Under 17 USC 101, the creator of any work owns it by default. Without a written IP assignment agreement, a co-founder who built the company’s core technology owns that technology personally, not the company. This is the single most common cause of failed or delayed startup due diligence at seed and Series A.

The problem compounds when a founder departs before an IP assignment is signed. A departed co-founder who is now a former colleague with grievances has every incentive to complicate a transaction the company needs. Obtaining a retroactive IP assignment from that person, under those circumstances, is expensive and may require significant concessions.

The prior art problem is equally critical. If any founder created relevant technology before the company was incorporated, the IP assignment must explicitly cover that prior work. An assignment covering only work created after incorporation leaves a gap for anything built during the pre-incorporation period.

A co-founder who leaves after six months should not retain the same equity stake as a co-founder who builds the company for four years. Without a vesting schedule, that is exactly what happens. The departing founder takes their full equity share, which becomes an undiluted block on the cap table held by someone who is no longer contributing.

The standard US startup vesting schedule is a four-year vest with a one-year cliff. Investors expect this structure. A cap table with unvestable co-founder equity held by a departed person creates concern about incentive alignment and about whether future negotiations with that person will be required. It is also a signal that the founding team did not take basic legal hygiene seriously at formation.

Software does not qualify as work-made-for-hire in an independent contractor context under 17 USC 101. A contractor who builds the startup’s product owns that code by default unless there is an explicit written IP assignment. Many early-stage startups work with contractors for months before formalizing agreements, or use informal agreements that do not include explicit assignment language.

At due diligence, investors require that the company own all IP in its product. If contractor work is not covered by a signed IP assignment, the company does not own that code. Tracking down former contractors, some of whom may be working for competitors, to obtain retroactive assignments is a documented due diligence failure pattern.

Startups often sign vendor agreements quickly without reviewing the liability provisions. Most vendor agreements cap the vendor’s liability at one to three months of fees. For a startup that depends on a critical vendor for infrastructure, payments, or communications, a vendor failure that causes $500,000 in operational loss may yield a recovery of $2,000 under the contract terms.

Furthermore, the indemnification provisions in most vendor agreements are unilateral: the startup indemnifies the vendor, but the vendor has no reciprocal obligation. A startup that signs without negotiating these provisions has accepted an asymmetric risk structure that may be indefensible if the vendor relationship deteriorates.

Many early-stage startup agreements, particularly those drafted informally between founders and early contractors or advisors, omit the governing law clause. When a dispute arises, the applicable state law is determined by conflict-of-laws principles rather than the parties’ agreement. The outcome can be unexpected and expensive to resolve before the underlying dispute can even be addressed.

The stakes are particularly significant for California-based startups. California has distinct standards for IP assignments, non-compete provisions sometimes embedded in agreements, and contractor classification that differ materially from Delaware, New York, and other common startup jurisdictions. Which state’s law applies to an early advisor agreement can determine whether a non-solicitation provision in that agreement is enforceable.

Scope disputes are the most common source of disagreement between startups and their service providers. The startup believes additional work was included in the original scope. The agency or development firm believes it constitutes additional billable work. Without a written change order procedure specifying how scope expansions are requested, approved, and priced, both positions are defensible.

Furthermore, without a change order procedure, unauthorized work performed by the service provider may be difficult to refuse payment for if the startup accepted its benefits. Courts in most US states apply quasi-contract principles to situations where a party received a benefit it did not explicitly authorize, creating recovery risk that a clear change order clause would eliminate.

Early-stage startups frequently make significant decisions, including equity grants, compensation decisions, and major contracts, without obtaining the required board consent documentation. At the pre-seed stage, when founders are often the only board members, this feels like administrative overhead with no practical consequence. At due diligence, it becomes a documented authorization gap.

Investors require documentation that the company’s major decisions were properly authorized by the board. Retroactively creating board consent documentation for past decisions raises questions about corporate governance standards that can slow a deal even when the underlying decisions were sound. The documentation burden at due diligence is significantly heavier when consent records were not maintained in real time.

Startups that collect user data and share it with technology vendors, including analytics platforms, CRM tools, and cloud infrastructure providers, accept regulatory responsibility for how that data is handled. Under California’s CPRA, startups that share personal data with vendors must have signed data processing agreements that comply with specific requirements. Colorado, Connecticut, Virginia, Texas, and Florida have enacted similar state privacy laws with their own vendor agreement obligations.

Most early-stage startups sign vendor agreements for technology tools without reviewing or negotiating the data processing terms. The regulatory exposure is not hypothetical. State attorneys general offices have initiated enforcement actions against companies of all sizes for data sharing practices that occurred through vendors without adequate contractual protections.