How to prepare a contract diligence findings report for Software License Agreements

Prepare a licensee-side software diligence report by reconciling the controlling contract package with actual and planned software use, then translating material gaps into decisions. Each finding should identify its source, affected entitlement or protection, business consequence, uncertainty, and accountable owner. The deliverable is a prioritized findings table supported by contract citations and deployment evidence, with a short decision summary distinguishing confirmed restrictions, unresolved questions, and proposed remedies. Keep recommendations separate from conclusions about breach, enforceability, or required transaction consent.

When to use this workflow

Use this workflow when an acquisition, restructuring, cloud migration, vendor renewal, or internal review requires counsel to explain whether critical software rights support the business plan. The audience includes technology counsel, transaction teams, procurement, IT asset management, and business owners responsible for continuity.

Define which licensee entities, products, deployments, and proposed changes the report covers. Distinguish installed software licenses from hosted subscriptions, maintenance arrangements, and OEM distribution rights. Retain related documents where they affect the licensed product, but do not treat those arrangements as interchangeable.

This is a general US transactional workflow, not advice for a particular matter. Contract interpretation and enforceability require analysis of wording, governing law, facts, and deal context. The federal copyright issue discussed below is separate from those contractual questions.

What you need

Collect the signed master agreement, orders, entitlement schedules, amendments, maintenance terms, escrow documents, and incorporated online terms. Preserve available dated versions; do not use a current vendor webpage as proof of terms incorporated into an older order.

Obtain technical evidence covering legal entities, affiliates, contractors, locations, hosts, virtual machines, cores, named or concurrent users, testing, and disaster recovery. Record the inventory date and ask the technical owner which facts are measured, estimated, or unknown. Include license-server records where they help establish the contractual usage metric.

Also obtain the transaction structure or migration plan, business-criticality assessment, renewal calendar, vendor correspondence, and available audit history. Request pricing and spending records where financial exposure cannot be assessed from the contract alone.

Identify the review baseline: the licensee’s own dated checklist and instructions, including required permissions, fallbacks, escalation criteria, and approvers. This is an internal review standard, not evidence of market practice or a claimed software feature.

Use the template

Use the Software License Agreements — Contract diligence findings report companion template below. You can copy this table into your working document or spreadsheet. Maintain supporting extracts and calculations in cross-referenced working papers.

Assign stable finding IDs rather than relying on spreadsheet row numbers. “Source / baseline” should identify the document version, clause or page, and relevant checklist item. Supporting extracts should retain exact wording, definitions, exceptions, and cross-references.

“Finding / evidence” connects the provision to an operational fact. “Consequence” identifies the affected activity, separating disruption from possible financial exposure. “Gap / confidence” distinguishes absent language from a missing schedule, unreadable page, unverified fact, or unresolved interpretation. Confidence describes evidentiary support; it is not the same as priority.

Record a specific next action and internal owner. “Decision / status” should distinguish awaiting evidence, requiring vendor agreement, authorized risk acceptance, and resolution supported by documentation. If a working-paper calculation supports a finding, include its sheet and cell references.

Step by step

1. Establish the document perimeter and decision date

Create a document index with stable IDs, dates, parties, execution status, and relationships between masters, orders, amendments, and schedules. Identify precedence language without assuming that the newest document overrides every earlier term.

Define the bounded decision: closing readiness, migration permission, renewal strategy, or another specified question. Record the evidence cutoff and required decision date. Separate documents supplied from documents actually reviewed. Flag missing incorporated terms and uncertain amendment status rather than silently selecting a controlling text.

Template output: document-gap findings showing affected products, missing sources, retrieval owners, and the decision each gap prevents.

2. Reconcile entitlements with deployment facts

Map the grant against the inventory using the contract’s measurement units. Do not translate concurrent users into named users, processors into cores, or production installations into all environments without a supported basis. Check affiliate access, contractors, hosting, geography, backup, testing, and disaster recovery separately.

Historical drafting illustrates the need to read permissions together: §§ 2.1 and 3.1 of the Express Digital Graphics–CPI agreement address defined studio/lab use and specified backup, disaster-recovery, testing, and quality-assurance copies alongside restrictions. Those provisions illustrate wording, not default rights.

Ask IT to validate both counts and classification. An inactive installation may still matter under a metric that counts installations rather than simultaneous use.

Template output: each material entitlement mismatch, with inventory evidence, contractual metric, exceptions, and technical validation status.

3. Test the proposed change, not just current use

Compare present deployment with planned ownership, entity consolidation, outsourcing, and infrastructure changes. Examine assignment, change-of-control, authorized-site, and third-party-use provisions together. Specify the event and affected licensee before assessing whether consent is implicated.

The Jabber–France Telecom filing, Attachment E-1, § 15, contains specimen language requiring prior written consent for assignments, including by operation of law, and treating ownership changes as assignments; consent must not be unreasonably withheld. This is a drafting example, not a universal change-of-control rule or proof of executed end-user rights.

Identify whether the report needs a contractual reading, governing-law analysis, vendor clarification, or consent. Do not equate a recommended consent request with a definitive conclusion that consent is legally required.

Template output: affected event, relevant language, interpretive question, proposed remedy, and transaction owner.

4. Assess audit exposure and continuity protections

Review compliance-audit rights against usage records and the systems an audit could expose. Extract scope, frequency, notice, auditor qualifications, confidentiality, cost allocation, true-up pricing, and dispute mechanics. Distinguish the vendor’s compliance audit from any licensee right to audit charges.

For comparison, Express Digital Graphics–CPI § 3.2 specifies an independent auditor reasonably acceptable to the licensee, confidentiality protection, reasonable written notice, regular business hours, and no more than one audit per twelve months. These are contractual safeguards, not statutory requirements; reasonable notice is not a fixed day count.

Review suspension and termination with support, warranties, IP indemnity exclusions, liability limitations, and exit rights. For critical installed software, examine whether escrow documents and release-use rights support the proposed continuity plan. Report missing evidence rather than assuming escrow guarantees operability.

Template output: exposure and continuity findings, identifying evidence limitations, interacting clauses, and pricing assumptions.

5. Separate copying questions from contractual permissions

Where migration, backup, or recovery creates additional copies, identify the contract question and any separate statutory question. Do not assume that possession under a license establishes ownership of the program copy.

17 U.S.C. § 117(a) permits an owner of a program copy to make or authorize essential-step copies or adaptations under specified use conditions, or archival copies subject to destruction when continued possession ceases to be rightful. The ownership prerequisite and conditions require analysis; this provision does not itself resolve contractual restrictions.

Keep this analysis proportionate. If the contract clearly permits the proposed activity, record that basis rather than turning every backup installation into an unnecessary statutory inquiry. Where ownership or permission remains disputed, assign the legal question explicitly.

Template output: proposed copying activity, express permissions or restrictions, unresolved ownership facts, and legal-analysis owner.

6. Prioritize findings and formulate proportionate remedies

Assess legal uncertainty, operational feasibility, financial exposure, and business criticality separately before assigning priority. Missing permission for a critical migration may demand action even when exposure is unquantified. An unusual clause may be immaterial to the planned use.

Match the remedy to the problem: retrieve a schedule, validate inventory, obtain consent, amend scope, negotiate audit protections, or develop an operational alternative. Separate existing rights from requested improvements. For financial scenarios, disclose the usage assumptions, pricing source, and disputed dependencies; do not present a modeled amount as established liability.

Where action depends on renewal, cancellation, cure, or notice provisions, preserve the contractual trigger, day-count language, delivery method, and receipt mechanics in supporting records. Label internal planning buffers as administrative choices.

Template output: reasoned priority, proposed remedy, accountable owner, decision timing, and required approval for residual risk.

7. Assemble the decision summary and verify closure

Lead with decisions needed, dependencies, and unresolved evidence—not a clause inventory. Group findings by product or business dependency. State the scope reviewed, evidence cutoff, and limitations so decision-makers can understand what the report does and does not establish.

Have technical owners verify deployment facts and counsel verify contractual characterizations. Reconcile related findings: ownership consent may not cure excess instances or approve a new host. Avoid counting the same potential charge repeatedly across linked issues.

Do not close a finding because a request was sent. Review the resulting consent or amendment, its covered entities, products, conditions, and duration. Record authorized risk acceptance separately from confirmation of compliant use.

Template output: final status for each material finding, documented approvals, and an assigned handoff for issues remaining open at the cutoff.

Worked example

Fictional scenario: Alder Basin Components LLC is evaluating an acquisition by Juniper Vale Holdings Inc. Alder uses fictional supplier Kestrel Logic’s ForgeMap software for production scheduling. Its executed agreement, D01, § 2 permits two production instances and one dormant recovery instance, with hosting sites identified in Schedule B. A planned migration would operate old and new environments in parallel for three weeks.

D01 § 12 expressly requires prior written consent for a change in ownership. Schedule B is missing from the supplied package. Inventory INV01 verifies two current production instances and one dormant recovery instance but does not establish the migration peak. Vendor email E01 says cloud deployments are supported without identifying approved sites or additional instance rights. Internal checklist LCP-v1 contains ownership-consent item C2 and deployment-scope item L3. All parties, documents, provisions, and facts in this example are fictional.

The report replaces “software is licensed” with three independent dependencies. Counsel can pursue ownership consent while IT establishes temporary capacity needs. Site approval remains unresolved even if the vendor grants additional instances. Each item is high priority because it affects the acquisition or migration decision, not because missing evidence proves breach. The available sources establish no current excess deployment and support no invented true-up amount.

Common mistakes

• Treating the master as the complete entitlement. Retrieve orders and schedules before interpreting a missing metric as unlimited use.
• Ranking clause novelty instead of business impact. Explain the affected operation, timing, uncertainty, and mitigation behind each priority.
• Treating vendor correspondence as an amendment. Assess what the message establishes, sender authority, amendment requirements, and scope.
• Converting missing evidence into confirmed breach. Identify the gap, assign validation, and state the conditional consequence.
• Closing linked issues with one narrow consent. Check whether the remedy covers ownership, quantities, hosting, and duration as applicable.

Final quality check

• Every material finding has a verified document/version ID and pinpoint source.
• Entitlement metrics match the contract and validated technical evidence.
• Missing attachments, unreviewed materials, and precedence conflicts remain visible.
• Current use is distinguished from planned acquisition or migration use.
• Priority reflects business consequences and timing, separately from confidence.
• Financial assumptions and unresolved legal questions are explicit.
• Open issues have owners and decision routes; closed issues have supporting evidence.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its due diligence capabilities include bulk document classification to organize documents and prioritize human review; tabular review supports work across documents. For contract review in Word, choose the licensee as the represented party and provide deal-specific instructions. Findings quote clauses, rank severity, locate text, and identify missing language as not present. Lawyers retain responsibility for source verification, deployment facts, and the report’s conclusions. Book a demo to discuss this reporting workflow.

Frequently asked questions

Should the report include every clause reviewed?

No. Report material findings and decisions. Retain the broader review record separately, identifying acceptable provisions and topics not examined so silence does not imply review.

How should perpetual licenses and maintenance be reported?

Record the license entitlement and maintenance period separately. Check continued use, upgrades, support, and termination against the actual documents; do not infer that one period controls all rights.

Can counsel estimate audit exposure before usage is validated?

Use a labeled scenario only with identified inputs. State the contractual metric, assumed usage, pricing source, and disputed dependencies. Otherwise report exposure as unquantified and assign the missing work.

What if the vendor will not supply a missing schedule?

Identify the permission that remains unverified. Seek express confirmation or amendment, assess operational alternatives, and identify the authorized risk decision-maker. Do not reconstruct the schedule from assumptions.

Sources

• U.S. Copyright Office, Copyright Law, Chapter 1, § 117.
• Express Digital Graphics–CPI Software License Agreement, §§ 2.1, 3.1, and 3.2.
• Jabber–France Telecom OEM Agreement, Attachment E-1 specimen software license, § 15.

Legal-source scope: October 13, 2026. The SEC-filed materials illustrate historical drafting, not market standards, current vendor terms, or enforceability.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.