Legal Due Diligence Checklist for In-House Counsel

The term sheet lands on a Tuesday. The buyer's counsel wants the data room populated by the end of next week, and the request list runs to eleven pages: every material contract, every board consent, every IP assignment, every open dispute, the cap table, the privacy policies, the SOC 2 report. You are a team of two, and the deal team wants to know today whether anything in there will slow the close. This legal due diligence checklist is how in-house counsel gets that answer before the buyer's clock starts: the data room built, the risky clauses flagged, and the explanation for each one already drafted.

Bloomberg Law's standard M&A due diligence request list runs to 174 document types, and it is written for the buyer: the documents an acquirer's lawyers want to pull apart. This checklist is written for the in-house lawyer on the other side of the table, the general counsel, associate GC, or legal ops lead preparing a company for a financing round, an acquisition, or an annual audit.

The work is the same documents, read in the opposite direction. You are reading for the landmines: the contract that needs consent before a change of control, the assignment clause that blocks the transfer, the missing board approval, the most-favored-nation term that resets pricing across the customer base the moment ownership shifts.

GC AI's CEO and co-founder, Cecilia Ziniti, was a general counsel three times (Anki, Bloomtech, and Replit), and an in-house counsel at Amazon and Cruise. Ziniti built GC AI to solve the problems she encountered firsthand as an in-house lawyer, and few problems are heavier than getting a company diligence-ready while running the rest of the legal department at the same time.

What Is a Legal Due Diligence Checklist?

A legal due diligence checklist is a structured list of the corporate, contractual, and regulatory items a company must produce and review before a financing, sale, or audit, organized so that nothing material gets missed. In an M&A context, the buyer uses it to scrutinize a target's contracts, corporate records, intellectual property, employment matters, data practices, litigation, and tax position to surface hidden liabilities. Sell-side, in-house counsel uses the same checklist in reverse: to assemble a clean data room, flag the deal-affecting terms early, and walk into diligence already knowing where the friction will be.

The categories below cover the eight areas a thorough review touches:

1. Corporate and governance
2. Material contracts
3. Intellectual property
4. Employment
5. Data and privacy
6. Litigation and disputes
7. Regulatory and compliance
8. Finance and tax

Each item is phrased as a check you can run against your own records. The checklist gives you the document list; what turns a pile of contracts into a defensible diligence summary is reading every one of them, and we cover how a legal AI platform carries that load after the checklist. Whether the close date holds depends on what that read turns up.

The Sell-Side Legal Due Diligence Checklist

The checklist below runs 44 checks across eight categories. Run the sections in the order that respects other people's calendars:

1. Material contracts first. Every consent you need is a third party's signature, and counterparties answer on their own schedule. The earlier you know which agreements need consent, the earlier those requests go out.
2. Corporate records and the cap table second. These gaps are fixable in-house: a missing board consent can be ratified and a ledger mismatch reconciled, with no counterparty involved.
3. The remaining six sections in parallel, each assigned to the person who owns the records: HR for employment files, security for the SOC 2 report, finance for the tax schedules.

Corporate and Governance

• Confirm the certificate of incorporation and all amendments are current and on file.
• Confirm bylaws (and any amendments) match the company's governance practice.
• Confirm a current certificate of good standing in the state of incorporation and every state of qualification.
• Confirm board minutes and written consents exist for every material action: financings, option grants, executive hires, acquisitions, and major contracts.
• Confirm stockholder consents exist where required, and that they match the actions taken.
• Confirm the cap table reconciles to the stock ledger, option records, SAFEs, notes, and warrants.
• Confirm the list of all subsidiaries and the ownership chain for each.
• Confirm any prior financing documents (stock purchase agreements, investor rights agreements, voting agreements) and their consent and notice provisions.

Material Contracts

• Identify every contract above your materiality threshold by revenue, spend, or strategic weight.
• Flag every change of control provision: which contracts grant the counterparty a termination or consent right when ownership shifts.
• Flag every assignment clause that requires consent to transfer, including anti-assignment language triggered by a stock sale.
• Flag every most-favored-nation and exclusivity term that could reset pricing or block a transaction.
• Flag uncapped indemnification obligations and missing limitation of liability caps in customer agreements; buyers price both into the indemnity package.
• Identify auto-renewal and termination-for-convenience provisions and their notice windows.
• Confirm signed copies exist for every material agreement, with all amendments, SOWs, and order forms attached.
• Identify any contract with a government counterparty, which often carries its own consent and novation rules.

Intellectual Property

• Confirm the company owns its core IP: every employee and contractor has a signed invention assignment, and contractor deliverables carry work-made-for-hire language.
• Confirm the trademark, patent, and copyright registrations and their current status.
• Confirm inbound and outbound license agreements, and whether any restrict assignment or change of control.
• Confirm open-source software usage is inventoried and the license obligations are documented.
• Confirm domain names and key social handles are registered in the company's name.

Employment

• Confirm offer letters, employment agreements, and contractor agreements are on file and signed.
• Confirm worker classification (employee vs. contractor) holds up under current standards.
• Confirm equity grant documentation matches the cap table and board approvals.
• Confirm any severance, retention, or change-of-control acceleration obligations and their cost.
• Confirm non-compete and non-solicitation obligations for key employees, and whether they hold up in each operating state.
• Confirm compliance with wage-and-hour, leave, and benefits requirements in every operating jurisdiction.

Data and Privacy

• Confirm the privacy policy matches how the company handles data in practice and names the right legal bases.
• Confirm data processing agreements are in place with vendors that handle personal data.
• Confirm the company's posture under applicable privacy laws (GDPR, CCPA/CPRA, and sector rules).
• Confirm the security certifications (SOC 2, ISO 27001) are current and the reports are accessible.
• Confirm any past data incidents are documented along with the response and notifications.

Litigation and Disputes

• Confirm a current schedule of pending and threatened litigation, with status and exposure.
• Confirm any settlements, consent decrees, or injunctions and their ongoing obligations.
• Confirm demand letters, regulatory inquiries, and unresolved disputes are logged.
• Confirm insurance coverage (D&O, E&O, cyber, general liability) and any open claims.

Regulatory and Compliance

• Confirm all licenses, permits, and registrations required to operate, by jurisdiction.
• Confirm export-control and sanctions screening where the business touches restricted markets.
• Confirm industry-specific compliance (financial, health, consumer) is documented.
• Confirm the AI governance posture: which AI tools touch company or customer data, under what terms.

Finance and Tax

• Confirm audited or reviewed financial statements for the periods the buyer will request.
• Confirm federal, state, and local tax filings are current and any disputes are disclosed.
• Confirm outstanding debt, guarantees, and liens, and their consent or repayment triggers.
• Confirm related-party transactions are documented and at arm's length.

A data room passes when every “yes” has a document behind it and every “no” has an explanation already drafted.

Why Sell-Side Diligence Breaks Without Reading Every Contract

A growth-stage company can carry several hundred active agreements, and the single point of failure in sell-side preparation is the one you did not re-read. A buyer's counsel will run a search across the full set for “change of control,” “assignment,” “exclusive,” and “most favored,” and they will find the three agreements that complicate the deal.

Run that same search first. Otherwise you learn about the problem when the buyer raises it, which is the worst possible moment to discover that your largest customer contract requires written consent before the acquisition can close.

Who finds a flag first changes what it costs. Every flag you find becomes a line in the disclosure schedules, priced into the deal on your terms. Every flag the buyer finds first becomes leverage: a purchase-price adjustment, a special indemnity, or a larger escrow holdback sitting against your representations and warranties.

Representations and warranties insurance raises the bar again. On an insured deal, the underwriter reads your diligence record too: a gap in the record surfaces as a policy exclusion, and whatever the policy excludes stays your problem after closing.

Maury Bricks, general counsel of ARKO Corp and GPM Investments and a CZ and Friends guest, has run the buyer's side of this read through 26 acquisitions. Asked where his team starts when acquiring a company, he described the review your records will face:

We ask them what licenses they have, then we do our own research to find out what licenses they should have. Are they operating their business the right way?

The math is what makes this hard for a lean team. Reading each agreement for a handful of deal-affecting clauses, on a buyer's timeline, while keeping the rest of the legal department running, is the kind of workload that used to mean a weekend of associates or a five-figure outside-counsel bill.

Bryanna Reed-Hoos, an in-house attorney, framed exactly this problem during a GC AI 101 class with a prompt built for a sell-side review:

Assume the role of a commercial lawyer for a technology startup. You are planning a contract review project focused on change of control clauses in your SaaS agreements with customers. What are the important elements of change of control that you should consider?

That prompt runs a sell-side review in miniature. One focused pass across a category of contracts, looking for one family of clauses, produces a structured answer the lawyer can act on. The question is whether you run it across ten contracts by hand or across three hundred at once.

How GC AI Reads the Whole Data Room

GC AI is an enterprise-grade legal AI platform built for in-house counsel, used by 2,100+ legal teams across 47 countries as of September 2026, including the legal departments at Liquid Death, Arc'teryx, Tipalti, and Snyk, plus 300+ public companies and 25 unicorns. For the full category landscape, the guide to the best legal AI tools for in-house counsel ranks the field. For sell-side diligence, the relevant capability is reading at the scale of a data room and surfacing the terms that change a deal.

Upload the material contracts into Files and GC AI can analyze up to 1,500 pages at once, which turns “read every agreement for change-of-control language” from a multi-day project into a single structured pass.

When the platform flags a clause, Exact Quote returns the language character-for-character with a citation back to the source document, so the flag in your diligence summary is the contract text itself, ready for the buyer or the board without another verification pass. Watch it pull a flagged clause verbatim, citation attached:

Playbooks carries the repeatable structure. A change-of-control review, an assignment-consent sweep, or an MFN audit is the same set of questions run across a contract set, and a custom playbook built from your own standards lets you run that review consistently, the same way every time, whether you run it or a teammate does while you are heads-down on the term sheet.

Ritesh Patel, Chief Legal Officer at Viant Technology, described the time math that makes this matter on a deadline:

If a contract review takes 45 minutes less, that's real time back in my day.

If that 45 minutes holds across a data room of several hundred agreements, it is the difference between making the buyer's deadline and asking for an extension that signals you were not ready. KT Farley, Chief Privacy Officer and Associate GC at Helix, described how the same capability changes who can do the first pass:

The ability to create and store reusable prompts and share them across the team has completely changed the work required to review standard work. Junior teammates now run the checklist prompt first and bring me the output as the predicate for my review.

The checklist prompt runs across the data room, a teammate brings you the flagged contracts, and your judgment goes to the dozen agreements that shape the deal.

The budget math is direct. GC AI pricing starts at $500 per seat per month as of July 2026, about what a single hour of deal-counsel time bills. The clause sweep that used to go out the door as a five-figure outside-counsel engagement runs on a seat you already pay for. Run your team's numbers in the ROI calculator.

For the deeper buyer-side mechanics of running an M&A or vendor review with AI, see the AI Contract Due Diligence guide for in-house teams. For getting any single agreement diligence-ready, the AI contract review guide for in-house counsel covers the clause-level pass.

Start Your Diligence Prep Before the Term Sheet

The companies that clear diligence fastest started preparing before a deal required it. Tricia Kinney, former general counsel of BlueLinx and chief legal and compliance officer at ServiceMaster and a CZ and Friends guest, gave lawyers stepping into a deal the same instruction:

Dig in on all the due diligence and figure out kind of where to start with the lens of, okay, once this is completed, what do I have to do?

Work the checklist with the close in mind, on a schedule you set:

1. Next 30 days: Build the data room as a standing asset. Pull every material contract into one organized collection and run a change-of-control and assignment sweep across the full set, so you already know which agreements need consent. Log each flagged contract in a consent tracker, one row per agreement: counterparty, clause, consent or notice required, and status. That matrix is the first work product the deal team will ask for.
2. Next 60 days: Reconcile the cap table to the stock ledger and confirm board consents exist for every material action, the two corporate gaps buyers find first.
3. Next 90 days: Run the full checklist above section by section and draft the explanation for every “no,” so nothing in the data room surprises you once a deal is live.

Prepared this way, you walk into the buyer's request list with the data room standing, the consents mapped, and your judgment free for the deal itself.