What do buyers actually look for during compliance due diligence?
During compliance due diligence, buyers look for evidence that governance is operational, not just documented. They want to see that controls are active, ownership is assigned, and the organisation can demonstrate continuous compliance across its regulatory obligations, not just a point-in-time certification.
In practice, this means buyers and their legal and technical advisors will examine several interconnected areas. They will review whether certifications such as ISO 27001 or ISO 42001 are current and whether the underlying management system is genuinely embedded in daily operations. They will assess GDPR compliance, including data processing agreements, records of processing activities, and breach response procedures. Where NIS2, DORA, or the EU AI Act applies, they will look for documented risk management, incident reporting frameworks, and accountability structures.
Beyond the paperwork, experienced buyers probe for what is sometimes called governance drift — the slow erosion of controls between audit cycles. They ask questions such as: who owns this policy today, when was it last reviewed, and what has changed since the last certification? If the answers are vague or inconsistent, that signals a governance system that exists on paper but is not actively managed.
Buyers also pay close attention to role-based accountability. A governance structure that depends on one or two key individuals, rather than embedded roles and processes, is treated as a continuity risk. In M&A contexts, key-person dependency in compliance functions is a known red flag because those individuals may leave post-acquisition.
How do compliance gaps affect deal valuation?
Compliance gaps affect deal valuation by giving buyers a concrete, defensible basis to reduce the price, introduce conditions, or restructure the deal. The financial impact depends on the severity of the gap, the regulatory exposure it creates, and how close the organisation is to a known deadline or enforcement action.
The most direct mechanism is the price chip. When advisors identify a material gap during due diligence, they quantify the cost of remediation and the potential regulatory penalty, then argue for a corresponding reduction in enterprise value. For gaps involving GDPR or NIS2, where administrative fines can reach significant percentages of global annual turnover, the theoretical downside can be large enough to justify a meaningful adjustment.
Beyond the headline price, buyers frequently introduce escrow arrangements, where a portion of the purchase price is held back until the seller demonstrates that identified gaps have been closed. This shifts the burden of remediation onto the seller, often under time pressure and at higher cost than if the work had been done proactively.
In some cases, particularly where gaps touch critical infrastructure, AI systems, or sensitive personal data, buyers use discovered compliance weaknesses to renegotiate the deal structure entirely. Earn-out provisions tied to compliance milestones, or representations and warranties insurance exclusions for known compliance issues, are increasingly common outcomes. Each of these mechanisms erodes the net proceeds the seller receives.
Which compliance gaps are most likely to delay or kill a deal?
The compliance gaps most likely to delay or kill a deal are those that create unquantifiable future liability, signal systemic governance failure, or involve active regulatory investigations. These gaps cannot be easily priced or remediated within a deal timeline, which makes them deal-breakers for risk-averse buyers.
Gaps that create open-ended regulatory liability
Unresolved GDPR breaches, particularly those that were not reported to the relevant supervisory authority within the required 72-hour window, represent a significant liability because the regulatory response is still pending. Similarly, NIS2 non-compliance in sectors classified as essential or important creates exposure that a buyer cannot fully assess or insure against before closing. Buyers faced with open-ended regulatory liability will either walk away or demand indemnities that make the deal economically unattractive for the seller.
Gaps that signal systemic governance failure
A missing or outdated ISO 27001 certification is concerning, but it is manageable. What buyers find harder to accept is evidence that the governance system was never genuinely operational. If policies have not been reviewed in years, if internal audits were never conducted, or if the organisation cannot produce evidence of management review, buyers conclude that the compliance posture is cosmetic. This type of systemic gap raises questions about what else may have been overlooked, and it undermines trust in the broader due diligence process.
What’s the difference between a compliance gap and a compliance risk?
A compliance gap is a specific, identifiable instance where an organisation’s current practices fall short of a regulatory requirement or standard. A compliance risk is the potential for harm, penalty, or operational disruption that arises from that gap or from future changes in the regulatory environment. The distinction matters because not every gap carries the same risk, and not every risk originates from an existing gap.
To make this concrete: if an organisation has not completed its Article 30 GDPR records of processing activities, that is a compliance gap. The compliance risk associated with it includes regulatory investigation, potential fines, and reputational damage if a breach occurs and the absence of records becomes visible to a supervisory authority. The gap is the fact; the risk is the consequence.
In a due diligence context, buyers assess both dimensions. They want to know what gaps exist today, and they want to understand the risk profile of each gap given the organisation’s sector, data footprint, and regulatory obligations. A gap in a low-risk area with a clear remediation path is treated very differently from a gap in a high-risk area with no documented owner and no remediation plan.
This distinction also shapes how governance should be structured. Continuous governance addresses both dimensions simultaneously: it closes gaps as they emerge and actively monitors the risk landscape so that new obligations are identified before they become gaps. Reactive compliance, by contrast, typically addresses gaps only after they have been discovered, by which point they may already carry significant risk.
How can organisations reduce compliance exposure before a sale process?
Organisations can reduce compliance exposure before a sale process by treating governance as a permanent operational capability rather than a pre-sale remediation exercise. The most effective preparation begins well before any transaction is contemplated, because buyers can distinguish between governance that is genuinely embedded and governance that was assembled quickly for the data room.
The practical steps fall into a clear sequence:
- Conduct an honest internal gap assessment across all applicable frameworks, including ISO 27001, GDPR, NIS2, and any sector-specific obligations. Identify gaps by domain, assign owners, and document remediation timelines.
- Close high-priority gaps before the process begins. Focus first on gaps that create open-ended liability or that signal systemic failure, as these are the gaps most likely to affect valuation or deal structure.
- Establish role-based accountability. Ensure that compliance ownership is distributed across defined roles rather than concentrated in one or two individuals. Buyers will look for this, and it reduces key-person risk.
- Maintain evidence of continuous operation. Management reviews, internal audit reports, policy review logs, and incident records all demonstrate that the governance system is alive, not dormant. Collect and organise this evidence well in advance.
- Align certification cycles with your anticipated transaction timeline. If a certification is due for renewal close to a potential sale, accelerate the process so that buyers see a current, valid certificate rather than one approaching expiry.
The underlying principle is that continuous governance is the most effective form of pre-sale preparation, precisely because it is indistinguishable from normal operations. An organisation that has maintained an active governance system across security, privacy, quality, and AI domains will enter a due diligence process with a data room that reflects genuine operational maturity, not last-minute remediation.
We built our governance services around exactly this principle: a subscription-based, always-active model that keeps organisations in a state of continuous readiness across their regulatory obligations. That readiness does not just support compliance — it protects enterprise value when it matters most. If you want to understand where your organisation stands before a sale process begins, contact us to plan a conversation and we will help you identify and close the gaps that matter.
Frequently Asked Questions
How far in advance of a sale should we start addressing compliance gaps?
Ideally, compliance remediation should begin at least 12 to 24 months before any anticipated transaction, as this gives your organisation time to close gaps, embed controls, and generate the evidence trail that buyers expect to see. Last-minute remediation is not only more expensive and disruptive, but experienced buyers and their advisors can usually tell the difference between governance that has been genuinely operational and governance that was assembled for the data room. If a sale is already on the horizon and time is short, prioritise closing gaps that create open-ended regulatory liability first, as these carry the greatest risk of derailing the deal.
What does a compliance data room typically need to include?
A well-prepared compliance data room should include current certifications (such as ISO 27001 or ISO 42001) along with their underlying audit reports, GDPR documentation including Article 30 records of processing activities, data processing agreements, and breach response procedures, as well as evidence of ongoing governance activity such as management review minutes, internal audit reports, and policy review logs. For organisations subject to NIS2, DORA, or the EU AI Act, documented risk management frameworks and incident reporting procedures should also be included. The goal is not just to show that policies exist, but to demonstrate that the governance system has been actively and consistently operated.
Can representations and warranties insurance cover compliance gaps discovered during due diligence?
Representations and warranties (R&W) insurance can provide useful protection in M&A transactions, but it typically excludes known issues — meaning any compliance gaps identified during due diligence are likely to be carved out of coverage entirely. Insurers will also scrutinise the quality of the seller's compliance posture when underwriting the policy, and a weak governance track record can result in higher premiums, broader exclusions, or outright refusal of cover. This is one of the strongest practical arguments for maintaining continuous, evidenced compliance well before a transaction: it keeps your options open and your insurance costs manageable.
How do buyers assess AI governance specifically, and what are the most common gaps they find?
Buyers assessing AI governance under frameworks such as ISO 42001 or the EU AI Act look for documented accountability structures, risk classification of AI systems, and evidence that human oversight mechanisms are genuinely operational rather than theoretical. The most common gaps organisations exhibit include the absence of an AI governance policy altogether, unclassified or undocumented AI use cases, and no formal process for assessing the risk of new AI deployments. Given that the EU AI Act introduces tiered obligations based on risk level, buyers in regulated sectors will pay close attention to whether the organisation has correctly identified its high-risk AI systems and put the required controls in place.
What happens if a compliance gap is discovered after the deal has already closed?
Post-closing discovery of compliance gaps can trigger several mechanisms depending on how the deal was structured. If the seller provided representations and warranties about the state of compliance, a discovered gap may constitute a breach that gives the buyer grounds for an indemnity claim. Where escrow arrangements were put in place, the buyer may seek to draw down against the held funds. In the most serious cases — particularly where the gap involves an unreported data breach or active regulatory investigation — the buyer may pursue legal remedies or, if the gap was known and concealed, allege misrepresentation. This underscores why proactive disclosure and genuine remediation before closing is always preferable to hoping gaps go unnoticed.
Is ISO 27001 certification alone sufficient to satisfy buyers in regulated sectors?
ISO 27001 is a strong foundation and is widely recognised by buyers as evidence of a structured approach to information security management, but it is rarely sufficient on its own for organisations in regulated sectors. Buyers will also expect to see GDPR compliance documentation, and depending on the sector, evidence of NIS2, DORA, or EU AI Act readiness. Critically, buyers look beyond the certificate itself to assess whether the underlying management system is genuinely active — a lapsed or narrowly scoped certification, or one that cannot be supported by internal audit and management review evidence, will raise more questions than it answers.
What is governance drift, and how can organisations detect and prevent it?
Governance drift refers to the gradual erosion of compliance controls between formal audit cycles — policies that are no longer reviewed, ownership that has shifted without being reassigned, and procedures that have fallen out of step with how the organisation actually operates. It is one of the most common findings in due diligence precisely because it is invisible until someone looks closely. Organisations can detect it through scheduled internal audits, regular policy review cycles with documented sign-off, and periodic management reviews that assess the current state of the governance system against its documented requirements. Preventing it requires treating compliance as a continuous operational function rather than a periodic certification exercise.
Related Articles
- Why does governance lose its power when it gets pushed too far down the organization?
- What is meant by governance drift and how do you prevent it?
- How do you make sure your certification stays valid between audit cycles?
- Why do companies have the policies but lack the capacity to implement them?
- What should you check before assuming an AI solution meets AI Act requirements?