The legal risks of partnering with start-ups and scale-ups

The legal risks of partnering with start-ups and scale-ups are concentrated in four places: the legal form of the counterparty and the personal liability that follows from it, the ownership of the intellectual property that the collaboration produces, the regulatory obligations you inherit by working with someone else’s technology, and what happens to your position if the company fails. None of these is solved by enthusiasm or by a template contract. They are solved by checking the Chamber of Commerce extract, the chain of title to the technology and the shareholders’ arrangements before you sign, and by writing the answers into the agreement.

This guide sets out what to check, which Dutch rules apply, and which clauses actually change the outcome when a collaboration with an early-stage company runs into trouble.

Why early-stage partners carry different risks

A collaboration with an established company is a negotiation between two organisations that both have a legal function, a compliance record and a balance sheet. A collaboration with a start-up or scale-up is not. The counterparty is usually a small group of people whose attention is on the product and the next funding round, whose documentation was assembled quickly and often without advice, and whose capacity to absorb a claim is limited by definition. The technology may be excellent and the legal foundation still be thin.

That combination produces a specific pattern. The contractual risk is not that the other side will refuse to perform; it is that the other side cannot deliver what it promised because it does not own it, is not permitted to use it, or no longer exists. A limitation of liability negotiated down to a sensible figure is worth little against a company with no assets, and an indemnity is only as good as the balance sheet behind it. The protection therefore has to be structural: verify the position before you commit, and build the agreement so that the value you need survives the failure of the other party.

Where the exposure sits

The legal form of your partner, and what it means for you

The first document to read is the Chamber of Commerce extract, and the first question is which legal form the counterparty has. It decides who is bound, who can sign, and who is liable.

A besloten vennootschap (BV, private limited company) has legal personality. It contracts in its own name, and the shareholders are not liable for its debts beyond what they paid for their shares. That protection is not absolute: directors can be held liable towards the company for improper management, and towards a creditor personally where they entered into an obligation knowing that the company would not be able to perform and would offer no recourse. In insolvency the trustee can hold directors liable for the deficit where the management was manifestly improper and that was an important cause of the bankruptcy, and a failure to file the annual accounts on time creates a statutory presumption against them. Those routes exist, but they are exceptions and they take proceedings; do not treat them as a substitute for contracting with a party that can pay.

A vennootschap onder firma (VOF, general partnership) and a maatschap have no legal personality in the same sense, and each partner is jointly and severally liable for the obligations of the business under the Commercial Code. That cuts both ways. It means there is a private recourse if things go wrong, but it also means the counterparty’s stability depends on the private position of individuals, and a dispute between the partners can paralyse the business. In a commanditaire vennootschap (CV, limited partnership) the general partner carries that liability while the limited partner does not, unless the limited partner performs acts of management, in which case the protection falls away.

Check three things in the extract and do not skip any of them. Check the legal form and the date of incorporation. Check who is registered as a director and whether the authority to represent is sole or joint and whether it is capped by amount, because a jointly authorised director signing alone does not bind the company. And check whether the filed annual accounts are up to date, because a company that has not filed is either not being administered properly or does not want the figures read. If the signatory is not a director, ask for the written power of attorney and read its scope and date.

Who actually owns the technology

The single most expensive mistake in these collaborations is the assumption that the start-up owns what it demonstrates. Under Dutch law that assumption fails in three recurring situations, and all three are checkable.

The first is work created before incorporation. Where a founder wrote the original code or designed the original process as a private individual, the copyright arose in that individual and stayed there. Copyright can only be transferred by a deed, so the rights do not move to the company because the founder later became a shareholder. A contribution described in the incorporation documents as know-how is not an assignment.

The second is freelancers and agencies. An employer acquires the copyright in works created by an employee in the performance of the employment relationship by operation of law, but that rule does not extend to contractors. A freelance developer keeps the copyright in the code unless it was assigned in writing, and a licence agreed informally can be limited in scope or revocable. Ask to see the assignment deeds. In a young company they either exist as a small set of documents or they do not exist at all.

The third is the parts that are not copyright. Patentable inventions made by employees are governed by the Patents Act, which allocates the right to the employer where the nature of the employment brought the invention about, but arrangements with founders and advisers frequently sit outside that. Trade secrets are protected by the Trade Secrets Protection Act only where reasonable measures were taken to keep them secret, so a company without access controls or confidentiality agreements has less to license than it thinks. Open source components carry their own licences, and a copyleft licence in a core module can affect what you are permitted to do with the combined product; ask for the bill of materials rather than a reassurance.

In the agreement itself, separate background intellectual property, meaning what each party brings, from foreground intellectual property, meaning what the collaboration creates, and state expressly who owns the foreground and what licence the other party receives. Avoid a bare statement that new rights are jointly owned. Joint ownership without further arrangement means neither party can exploit or license the result without the other’s cooperation, which converts a successful project into a permanent negotiation. If joint ownership is what the parties want, write down who may license to whom, who maintains and pays for registrations, who enforces against infringers, and who bears those costs.

Founders, shares and governance

A start-up’s internal arrangements are your problem the moment your project depends on the people in it. Two documents govern them and they do different work. The articles of association are public, bind every shareholder including a future one, and can only be amended by notarial deed. The shareholders’ agreement is private, binds only the parties to it, and a breach of it produces a claim for damages or a contractual penalty rather than an invalid corporate decision. Anything that must work against a new shareholder therefore belongs in the articles; the transfer of shares in a BV requires a notarial deed in any event.

Ask to see both, and read them for four things. Vesting: do the founders’ shares vest over time, with a cliff, so that a founder who leaves in year one does not walk away with a quarter of the company. Leaver provisions: is there a distinction between a good leaver and a bad leaver, and a mechanism and a price for the compulsory transfer of shares. Decision-making: which resolutions need a qualified majority or the approval of the general meeting, and is there a mechanism that actually breaks a deadlock rather than referring the parties to further consultation. And the capitalisation table: who holds what, whether there are option pools, convertible loans or SAFE-style instruments outstanding, and what those convert into. A cap table that cannot be reconciled with the register of shareholders is a warning in itself.

Where the relationship between shareholders breaks down anyway, Dutch corporate law provides the statutory buy-out and withdrawal proceedings and the inquiry procedure before the Enterprise Chamber (Ondernemingskamer). Those procedures were reformed by the Act amending the dispute resolution and inquiry procedures, in force since 1 January 2025, which concentrated the dispute proceedings and shortened the route. They are effective, but they take time and they are not a substitute for a workable agreement, particularly where your own project depends on the company continuing to function in the meantime.

If you are taking a stake yourself rather than only contracting, negotiate your position in the shareholders’ agreement directly: an information right with a defined frequency, a reserved-matters list covering the decisions that would affect your project, anti-dilution protection or at least a pre-emption right on new issues, tag-along rights so that you are not left behind a change of control, and a clear statement of what happens to your commercial agreement if your shareholding ends.

Due diligence before you commit

Due diligence on an early-stage company is not a scaled-down version of a corporate acquisition review. It is a targeted search for the four or five documents whose absence would make the collaboration unworkable. Scope it to what you actually depend on, and put the request in writing so that the answers, and the silences, are recorded.

On the corporate side, obtain the Chamber of Commerce extract, the current articles of association, the shareholders’ agreement, the register of shareholders and the cap table, the most recent filed and unfiled accounts, and a statement of outstanding loans, security interests and guarantees. Ask about pending or threatened litigation and about any tax or contribution arrears. A search of the insolvency register and of the register of pledges on the company’s assets costs almost nothing and occasionally changes everything.

On the intellectual property side, ask for the assignment deeds from founders, employees and contractors, the register entries for trademarks and patents and their renewal dates, the open source bill of materials with licences, and the list of third-party components and their terms. Ask specifically whether any part of the technology was developed under a grant or a university collaboration, because those arrangements frequently reserve rights or impose publication obligations that no one mentions.

On the commercial and regulatory side, review the key customer and supplier contracts for exclusivity, change of control and most-favoured-customer clauses that could conflict with what you are about to agree; the employment contracts of the key people, including any non-competition or non-solicitation clauses that could limit what they may do for the joint project; the data protection documentation, meaning the record of processing activities, the processing agreements, the transfer mechanisms for data leaving the EEA and the security measures; and the position under any sector regulation that applies to the product. Our page on due diligence investigations in the Netherlands sets out how such a review is organised in practice.

Record the outcome. Findings that cannot be resolved before signing should either become a condition precedent, a specific indemnity, or a reason not to proceed. The one thing that should not happen is a finding that is noted in a report and never converted into a contractual consequence.

The regulatory obligations you inherit

Working with someone else’s technology does not transfer their compliance problem to them. In data protection, in artificial intelligence and in cybersecurity, the obligations attach to roles that you may occupy without having chosen to.

Personal data

Under the GDPR the decisive question is who determines the purposes and means of the processing. If you do, you are the controller and you answer for the processing even though the start-up runs the systems, and a written processing agreement is compulsory. If you determine them jointly, you are joint controllers and you must set out in an arrangement between you who fulfils which obligation, in particular towards data subjects, and make the essence of that arrangement available to them. Getting the roles wrong is not a technicality: it decides who has to answer a data subject request, who notifies a breach, and who is addressed by the supervisory authority.

Three points deserve attention with early-stage partners in particular. A personal data breach must be notified to the Dutch Data Protection Authority without undue delay and, where feasible, within seventy-two hours, which means the agreement must oblige the other party to inform you immediately rather than after its own investigation. Transfers outside the EEA need a valid mechanism, and a start-up using a non-EU cloud provider or a non-EU model provider frequently has none documented. And the maximum administrative fines run to four per cent of worldwide annual turnover for the most serious infringements, calculated on the undertaking, which is why the allocation of liability for a data protection failure belongs in a specific indemnity rather than under a general cap.

Artificial intelligence

If the joint product uses artificial intelligence, the EU AI Regulation allocates obligations by role: provider, deployer, importer or distributor. Putting your name on a system developed by the start-up can make you the provider, with the full set of obligations that follow. The regime is being phased in, and the digital omnibus package deferred only the high-risk rules, moving the Annex III obligations to 2 December 2027 and the Annex I obligations to 2 August 2028. The prohibitions on unacceptable practices, the rules for general-purpose AI models and the transparency obligations of article 50, including the duty to make clear that content is AI-generated and that a user is interacting with a machine, already apply. The proposed AI Liability Directive was withdrawn, so liability for damage caused by an AI system is governed by ordinary Dutch law and by the product liability regime.

Cybersecurity

The Cyberbeveiligingswet, which implements the NIS2 Directive, has been in force since 15 August 2026. Entities within its scope must register with the National Cyber Security Centre, take appropriate technical and organisational measures, and report significant incidents on a two-stage timetable, with an early warning within twenty-four hours and a fuller notification within seventy-two hours. The obligations extend into the supply chain, so an organisation within scope has to manage the security of its suppliers, and a start-up supplying a critical component will be asked to demonstrate its measures whether or not it falls within scope itself. Establish early whether either party is in scope, and record in the agreement who reports what, to whom and within what period.

The clauses that decide the outcome

Once the position is known, the agreement has to record it. A generic template will not do this, because the risks in a start-up collaboration are concentrated in places a template treats as boilerplate. Our guide to drafting cooperation agreements covers the structure; the points below are the ones that behave differently with an early-stage partner.

Start with the pre-contractual phase. Negotiations in the Netherlands are governed by good faith, and breaking them off can, in the final stage, expose the withdrawing party to a claim for costs or even for lost profit. The threshold is high and the Supreme Court requires restraint in applying it, but the way to keep the question from arising is a short letter of intent stating that no party is bound until a signed contract exists, that each bears its own costs, and that either may withdraw. If exclusivity is granted or one party is asked to invest during the talks, say what happens to those costs if the deal does not close.

In the agreement itself, define the scope of the collaboration in terms of deliverables, acceptance criteria and dates rather than intentions, and set out what happens when a milestone is missed: a cure period, then a defined consequence. Remember that most remedies for non-performance under Dutch law require the debtor to be in default, which normally means a written notice giving a reasonable period to perform; build the notice mechanism into the contract so that no one has to argue about it later.

Allocate liability in a way that reflects the counterparty’s capacity to pay. A cap expressed as a multiple of the fees is normal, but carve out the risks that would be existential for you and treat them separately: third-party intellectual property infringement, breach of confidentiality, a data protection failure, and wilful misconduct. Note that a limitation of liability never protects against intent or deliberate recklessness, and that a cap set so low that reliance on it would be unacceptable by standards of reasonableness and fairness can be set aside. Where an indemnity is agreed, give it a notification duty, a conduct-of-claim mechanism and, if the amounts justify it, security in the form of a guarantee, an escrow of part of the fee or warranty insurance. An unsecured indemnity from a company with a year of runway is a comfort, not a protection.

Deal with the people as well as the entity. Key-person provisions, a non-solicitation clause covering the team on both sides, and confidentiality obligations that survive termination and are backed by a proportionate contractual penalty, are what preserve the value of the collaboration if the founders move on. A penalty clause replaces damages unless the contract says it is cumulative, and a court may reduce a penalty whose application would be manifestly unfair, so keep the amount proportionate to the interest it protects.

Finally, write the ending before you need it. Define the termination triggers precisely, including a change of control, a failure to meet defined milestones and the commencement of insolvency proceedings; set out the wind-down, meaning who keeps which rights, what happens to jointly developed material, how data is returned or destroyed, and how customers are informed; and choose one dispute route. A tiered clause with escalation, then mediation, then either the Dutch courts or a named arbitral institution works, provided it is unambiguous and does not name two routes at once.

Funding rounds, dilution and change of control

A start-up that succeeds raises money, and every round changes the company you contracted with. If you hold shares, a new issue dilutes you unless you have a pre-emption right or an anti-dilution provision and the means to follow your money. Convertible loans and similar instruments issued before your entry convert on terms agreed with earlier investors, so ask what is outstanding and at what discount and valuation cap it converts; a cap table that looks comfortable today can look very different after a conversion.

Even if you hold no shares, the rounds affect you. A new lead investor will bring its own shareholders’ agreement, its own reserved-matters list and often its own view of which commercial arrangements the company should keep. Liquidation preferences determine who is paid first on an exit and can mean that a sale at a respectable price returns nothing to the ordinary shareholders. And an acquisition of the start-up by a competitor of yours can leave your technology, your data and your commercial terms in the hands of the last party you would have chosen.

Two contractual answers work. The first is a change of control clause that gives you a right to terminate, or at least a right to be consulted and to take your material out, when control of the counterparty changes; define control by reference to voting rights rather than to a vague notion of ownership. The second is to make the value you need independent of the corporate future: a licence that is irrevocable within its defined scope, expressed to survive termination and change of control, an escrow arrangement, and a copy of the documentation and the data in your own systems. Those provisions cost nothing while the relationship is good and are the only thing that works when it is not.

The founders and the team

The people are usually the asset, and the arrangements around them are often the weakest documents in the company. Ask how the founders and the core team are engaged. Where individuals invoice the company as self-employed contractors but work under its direction, on its systems and to its instructions, the relationship can qualify as employment regardless of the label, with wage tax, contributions and dismissal protection following. The Dutch tax authorities ended the enforcement moratorium on false self-employment on 1 January 2025, and a statutory presumption of employment based on an hourly rate has been adopted but enters into force by royal decree. A company carrying a group of nominally self-employed key people carries an unquantified liability, and in a collaboration that liability can surface at the worst moment.

The same documents matter for intellectual property, because the automatic transfer of copyright works only for employees, and for confidentiality, because obligations that were never agreed cannot be enforced. Ask for the contracts of the people whose work your project depends on, and check for non-competition and non-solicitation clauses from previous employers that could restrict what those people are permitted to do for the joint project. A claim by a former employer, brought at the moment the joint product is launched, is a familiar and entirely avoidable problem.

If the start-up fails

Failure is a normal outcome in this segment, and the contractual work that matters is the work that assumes it. Three questions decide how much you lose.

The first is access to the technology. In Dutch insolvency the trustee is not obliged to perform the company’s contracts; asked to state whether it will perform, the trustee may decline, and your licence is then of little practical use if you cannot reach the source code. A source code escrow arrangement with a reputable escrow agent, with release conditions that include insolvency and discontinuation of support, and with a verification of the deposited material, is the standard answer. It has to be agreed at the outset and the deposits have to be maintained; an escrow clause with an empty vault behind it protects nothing. We set out how these arrangements are built in our article on software escrow in the Netherlands.

The second is your own property and your own money. Anything you supply should remain identifiably yours, whether that is equipment, tooling or data, and retention of title on goods you deliver must be agreed before delivery to be effective against the estate. Prepayments and milestone payments are unsecured claims once the estate is opened, so match the payment schedule to delivered value rather than to a calendar.

The third is what happens to a company that does not go through insolvency at all. A BV can be dissolved without liquidation where it has no assets at the moment of dissolution, and the criterion is the absence of assets, not the absence of debts, so a company with outstanding liabilities can disappear from the register. Since the temporary transparency legislation the management board has to file a final financial statement and inform the creditors, but the practical lesson stands: a counterparty can cease to exist quickly, and a claim you have not secured may have nowhere left to go. What you can do beforehand is described in our article on the consequences of your contract partner’s bankruptcy.

When to involve a lawyer

There are three moments where advice changes the outcome rather than confirming it. The first is the term sheet. It is usually described as non-binding, but it sets the commercial expectations that the final agreement is measured against, and a concession made there is hard to reverse. The second is the due diligence, where the value lies in knowing which absent document matters and how to convert a finding into a condition, an indemnity or a price. The third is the drafting of the liability, intellectual property and termination provisions, which is where the money is actually allocated.

The proportion matters as well. Legal work on a collaboration of this kind should be scaled to the exposure, not to the length of the document. A focused review of the corporate position, the chain of title to the technology and three or four clauses is often all that is needed, and it is considerably cheaper than the dispute it prevents. A corporate lawyer who has seen these structures will know within an afternoon whether the foundation holds.

Law and More advises Dutch and international companies on collaborations with start-ups and scale-ups: corporate and intellectual property due diligence, cooperation and development agreements, shareholders’ arrangements, data protection and AI compliance, and disputes when a collaboration ends badly. If you are preparing such a partnership, or you are already in one and the position has become unclear, contact our office.

Frequently asked questions

When you're thinking about partnering with a start-up or scale-up, it’s natural to have questions. The legal side of things can feel a bit tangled. This section cuts through the complexity to give you direct answers on some of the most common concerns.