SaaS, software licensing and technology procurement
We prepare and negotiate subscription agreements, enterprise SaaS terms, software licences, platform terms and related implementation and support arrangements. For providers, the work connects the product's permitted uses and commercial model with customer commitments. For buyers, it examines the rights, dependencies and restrictions that can affect deployment and future change.
Key points include authorised users and group-company access, licence metrics, usage limits, overage charges, renewal pricing, audit rights, acceptable use and suspension. We address service availability, material functionality changes, data export and the practical consequences of switching supplier. General pricing, liability and delivery provisions are coordinated with our Commercial Contracts practice.
Development, implementation and ownership
We advise on software development, integration, implementation and technical consultancy agreements. Clear specifications, milestone acceptance, change control and customer dependencies help distinguish an unfinished deliverable from a new requirement.
We examine the chain of rights in code, documentation and other deliverables, including employee or contractor contributions, pre-existing tools and third-party components. Contracts should distinguish ownership from a licence and explain what the client can use, modify or transfer. Maintenance obligations, access to source materials and any proposed escrow arrangement require their own commercial and technical assessment.
Data-processing and data-sharing arrangements
We help identify which organisation determines a processing activity and which acts on another's instructions, rather than assuming the contract's chosen label settles the question. The documentation may involve a processor agreement, controller-to-controller sharing terms or arrangements between joint controllers.
The contractual work addresses permitted purposes, instructions, access, confidentiality, security commitments, subcontractors, assistance with rights requests, incident cooperation, audits and return or deletion. We work with the business's actual data flows and controls so schedules describe the service being delivered, not a generic set of assurances that operations cannot support.
International data flows
Overseas hosting, support access and group sharing can raise different transfer questions. We map the relevant flows and assess whether restricted-transfer rules apply before selecting documentation.
Where contractual safeguards are appropriate, support may include a UK International Data Transfer Agreement or the UK Addendum to relevant EU standard clauses, together with the applicable transfer assessment and supporting measures. A signed form is not a substitute for understanding the recipients, onward transfers and protections in practice. EU or other local-law requirements are scoped separately where relevant.
AI products, procurement and commercial terms
We advise on the legal terms for buying, supplying and integrating AI-enabled services. That includes pilots, enterprise subscriptions, API arrangements and AI functionality embedded within a wider product.
We address permitted inputs and uses, access to confidential or personal information, retention, model training and improvement rights, third-party model dependencies and changes to functionality. The allocation of rights in prompts, datasets and outputs needs careful drafting; contractual permission should not be confused with a guarantee that every output attracts intellectual-property protection or is free of third-party claims.
Warranties, indemnities, evaluation criteria and human-review requirements should reflect the intended use. We also address restrictions on deployment, information needed to investigate errors, termination and the treatment of retained data or model-related assets when the service ends.
AI governance and accountable deployment
We help turn an AI initiative into a defined decision and approval process: which tools may be used, for what purpose, with which information, under whose responsibility and subject to what review.
Work can include an inventory of intended uses, a risk-triage framework, supplier questions, acceptable-use guidance, approval records and procedures for material changes or incidents. We identify when a data protection impact assessment, further regulatory analysis or specialist technical evaluation is needed. Higher-risk uses require a closer examination of the affected people, the decisions being supported and the safeguards available; one policy cannot answer every use case.
Privacy documentation and operational implementation
We support privacy notices, internal guidance, retention frameworks, rights-request procedures and contractual incident-response arrangements. Advice starts with how information is collected and used, who receives it and which obligations the business can actually implement.
A targeted review may cover a new product, an enterprise customer's requirements or a known gap in existing documentation. We prioritise the decisions and evidence needed to make progress, coordinating with internal privacy and security owners rather than treating new documents as a complete compliance programme.
Technology and data in investment and M&A
For investment in a technology business, the questions include who owns the core IP, whether key licences survive investment and whether the proposed use of data is supported.
Technology and data issues can affect the value and transferability of a business. We support legal due diligence on core licences, contractor assignments, key suppliers, data rights, AI dependencies and restrictions triggered by a change of ownership.
Findings can inform pre-completion remediation, transaction protections, disclosures and integration priorities. We distinguish the legal review from technical diligence and involve specialist advisers where code, architecture, security or model performance needs independent assessment.