Diligence: Legal, Regulatory, and IP Risks

Hello! Welcome back.

In our previous lessons, we built a three-part framework for assessing a startup's core business, focusing on the team, market, and product. We concluded by looking at how to assess product and technology, touching upon Intellectual Property (IP) as a source of defensibility.

Today, we shift our focus from the internal strengths of the business to the external and structural risks that can undermine it. This lesson directly addresses the learning outcome: to identify key legal, regulatory, and intellectual property risks during diligence.

Your goal isn't to become a lawyer, but to develop an investor's instinct for spotting red flags. Knowing what to look for and when to engage legal counsel is a critical skill for running an accelerator and managing a fund. This is especially true given your stated goal of understanding the strategic requirements rather than performing the legal work yourself. We will cover the core legal, IP, and regulatory risks that you must screen for before making an investment decision.

1. The Legal Due Diligence Framework

Legal due diligence is the process of verifying a startup's legal health and uncovering hidden liabilities. It's about ensuring the company is built on a solid foundation and that you, as an investor, are actually acquiring a legitimate stake in a well-structured entity.

A great way to start is by understanding the process from a venture capital lawyer's perspective. The following video from 500 Global, a prominent accelerator, provides an excellent overview.

As the video explains, diligence for early-stage companies is a balancing act. You're investing in the riskiest assets but can't afford to spend a fortune on legal fees. Therefore, you must focus on the issues that pose the greatest existential threats. We can group these into three main categories:

1. Corporate and Governance Risks: Is the company legally sound?
2. Intellectual Property Risks: Does the company truly own its "secret sauce"?
3. Regulatory and Litigation Risks: Are there any external legal threats?

The image below gives a good overview of where legal diligence fits into the broader picture. We are now focusing on the "Legal" quadrant.

2. Corporate and Governance Risks: Is the House in Order?

Before you invest a single dollar, you must verify that the company is a legally sound entity and that its ownership is clear and properly documented. Errors here are not just minor problems; they can invalidate your entire investment.

The next segment of the 500 Global video provides a fantastic, practical checklist of the exact documents to review.

To summarize and reinforce these points, here are the non-negotiable items you need to check:

• Formation Documents (Articles of Incorporation & Bylaws): Confirms the company legally exists, typically as a Delaware C-Corp, which is the standard for US VC-backed startups.
• Board and Shareholder Actions: All major decisions—like issuing stock, creating an option pool, or authorizing your investment—must be approved by the board and/or stockholders. You need to see the signed consents or minutes.
• Capitalization Table (Cap Table): This must be a detailed ledger of all stockholders, option holders, and convertible instrument holders. Critically, it must be backed by signed legal documents (like stock purchase agreements). A cap table is a summary, not the source of truth.
• Founder Stock Purchase Agreements: These documents show that founders properly purchased their shares. A huge red flag is a missing 83(b) election filing for stock subject to vesting. As the video notes, this is a ticking tax time bomb for the founder that cannot be fixed later.
• Employee/Advisor Agreements & Option Grants: Ensure everyone has a contract. If stock options have been granted, you must ask for a 409A valuation report. This report establishes the fair market value of the stock and protects employees from major tax penalties.

The following article from Phoenix Strategy Group provides a detailed textual breakdown of each of these documents. It’s a great resource to bookmark for future reference.

3. Intellectual Property (IP) Risks: Who Owns the Brains?

In the last lesson, we discussed IP as a competitive moat. Now, we look at it as a source of risk. The single most important question in IP diligence is: Does the company unambiguously own all the IP it claims to?

For software and AI companies, the value is in the code, the data, and the models. If the ownership of that IP is questionable, the company's value is questionable.

Key IP Diligence Areas:

• IP Assignment Agreements: Every single person who has contributed to the product—founders, employees, consultants, interns—must have signed an agreement that assigns the rights to their work to the company. This is typically called a Confidential Information and Invention Assignment Agreement (CIIA or PIIA). A missing assignment from a key early engineer or a founder is a five-alarm fire.
• Third-Party and Open Source IP: Does the product use code or data from other sources? You need to understand the licenses. Using open-source code with a "copyleft" license (like GPL) might require the company to make its own proprietary code public—a catastrophic outcome.
• Freedom to Operate (FTO): Does the company's product infringe on a competitor's patents? While a full FTO analysis by a law firm is expensive, you should ask the founders if they are aware of any dominant patents in their space.
• Patent Status: As the video highlights, founders sometimes use the term "patented" loosely. You must verify if a patent is merely "filed" (provisional or non-provisional) or actually "issued."

Special IP Risks for AI Startups

Your focus on AI startups requires an even deeper level of scrutiny here, as ownership is often more complex than in traditional software.

For an AI startup, you must ask:

• Who owns the training data? Did they scrape it from the web in violation of terms of service? Is it licensed from a third party? Do they have the rights to use it for commercial purposes?
• Who owns the model outputs? If the model was trained on licensed data, what are the restrictions on the commercial use of its predictions or creations?
• What are the dependencies? Many AI startups build on open-source models (e.g., from Hugging Face or Meta). What are the licenses of those foundational models, and what limitations do they impose?

4. Regulatory and Litigation Risks

Finally, you need to scan for external legal threats.

• Regulatory Compliance: Does the company operate in a regulated industry (e.g., FinTech, HealthTech, EdTech)? You must verify they have the necessary licenses, permits, and certifications. For AI, this is an evolving landscape; an AI tool for medical diagnosis, for example, will face FDA scrutiny.
• Litigation: You must ask for a list of any pending, threatened, or past lawsuits. An ongoing lawsuit represents a potentially significant financial drain and a distraction for the management team.

The Phoenix Strategy article provides excellent summaries of the documents related to these risks.

Conclusion

You have now added a crucial layer to your diligence framework. By learning to spot the most common and dangerous legal, regulatory, and IP risks, you can protect your fund from catastrophic errors and engage with lawyers in a more efficient, strategic manner.

Key Takeaways:

• Diligence is Verification: Legal diligence is about verifying a clean corporate structure, clear ownership, and the absence of hidden liabilities.
• Focus on Showstoppers: For early-stage deals, focus on foundational issues: proper incorporation, authorized share issuances, and complete IP assignments.
• IP Ownership is Paramount: A startup's value is intrinsically linked to its IP. You must confirm that all intellectual property created for the company is legally owned by the company.
• AI Adds Complexity: AI startups have unique IP risks related to the ownership of training data, model outputs, and dependencies on third-party models and tools.
• Know When to Call a Lawyer: Your role is to be the first line of defense. When you spot a red flag like a missing IP assignment or an unauthorized stock grant, your job is to halt the process and bring in legal counsel to assess and fix the issue.

Preview of the Next Lesson

We have now examined the startup from four different angles: Team, Market, Product, and Risk. The final step in the diligence process is to bring all these findings together. In the next lesson, we will cover how to synthesize due diligence findings into a concise investment memo to support a decision. This document is the culmination of your work and serves as the core argument for or against investing in a company.