How long technical due diligence takes, by scope

How long does technical due diligence take? Two answers, depending on scope: a focused read takes 3 to 4 days, a full audit takes 2 to 3 weeks. Anything past a month usually points to a process problem, and anything under two days is a conversation rather than diligence.

The right scope depends on the check size and the thesis, not on how nervous everyone feels. Here is what each format covers, what stretches the clock in practice, and how to run the work inside a competitive process where the window is not yours to set.

The two scopes, and what each buys you

The 3 to 4 day focused read answers a narrow question: is there a reason not to do this deal, and is the story the company tells materially true? It covers architecture against the growth plan, a targeted look at the critical code paths, secrets and access hygiene, the team map, and verification of the two or three claims the valuation leans on. For AI targets, that includes the core AI checklist: production reality, eval practice, unit economics. The output is a short memo with ranked findings. Most pre-term-sheet situations need this and nothing more.

The 2 to 3 week full audit is what feeds an investment committee before close. It adds depth everywhere the read sampled: real code review of the core modules, commit history analysis, a security pass scaled to the deal, dependency and license review, infrastructure cost modeling, structured sessions with the CTO and senior engineers, and for AI products, direct verification of performance claims on production data. The output is an executive summary, a scorecard, and a severity-ranked risk register with remediation costs. Price follows the same split, and we laid out the ranges in what technical due diligence costs.

How long technical due diligence takes when things go wrong

The calendar risk is rarely the analysis. It is everything around it. Four things stretch the clock, in descending order of frequency:

• A thin data room. When architecture docs, metrics, and incident history do not exist, the first week becomes archaeology. The fix is a good request list sent on day zero.
• CTO availability. Diligence needs hours with the person who holds the system in their head. If those hours are rationed to one call a week, three weeks becomes six. Agree the interview schedule before the engagement starts, not during it.
• Access friction. Legal review of repo access, NDAs for contractors, security sign-off on read-only accounts: each can eat three days. Ask for access the day the LOI is signed.
• Scope drift. "While you are in there, could you also look at" is how a two-week audit becomes a five-week one. New questions are fine; they go in a follow-up scope.

None of these are technical problems, which is why commissioning diligence late is the mistake that hurts most. The work itself is predictable. The logistics are not, and logistics are what deadlines are made of.

Fitting diligence into a competitive deal window

In a competitive process you do not get three relaxed weeks. What works, from engagements where the window was ten days from start to IC:

Run the focused read first, always. Three days in, you know whether there is a deal-killer, and everything after that is refinement rather than discovery. Parallelize people and code: interviews in the mornings, repo and infrastructure work the rest of the day, so neither stream waits on the other. Deliver findings as they land instead of saving them for a final report; a severe finding on day four should reach the deal team on day four, because it changes what everyone else is negotiating. And pre-agree the severity scale with the fund, so the report needs no meeting to interpret.

The one step we refuse to compress is verification. Skipping the moment where claims meet production data saves a day and turns the report into decoration.

If you have not commissioned one before and want the fuller picture of scope and deliverables, start with what technical and AI due diligence covers. And when the deal is live and the window is already ticking, that is the situation our technical audit is built for: a 3 to 4 day read when speed decides, a 2 to 3 week audit when the check justifies depth.