Start-up partnerships: legal risks and how to contain them

When you partner with a start-up or scale-up, the legal risk sits in four places: the counterparty’s legal form and who is liable, ownership of the intellectual property, the regulatory obligations you take on, and what happens if the company fails. A template contract does not solve these; checking the Chamber of Commerce (KVK) extract, the chain of title to the technology and the shareholders’ arrangements before you sign does.

This guide explains what to check under Dutch law, which statutory rules apply and which clauses decide the outcome when a collaboration with an early-stage company goes wrong.

Why does an early-stage partner carry different risks?

The main risk is not that a start-up refuses to perform, but that it cannot: it does not own what it promised, may not use it, or no longer exists. A liability cap or an indemnity is only worth the balance sheet behind it, and a young company with twelve months of runway has little to recover from.

Your protection therefore has to be structural. You verify the position before you commit and build the agreement so that what you need survives the failure of the other party, for example through escrow under a licence that survives termination.

What does the legal form of your partner mean for you?

The legal form decides who is bound, who may sign and who is liable. Read the KVK extract first.

A private limited company (besloten vennootschap, BV) contracts in its own name, and shareholders are not liable for its debts. Directors can be liable towards the company for improper management under Article 2:9 of the Dutch Civil Code (BW). In bankruptcy, Article 2:248 BW makes directors jointly and severally liable for the deficit if management was manifestly improper and this was an important cause of the bankruptcy. Failure to keep proper books or to file the annual accounts creates a statutory presumption against them. These routes require proceedings; they do not replace contracting with a party that can pay.

In a general partnership (vennootschap onder firma, VOF) each partner is jointly and severally liable for the firm’s obligations under Article 18 of the Commercial Code (WvK). In a limited partnership (commanditaire vennootschap, CV) the limited partner becomes fully liable if it performs acts of management (Articles 20 and 21 WvK).

Check three things in the extract: the legal form and date of incorporation; who the directors are and whether their authority is sole, joint or capped; and whether the annual accounts have been filed. If the signatory is not a registered director, ask for a written power of attorney and check its scope and date.

Who actually owns the technology?

Do not assume the start-up owns what it demonstrates. Under Dutch law that assumption fails in three recurring situations, and all three can be checked.

First, work created before incorporation. Copyright arises in the individual founder who wrote the code. Under Article 2 of the Copyright Act (Auteurswet) a transfer requires a written deed (akte); becoming a shareholder does not move the rights to the company.

Second, freelancers and agencies. Article 7 of the Copyright Act makes the employer the author of works an employee creates in the course of employment, unless agreed otherwise. That rule does not cover contractors: a freelance developer keeps the copyright unless it was assigned in writing. Ask to see the assignment deeds.

Third, rights other than copyright. Under Article 12 of the Patents Act 1995 (Rijksoctrooiwet) an employee’s invention belongs to the employer where the nature of the job is to make such inventions; arrangements with founders and advisers often fall outside that. The Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen) only protects information for which reasonable secrecy measures were taken. Open source components carry their own licences, so ask for the software bill of materials.

In the agreement, separate background IP (what each party brings) from foreground IP (what the collaboration creates), and state who owns the foreground and which licence the other party receives. Avoid a bare clause that new rights are “jointly owned”: without further arrangements, neither party can exploit or license the result freely. If you want joint ownership, record who may license, who pays for registrations and who enforces against infringers.

Which founder and governance documents should you read?

Read the articles of association and the shareholders’ agreement; they do different work. The articles are public and bind every shareholder, including future ones. The shareholders’ agreement binds only its parties, and a breach gives a claim for damages or a penalty, not an invalid corporate decision. Under Article 2:196 BW every issue or transfer of BV shares requires a notarial deed.

Check four points. Vesting: do founders’ shares vest over time, so that a founder who leaves in year one does not keep a quarter of the company? Leaver provisions: is there a good-leaver/bad-leaver mechanism with a price? Decision-making: which resolutions need a qualified majority, and is there a real deadlock mechanism? Capitalisation table: are there option pools, convertible loans or SAFE-type instruments outstanding, and does the table match the shareholders’ register?

If shareholder relations break down, Dutch law offers statutory buy-out and withdrawal proceedings and the inquiry procedure before the Enterprise Chamber (Ondernemingskamer) of the Amsterdam Court of Appeal. These are effective but take months, and your project needs the company to keep functioning in the meantime.

If you take a stake yourself, negotiate an information right with a fixed frequency, a list of reserved matters, a pre-emption right on new issues, a tag-along right and a clause on what happens to your commercial agreement if your shareholding ends.

How do you run due diligence on a start-up?

Keep it targeted: look for the four or five documents whose absence would make the collaboration unworkable, and request them in writing so that answers and silences are recorded. Our page on due diligence investigations in the Netherlands explains how a review is organised.

• Corporate: KVK extract, articles of association, shareholders’ agreement, shareholders’ register, cap table, latest accounts, and a list of loans, security rights and guarantees.
• Insolvency: a search of the central insolvency register and any pending litigation or tax arrears.
• IP: assignment deeds from founders, employees and contractors; trademark and patent registrations with renewal dates; the open source bill of materials; any grant or university arrangement that reserves rights.
• Commercial: key customer and supplier contracts for exclusivity and change-of-control clauses; contracts of key people, including non-compete clauses from former employers.
• Data and regulation: records of processing, processing agreements, mechanisms for transfers outside the EEA and security measures.

Convert every finding into a contractual consequence: a condition precedent, a specific indemnity, a price adjustment or a decision not to proceed.

Which regulatory obligations do you take on?

Working with someone else’s technology does not move your compliance duties to them. In data protection, AI and cybersecurity, obligations attach to roles you may hold without choosing them.

Personal data

Under the GDPR, whoever determines the purposes and means of processing is the controller. If that is you, you are responsible even though the start-up runs the systems, and Article 28 GDPR requires a written processing agreement. Joint controllers must record who handles which obligation towards data subjects.

A personal data breach must be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where feasible within 72 hours under Article 33 GDPR. Your agreement should oblige the start-up to inform you immediately. Fines for the most serious infringements reach 4% of worldwide annual turnover, so put data protection failures in a specific indemnity outside the general cap.

Artificial intelligence

The EU AI Act (Regulation (EU) 2024/1689) allocates obligations by role: provider, deployer, importer or distributor. Putting your name on a system the start-up built can make you the provider. The prohibitions, the rules for general-purpose AI models and the transparency duties (for example disclosing that a user deals with a machine) already apply; the digital omnibus (Regulation (EU) 2026/1744) postponed the obligations for high-risk systems. Liability for damage caused by AI is governed by ordinary Dutch law and the product liability rules.

Cybersecurity

The Cyberbeveiligingswet, implementing the NIS2 Directive, has applied since 15 August 2026. Entities in scope must take security measures, manage supplier risk and report significant incidents: an early warning within 24 hours and a notification within 72 hours. A start-up supplying a critical component will be asked to demonstrate its measures, so record in the agreement who reports what to whom.

Which clauses decide the outcome?

The risks sit in clauses that templates treat as boilerplate. Our guide to drafting cooperation agreements covers the structure; these points behave differently with an early-stage partner.

• Letter of intent. Breaking off advanced negotiations can lead to liability for costs under Dutch case law. State that nobody is bound until signing and that each party bears its own costs.
• Scope and default. Define deliverables, acceptance criteria and dates. Under Article 6:82 BW default usually requires a written notice with a reasonable period to perform; build that notice procedure into the contract.
• Liability. Cap liability, but carve out IP infringement, confidentiality, data protection and wilful misconduct. A cap cannot be invoked where that would be unacceptable by standards of reasonableness and fairness (Article 6:248(2) BW).
• Security for indemnities. Back material indemnities with a guarantee, a partial fee escrow or insurance.
• People. Key-person and non-solicitation clauses, and confidentiality backed by a penalty. A penalty replaces damages unless agreed otherwise (Article 6:92 BW) and the court may reduce it if fairness clearly requires (Article 6:94 BW).
• Termination and disputes. Triggers for change of control, missed milestones and insolvency; a wind-down plan for rights, data and customers; and one unambiguous dispute route.

How do funding rounds and a change of control affect you?

Every funding round changes the company you contracted with. A new lead investor brings its own shareholders’ agreement and reserved matters, liquidation preferences decide who is paid first on an exit, and convertible loans convert at a discount or valuation cap agreed with earlier investors.

Two clauses protect you. A change-of-control clause, defined by voting rights, gives you a right to terminate or to take your material out. And a licence that is irrevocable within its scope and survives termination and change of control, combined with escrow and a copy of the documentation in your own systems, keeps your access independent of who owns the start-up.

Are the founders and key staff properly engaged?

Ask how the team is engaged. Where people invoice as self-employed contractors but work under the company’s direction, the relationship can qualify as employment, with wage tax, social security contributions and dismissal protection. The Dutch Tax Administration (Belastingdienst) resumed enforcement against false self-employment on 1 January 2025.

The same contracts matter for IP, because the automatic transfer under Article 7 of the Copyright Act only works for employees, and for confidentiality. Check for non-compete clauses from former employers that could restrict what key people may do for your project.

What happens if the start-up fails?

Three questions decide how much you lose: access to the technology, your own property and payments, and whether the company simply disappears.

In bankruptcy the trustee (curator) does not have to perform the company’s contracts. Under Article 37 of the Bankruptcy Act (Faillissementswet) you can set the trustee a reasonable period to confirm performance; if the trustee does not commit, the trustee loses the right to demand performance and you are left with a claim against the estate. A source code escrow with release on insolvency or discontinued support, and verified deposits, is the standard answer. See our article on software escrow in the Netherlands.

Keep what you supply identifiable as yours. Retention of title (Article 3:92 BW) must be agreed before delivery. Prepayments become unsecured claims once bankruptcy is declared, so match payments to delivered value.

A BV can also cease to exist without bankruptcy. Under Article 2:19(4) BW a company that has no assets when it is dissolved ceases to exist immediately, even if it still has debts. Article 2:19b BW then requires the board to file a balance sheet and statement of income and expenditure with the trade register within fourteen days. More on your options in the consequences of your contract partner’s bankruptcy.

What should you check as the established partner?

Before you sign, run through these checks; each one takes little time compared with a dispute.

• KVK extract: legal form, registered directors, authority to represent and filed accounts.
• Written assignment deeds for all code and designs from founders, freelancers and agencies.
• Shareholders’ agreement and cap table: vesting, leaver rules, outstanding convertibles.
• GDPR roles and a signed processing agreement under Article 28 GDPR.
• Escrow, a surviving licence and a change-of-control clause in the contract.
• Liability carve-outs and security behind any indemnity.

What should you check as the start-up?

A large partner’s standard terms are often drafted for suppliers with a full legal department; check what they ask of you.

• Is the IP clause limited to foreground IP, or does it reach your background technology?
• Does an exclusivity or most-favoured-customer clause conflict with existing contracts or future investors?
• Is the liability cap proportionate to the fee, and are uncapped indemnities insurable?
• Can you meet the reporting deadlines for data breaches (72 hours) and security incidents (24 hours)?
• Are your own assignment deeds and processing agreements in order, so due diligence does not stall?

What can we do for you with a start-up partnership?

Our corporate lawyers advise companies on both sides of these collaborations.

• We review the KVK extract, articles of association, shareholders’ agreement and cap table of your counterparty.
• We check the chain of title to the technology and list the missing assignment deeds.
• We draft or review the letter of intent, cooperation or development agreement and the IP, liability and termination clauses.
• We set up the escrow, licence and change-of-control provisions.
• We map GDPR, AI Act and Cyberbeveiligingswet roles and draft the processing agreement.
• We act in negotiations and disputes when a collaboration ends.

Summary

• Check the counterparty’s legal form, directors and filed accounts in the KVK extract before signing.
• Copyright only moves to the start-up by a written deed (Article 2 Copyright Act); freelancers keep their rights unless assigned.
• Your GDPR, AI Act and cybersecurity duties stay with you as controller, provider or entity in scope.
• Escrow, a surviving licence and a change-of-control clause protect you if the start-up fails or is sold.

Frequently asked questions