Your due-diligence playbook lists 60 SaaS contracts. The target firm has 200 SaaS tools in active use. The 140 you didn't see in the data room are coming with the deal. So are their compliance obligations, their renewal commitments, and their AI features. This is the SaaS governance gap that most acquirers discover after the deal closes, not before.
This piece is the structured addendum to standard tech due diligence. The seven items that surface the gap, the AI-specific add-ons, the red-flag patterns, and a pre-close audit pattern that buyers can require contractually.
What Standard Tech Due Diligence Covers
Standard playbooks ask for the things that are recorded. The vendor list from procurement. The active contracts in the contract management system. The renewal calendar from finance. The security questionnaires from the previous twelve months. The known incidents and the response postures. For non-AI vendors with mature internal procurement, this captures most of the picture.
The gap appears when the firm being acquired has the buying patterns of the past five years; credit-card SaaS adoption, team-budget devtools, free-tier consumer AI usage, embedded AI features turning on inside SaaS the firm already had. None of these surface in the data room because none of them appear in the systems standard due diligence inspects, and none of them appear in the target's SaaS inventory either.
Seven Items to Add to the Playbook
Each item identifies a category of obligation that survives the close and that the acquirer inherits.
Personal-card subscriptions. Run an expense management query for the last 24 months filtered to recurring software charges under the procurement threshold. The output is rarely shorter than thirty entries at a target firm with two hundred employees, and is rarely surfaced in data rooms because expense data is not part of the standard tech DD bundle. Each entry is a contractual relationship the buyer inherits, and collectively they represent the shadow IT layer that no standard data room exercise reaches.
AI feature inventory. Ask which AI features are turned on inside the SaaS that does appear on the inventory. Notion AI, Slack AI, HubSpot Breeze, Microsoft Copilot, Salesforce Einstein, Atlassian Intelligence, Zendesk AI. Each generates obligations the documented SaaS contract does not reference. The data room rarely includes this layer. Effective software inventory management in the AI era requires the AI feature layer, not just the application layer.
ICT register quality and currency. For target firms in scope of DORA, ask to see the Article 8 register and the date of last refresh. A register more than ninety days stale is a substantive operational gap. A register that does not exist for a firm in DORA scope is a finding. The same logic applies to NIS2 supply chain inventories for in-scope non-financial firms.
RoPA currency. Ask to see the GDPR Article 30 records of processing activities and ask when each entry was last reviewed. RoPA entries last refreshed before any AI feature activation in the corresponding SaaS are stale; the rebuild work the buyer inherits is the cost of bringing the register current. The cost is real and rarely reflected in the deal economics.
Third-party concentration. Beyond the documented vendors, look at the concentration of underlying infrastructure. How many of the SaaS tools run on the same cloud, with the same identity provider, with the same handful of payment processors. The concentration analysis reveals systemic exposure that single-vendor analysis misses.
Free-tier usage. Survey or audit for free-tier consumer AI usage across the workforce. The pattern is reliable: any target firm with a meaningful engineering or marketing function has free-tier ChatGPT usage in the workflow. The post-close cleanup, moving employees onto sanctioned tiers, retroactively assessing what data has been processed, is the shadow IT remediation work the buyer inherits under a different name.
Evaluation creep. Ask the engineering and product teams which AI tools are currently "in evaluation." The honest answer is rarely zero, and the evaluation status of each tool typically obscures whether the tool is actually processing production data. The clearest test: does the tool have access to production credentials or production data, and if so, what governance applies. The answer at most target firms is some and informal.
Red-Flag Patterns
Three patterns warrant deeper review before the deal proceeds.
High engineering headcount with no central tooling-spend record. Engineering organisations without central control of tool budget reliably accumulate substantial shadow tooling, typically thirty per cent or more of total SaaS surface, in our audits. The integration cost is correspondingly substantial because the rationalisation work runs across the engineering culture, not just the SaaS management system.
Recent AI initiative without a documented governance layer. The target firm that announced an "AI strategy" in the last twelve months but cannot produce an AI inventory has the same exposure as a target with no AI initiative, but with the additional risk that the firm believes itself to be ahead of the curve. The narrative gap is the operational gap is the buyer's inherited problem.
Non-EU-resident SaaS for EU customer data. Target firms operating in the EU customer market with material reliance on non-EU SaaS providers without explicit residency commitments are running a transfer-mechanism exposure. The exposure may have been manageable in the seller's hands; under the buyer's brand, with the buyer's customer relationships, the exposure changes shape.
What Montro Finds in Pre-close Discovery |
When Montro runs a pre-close discovery exercise for an acquirer, the comparison between the data room inventory and the actual discovery output is where the deal conversation changes. The data room indicated sixty items, and the discovery came back with one hundred and eighty. The acquirer will inherit all one hundred and eighty regardless of the fact that the data room did not make the other one-twenty disappear. What the data room did was leave them unpriced. Each undisclosed tool is a liability the buyer is now absorbing without a negotiated adjustment. Some are renewal commitments, some are AI tools with EU AI Act deployer obligations attached, and some are processing EU customer data with no DPA in place. The discovery output does not create these problems; it only surfaces them before the deal closes, which is the only moment they can be priced, negotiated, or walked away from. |
A Pre-Close Audit Pattern that Buyers can Require
The contractual mechanism. The acquirer can require, as a closing condition or as part of the representations and warranties, a structured discovery audit conducted by an independent party against an agreed scope. The output is a documented inventory and classification register that the buyer takes possession of at close, with any disclosed exceptions priced into the deal.
The scope items that work in practice: the seven additions listed above; a documented sub-processor lineage for the top thirty SaaS by data sensitivity; an AI feature inventory at the workspace and tenant level; a triage list of the high-risk subset that requires post-close remediation. Together these form the basis of a credible SaaS inventory the acquirer can rely on at close.
The output is not pre-close compliance. It is pre-close visibility. The acquirer inherits the obligations either way; the difference is whether the inheritance is documented through proper software inventory management and priced in, or surfaces as integration surprises in the first quarter post-close.
Frequently Asked Questions
What should a buyer do if the target firm has no AI inventory at all?
Treat the absence as a red flag, not a blocker. The lack of an AI inventory means the buyer cannot assess what obligations are being inherited, not that no obligations exist. The practical response is to require a structured AI discovery exercise as a condition to close, with the output delivered before signing or priced into the representations and warranties as a known gap. A target firm with no inventory is not unusable; it is a target whose inherited obligations are unquantified until the inventory exists.
Are AI-related compliance obligations transferable in an acquisition?
Yes. When a firm is acquired, the acquirer inherits the target's contractual relationships, regulatory obligations, and compliance posture, including any gaps. An ungoverned AI tool in the target's environment does not disappear at close; it becomes the acquirer's ungoverned AI tool, with the acquirer's brand and regulatory profile attached. GDPR processor obligations, EU AI Act deployer obligations, and DORA ICT register requirements all remain attached to the legal entity after acquisition.
How does evaluation creep differ from shadow IT in a due diligence context?
Shadow IT is an unsanctioned tool adoption the organisation does not know about. Evaluation creep is tool adoption the organisation knows about but has not formally governed, typically framed as "we're just testing it." The distinction matters in due diligence because evaluation tools are often disclosed voluntarily while shadow tools are not, creating a false picture of governance maturity. The relevant question for both is the same: does the tool have access to production data, and if so, what governance applies.
What is the standard timeframe for a pre-close SaaS and AI discovery audit?
A structured discovery exercise covering the seven items in this piece; expense data, AI feature inventory, ICT register, RoPA currency, concentration analysis, free-tier usage, and evaluation creep, typically takes thirty days at a mid-market target firm with the right data source access. The output is a documented inventory and classification register the buyer takes possession of at close. Requiring this as a pre-close condition adds thirty days to the timeline; not requiring it typically adds considerably more to the post-close integration programme.
