Deeptech Due Diligence: What Do Investors Check in a French Start-up?

By Maître Arnaud Touati
06/10/2026

Reviewed and approved by Arnaud Touati (Maître), partner and co-founder of the firm

Key points

Due diligence on a deeptech start-up covers five areas: the intellectual property chain of title, freedom to operate, the cap table, regulatory compliance and actual technological maturity.
The investor checks that the company actually owns the technology: assignment of inventions by the founders, assignment of code by the developers and the status of licences transferred from a public laboratory.
Freedom to operate analysis looks at prior patents that could prevent commercialisation, because holding a patent does not guarantee freedom to exploit.
Review of the fully diluted cap table covers shares, BSPCE, BSA, AGA, convertibles, the shareholders’ agreement and founder vesting, to anticipate final dilution.
Regulatory compliance covers the GDPR (record of processing, DPA, impact assessments) and sector-specific regulations depending on the field: health, finance, energy or cybersecurity.
A flaw in any one of these five blocks can derail the fundraising or lead to conditions precedent.

Due diligence on a deeptech start-up covers five areas: the intellectual property chain of title (who owns what), freedom to operate, the cap table and outstanding instruments, regulatory compliance (GDPR, sector-specific, any dual-use issues), and actual technological maturity (TRL, Technology Readiness Level). Any serious deeptech investor examines these five blocks before a firm term sheet. A flaw in any one of them derails the fundraising or leads to conditions precedent.

Table of Contents

Area 1: the intellectual property chain of title

The investor wants to be sure that the company actually owns the technology it exploits. The review covers:

Assignment of inventions by the founders: formal, dated deeds of assignment; for patents and patent applications, the transfer must be in writing, failing which it is void (Article L. 613-8 of the French Intellectual Property Code (CPI) (in French)).
Ownership of source code and inventions: employees (economic rights in software vest in the employer, Article L. 113-9 of the CPI; employee inventions made in the course of their duties, Article L. 611-7 of the CPI), external contractors (express contractual assignment), interns (specific assignment required).
Status of licences and patents transferred from a public laboratory: agreement with the SATT (technology transfer acceleration company) or the institution, royalty terms, reversion clauses.
Third-party components: open source licences used (compatibility with commercial exploitation, viral effect of the GPL, MIT/Apache attributions), libraries and SDKs under paid licences.
Trade marks, domain names, derivative rights: held in the company’s name, not the founder’s.

The slightest defect in the chain (for example a freelancer who never assigned their rights in a critical module) can block the investment.

Area 2: freedom to operate (FTO)

Freedom to operate is the analysis of prior patents that could prevent the product from being commercialised. Holding a patent on your own invention does not guarantee freedom to operate: a third party may hold an earlier patent covering an upstream element your product needs.

The investor examines:

Prior art search by a specialised firm in international patent databases (Espacenet, USPTO, JPO).
Mapping of competitors’ patents: owners, priority dates, expiry dates, jurisdictions covered.
Litigation risks: presence of known patent trolls, competitors’ litigation history.
Design-around strategy: technical alternatives available, possibility of cross-licensing.

The cost of an FTO analysis depends on its scope. Deeptech investors frequently ask for one.

Area 3: the cap table and dilutive instruments

The investor wants to understand the capital structure and anticipate final dilution. Review of:

Fully diluted cap table: shares, BSPCE (French start-up share warrants), BSA (share warrants), AGA (free shares), convertibles, under every exercise scenario.
Existing shareholders’ agreement: pre-emption, drag-along, tag-along, anti-dilution and ratchet clauses.
BSA Air and convertible bonds: conversion terms, impact at the next round.
Commitments made to earlier investors: liquidation preference clauses, ratchet, board seats.
Founder vesting: whether there is reverse vesting (the company can recover the founder’s shares if they leave), duration, cliff.
Planned option pool: a reserve for future employees, sized for the hiring plan.

Area 4: regulatory compliance

GDPR and personal data

On the basis of Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés) (in French):

An up-to-date record of processing activities.
An accessible and compliant privacy policy.
Legal bases for processing identified for each purpose.
Data processing agreements (DPA) with service providers (cloud, analytics, payroll).
Data protection impact assessments (AIPD/PIA) for high-risk processing.
Appointment of a DPO (Data Protection Officer) where required.
A procedure for handling data subjects’ requests.
A procedure for handling personal data breaches.

Sector-specific regulations

Health: CE marking and compliance with Regulations (EU) 2017/745 (MDR) and 2017/746 (IVDR) for medical devices, under the supervision of the ANSM (French medicines and health products agency).
Finance: ACPR (French prudential supervision and resolution authority) or AMF (French financial markets authority) authorisation, PSD2 compliance for payment services, MiCA for digital assets.
Energy and environment: ICPE authorisations (installations classified for environmental protection), certifications, sector standards.
Cybersecurity: SecNumCloud qualification, CSPN certification (first-level security certification), NIS2 compliance.

Dual-use and export controls

Technologies with both civil and military uses are subject to Regulation (EU) 2021/821. A review is required for:

Advanced cryptography.
High-performance computing and specialised chips.
Drones and autonomous systems.
Sensitive biotechnologies.
Advanced materials.

Area 5: technological maturity (TRL)

The TRL (Technology Readiness Level) scale, commonly used by public and private funders, defines 9 levels of maturity:

TRL 1-3: scientific principles observed, concept formulated, experimental proof.
TRL 4-6: validation in the laboratory, then validation and demonstration in a representative environment.
TRL 7-9: prototype in real conditions, system qualification, commercial operation.

The investor seeks to:

Have the stated TRL validated by an independent expert.
Identify the missing technical milestones (moving from TRL 6 to TRL 7 often requires industrialisation and certifications).
Anticipate the cost and time needed to reach a marketable TRL.
Spot gaps between marketing communication and technical reality.

Other points investors look at

Customer contracts and partnerships: duration, exclusivity, assignment clauses, MAC clauses.
Pending or potential disputes: litigation with customers, former employees, competitors.
Financial commitments: bank debt, convertible bonds, guarantees given, long leases.
Research Tax Credit (Crédit Impôt Recherche, CIR): base correctly calculated, justified, not rejected by the tax authorities.
JEI status (Jeune Entreprise Innovante, young innovative company): eligibility, correct application of the social security and tax exemptions.
Bpifrance, ADEME and regional grants: eligibility conditions met, repayment schedules where applicable.
Transferable critical assets: servers, cloud access, administrator accounts, code in private repositories.

How a due diligence typically unfolds

Non-binding term sheet signed after initial meetings.
Set-up of a secure data room by the start-up, with NDAs signed by the parties involved.
DD questions issued by the investors’ advisers (typically 50 to 200 questions).
Topic-specific meetings: technical, legal, financial, commercial.
Due diligence reports: typically a legal report (investor’s lawyer), a technical report (external expert), a financial report (audit).
List of conditions precedent: corrections to be made before signing.
Closing: signing of the legal documents (shareholders’ agreement, warranty and indemnity (garantie d’actif et de passif), ancillary agreements), transfer of funds.

Common pitfalls for start-ups

Missing or disorganised documents: a poorly prepared data room slows the process and worries the investor.
Rights assignments not regularised: a freelancer or co-founder without a written assignment triggers a blockage.
Inconsistent cap table: discrepancy between the BSPCE granted and the fully diluted table presented.
GDPR neglected: no DPA with processors, empty record, generic policy.
Overstated TRL: marketing communication goes beyond technical reality, and the expert detects it.
Undisclosed disputes: clear bad faith, grounds for withdrawal and for a claim under the warranty and indemnity.
Forgotten commitments: change of control clauses in customer contracts, which may trigger termination when the fundraising takes place.

Preparing for due diligence in advance

A well-prepared start-up can shorten the DD and negotiate on better terms. Recommendations:

Set up an internal data room from the seed stage, updated as you go.
Carry out an annual IP review with an intellectual property lawyer.
Carry out a GDPR audit at each growth stage.
Document JEI status, the CIR and grants received.
Keep a register of critical contracts with their sensitive clauses annotated.

Due diligence is the moment of truth for a deeptech start-up. How well it is prepared shapes the success of the fundraising and the quality of the relationship with the investor. Every situation is different and calls for a case-by-case analysis.