Technology

SaaS and bespoke development contracts: what your corporate customer will demand

Nextica Law & Tax drafts and negotiates a tech company's contracts: software subscription agreements with service levels and availability commitments, the data processing agreement as a mandatory annex, limitation and allocation of liability, source code escrow, reversion and data exit plans; bespoke development contracts with milestones and acceptance; and the two clauses now appearing in every private tender: the pass-through of cyber-resilience requirements and the allocation of liability where the product incorporates artificial intelligence, within the framework of Regulation (EU) 2024/1689.

Request advice

It sells subscriptions on a contract translated from the United States, and the first big corporate customer will not sign it.

What's included

1. Diagnosing the contract you sell with today and what the first large corporate customer who reads it in full will ask for.

2. Drafting the subscription agreement with a service level agreement

availability percentage, how it is measured, what is excluded from the calculation, and what remedy applies on breach.

3. A data processing annex with sub-processors and international transfers named one by one, not generically.

4. Limitation and allocation of liability

cap, carve-outs and whether it covers data loss, which is the most negotiated point after price.

5. Exit and reversion

in what format the data is returned, how quickly, at what price, and what happens to the backups.

6. Source code escrow where the customer requires it, with the release events agreed rather than assumed.

7. The two clauses now appearing in every private tender

the pass-through of cyber-resilience requirements and the allocation of liability where the product incorporates artificial intelligence.

THE TRANSLATED CONTRACT THE BIG CUSTOMER WILL NOT SIGN

As soon as deal size goes up, the contract stops being a formality and becomes the bottleneck of the sales cycle.

A service level promised without defining how it is measured or what is excluded

service credits are a remedy, not decoration, and availability committed without a maintenance window or a calculation method is breached in the first month.

A generic data protection annex

the processing agreement must identify sub-processors and the international transfer mechanism where there is one. An annex that does not name them is no good for the customer or for the authority.

art. 28 General Data Protection Regulation

A product integrating a third party's AI model without allocating liability in the contract: obligations differ according to your role in the chain, and whoever develops the system and whoever deploys it do not carry the same ones.

Regulation (EU) 2024/1689

Frequently asked questions

What gets negotiated most in a SaaS contract with a large company?

Almost always the same things, and almost never the price. First, the service level agreement: what availability percentage is committed, how it is measured, what is excluded from the calculation and what happens on breach —service credits are a remedy, not decoration. Second, the limitation of liability: the cap, whether it has carve-outs and whether it covers data loss. Third, the data protection annex, with sub-processors and international transfers named. And fourth, exit: in what format the data comes back, how quickly and at what price.

My product integrates a third party's AI model. Who is liable?

Whoever the contract says, which is why it has to say. Regulation (EU) 2024/1689 sets out different obligations depending on your role in the chain —whoever develops the system and whoever deploys it do not carry the same ones— and the risk-level classification determines what documentation and controls are needed. In the customer contract there are three things worth settling: what information is provided about how the system works, who answers for the decisions it produces, and what happens if the model provider changes its terms or withdraws it.

More frequently asked questions · DERECHO MERCANTIL

Results, not names