Technology and software

A frequent finding in Dutch software due diligence is a gap in the chain of title. Under Dutch copyright law, works created by employees in the course of their duties generally vest in the employer, but contractors, freelancers and founders who wrote code before incorporation do not fall under that rule, and an assignment is needed in writing. Companies that grew out of a founder's side project, that used offshore development providers, or that acquired code through an earlier acquisition frequently cannot produce a clean chain. That position can be remedied, and remedying it before a buyer identifies it is considerably less expensive.

Remediation is a process rather than a signature. A retrospective assignment has to identify the works it transfers, since the Copyright Act requires a deed, which is construed narrowly, and moral rights remain with the author, who can waive them only to a limited extent. Where the counterparty is a former contractor or a departed founder, the request itself indicates why it is being made, which is why the position is better addressed while the relationship is current. Where code sits in a founder's personal holding company and is licensed to the operating company rather than owned by it, the licence terms, their duration and their termination provisions form part of what is being acquired, and a buyer will normally want ownership consolidated before closing rather than a warranty about it.

Open-source usage is the second recurring issue. The question is rarely whether open source is used, since it almost always is, but whether copyleft-licensed components have been linked in a way that could compel disclosure of proprietary code, and whether the company is able to produce a bill of materials. A buyer that cannot answer that question prices the uncertainty.

In SaaS, the contract base is the asset. Due diligence establishes the real renewal profile rather than the reported one: auto-renewal versus annual negotiation, notice periods, uncapped liability or unusual indemnities, service credits, most-favoured-nation clauses, and above all change-of-control provisions in the contracts that carry revenue concentration. A termination right on change of control held by a top-five customer is addressed through a condition precedent, a price adjustment or the allocation of post-closing risk, and it needs to be identified in the first week of diligence rather than in the sixth.

The commercial terms behind the revenue matter as much as the identity of the customers. Diligence tests how annual recurring revenue has been defined and whether that definition matches the contracts, since implementation fees, professional services, hardware resale and usage-based overage are frequently presented alongside subscription revenue. Liability provisions are read on the same basis, because a cap expressed as the fees paid in the preceding twelve months behaves very differently from an uncapped indemnity for data protection or intellectual property infringement, and uptime commitments, service credits and termination rights for repeated failure turn an operational problem into a contractual one. Public sector customers add procurement considerations, and where a contract has been awarded under a framework, whether it survives a change of supplier is a question for the framework rather than for the contract.

• The GDPR position is a value item, not a compliance footnote: lawful basis for the data the product uses, international transfer arrangements, processor terms with customers, the sub-processor chain and the notice rights customers hold over changes to it, and the treatment of customer data in model training. A breach history, any correspondence with the Autoriteit Persoonsgegevens and the records of processing are reviewed rather than taken on warranty.
• The open-source position is established through a bill of materials rather than asserted. The analysis distinguishes permissive licences from copyleft licences whose reciprocity obligations depend on how the component has been linked and on whether the software is distributed or delivered as a hosted service, and it extends to the components introduced by third-party dependencies rather than only those chosen directly.
• The EU AI Act applies in stages, with different application dates for, among other things, prohibited practices, general-purpose AI models and high-risk AI systems. Which obligations apply at the time of the transaction is established case by case.
• The Dutch Cybersecurity Act implementing NIS2 brings a large number of essential and important entities into a registration, risk management and prompt incident reporting regime, with management-level accountability.
• The Data Act and the DSA may apply depending on the business model, and sector regimes such as DORA apply where the target provides services to financial entities, which brings the target within its customers' outsourcing and ICT third-party requirements as well as its own.
• EU dual-use export controls apply to parts of the Dutch technology sector, and national licensing measures apply to advanced semiconductor manufacturing equipment, so classification, licence history and end-user screening are diligence items where the products or the underlying technology fall within the lists.

• Employee-created IP generally vests in the employer under the Copyright Act where the work falls within the duties for which the employee was engaged, but contractor and pre-incorporation IP requires a written assignment by deed, and that position is best confirmed before signing rather than addressed in disclosure. Software developed by a subsidiary or by a founder's holding company for the operating company raises the same question inside the group.
• Non-compete clauses in Dutch employment contracts are subject to strict formal requirements (art. 7:653 DCC), with additional requirements in a fixed-term contract, and a court can annul or limit the clause. That matters where the value depends on retaining founders and key engineers.
• Employee participation via a STAK with depositary receipts is the standard Dutch structure and keeps the cap table workable through multiple rounds. The taxable moment on employee share options is generally not exercise but the moment the shares become tradeable, where that is later, unless the employee elects to be taxed at exercise, which affects how plans are designed in companies with no liquidity event in prospect.
• Share transfers require a notarial deed (art. 2:196 DCC), which affects the mechanics of option exercises and secondary sales, and the articles will usually add offer or consent provisions that a secondary transaction has to work through.
• Investment screening under the Vifo Act catches designated sensitive technologies, including semiconductors and quantum technology, and the scope can be extended; we establish case by case which categories apply at the time of the transaction.