Legal & Compliance

Most business operators encounter legal situations the same way they encounter security situations: after the fact, when something has already gone wrong. A contract dispute that could have been resolved by a two-sentence clause. An IP question that creates a weeks-long delay before signing. A contractor arrangement that turns into an audit. The legal layer isn't invisible — it's just background until it isn't.

This guide is not a substitute for legal counsel. It's the working vocabulary a business operator needs to engage with legal situations intelligently — to know what kind of contract you're looking at, what IP protections your company does and doesn't have, when employment law questions need a lawyer, what the major privacy regulations actually require of you, how product launches get caught in regulatory review, and how to know when you actually need outside counsel versus when you need Google.

We'll cover six areas in roughly ascending complexity. Contracts first — because everyone signs them. Intellectual property second — because everyone creates it. Employment law third — because everyone works under it. Data privacy law fourth — because it now applies to nearly every product. Regulatory compliance for product launches fifth — because it catches teams off guard more than almost any other legal topic. And finally: when to call a lawyer, which turns out to be a much more answerable question than it sounds.

§1 Contracts: the language of agreements Foundational

Contracts are not a legal team's exclusive domain. They're the formal version of the agreements your company makes every time it buys something, hires someone, engages a vendor, or commits to a partnership. Understanding the common contract types — and what each one is actually doing — is baseline business literacy.

The four contracts you'll encounter most often:

NDA (Non-Disclosure Agreement) — sometimes called a confidentiality agreement — is the mechanism for sharing sensitive information between parties while limiting who they can share it with. An NDA is often the first document in any new business relationship: before you share customer data with a vendor, before you discuss a potential acquisition, before a candidate gets access to proprietary product details in a hiring process. Key distinctions: mutual vs unilateral. A mutual NDA protects both parties' confidential information. A unilateral NDA protects only one party's — typically the one doing the disclosing. Most employment NDAs are unilateral.

MSA (Master Service Agreement) governs the ongoing relationship between two companies — the standing terms that apply whenever you do business together. An MSA covers the legal framework: liability limits, indemnification, dispute resolution, governing law, and termination rights. It's designed to be signed once and then referenced by subsequent work orders or statements of work. Many vendor relationships have an MSA + SOW structure: the MSA sets the rules of engagement; the SOW specifies the particular engagement.

SOW (Statement of Work) is the specific deliverables agreement — what's being built, delivered, or provided; the timeline; the price; the acceptance criteria. An SOW is operational where an MSA is legal. A gap between what the MSA covers and what the SOW specifies is a common source of disputes — particularly when the scope changes mid-engagement and nobody updated the paperwork.

Vendor agreements (vendor contracts, supplier agreements, service agreements) are the umbrella term for procurement-side contracts: what you're paying for, what you're getting, what happens if you don't get it, and who owns what at the end. Vendor agreements that touch your data should include a data processing agreement (DPA) — the mechanism for specifying what the vendor can and cannot do with your data under privacy law.

Related glossary: NDA, MSA, SOW, DPA, indemnification

§2 Intellectual property: what your company owns (and what it doesn't) Foundational

Intellectual property law is the framework for owning ideas, creative output, inventions, and information that give a business competitive advantage. The four main categories of IP protection work differently, apply to different things, and are acquired in different ways — confusing one for another is a source of real business decisions going wrong.

Copyright protects original creative works: code, written content, designs, marketing materials, training datasets, product documentation. Copyright exists automatically at creation — you don't need to register it, though registration strengthens your enforcement options. The critical business implication: copyright belongs to the creator by default. When a contractor writes code or creates designs for your company, that work is not automatically your company's property — it belongs to the contractor unless there is a written agreement (a work-for-hire clause or IP assignment) that transfers ownership. This is one of the most commonly overlooked clauses in contractor agreements.

Trademark protects brand identifiers — names, logos, taglines — that distinguish one company's goods or services from another's. Unlike copyright, trademark is use-based: you acquire rights by using a mark in commerce, and you strengthen them by registering with the relevant trademark office (USPTO in the US). Trademark protection is geographically scoped and category-specific — owning "Meridian" in software doesn't prevent a different company from using "Meridian" in a different industry or a different country. Trademark can last indefinitely, as long as the mark is actively used and maintained.

Patent protects inventions: novel, non-obvious, and useful methods, processes, or devices. Patents require registration, are expensive to obtain (often $20,000–$50,000 in legal fees for a US utility patent), and take years to grant. The protection window is 20 years from filing. Most software patents cover specific methods or system architectures — not ideas generally, which are unpatentable. Patent strategy is a specialized discipline; it's the IP type most companies engage outside patent counsel for.

Trade secrets protect proprietary information that gives a business advantage and is kept confidential — formulas, algorithms, customer lists, manufacturing processes. Trade secret protection lasts as long as the information stays secret and reasonable efforts are made to keep it that way. The legal protection (the Defend Trade Secrets Act in the US) covers misappropriation — theft, breach of duty. It does not protect against independent discovery or reverse engineering.

Related glossary: IP, copyright, trademark, trade secret, work-for-hire, USPTO

§3 Employment law basics: what governs the working relationship Foundational

Employment law is often taught as a thing HR knows and everyone else doesn't need to understand. That's partially true and mostly a mistake. The business decisions that create employment law risk — contractor vs employee designation, offer language, equity structure, termination decisions — are made by managers, finance leads, and founders, not HR specialists. Understanding the framework that governs those decisions changes how you make them.

At-will employment. In most US states, employment is "at-will" by default: either party can end the relationship at any time, for any legal reason, without owing the other party advance notice. At-will is frequently misunderstood in two directions. The first misunderstanding: "at-will means we can fire anyone anytime for anything." At-will employment doesn't override anti-discrimination law — you can't terminate for a protected characteristic (race, sex, religion, national origin, disability, age, pregnancy, and others, depending on jurisdiction). The second misunderstanding: "employment contracts override at-will." Offer letters, employment agreements, and even verbal representations can modify at-will status — an offer letter that says "you will be employed for two years" may create an implied contract.

Employee vs contractor classification. The distinction between an independent contractor and an employee is not a choice the hiring company makes — it's determined by the actual nature of the working relationship, assessed under several legal tests. The most consequential: the ABC test (used in California and a growing number of states) starts from a presumption of employee status and requires companies to demonstrate three things to classify someone as a contractor: (A) they're free from company control and direction; (B) their work is outside the company's usual business; (C) they're independently established in a trade or business. The economic reality test (used federally) looks at factors like investment, profit/loss risk, degree of control, and integration into the business. Misclassification — treating employees as contractors — exposes companies to back taxes, benefits liability, penalties, and class action risk.

Severance and notice periods. The US has no legal requirement for severance pay in most circumstances — it's a negotiated component of separation. The federal Worker Adjustment and Retraining Notification (WARN Act) requires 60 days advance notice for layoffs exceeding 50 employees (or 33% of the workforce at a site). Several states have stricter requirements. Failing to provide WARN Act notice when required exposes companies to 60 days of back pay and benefits per affected employee.

Related glossary: independent contractor, at-will employment, WARN Act, misclassification, RBAC

§4 Data and privacy law: your obligations to the people whose data you hold Building

Most companies that handle personal data — and most companies do — operate under multiple overlapping privacy frameworks simultaneously. The major ones (GDPR, CCPA, HIPAA) are covered in depth on the technical side in Security & Compliance §3. This section covers the business and legal obligations side: what you have to do, when you have to do it, and what changed in the 2024–2026 regulatory cycle.

GDPR's core obligations for business operators. Beyond the technical safeguards (which security teams own), GDPR creates specific organizational obligations:

• Lawful basis documentation. For every category of personal data you process, you must have and document a lawful basis (consent, legitimate interest, contract necessity, or legal obligation). "We have it and we find it useful" is not a lawful basis.
• Data Protection Impact Assessments (DPIAs). Required before beginning processing that is "likely to result in a high risk" to individuals — automated decision-making, large-scale sensitive data processing, systematic surveillance. A DPIA is a structured analysis, not a checkbox.
• Data breach notification. Supervisory authority within 72 hours; affected individuals when risk to them is high. The 72-hour clock starts from when the organization becomes aware, not when the breach occurred.

The US state privacy law landscape (2024–2026). GDPR was followed by a cascade of US state laws: California (CCPA/CPRA), Virginia, Colorado, Connecticut, and now over a dozen additional states with active privacy legislation or regulations. No federal standard exists. The practical business implication: if you serve US consumers at scale, you're operating under a patchwork of overlapping requirements. The substantive rights granted are broadly similar (access, deletion, opt-out of sale/sharing, correction) — the differences are in thresholds, exemptions, and enforcement mechanisms. Building the operational infrastructure once (consent management, DSAR workflow, data inventory) and then adding state-specific elements is more sustainable than treating each state as a separate compliance project.

HIPAA's business impact beyond healthcare companies. Many technology companies that don't consider themselves healthcare businesses encounter HIPAA through their customers. Any technology vendor whose product is used by a healthcare covered entity (hospital, clinic, health plan, pharmacy) to process or store protected health information (PHI) becomes a business associate under HIPAA — subject to HIPAA requirements and required to sign a Business Associate Agreement (BAA). Software companies that discover this late — during an enterprise healthcare procurement — face either a lengthy compliance buildout or losing the deal.

Related glossary: GDPR, CCPA, HIPAA, PHI, BAA, DSAR, DPIA, business associate

§5 Regulatory compliance for product launches Building

Most product teams are experienced at the internal mechanics of launching — sprint planning, staging environments, go/no-go checklists, comms plans. Far fewer have a systematic view of what regulatory and legal review looks for at each stage — and why things get caught late in the process when they should have been resolved at design time.

The categories that trigger legal review. Legal or compliance review of a product feature or launch is triggered by a predictable set of conditions:

Financial services and payments. Any product that moves money, extends credit, stores payment credentials, or makes investment recommendations touches a regulatory layer. In the US: payments need money transmitter licenses at the state level (44 states have separate licensing); lending products need state lending licenses; investment advice products may trigger SEC investment adviser registration; stored value and prepaid products fall under FinCEN and state money services business regulations. These licenses take months to obtain. Building a payment feature without confirming the regulatory path first is how launch timelines slip by quarters.

Healthcare and life sciences. Beyond HIPAA (covered in §4), products that make clinical recommendations, analyze diagnostic data, or influence care decisions may constitute a medical device under FDA regulations — requiring 510(k) clearance or de novo authorization. The FDA's Software as a Medical Device (SaMD) guidance determines whether a software product is a medical device based on its intended use and risk level. Companies that discover this during a hospital procurement or an FDA inquiry, rather than at design time, face a significantly more expensive response.

Advertising and consumer protection. Advertising features, promotional mechanics, and consumer-facing claims are regulated by the FTC (deceptive practices, endorsement guidelines), state consumer protection statutes, and sector-specific rules (financial advertising, health claims). Influencer disclosures, "free trial" mechanics that convert to subscriptions, and health claims on consumer products are frequent enforcement areas.

Data brokerage and AI decision-making. Products that buy or sell consumer data, or that make decisions with material effects on consumers (credit, insurance, employment, housing), face a growing regulatory layer: data broker registration requirements in multiple states, CFPB supervisory authority over financial AI models, and emerging EU AI Act requirements for high-risk AI applications.

Related glossary: MSB, money transmitter, FTC, SaMD, regulatory compliance

§6 When to call a lawyer (and when not to) Strategic

Legal counsel is expensive — $400–$700/hour for generalist business attorneys; $600–$1,000+ for specialists in IP, regulatory, or M&A. The cost of calling a lawyer when you need one is almost always lower than the cost of not calling a lawyer when you did need one. But the calculation is not "always call a lawyer" — that produces unnecessary overhead and teaches teams to avoid the question entirely, which is worse.

A risk-tier framework for when to engage counsel:

Tier 1 — Call immediately (same-day or next-day). Situations where delay compounds risk:

• Threat of litigation or an actual lawsuit filed
• Government investigation or regulatory inquiry (IRS, SEC, FTC, NLRB, state AG)
• Breach of confidential information or a security incident involving personal data (GDPR's 72-hour clock)
• Termination of a VP or above (severance, non-compete, and discrimination risk are all highest at this level)
• Acquisition offer or term sheet received
• Intellectual property infringement claim received or sent

Tier 2 — Engage before executing (days, not weeks). Situations where the decision should happen before paperwork is signed or action is taken:

• Any contract over a material threshold (define this for your company: often $50K–$250K)
• A new partnership that involves data sharing or IP collaboration
• Contractor-to-employee transition or vice versa for an existing worker
• A new product feature in a regulated space (§5 above)
• Operating in a new country or regulated industry for the first time

Tier 3 — Track but handle internally unless it escalates. Situations where legal awareness matters but external counsel is premature:

• Standard vendor agreements (with the MSA pattern already established)
• Employee handbook updates (legal should review the initial version; updates are often internally manageable)
• Trademark monitoring (can be handled via a trademark watch service until action is needed)
• DSAR responses (once the process is established from the first lawyer-assisted response)

The goal of the risk-tier framework is not to replace legal judgment — it's to make it easier to know when to invoke it. Companies that build the reflex of "which tier is this?" into how they handle situations spend less time debating whether to call a lawyer and more time getting the right answer quickly.

Related glossary: outside counsel, in-house counsel, litigation, regulatory compliance, indemnification

What to remember from this guide

Legal risk in a business context is mostly predictable. Contracts have standard shapes — knowing what an MSA is for versus what a SOW does versus when an NDA is appropriate changes how you move through business relationships. IP ownership is automatic for copyright but never automatic for contractors — the assignment clause is the one sentence that prevents the most expensive disputes. Employment classification is a fact question, not a paperwork question — the label "contractor" on a 1099 doesn't change the legal analysis. Privacy obligations travel with the data, not with the company's self-description — building HIPAA controls only when a hospital asks for a BAA is always more expensive than building them during design. Regulatory review for product launches is cheapest at the discovery phase and most expensive at the pre-launch phase, which is exactly when it most often happens. And the decision of when to call a lawyer is answerable with a simple risk framework: Tier 1 is today, Tier 2 is before you sign, Tier 3 is tracked internally.

None of this is a substitute for qualified legal counsel when the situation calls for it. It is the working knowledge that helps you recognize when the situation calls for it.

Related guides: Security & Compliance — specifically §3 (GDPR, CCPA, HIPAA technical controls — this guide covers the process-and-law obligations side); Org & Roles — §1 (General Counsel / CLO in the org structure)

§7 Employment law fundamentals for managers Strategic

Most managers become managers through promotion, not training. They inherit a set of tools — hiring, performance management, compensation, termination — that carry legal exposure that nobody explicitly briefed them on. The result is that expensive mistakes get made not by bad actors but by well-meaning people who didn't know what they didn't know. The fundamentals here aren't a substitute for HR counsel, but they are the baseline every manager should carry.

In the United States, most private-sector employment is at-will: either party can end the relationship at any time, for any reason or no reason, without notice. This sounds like unlimited flexibility for employers, but the doctrine has meaningful exceptions. The big one: you cannot terminate someone for an illegal reason. Federal law prohibits employment decisions — hiring, firing, promotion, compensation, discipline — based on protected characteristics: race, color, national origin, sex, religion (Title VII), age 40 and over (ADEA), disability (ADA), and pregnancy (PDA). Many states and cities add additional protected classes including sexual orientation, gender identity, and marital status. "We can fire anyone for anything" is technically true; "we can fire anyone for any reason" is not.

Hostile work environment is a specific legal concept that gets used casually in ways that misrepresent it. It does not mean an unpleasant or high-pressure workplace. It means conduct that is (1) based on a protected class, (2) severe or pervasive enough to create an abusive working environment, and (3) something a reasonable person would find hostile. Both elements — the protected-class connection and the severity threshold — must be present. A manager who yells at everyone equally is creating a bad culture, not a hostile work environment in the legal sense. A manager who singles out employees of a particular race or gender for harsh treatment is a different matter entirely.

The independent contractor vs employee classification is a separate category of exposure that bites companies constantly. The legal test for worker classification is fact-based and multifactorial — it looks at behavioral control (does the company direct how the work is done?), financial control (does the worker invest in their own tools, work for multiple clients?), and the type of relationship. Misclassifying an employee as a contractor has significant consequences: back taxes, penalties, and benefit obligations. The question isn't what you call someone; it's what the working relationship actually looks like in practice.

Rule of thumb: if the decision would look different to a neutral reviewer who knew the employee's protected characteristic, stop and seek counsel.

Related glossary: at-will employment, protected class, hostile work environment, independent contractor