.
This article sets out the specific legal problems lawyers find most often when they conduct investor-side due diligence on early and growth-stage companies. It is written for legal professionals advising founders, advising investors, or both. Understanding what consistently surfaces in these reviews is the starting point for conducting them well.
The Structure of a Legal Due Diligence Exercise
Before examining what lawyers find, it helps to understand how the process is organized.
A typical seed round requires a data room containing roughly 40 documents. A Series A or Series B round expands to 90 to 120, adding multiple years of audited financials, board minutes across the company's life, employment agreements for every current employee, and a more detailed review of customer and vendor contracts. The review covers six broad categories: corporate structure and governance, intellectual property, employment and contractor relationships, material contracts, litigation and regulatory exposure, and financial records.
Legal due diligence is typically the most extensive part of the process. The seed funding process, assuming clean documentation, takes four to eight weeks after the term sheet. A Series A runs six to twelve. Series B and later can run twelve to sixteen. The 45 to 60 day exclusivity window written into most term sheets assumes a clean data room. When the data room is not clean, founders learn about it in the worst possible way: watching the exclusivity period run out while their lawyers scramble.
The lawyers conducting this review are not trying to kill deals. They are trying to map every material risk before capital is deployed, so the investor can decide how to price that risk, whether through protective deal terms, adjusted valuation, or walking away.
Problem One: The Cap Table Is Messier Than the Pitch Deck Suggests
The capitalization table is the document that records who owns what in a company. In theory, it is a clean, updated record of every equity stake, option grant, convertible instrument, and shareholder agreement. In practice, early-stage companies consistently present with messy equity structures: unresolved founder disputes, improperly documented option grants, SAFEs or convertible notes with ambiguous conversion mechanics, or anti-dilution provisions that create unexpected downstream effects on the post-money capitalization.
Several specific problems appear regularly. The first is the informal commitment — an email to an early advisor promising two percent of the company, never formalized in a signed agreement. If a startup made equity commitments to early advisors without formal documentation, that must be resolved before due diligence. The second is dead equity: a co-founder who left the company in the first year but holds a significant block of shares because the founders' agreement had no vesting schedule with a cliff. Institutional investors will not inject capital if a large percentage of the cap table is held by someone who contributes nothing to the company's growth.
The third problem is conversion mechanics. Convertible notes and SAFEs written in a hurry at the seed stage often contain provisions that interact badly with the terms of a later priced round. The math looks fine in isolation. When a lawyer models it out under the actual terms of the proposed investment, the dilution to the founders is different from what they expected, and the investor's effective ownership is different from what was discussed.
None of these issues are unfixable. But they each take time to resolve, and time spent fixing cap table problems is time the exclusivity window is running.
Problem Two: The Company Does Not Actually Own Its Intellectual Property
This is the issue lawyers treat as the highest-stakes area of any technology-focused due diligence exercise.
The inquiry centres on confirming that the company, not the founders individually, not a prior employer, not a freelance developer working under a poorly drafted services agreement, actually owns its core intellectual property free and clear. The checklist covers properly executed invention assignment agreements with present-tense assignment language, and confirmation that no founder developed key IP while subject to a prior employer's proprietary information agreement.
One of the most common issues found during due diligence is that founders have not formally assigned pre-incorporation IP to the company. If the product was built before incorporation, or by founders in their personal capacity, an IP assignment agreement must be executed. This is a basic requirement that investors check across every deal without exception.
The freelancer problem is equally common and often overlooked. A startup hires a developer on a contract basis to build early features. No IP assignment clause exists in the contract. Under the default rules in most jurisdictions, work created by an independent contractor belongs to the contractor, not the company that paid for it. The company has been using and building on code it does not technically own.
For technology companies, there is an additional IP dimension in 2026 that has sharpened investor attention. Investors are increasingly wary of copyleft open-source licenses in a startup's codebase. A company that has incorporated code licensed under certain open-source terms may, depending on how that code was used, be required to release its own proprietary code publicly. That is an existential problem for a product whose value depends on proprietary technology, and it surfaces during IP due diligence.
Problem Three: Workers Are Classified the Wrong Way
Startups that fail to correctly classify full-time workers as employees rather than contractors expose themselves to back tax liabilities, penalties, and regulatory scrutiny. Investors do not want to acquire these liabilities as part of a funded company.
The problem is structural. Early-stage startups frequently keep headcount low by engaging people as contractors to avoid employment taxes, benefits obligations, and the administrative burden of formal employment. This works until a lawyer applies the relevant jurisdiction's classification tests to the actual working relationship, looking at things like exclusivity, control over how work is done, and whether the person has other clients.
Whether workers are properly classified under the applicable employment standards, and whether key executives or engineers are subject to non-compete or non-solicit obligations from prior employers that could create injunction risk, are standard questions in any legal diligence on the employment workstream. A startup that relied heavily on misclassified contractors will either need to restructure those relationships before closing, or the investor will negotiate indemnification for the resulting exposure.
Problem Four: Customer Concentration Risk Buried in the Contracts
The financial model shows strong revenue. Due diligence sometimes reveals that the revenue picture is significantly more fragile than it appears.
This kind of concentration risk belongs in the legal diligence, not just the financial model. A lawyer reviewing the actual contract will see the termination notice period, the auto-renewal provisions, any minimum purchase commitments, and whether there are clauses that allow the customer to exit if the company changes ownership. Change-of-control provisions in a top customer contract can allow that customer to walk away the moment new capital is invested. When that customer represents a significant portion of revenue, the economic basis of the investment changes materially.
Misrepresentations or incomplete disclosures during the due diligence process can escalate into significant legal challenges. Undisclosed contractual liabilities or pending litigation may derail negotiations, and in serious cases expose parties to reputational and financial risk. The lawyers conducting the review are specifically looking for the gap between what was presented in the pitch and what the documents actually say.
Problem Five: Regulatory Exposure That Has Not Materialized Yet
This category has grown substantially in scope over the past two years, and it is where lawyers are spending more time in 2026 than in earlier cycles.
The regulatory diligence inquiry asks not just whether the company is currently compliant, but what the company's compliance infrastructure will need to look like in 18 months as it scales into new jurisdictions or customer segments. This question is especially pointed for companies operating in fintech, health technology, and AI-adjacent businesses, where the regulatory environment is actively shifting.
For privacy-dependent businesses, the diligence now covers not just data processing agreements with vendors but whether the company's data practices could support or undermine a future regulatory interaction. A startup that has been collecting user data informally, without proper consent frameworks or data processing agreements, may have built a business on a foundation that requires significant restructuring before it can operate lawfully at scale in additional markets.
The most common manifestation of this problem is not active regulatory violation. It is the absence of compliance infrastructure: no privacy policy that reflects actual data practices, no records of consent, no vendor agreements that address data handling, no designated privacy officer for businesses that need one. These gaps are fixable. The time and legal cost of fixing them is a real variable in the transaction.
Problem Six: Corporate Records That Do Not Reflect Reality
This is the most basic category and among the most frequently encountered. A company's minute book and corporate records are meant to document every significant decision taken by the board and shareholders: the issuance of shares, the approval of option grants, the authorization of material contracts, the resolution of every financing round.
Investors want to see that the entity was properly formed and that corporate hygiene rules have been followed from the beginning. What they often find is that board minutes are incomplete, option grants were made without proper board approval, material contracts were signed without the relevant corporate authority being verified, and earlier financing rounds were documented inconsistently.
The reason this matters is not technical pedantry. Verbal commitments and informal equity arrangements are major red flags for investors, because they suggest a company that may have undocumented obligations it is not fully aware of. If a startup's records show a board resolution authorizing an option pool that does not match the cap table, the investor cannot be certain which one is accurate.
Problem Six: Corporate Records That Do Not Reflect Reality
This is the most basic category and among the most frequently encountered. A company's minute book and corporate records are meant to document every significant decision taken by the board and shareholders: the issuance of shares, the approval of option grants, the authorization of material contracts, the resolution of every financing round.
Investors want to see that the entity was properly formed and that corporate hygiene rules have been followed from the beginning. What they often find is that board minutes are incomplete, option grants were made without proper board approval, material contracts were signed without the relevant corporate authority being verified, and earlier financing rounds were documented inconsistently.
The reason this matters is not technical pedantry. Verbal commitments and informal equity arrangements are major red flags for investors, because they suggest a company that may have undocumented obligations it is not fully aware of. If a startup's records show a board resolution authorizing an option pool that does not match the cap table, the investor cannot be certain which one is accurate.
What This Means for the Lawyers Conducting the Review
Legal due diligence at this level requires synthesizing a large volume of documents, regulatory frameworks, and factual history across multiple workstreams simultaneously. The lawyer advising an investor on a growth-stage deal is not just reading contracts. They are researching how a particular regulatory framework applies to the company's business model, checking whether employment classification standards in the relevant jurisdiction support the company's current contractor arrangements, and understanding what the IP assignment law in the relevant jurisdiction says about pre-incorporation work.
That research burden is real, and it is one of the areas where the quality of the lawyer's supporting tools makes a material difference to the speed and reliability of the work. A lawyer who can research the regulatory exposure question across multiple relevant jurisdictions without switching between five separate databases, and who receives output that traces every finding to a verifiable primary source, moves through the diligence workstream faster and with greater confidence in the output.
Ovviously is built for precisely this kind of work. A legal research and drafting workspace designed for lawyers across multiple common law jurisdictions, it allows practitioners to interrogate jurisdiction-specific regulatory questions, trace findings to primary sources through inline citation, and draft structured findings in formats that translate into professional diligence reports. For lawyers managing investor-side due diligence across international transactions, or advising founders preparing for their first institutional round, Ovviously provides the research and drafting infrastructure that lets legal judgment do its work without the document-retrieval overhead that currently consumes a disproportionate share of every diligence timeline.
Preparing for Due Diligence: What the Best Founders Do Differently
The founders who move through due diligence fastest are not always those with the cleanest companies. They are the ones who found the problems first.
Startups that invest early in legal hygiene are consistently better positioned to close rounds quickly and on favorable terms. That means working with lawyers who understand venture transactions before the term sheet arrives, not after. It means IP assignment agreements executed at the time work is created, not retrospectively. It means a cap table that is reconciled against physical stock records on a regular basis. It means employment agreements and contractor agreements that have been reviewed against applicable classification standards.
The data room itself is a signal. Founders who pre-populate a clean, organized data room before signing a term sheet move significantly faster through the diligence phase than those who begin assembling documents after execution. A data room that is logically organized, consistently named, and complete is not just convenient for the reviewing lawyers. It tells the investor something about how the founders run the company.
Frequently Asked Questions
What are the most common legal issues found in startup due diligence? The issues that surface most consistently are: cap table irregularities including undocumented equity commitments and dead equity from departed founders; intellectual property gaps where the company does not hold clear title to its core technology; worker misclassification where contractors should be employees; customer concentration risk buried in contract terms; regulatory exposure in areas such as data privacy and financial services; and incomplete corporate records that do not match the actual history of decisions taken. Any one of these can result in deal terms being renegotiated, valuation being adjusted, or the deal being withdrawn.
Why does intellectual property due diligence matter so much in early-stage deals? For early and growth-stage companies, the primary asset being acquired is often intangible: the codebase, the brand, the data, the proprietary methodology. If the company does not hold clear title to those assets because founders built key technology before incorporation, or contractors were engaged without IP assignment agreements, the investor is not acquiring what the pitch deck describes. IP gaps discovered after closing are among the most difficult problems to fix because the practical ability to compel assignments disappears once the parties know capital has been deployed.
How long does legal due diligence take for a startup funding round? Timelines depend heavily on how organized the company's documentation is before the process begins. A seed round with a clean data room typically takes four to eight weeks of legal diligence after the term sheet is signed. A Series A runs six to twelve weeks. Series B and later can run twelve to sixteen weeks. Disorganized records, IP gaps, or regulatory issues that require resolution can extend any of these timelines significantly.
What is a cap table and why does it matter in due diligence? The cap table is the record of every equity interest in the company: founder shares, option grants, convertible notes, SAFEs, and shareholder agreements. Investors review it to confirm who will own what after the investment closes, whether there are any undocumented equity commitments, and whether the conversion mechanics of any outstanding instruments create unexpected dilution. A cap table that does not accurately reflect the company's equity history is a red flag that raises questions about what else may be undocumented.
What do lawyers mean by customer concentration risk in startup due diligence? Customer concentration risk refers to the situation where a significant portion of a startup's revenue is generated by a small number of customers, particularly where those customers have contractual rights to exit with short notice. During legal diligence, lawyers review the actual contract terms to assess how much of the company's revenue is genuinely committed versus terminable at will. If a single customer represents a large share of revenue and can exit on 60 days' notice, or if a change-of-control provision in that contract allows the customer to walk away when new investment closes, that is a material risk that affects how the deal is structured.
What is the role of a lawyer in startup investor due diligence? Investor-side counsel conducts a structured legal review of the target company across corporate governance, intellectual property, employment, material contracts, litigation, and regulatory compliance. They identify gaps and risks, advise the investor on how to price or protect against those risks through deal terms, and prepare findings in a format that supports the investor's final decision. Founder-side counsel helps the startup prepare its data room, identifies gaps before the investor's lawyers find them, and negotiates the representations, warranties, and indemnities that allocate discovered risks between the parties.
This article is intended for informational purposes only and does not constitute legal advice. Legal professionals should apply their own judgment to any matters discussed, having regard to the professional standards and applicable law in their jurisdiction.
