Q&A: due diligence for tech M&A in France

Due diligence

Typical areas

What are the typical areas of due diligence undertaken in your jurisdiction with respect to technology and intellectual property assets in technology M&A transactions? How is due diligence different for mergers or share acquisitions as compared to carveouts or asset purchases?

The typical areas of IP due diligence in France include verification of the accuracy of IP portfolio provided by the target company with regard to registered trademarks, patents, SPCs, utility models, plant variety right, designs and semiconductors, as well as domain names. Due diligence shall also cover the verification of the incorporation of open-source software within technologies used by the target company, as well as the existence of open-source licensing agreements such as GNU General Public Licence with the target’s clients or service providers.

With respect to data protection, due diligence is carried out in the area of GDPR, including the review of the internal procedures and documents proving the target company’s compliance, and of the policies published on its websites.

In some cases, due diligence will also cover cybersecurity and the examination of the security incident procedures implemented by the target company. Hence, the results of the vulnerability tests such as pen tests turn out useful to establish the level of the target company’s maturity with regard to information security.

With regard to IP due diligence for carve-outs, the buyer must be particularly attentive with regard to transferability of the IP rights and change of control terms, where potential rights impacting IP ownership can be granted in connection with change of ownership or management of the target company. Thus, the buyer needs to pay attention to any clauses relative to these issues in previous agreements. Another aspect specific for carve-outs would be the information related to the change of name, in the meaning of trademark, but also of its commercial use in communication with partners and clients, in email addresses and domain names. The question of the durability and continuity of the name will be more important in case of partial transactions to avoid the confusion between entities and their name use. Finally, the modalities of the transition need to be further investigated. It is in interest of both parties to discuss whether the systems are autonomous or require the assistance in transition of certain services or duplication of crucial software information.

Customary searches

What types of public searches are customarily performed when conducting technology M&A due diligence? What other types of publicly available information can be collected or reviewed in the conduct of technology M&A due diligence?

A potential investor or buyer usually carries out searches in publicly available IP databases (eg, INPI for French IP registrations, OAMI for EU IP registrations, or the World Intellectual Property Organization for international registrations) to verify the accuracy of the IP-related information provided by the target company. The findings of the searches usually include the name of the registered owner, the dates of registration and potential expiration, and the existence of any registered licence or security interest or any other potential type of restraint (such as limited class of products or services for trademarks, or non-payment of the renewal fee in a given country for a patent).

Private databases (ie, databases requiring subscription fees) may give additional relevant information, including the existence of any past or pending litigation involving the target company as a claimant or a defendant, or involving the target company’s IP assets.

In some cases, such IP databases may also allow the identification of any prior or posterior IP rights owned by third parties, which could constitute an obstacle to the use by the target company (and the potential buyer post-closing) of its IP assets.

With respect to data protection, before the entry into force of the GDPR, the data protection authorities often provided for the list of formalities to be carried out by companies on their respective websites. Even though the GDPR no longer requires formalities to be carried out (since data controllers and processors must keep a register of their data protection activities), such information may still be relevant to assess the target company’s compliance for the period before 25 May 2018.

Registrable intellectual property

What types of intellectual property are registrable, what types of intellectual property are not, and what due diligence is typically undertaken with respect to each?

Not all types of intellectual property are registrable in France; trademarks, patents, SPCs, utility models, plant variety right, designs and semiconductors are. In contrast to common law countries, France does not provide for registration of author’s rights (equivalent of copyrights in the United States).

Software is not registrable. However, source codes may be held in escrow by a third party, such as a public notary or an agency dedicated to software (eg, the APP Agency for the Protection of Programs).

Acquirers will usually need to be provided with the list of intellectual property owned or used by the target company or necessary to run the target company’s business on a stand-alone basis. This is particularly important in respect of non-registrable intellectual property since it cannot be found, traced or verified on public databases. The assessment of the nature of non-registrable intellectual property that the target company owns or uses, and of potential associated restraints, can be conducted by reviewing the target company’s rights and obligations provided under related contracts.

Due diligence undertaken with respect to registered IP assets include verification of the registered owner’s name, the dates of registration and potential expiration, the existence of any registered licence or security interest, or any other potential type of restraint (such as limited class of products or services for trademarks, non-payment of the renewal fee in a given country for a patent, etc). For patents, due diligence may also include verification whether the title is opposed before the EPO or the French PTO.

Liens

Can liens or security interests be granted on intellectual property or technology assets, and if so, how do acquirers conduct due diligence on them?

Yes, specific liens and security interests can be granted on IP rights (eg, trademarks, patents, movies, designs, domain names, software and databases). For unregistered IP rights (such as domain names, software and databases), since there is no legal provision specifically relating to the grant of security interests thereon, it is important to identify the register or the database on which the lien or security interest should be recorded and how to ensure that the lien can be enforced against third parties. Intellectual property rights can also be part of the liens and security interests taken on the tangible and intangible assets of the grantor.

Employees and contractors

What due diligence is typically undertaken with respect to employee-created and contractor-created intellectual property and technology?

When intellectual property is developed or created by an employee or a contractor, it is important to ensure that the rights in such intellec­tual property are vested in the target company. Patentable inventions that are developed by employees as part of their employment and during the performance of their duties are automatically assigned to the employer which must pay additional compensation to the employee for such assignment. Those patentable inventions that are developed by employees outside the scope of their employment but using resources provided by the employer belong to the employee; the employer may, however, ask to be assigned ownership in consideration of a fair price. In this respect, it is important to check whether there is an IP assignment clause associated with an appropriate supplementary remuneration policy. Inventions that are developed by employees outside the scope of their employment using their own resources belong to the employee (article L 611–7 of the French Intellectual Property Code). Software created by employees during the scope of their employment automati­cally belong to the employer unless the employment agreement provides otherwise (article L 113–9 of the French Intellectual Property Code). Specific requirements shall apply to software created with open-source licences, where certain licensing conditions have to remain the same as for the initial licence. The inventions incorporating such type of software must be identified and thoroughly investigated to ensure their compliance with licensing terms.

Special attention should be paid to trainee contracts: in the absence of an assignment clause, trainees remain owners of the inventions and software they develop.

All other intellectual property created by employee or contractor belong, from the beginning, to the employee or contractor and, there­fore, must be expressly assigned in writing to the employer. In particular, it is recommended that copyright assignments be detailed, in particular, in respect of the scope of the economic rights to be assigned. However, assignment of economic future rights in works is not allowed.

Transferring licensed intellectual property

Are there any requirements to enable the transfer or assignment of licensed intellectual property and technology? Are exclusive and non-exclusive licences treated differently?

Transfer or assignment of licensed intellectual property and technology must be registered on the relevant IP register to become enforceable against third parties. In practice, non-exclusive licences are not regis­tered. Depending on the terms of the licence agreement, consent of the licensee may be required for the transfer or assignment of the licensed IP and technology. Indeed, such a transfer will most likely imply the transfer or assignment of the licence itself. In any case, such transfer can only be possible according to the terms of the IP rights assignment or transfer clause provided in the licence agreement, which might, as the case may be, limit its scope or impose specific requirements related to such transfer.

Software due diligence

What types of software due diligence is typically undertaken in your jurisdiction? Do targets customarily provide code scans for third-party or open source code?

When software is a key asset of the transaction, specific software due diligence will help with assessing the rights and obligations of the target company associated with such software. The following due diligence is typically undertaken as part of this software audit:

• identifying whether the software owned or used by the target company is proprietary or open source-based and who actually developed the source code (the target company’s employees or outside contractors);
• verifying that all of the IP rights in the software are vested in the target company;
• identifying any open source software, including open source soft­ware used to develop the target company’s software (eg, Apache) and associated licence terms, as those licence terms may apply to the software into which open source components have been integrated (contamination effect);
• detecting vulnerabilities of the software components or those components that are not in use, are slowing the software opera­tion or need to be updated or upgraded; and
• assessing whether the software used by the target company is the most efficient and reliable software for the target company.

It is not customary for targets to provide scans for third-party or open source code.

In some cases, a specific technology due diligence might be required in order to verify the technical aspects of software within the scope of the transaction.

Special or emerging technologies

What are the additional areas of due diligence undertaken or unique legal considerations in your jurisdiction with respect to special or emerging technologies?

The legal framework with respect to special or emerging technologies is itself emerging or non-existent. Additional areas of due diligence undertaken or unique legal considerations with respect to such tech­nologies focus on the following key legal issues:

• for artificial intelligence, whether the software performs tasks that are regulated (eg, providing legal or financial advice) and whether the privacy and cybersecurity risk assessments have been performed;
• for internet of things and autonomous driving, personal data and liability;
• for big data, on security and personal data, especially focusing on how the system has taken into account the purpose limitation enshrined in the GDPR and other aspects that may be subject to new regulations such as AI Act, Data Act, Data Governance Act and Digital Services Act;
• for Cloud hosting, on location of the premises, security and storage of personal data, in particular if such data can potentially be communicated to foreign governments; and
• for sale of products and services to consumers (B2C), on liability and compliance with consumer protection laws and fair practices.