The transaction has closed. The management presentation looked great, the numbers added up, and the market was growing. Three months later, you discover that the code belongs to the former CTO, the key contract with your largest customer contains a change-of-control clause, and the business model relies on a practice that has just attracted a regulator’s attention. Your due diligence missed it because it looked in the wrong places.
Around 330 to 350 transactions close each year in Poland’s M&A market. Poland remains a leader in Central and Eastern Europe: 284 transactions with a total value of EUR 7.45 billion were completed in 2023. Despite this scale, public sources do not provide aggregated data on how many of these deals end in post-closing disputes. “Post-closing M&A disputes” is not even a separate category in the statistics of the Court of Arbitration at the Polish Chamber of Commerce. This means post-closing risks are real but hard to see, and thorough pre-signing diligence is the only way to protect against them.
This article explains how strategic due diligence differs from a standard audit, which areas deserve attention when acquiring a technology company, and how to turn findings into specific protections in a share purchase agreement (SPA). It also explains when to renegotiate and when it may be better to walk away.
Key terms to know before a transaction
Before getting into the details, it helps to clarify the terminology. M&A transactions have their own language, and unfamiliarity with it can make it harder to communicate with advisers and negotiate with the other party.
| Term | Meaning |
|---|---|
| Due diligence (DD) | A legal, financial, and operational review of a company before its acquisition. It should answer what you are buying and what risks come with it. |
| SPA (share purchase agreement) | An agreement for the sale of shares or stock that records the transaction terms, including protective mechanisms. |
| Warranties (representations and warranties) | Statements by the seller about the company’s condition. If they prove untrue, the buyer may seek compensation. |
| Indemnities | An undertaking by the seller to cover specified losses that may arise after closing. |
| Escrow | Part of the purchase price retained in an escrow account as security against buyer claims. |
| Earn-out | Part of the purchase price tied to the company’s post-acquisition performance, sharing risk between the parties. |
| Closing | Completion of the transaction, when the shares transfer to the buyer. |
| Red flag DD | A limited review focused on areas that could change the deal outcome, used when time is short. |
| Change of control | A contractual clause giving the other party a right to terminate if ownership changes. |
How strategic due diligence differs from a standard review
Standard DD ends with a report listing reservations. The report lands on the board’s desk, and the lawyer marks risks in red, yellow, and green. The problem is that this report does not answer the question the buyer actually cares about: should we buy, at what price, and on what terms?
Strategic DD changes the purpose of the review. Instead of a formal audit, it provides a basis for a decision.
| Criterion | Standard DD | Strategic DD |
|---|---|---|
| Purpose | List of risks and reservations | Decision recommendation: proceed, renegotiate, or walk away |
| Prioritization | All findings treated as equally important | Risks ranked by their impact on valuation and the business model |
| Outcome | Report with reservations | Report, risk matrix, and specific SPA protections |
| Communication | Final report after the review ends | Deal-breakers flagged as they emerge during the review |
| Scope | A little review of everything | In-depth review of 3 to 5 areas critical to transaction value |
The prioritization logic is similar to managing vulnerabilities in IT systems: not every risk needs to be eliminated. Some can be accepted with monitoring; others require an immediate price adjustment or additional protection. The decision depends on how significantly a risk affects the target’s business model.
Five areas to prioritize
Transaction experience shows that the areas most likely to prove critical are:
- Intellectual property (IP), particularly in IT and SaaS companies whose value rests on code and technology
- Key contracts, including agreements with major customers, suppliers, and technology partners
- Regulatory compliance, including licenses, permits, and industry requirements (KNF, UOKiK, UODO)
- Corporate and ownership structure, including the cap table, relationships between shareholders, and the company’s transformation history
- Founder relationships and personal dependencies, including who actually holds the knowledge, contacts, and influence over the business
One poorly assessed area in a regulated or technology sector can undermine the entire operating model.
Risks that most often “blow up” after closing
A company’s legal risks are spread across contracts, ownership structure, IP, industry regulations, and personal relationships. Unless they are organized, it is difficult to assess the significance of each threat.
a) Incomplete IP rights: a trap for technology companies
Under Polish copyright law, a computer program is protected as a literary work (Article 74(1) of the Act on Copyright and Related Rights). Protection covers source code, object code, and preparatory materials, but not algorithms or operating principles.
Economic rights to a program created by an employee as part of employment belong to the employer (Article 74(3) of the Act). This is original acquisition: the employee never acquires the economic rights and retains only moral rights, which are inalienable and unlimited in time.
Problems arise when:
- Code was written by contractors or B2B subcontractors. Rights do not transfer automatically in that case. An agreement transferring rights across all fields of exploitation is needed.
- Rights transfer agreements do not cover all fields of exploitation under Article 74(4), including reproduction, translation, adaptation, and distribution.
- The code contains open-source components. Research indicates that 99% of applications contain open-source components, and 75% of them have known security vulnerabilities. Copyleft licenses, such as GPL, may require the source code of the entire product to be made available.
- The code is generated using AI tools. Ownership of such code and the ability to license it are becoming increasingly critical parts of the review.
For joint authorship (Article 9 of the Act), copyright belongs jointly to the co-authors, generally in equal shares unless an agreement provides otherwise. If the company has not regulated this with its team, you are buying an unclear legal position.
b) Change-of-control clauses in key contracts
A change in the company’s ownership may trigger a counterparty’s right to terminate the agreement. If DD misses this, the buyer may lose revenue overnight, without an opportunity to renegotiate after closing.
c) Regulatory exposure
The target’s business model may depend on practices that raise regulatory concerns. UOKiK fines for competition-law violations can reach 10% of a business’s turnover. In regulated industries such as fintech, medtech, and energy, losing a license or permit may block the entire business.
New EU rules broaden the scope of DD:
| Regulation | Effect on the scope of DD |
|---|---|
| GDPR | Review of data processing agreements, incident procedures, and oversight of processors |
| AI Act (in force from 1 August 2024) | Review of AI system compliance with high-risk system requirements; penalties of up to EUR 40 million or 7% of turnover |
| NIS2 | Review of cybersecurity risk-management measures, including in the supplier chain |
| DORA | For the financial sector: review of operational continuity, cybersecurity testing, and exit plans in IT supplier agreements |
| CSDDD (Directive 2024/1760) | Review of compliance with supply-chain DD requirements concerning human rights and the environment |
d) Hidden liabilities from corporate history
The buyer acquires the company together with its history. If the target recently transformed from a civil-law partnership, the shareholders of the newly formed limited liability company are jointly and severally liable with the company for pre-transformation liabilities for 3 years. If enforcement against the limited liability company’s assets is ineffective, its management board members are jointly and severally liable for its obligations (Article 299 of the Commercial Companies Code). DD should verify whether this exposure exists.
How to turn DD findings into SPA terms
Identified risks have value only when you turn them into specific protective mechanisms in the SPA. A report that ends with a list of reservations, without recommendations for what to do about them, does not protect the buyer.
The logic is the same as in IT contract negotiations: determine which risks the seller bears, which the buyer bears, and which should be shared.
Indicative market standards for protective mechanisms in Polish SPAs
There are no publicly available quantitative benchmarks in Poland. The ranges below reflect market practice and may vary depending on transaction size, industry, and the parties’ negotiating strength.
| Mechanism | Indicative market standard |
|---|---|
| Warranty cap: fundamental representations (for example, share ownership and capacity to enter into the agreement) | Up to 100% of the transaction price |
| Warranty cap: tax representations | 30-50% of the transaction price |
| Warranty cap: business representations (for example, contracts, IP, and compliance) | 10-30% of the transaction price |
| Warranty period: fundamental | No limit or general limitation periods |
| Warranty period: tax | 5-7 years |
| Warranty period: business | 12-24 months |
| Escrow | 5-15% of the price, held for 12-24 months |
| W&I insurance | Coverage: 20-40% of the transaction value; premium: 0.6-2% of the insured amount, paid once |
Seven steps from DD findings to SPA protection
- Hold a kick-off workshop. Before the review, define with legal counsel the specific business decision DD must support. Not “review the company,” but “determine whether the target achieves our strategic objective.”
- Focus the review on 3 to 5 critical areas. Instead of reviewing everything superficially, analyze in depth where transaction value is created or lost.
- Require timely communication of deal-breakers. The adviser should immediately flag risks that could change the deal outcome, not wait for the final report.
- Prepare a risk prioritization matrix. Rank risks along two dimensions: impact on valuation and probability of materialization. Use it as decision material for the board or investment committee.
- Translate every risk into a transaction mechanism. Consider a price adjustment, warranty, indemnity, escrow, earn-out, or condition precedent. Do not accept a report that ends with a list of reservations.
- Plan the SPA drafting as an integral part of the process, not a separate stage after the review is complete.
- Document the rationale for the decision. Article 293(3) of the Commercial Companies Code (business judgment rule) protects a board that acted on the basis of information, analyses, and opinions that should have been considered in the circumstances. DD documentation, including reports, opinions, and board meeting minutes, is significant evidence.
Board liability for an acquisition decision: what the law says
No provision of the Commercial Companies Code expressly requires due diligence before an acquisition. DD is market practice, not a statutory requirement.
That does not mean the board can ignore the review. Board members’ liability for damage caused to the company is based on Article 293(1) of the Commercial Companies Code (limited liability companies) and Article 483(1) (joint-stock companies). The company must establish unlawful conduct, damage, and a causal link, but the board member bears the burden of proving absence of fault.
Since 13 October 2022, Article 209¹, section 1 of the Commercial Companies Code has required a board member to exercise the care appropriate to the professional nature of the activity and to remain loyal to the company.
The business judgment rule also applies (Article 293(3) of the Commercial Companies Code): a board member does not breach the duty of care if, acting loyally towards the company, they act within the limits of justified business risk, including on the basis of information, analyses, and opinions that should have been considered in the circumstances.
The Supreme Court has confirmed this line of case law:
- Judgment of 24 July 2014 (II CSK 627/13): culpable conduct beyond the limits of business risk is contrary to the company’s interests and justify liability under Article 293(1) of the Commercial Companies Code.
- Judgment of 14 April 2016 (II CSK 430/15): liability for improper management falls within the regime of Article 293 of the Commercial Companies Code.
- Judgment of 29 October 2010 (I CSK 595/09): conducting DD does not rule out relying on mistake (Article 84 of the Civil Code) if the mistake concerned the substance of the legal act and was material.
The takeaway: failing to conduct DD in a complex transaction may be assessed as a failure to exercise due care. Due diligence falls within the “information, analyses, and opinions” described in Article 293(3) of the Commercial Companies Code and can show that the board acted within the limits of justified business risk.
When to renegotiate and when it may be better to walk away
Strategic DD does not end with a single recommendation. Depending on the findings, the adviser should present scenarios:
| Scenario | When to use it | Example |
|---|---|---|
| Proceed without changes | Identified risks are acceptable and do not affect valuation or the business model | Minor corporate documentation gaps that can be filled before closing |
| Renegotiate terms | Risks require a price adjustment or additional protections in the SPA | Incomplete IP rights: renegotiate the price and add warranties |
| Proceed subject to conditions | Risks are serious but can be removed before closing | A required regulatory license is missing: make obtaining it before closing a condition precedent |
| Conduct further diligence | DD has revealed signals requiring deeper review, and there is not enough information to decide | A complex ownership structure with personal connections requires additional governance review |
| Walk away | A deal-breaker cannot be addressed through transaction mechanisms | The business model depends on a practice that violates regulations and required permits cannot be obtained |
In competitive processes where the seller expects a quick decision, a red flag DD model can work: a limited review focused on areas that could change the deal outcome. It allows you to move quickly, but not blindly. After securing exclusivity, you can expand the review.
How we can help
Legal risks in an M&A transaction are spread across IP, contracts, compliance, governance, and personal relationships. Without organizing them and translating them into SPA protections, you are buying a company with an unknown set of problems.
Our support for M&A transactions includes:
- Kick-off workshop: we define the purpose of the review and the decision DD should support.
- Strategic DD with risk prioritization: we focus the review on areas critical to transaction value instead of looking superficially at everything.
- Report with a risk matrix and recommendations: each risk is translated into a specific transaction mechanism, such as a price adjustment, warranty, indemnity, escrow, earn-out, or condition precedent.
- Timely deal-breaker communication: we flag risks that could change the deal outcome immediately, not only in the final report.
- SPA negotiation support: we turn DD findings into provisions in the share purchase agreement.
- Red flag DD for competitive processes: when you have 2 to 3 weeks to decide, we narrow the review to the issues that could change the deal outcome.
We combine corporate law with knowledge of IT, SaaS, and fintech. We understand how technology companies work and where risks most often arise.
Do not buy problems with the company
Due diligence is a decision-making tool, not a formality. A standard review that ends with a list of reservations does not protect the buyer. DD that prioritizes risks, translates them into SPA protections, and gives the board a clear recommendation does: proceed, renegotiate, or walk away.
If you are planning an acquisition or investment, contact us. We will assess whether your due diligence is asking the right questions before you sign the SPA.
Frequently asked questions
How does strategic due diligence differ from standard DD? Standard DD ends with a report listing risks. Strategic DD prioritizes them by their impact on valuation and the business model, translates them into specific protections (warranties, indemnities, escrow, earn-out, or price adjustments), and gives the board a recommendation: proceed, renegotiate, or walk away. The difference is the purpose: DD should support a decision, not simply document the facts.
How long does due diligence take, and can it be done in 2 to 3 weeks? Timing depends on the size and complexity of the target. A full review usually takes 4 to 8 weeks. Competitive processes under time pressure use red flag DD, a limited review focused on areas that could change the deal outcome. It allows a considered decision quickly, with the option to expand the review after exclusivity is secured.
Which areas should be prioritized when acquiring an IT or SaaS company? The five areas most often critical are rights to code and technology (including developer agreements, open-source components, and AI-generated code), key contracts (especially change-of-control clauses), regulatory compliance (GDPR, AI Act, and NIS2), corporate structure and cap table, and personal dependencies: who actually holds knowledge and customer relationships.
If DD identifies serious risks, does that automatically mean walking away? No. Strategic DD offers several scenarios: proceed without changes, renegotiate terms (price adjustment or additional warranties), proceed subject to a condition precedent, conduct further diligence, or walk away. Walking away is justified only when the risk cannot be addressed through transaction mechanisms, for example, a business model based on a practice that violates regulations.
Is the board legally required to conduct DD before an acquisition? No. No provision of the Commercial Companies Code expressly imposes this requirement. DD is market practice. Failing to conduct a review in a complex transaction may nevertheless be assessed as a failure to exercise due care under Article 293. The business judgment rule (Article 293(3)) protects a board that acted on the basis of information, analyses, and opinions considered in a careful assessment. DD falls within that category.
How can I justify DD findings to an investment committee or supervisory board? Prepare a risk prioritization matrix (impact on valuation multiplied by probability of materialization) and a report with scenario-based recommendations. DD documentation, including reports, opinions, and board meeting minutes (Article 208¹ of the Commercial Companies Code), is evidence that the acquisition decision was made within the limits of justified business risk.
