{"id":3890,"date":"2026-08-24T12:27:34","date_gmt":"2026-08-24T12:27:34","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3890"},"modified":"2026-10-23T11:20:59","modified_gmt":"2026-10-23T11:20:59","slug":"strategic-due-diligence-ma-decisions","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/strategic-due-diligence-ma-decisions\/","title":{"rendered":"Strategic Due Diligence: How Not to Buy Problems with a Company"},"content":{"rendered":"

The transaction has closed. The management presentation looked great, the numbers added up, and the market was growing. Three months later, you discover that the code belongs to the former CTO, the key contract with your largest customer contains a change-of-control clause, and the business model relies on a practice that has just attracted a regulator\u2019s attention. Your due diligence<\/strong> missed it because it looked in the wrong places.<\/p>\n

Around 330 to 350 transactions close each year in Poland\u2019s M&A market. Poland remains a leader in Central and Eastern Europe: 284 transactions with a total value of EUR 7.45 billion were completed in 2023. Despite this scale, public sources do not provide aggregated data on how many of these deals end in post-closing disputes. \u201cPost-closing M&A disputes\u201d is not even a separate category in the statistics of the Court of Arbitration at the Polish Chamber of Commerce. This means post-closing risks are real but hard to see, and thorough pre-signing diligence is the only way to protect against them.<\/p>\n

This article explains how strategic due diligence<\/strong> differs from a standard audit, which areas deserve attention when acquiring a technology company, and how to turn findings into specific protections in a share purchase agreement<\/a> (SPA). It also explains when to renegotiate and when it may be better to walk away.<\/p>\n

Key terms to know before a transaction<\/h2>\n

Before getting into the details, it helps to clarify the terminology. M&A transactions have their own language, and unfamiliarity with it can make it harder to communicate with advisers and negotiate with the other party.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Due diligence (DD)<\/strong><\/td>\nA legal, financial, and operational review of a company before its acquisition. It should answer what you are buying and what risks come with it.<\/td>\n<\/tr>\n
SPA (share purchase agreement)<\/strong><\/td>\nAn agreement for the sale of shares or stock that records the transaction terms, including protective mechanisms.<\/td>\n<\/tr>\n
Warranties (representations and warranties)<\/strong><\/td>\nStatements by the seller about the company\u2019s condition. If they prove untrue, the buyer may seek compensation.<\/td>\n<\/tr>\n
Indemnities<\/strong><\/td>\nAn undertaking by the seller to cover specified losses that may arise after closing.<\/td>\n<\/tr>\n
Escrow<\/strong><\/td>\nPart of the purchase price retained in an escrow account as security against buyer claims.<\/td>\n<\/tr>\n
Earn-out<\/a><\/strong><\/td>\nPart of the purchase price tied to the company\u2019s post-acquisition performance, sharing risk between the parties.<\/td>\n<\/tr>\n
Closing<\/strong><\/td>\nCompletion of the transaction, when the shares transfer to the buyer.<\/td>\n<\/tr>\n
Red flag DD<\/strong><\/td>\nA limited review focused on areas that could change the deal outcome, used when time is short.<\/td>\n<\/tr>\n
Change of control<\/strong><\/td>\nA contractual clause giving the other party a right to terminate if ownership changes.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How strategic due diligence differs from a standard review<\/h2>\n

Standard DD ends with a report listing reservations. The report lands on the board\u2019s desk, and the lawyer marks risks in red, yellow, and green. The problem is that this report does not answer the question the buyer actually cares about: should we buy, at what price, and on what terms?<\/strong><\/p>\n

Strategic DD changes the purpose of the review. Instead of a formal audit, it provides a basis for a decision.<\/p>\n\n\n\n\n\n\n\n\n\n
Criterion<\/th>\nStandard DD<\/th>\nStrategic DD<\/th>\n<\/tr>\n<\/thead>\n
Purpose<\/td>\nList of risks and reservations<\/td>\nDecision recommendation: proceed, renegotiate, or walk away<\/td>\n<\/tr>\n
Prioritization<\/td>\nAll findings treated as equally important<\/td>\nRisks ranked by their impact on valuation and the business model<\/td>\n<\/tr>\n
Outcome<\/td>\nReport with reservations<\/td>\nReport, risk matrix, and specific SPA protections<\/td>\n<\/tr>\n
Communication<\/td>\nFinal report after the review ends<\/td>\nDeal-breakers flagged as they emerge during the review<\/td>\n<\/tr>\n
Scope<\/td>\nA little review of everything<\/td>\nIn-depth review of 3 to 5 areas critical to transaction value<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The prioritization logic is similar to managing vulnerabilities in IT systems: not every risk needs to be eliminated. Some can be accepted with monitoring; others require an immediate price adjustment or additional protection. The decision depends on how significantly a risk affects the target\u2019s business model.<\/p>\n

Five areas to prioritize<\/h3>\n

Transaction experience shows that the areas most likely to prove critical are:<\/p>\n

    \n
  1. Intellectual property (IP)<\/a><\/strong>, particularly in IT and SaaS companies whose value rests on code and technology<\/li>\n
  2. Key contracts<\/strong>, including agreements with major customers, suppliers, and technology partners<\/li>\n
  3. Regulatory compliance<\/strong>, including licenses, permits, and industry requirements (KNF, UOKiK, UODO)<\/li>\n
  4. Corporate and ownership structure<\/strong>, including the cap table, relationships between shareholders<\/a>, and the company\u2019s transformation history<\/li>\n
  5. Founder relationships and personal dependencies<\/strong>, including who actually holds the knowledge, contacts, and influence over the business<\/li>\n<\/ol>\n

    One poorly assessed area in a regulated or technology sector can undermine the entire operating model.<\/p>\n

    Risks that most often \u201cblow up\u201d after closing<\/h2>\n

    A company\u2019s legal risks are spread across contracts, ownership structure, IP, industry regulations, and personal relationships. Unless they are organized, it is difficult to assess the significance of each threat.<\/p>\n

    a) Incomplete IP rights: a trap for technology companies<\/h3>\n

    Under Polish copyright law<\/a>, a computer program is protected as a literary work (Article 74(1) of the Act on Copyright and Related Rights). Protection covers source code, object code, and preparatory materials, but not algorithms or operating principles.<\/p>\n

    Economic rights to a program created by an employee as part of employment belong to the employer (Article 74(3) of the Act). This is original acquisition: the employee never acquires the economic rights and retains only moral rights, which are inalienable and unlimited in time.<\/p>\n

    Problems arise when:<\/p>\n

      \n
    1. Code was written by contractors or B2B subcontractors. Rights do not transfer automatically in that case. An agreement transferring rights across all fields of exploitation is needed.<\/li>\n
    2. Rights transfer agreements do not cover all fields of exploitation under Article 74(4), including reproduction, translation, adaptation, and distribution.<\/li>\n
    3. The code contains open-source components. Research indicates that 99% of applications contain open-source components, and 75% of them have known security vulnerabilities. Copyleft licenses, such as GPL, may require the source code of the entire product to be made available.<\/li>\n
    4. The code is generated using AI tools. Ownership of such code and the ability to license it are becoming increasingly critical parts of the review.<\/li>\n<\/ol>\n

      For joint authorship (Article 9 of the Act), copyright belongs jointly to the co-authors, generally in equal shares unless an agreement provides otherwise. If the company has not regulated this with its team, you are buying an unclear legal position.<\/p>\n

      b) Change-of-control clauses in key contracts<\/h3>\n

      A change in the company\u2019s ownership may trigger a counterparty\u2019s right to terminate the agreement. If DD misses this, the buyer may lose revenue overnight, without an opportunity to renegotiate after closing.<\/p>\n

      c) Regulatory exposure<\/h3>\n

      The target\u2019s business model may depend on practices that raise regulatory concerns. UOKiK fines for competition-law violations can reach 10% of a business\u2019s turnover. In regulated industries such as fintech, medtech, and energy, losing a license or permit may block the entire business.
      \nNew EU rules broaden the scope of DD:<\/p>\n\n\n\n\n\n\n\n\n\n
      Regulation<\/th>\nEffect on the scope of DD<\/th>\n<\/tr>\n<\/thead>\n
      GDPR<\/strong><\/td>\nReview of data processing agreements<\/a>, incident procedures, and oversight of processors<\/td>\n<\/tr>\n
      AI Act<\/strong> (in force from 1 August 2024)<\/td>\nReview of AI system compliance with high-risk system requirements; penalties of up to EUR 40 million or 7% of turnover<\/td>\n<\/tr>\n
      NIS2<\/strong><\/td>\nReview of cybersecurity risk-management measures, including in the supplier chain<\/td>\n<\/tr>\n
      DORA<\/strong><\/td>\nFor the financial sector: review of operational continuity, cybersecurity testing, and exit plans in IT supplier agreements<\/td>\n<\/tr>\n
      CSDDD<\/strong> (Directive 2024\/1760)<\/td>\nReview of compliance with supply-chain DD requirements concerning human rights and the environment<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      d) Hidden liabilities from corporate history<\/h3>\n

      The buyer acquires the company together with its history. If the target recently transformed from a civil-law partnership, the shareholders of the newly formed limited liability company are jointly and severally liable with the company for pre-transformation liabilities for 3 years. If enforcement against the limited liability company\u2019s assets is ineffective, its management board members are jointly and severally liable for its obligations (Article 299 of the Commercial Companies Code). DD should verify whether this exposure exists.<\/p>\n