Product & Market Compliance Due Diligence: M&A Checklist

Product and market regulatory compliance due diligence evaluates whether a target company's products, commercial claims, technical documentation, registrations, and certifications legally permit it to sell into its target jurisdictions. Unlike generic corporate compliance diligence, which concentrates on broad organizational governance such as anti-bribery, anti-money laundering, general data protection, labor practices, and environmental health and safety, product and market compliance investigates the lawful marketability of specific revenue-generating assets. In modern cross-border transactions, this specialized review determines whether core commercial revenue is legally protected or exposed to immediate enforcement, product recalls, or complete market exclusion.

Regulatory authorizations, valid CE markings, and correct product classifications function as substantial competitive moats. Gaining market entry in regulated categories requires significant capital and protracted timelines. For instance, anyone who wants to sell a device in the United States must make a 510(k) submission at least 90 days prior to offering the device for sale, and the device may not be marketed until the FDA issues an order finding it substantially equivalent. Preparation, testing, and review cycles commonly absorb many months of engineering and regulatory work before a single unit can be sold. When an acquisition target operates with flawed classifications, expired certifications, or unsubstantiated marketing claims, the acquirer inherits severe regulatory liabilities that can instantly impair terminal value.

Distinguishing Product Diligence from Generic Corporate Compliance

Corporate compliance reviews routinely assess whether a target company maintains standard internal governance policies and statutory registers. However, generic reviews frequently miss underlying technical non-compliance in the product catalog. Evaluating commercial viability requires deal teams to verify whether product specifications align with underlying technical files, whether local distribution licenses exist in every active sales territory, and whether on-pack claims comply with sector-specific marketing frameworks product market checklist.

• Scope of authority: Generic compliance inspects corporate entity standing and HR policies, whereas product compliance evaluates technical files, product master records, and national health authority clearances.
• Revenue durability: Flaws in entity governance rarely halt physical sales overnight, but an invalid CE mark or an unapproved therapeutic claim can lead to immediate border seizures, injunctions, and stop-sale orders.
• Remediation complexity: Updating an employee handbook takes weeks, while re-certifying a complex hardware asset or resolving a Notified Body non-conformity can take years and require full clinical re-evaluations.

A comprehensive product and market due diligence framework evaluates target assets across three sequential pillars: pre-market authorizations, quality management systems, and post-market advertising claims. Deal teams must test each pillar using primary regulatory documentation rather than relying on management representations or high-level warranty disclosures.

Pillar 1: Pre-Market Authorizations and Classification Accuracy

Deal teams must independently verify that all commercial products hold valid, unexpired marketing clearances from primary regulatory authorities. In the medical technology domain, this includes checking FDA 510(k) clearances, Premarket Approvals (PMA), or De Novo grants against the target company's complete SKU list. For European markets, acquirers must inspect valid CE certificates issued by designated Notified Bodies under Regulation (EU) 2017/745 (MDR) or Regulation (EU) 2017/746 (IVDR), the regimes that govern conformity assessment before a device is placed on the EU market.

Acquirers must be aware that valid CE certificates do not automatically transfer post-acquisition. In asset purchases or structural reorganizations, changes in legal manufacturer identity, designated authorized representatives (EC REP), or production facilities trigger mandatory Notified Body reviews, contract novations, and quality system audits before products can be legally released under the buyer's name.

Pillar 2: Quality Systems and Technical Documentation

Holding a formal clearance is insufficient if the underlying quality management system (QMS) is defective. Diligence must examine whether manufacturing facilities and design controls comply with ISO 13485 standards or the FDA Quality Management System Regulation (QMSR). Deal teams must review the target's technical documentation files, Design History Files (DHF), Risk Management Files (ISO 14971), and Corrective and Preventive Action (CAPA) logs to confirm that engineering changes made over time remain within the scope of cleared indications.

Pillar 3: Post-Market Advertising and Marketing Claims

Commercial growth in consumer health, functional foods, supplements, and digital health often relies on aggressive marketing claims across websites, social media, and packaging. Diligence requires testing whether these claims possess competent and reliable scientific evidence prior to public dissemination. Under the Federal Trade Commission (FTC) policy statement regarding advertising substantiation, a firm's failure to possess and rely upon a reasonable basis for objective claims constitutes an unfair and deceptive act or practice in violation of Section 5 of the FTC Act.

In the European Union, the European Food Safety Authority (EFSA) enforces strict standards under Regulation (EC) No 1924/2006. Out of more than 2,300 health claim applications evaluated, the European Commission has approved over 260 health claims, while more than 70% of evaluated claims have been rejected due to a lack of sufficient scientific evidence. When targets market supplements or functional products using unauthorized health claims, buyers face severe enforcement from national regulators, consumer protection authorities, and competitor litigation.

• Pre-market checks: Confirm that device classification codes, intended use statements, and clearance letters match the physical product configurations sold in the market.
• Quality system audits: Review internal audit results, supplier qualification files, and Notified Body audit surveillance reports to identify unresolved non-conformities.
• Claim substantiation files: Cross-reference every quantitative marketing assertion on direct-to-consumer websites and packaging against peer-reviewed clinical studies held in the target company's archives.

To conduct rigorous legal due diligence on product and market compliance, deal teams must issue structured, granular document requests early in the virtual data room (VDR) process. Standard legal request lists often request 'material permits and licenses,' which invites ambiguous target disclosures. Diligence teams should require specific primary documentation files for every revenue-generating product line.

Primary Regulatory Filings and Technical Files

Buyers should request complete regulatory dossier copies rather than high-level confirmation letters. This includes original FDA 510(k) summary packages, clearance letters, PMA approval orders, establishment registration records, and device listings. For European products, request the complete Technical Documentation compiled under MDR Annex II and Annex III, including Clinical Evaluation Reports (CER), Post-Market Clinical Follow-up (PMCF) plans, and Periodic Safety Update Reports (PSUR).

Acquirers must verify that historical engineering changes, material substitutions, and software version updates have been evaluated through formal change control protocols. Diligence must establish whether cumulative product modifications required a new 510(k) filing or a formal Notified Body submission, or whether they were properly documented in internal Letters to File.

• Regulatory Authorizations: Full copies of all clearances, CE certificates, classification rationales, authorized representative agreements, and national establishment registrations across all operating territories.
• Quality and Technical Files: ISO 13485 certificates, ISO 14971 risk files, current Clinical Evaluation Reports, design verification and validation test reports, and software life-cycle documentation (IEC 62304).
• Regulator Correspondence: Complete correspondence histories with the FDA, national competent authorities (such as BfArM, ANSM, MHRA), and Notified Bodies over the preceding five years, including inspection reports (FDA Form 483s), audit findings, and formal response letters.
• Adverse Event and Recall Logs: Mandatory vigilance reports, Medical Device Reports (MDRs), Field Safety Corrective Actions (FSCAs), recall documentation, and customer complaint trends categorized by root cause.
• Advertising Substantiation Dossiers: Master marketing claims matrices mapping every promotional assertion on packaging, websites, and advertising collateral directly to underlying clinical trial reports or authorized monograph lists.

During transactions, private equity teams and corporate acquirers must distinguish between existential regulatory violations that require deal renegotiation or termination, and manageable non-conformities that can be priced into indemnity escrows, special reps, or post-closing integration budgets.

When severe red flags emerge, deal teams must assess the feasibility of remediation before signing. If a target company has failed to establish a formal MDR transition agreement with a designated Notified Body, re-establishing certification can require 12 to 24 months of technical preparation and third-party audit scheduling, eliminating near-term European cash flows.

Reviewing thousands of pages of technical files, clinical evaluations, and regulatory correspondence under tight deal timelines presents a major operational bottleneck for M&A advisory teams and investment committees. An AI-native diligence workspace addresses this by structuring the evidence before analysts start reading.

Using Data Room Ingestion, the platform connects directly to virtual data rooms, rapidly ingesting and categorizing thousands of unstructured regulatory dossiers, technical files, audit reports, and marketing assets. The AI-Analysis Engine reads across complex technical documentation to cross-reference on-market product claims and catalog SKUs directly against underlying clearance letters, CE certificates, and clinical substantiation files.

• Automated Document Classification: Instantly maps disparate files into structured regulatory categories, including technical files, QMS records, audit reports, and health authority correspondence.
• Certificate Validation and Expiry Tracking: Detects expired or non-compliant CE marks, flags missing Notified Body agreements under MDR transition rules, and identifies missing international establishment licenses.
• Marketing Claim Cross-Referencing: Compares direct-to-consumer webshop copy and packaging claims against approved indications for use and underlying clinical dossiers, highlighting unapproved health assertions.
• Risk Radar Integration: Risk Radar automatically detects material anomalies across regulatory workstreams, evaluates potential financial liabilities, and compiles a prioritized risk register in minutes.

Structured Evidence for Investment Decisions

By connecting every identified risk directly to source-grounded excerpts in the data room, the AI-Analysis Engine enables deal professionals and external advisors to audit findings collaboratively commercial due diligence. Instead of manually searching through thousands of PDF pages, deal teams review pre-structured evidence packs that highlight missing filings, ambiguous classification rationales, and regulatory exposure.

Plausity is a specialized software platform designed to assist deal, management, and advisory teams in structuring data room evidence, identifying potential compliance issues, and preparing comprehensive risk registers during M&A due diligence.

• No Legal Advice: Plausity does not provide legal advice, regulatory opinions, or formal statutory interpretations. The software platform, including its analysis and automated outputs, is intended solely for informational and operational diligence assistance.
• No Compliance Certification: Plausity does not certify, validate, or guarantee the regulatory compliance, safety, efficacy, or marketability of any product, service, medical device, food supplement, or business entity.
• Qualified Advisor Confirmation Required: The platform does not replace qualified legal counsel, regulatory consultants, certified auditors, or designated Notified Bodies. All automated findings, extracted data, risk scorings, and discrepancy reports generated by the platform must be reviewed, verified, and confirmed by qualified legal and regulatory professionals prior to executing any transaction or making binding investment decisions.

Integrating product and market compliance diligence into your M&A process requires early operational alignment. Deal teams should deploy the structured evidence request list during the initial VDR opening to ensure targets provide primary technical files and regulator correspondence without delay.

• Deploy Granular Requests Early: Replace standard corporate compliance requests with explicit demands for technical files, FDA 510(k) packages, CE certificates, CAPA logs, and marketing claim substantiation dossiers.
• Execute Automated Ingestion: Use Data Room Ingestion to scan and structure uploaded files, creating a unified knowledge layer across technical, clinical, and regulatory domains.
• Cross-Reference Claims and Authorizations: Leverage the AI-Analysis Engine to systematically map commercial SKUs and marketing claims against primary clearance letters and clinical evaluation reports.
• Prioritize Identified Risks with Risk Radar: Utilize Risk Radar to categorize findings into deal-breakers versus manageable integration costs, feeding verified insights into purchase price adjustments, indemnity escrows, and transition timelines.
• Engage Specialized Counsel for Final Validation: Present source-grounded evidence packs directly to external regulatory counsel to secure binding legal opinions and structure appropriate reps, warranties, and closing conditions.

By replacing generic corporate checks with rigorous product-level verification, deal teams protect transaction value, avoid catastrophic successor liabilities, and establish a clear foundation for post-acquisition market expansion.

Plausity is an AI-native due diligence and deal intelligence platform that helps M&A advisory firms, VC and PE funds, corporate development teams and family office investment teams structure evidence, findings and questions across a data room. Plausity does not provide legal advice, does not issue compliance certification and does not replace qualified legal or regulatory advisors — it supports evidence structuring, issue spotting, source grounding and risk register preparation, and all findings should be confirmed by qualified legal or regulatory advisors.

To explore the underlying capabilities, see the Plausity AI analysis engine and the findings and risk intelligence product page. For team-level workflows, see how VC and PE funds and M&A advisory firms use Plausity across live deals.

1. fda.gov
2. eur-lex.europa.eu
3. ftc.gov
4. efsa.europa.eu
5. eur-lex.europa.eu