Clauses
1. Ownership of test code and test assets
All test code, automation frameworks built for [Customer], test cases, test data, test plans, reports and related documentation created under this Agreement ("Test Assets") are assigned to [Customer] on creation, and [Supplier] hereby assigns to [Customer] all rights, title and interest in them. To the extent any Test Asset is not a work made for hire, this assignment applies. [Supplier] may keep pre-existing tools listed in [Schedule X] and grants [Customer] a perpetual, royalty-free licence to use them as part of the Test Assets. [Supplier] will sign any further documents needed to record this assignment. This is a starting point for review by [Customer]'s counsel.
Why: Test scripts, automation frameworks, test data sets and test documentation are paid for by the buyer and are needed to keep testing after the contract ends. In the US, software written by an outside company is usually not a work made for hire, so ownership moves to the buyer only through a written assignment. Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
2. Repository and tool accounts held by the buyer
[Supplier] will store all Test Assets in source control, test management and CI accounts owned and administered by [Customer], and will not keep the only copy of any Test Asset in systems controlled by [Supplier]. [Customer] will grant and revoke [Supplier] access to those accounts. On request, and in any case on exit, [Supplier] will return any Test Assets held elsewhere in a usable, documented format within [10] business days.
Why: If the test code lives in the vendor's repository, the buyer depends on the vendor's cooperation to get it back. Holding the repository, pipelines and test management accounts in the buyer's name keeps access and return of the work simple. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
3. Knowledge transfer on exit
On expiry or termination, [Supplier] will deliver a knowledge transfer to [Customer] or its nominated replacement supplier covering the test strategy, the structure and running of the automation suite, open defects, known flaky tests, environment setup and test data. Knowledge transfer will include up to [40] hours of working sessions and written handover notes, at no extra charge [or at the rates in Schedule X]. [Customer] will confirm in writing when the knowledge transfer is complete.
Why: The buyer needs a way to move testing to another supplier or in-house without losing what the outgoing team knows. Regulators ask firms to plan exit so that the service can be transferred without disruption. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)
4. Exit plan and exit assistance period
[Supplier] will deliver a draft exit plan within [60] days of the start date and update it [annually]. On notice of termination or expiry, [Supplier] will continue to provide the services and reasonable exit assistance for an exit period of up to [90] days, as requested by [Customer], on the terms of this Agreement. During the exit period [Supplier] will cooperate with any replacement supplier and will not reduce the team or service levels without [Customer]'s written approval.
Why: A written exit plan agreed early is easier to negotiate than one agreed during a dispute. An exit assistance period keeps the service running while the buyer moves it elsewhere. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)
5. Staff replacement terms
[Supplier] will give [Customer] at least [20] business days' written notice before replacing any member of the assigned team, except for resignation, illness or dismissal. Any replacement will have skills and experience at least equal to the person replaced and will be subject to [Customer]'s reasonable approval. [Supplier] will provide an overlap of at least [10] business days in which the replacement shadows the departing person, at no charge to [Customer].
Why: Rotating testers take product knowledge with them, and the buyer ends up paying for the new person to learn. Notice and an overlap period at the vendor's cost keep that cost with the party that caused the change. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO 37500:2014 Guidance on outsourcing (https://www.iso.org/standard/56269.html)
6. Key personnel
The individuals listed in [Schedule X] are Key Personnel. [Supplier] will not remove or reassign Key Personnel during the first [12] months without [Customer]'s prior written consent, except for resignation, illness or dismissal. Any replacement is subject to the staff replacement terms in clause [X]. Repeated or unapproved changes of Key Personnel are a material breach.
Why: The people presented during selection are often part of why the vendor was chosen. Naming them in the contract stops a switch after signature without the buyer's agreement. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
7. Service levels with measurable targets
[Supplier] will meet the service levels in [Schedule X]. Each service level states what is measured, the target, the data source, the measurement period and who reports it. Examples to agree: regression run completed within [X] hours of a release candidate, critical defects triaged within [4] business hours, test reports delivered by [day] each [week]. [Supplier] will report performance against each service level [monthly] with the underlying data.
Why: Service levels only help if both sides can measure them the same way. Each one needs a definition, a target, a measurement method and a reporting cycle. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); FAR Subpart 37.6: Performance-Based Acquisition (https://www.acquisition.gov/far/subpart-37.6)
8. Service credits and remedies
If [Supplier] misses a service level, [Customer] will receive the service credit shown in [Schedule X], deducted from the next invoice. Service credits are a price adjustment and do not limit [Customer]'s other rights. If [Supplier] misses the same service level in [3] out of any [6] consecutive months, [Supplier] will deliver a remediation plan within [10] business days, and [Customer] may terminate for cause if the plan is not delivered or not met.
Why: Without a stated consequence, a missed service level becomes a discussion rather than a remedy. Credits and a clear path to termination for repeated failure give service levels weight. Source: FAR Subpart 37.6: Performance-Based Acquisition (https://www.acquisition.gov/far/subpart-37.6); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
9. Data processing agreement
Where [Supplier] processes personal data on behalf of [Customer], it does so as processor under the data processing terms in [Schedule X], which set out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects. [Supplier] will process personal data only on [Customer]'s documented instructions, ensure its staff are bound by confidentiality, apply appropriate security measures, assist [Customer] with data subject requests and breach obligations, delete or return the data at the end of the services, and make available the information needed to show compliance.
Why: When a testing vendor handles personal data for the buyer, the GDPR requires a written contract with specific content. Testers can see personal data in test environments, logs and screenshots even when that is not the plan. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Contracts and liabilities between controllers and processors (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/)
10. Subprocessor approval and data location
[Supplier] will not engage any subprocessor without [Customer]'s prior [specific / general] written authorisation. For general authorisation, [Supplier] will give [30] days' notice of any new or replacement subprocessor, and [Customer] may object. [Supplier] will impose the same data protection obligations on each subprocessor and remains liable for it. Personal data will not be transferred outside [the EEA / the UK] without [Customer]'s written approval and an approved transfer mechanism such as the Standard Contractual Clauses.
Why: The buyer is responsible for knowing who handles its data and where. Prior approval of subprocessors and a limit on transfers keep that under the buyer's control. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Standard Contractual Clauses for international transfers (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
11. No production data without written approval
[Supplier] will use only synthetic, anonymised or masked data for testing unless [Customer] approves in writing the use of specific production data for a specific purpose and period. [Supplier] will not copy production data to any environment or device outside those approved by [Customer]. Any approved production data will be deleted at the end of the approved period and [Supplier] will confirm deletion in writing.
Why: Copying live customer data into test environments puts personal or health data where controls are usually weaker. The default should be synthetic or masked data, with any exception approved in writing. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Sample Business Associate Agreement Provisions (https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html)
12. Security obligations and incident notification
[Supplier] will maintain the security measures in [Schedule X], including access control, multi-factor authentication for [Customer] systems, device encryption and removal of access within [1] business day when a team member leaves. [Supplier] will notify [Customer] without undue delay, and in any case within [24] hours, after becoming aware of a security incident affecting [Customer] systems or data, and will provide the information and cooperation [Customer] needs to investigate and report it.
Why: Test teams often hold credentials to staging and sometimes production systems. The buyer needs stated minimum controls and early notice of any incident so it can meet its own reporting duties. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)
13. Audit and information rights
[Supplier] will provide [Customer], its auditors and any regulator with competent authority, on reasonable notice, access to information, premises, systems and staff relevant to the services, so they can verify compliance with this Agreement. [Supplier] will provide its current independent assurance reports (such as a SOC 2 Type II report or ISO/IEC 27001 certificate) on request. [Customer] may carry out [one] audit per year, plus further audits after a security incident or regulatory request.
Why: The buyer, and in regulated sectors its regulator, may need to check how the service is delivered. A written right to information and audit avoids having to negotiate access when it is needed. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)
14. Restriction on subcontracting
[Supplier] will not subcontract any part of the services without [Customer]'s prior written consent. [Supplier] will identify each proposed subcontractor, the work it will do and where it will do it. [Supplier] remains fully responsible for the acts and omissions of its subcontractors and will ensure each one is bound by obligations equivalent to this Agreement, including confidentiality, security and audit rights.
Why: A buyer who assesses one vendor can end up with work done by another company it never checked. Subcontracting should need the buyer's consent, and the main vendor should stay responsible. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)
15. Confidentiality
[Supplier] will keep confidential all information received from [Customer], including unreleased product details, defect and vulnerability information, source code and test results, and will use it only to provide the services. [Supplier] will share it only with staff and approved subcontractors who need it and are bound by equivalent obligations. These obligations continue for [5] years after the end of this Agreement, and indefinitely for source code and vulnerability information.
Why: Testers see unreleased features, defects and security weaknesses before anyone else. Confidentiality needs to cover that information and survive the end of the contract. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)
16. Rate lock and price review
The rates in [Schedule X] are fixed for the first [24] months. After that, [Supplier] may propose a change no more than once in any [12] months, with [90] days' written notice, and any increase will not exceed [the change in a named index / X percent]. Changes in team seniority mix that affect charges require [Customer]'s prior written approval.
Why: A low first-year rate followed by unplanned increases changes the value of the whole contract. Fixing rates for a period and linking later changes to a stated index keeps costs predictable. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)
17. Change control
Either party may request a change to the services by written change request. [Supplier] will respond within [10] business days with the effect on scope, charges, timetable, service levels and risk. No change takes effect, and no additional charge is payable, until both parties sign the change. [Supplier] will not reduce the services or team size as a way of absorbing a change without [Customer]'s approval.
Why: Scope in testing work changes often. A written change procedure keeps price, timing and service levels tied to what was actually agreed. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO 37500:2014 Guidance on outsourcing (https://www.iso.org/standard/56269.html)
18. Termination for convenience and for cause
[Customer] may terminate this Agreement or any statement of work for convenience on [30] days' written notice, paying only for services delivered up to the termination date [and any agreed termination charge in Schedule X]. Either party may terminate for cause on written notice if the other commits a material breach that is not remedied within [20] business days of notice, or immediately for a breach that cannot be remedied. [Customer] may also terminate where required by a regulator. The exit plan and exit assistance terms apply in all cases.
Why: The buyer should be able to leave a relationship that is not working without having to prove breach, and should be able to leave quickly when there is a serious breach. Both routes should trigger the exit terms. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
19. Acceptance of deliverables
Each deliverable listed in a statement of work will have acceptance criteria agreed in advance, for example: the automation suite runs in [Customer]'s CI pipeline, passes on a clean environment, and is documented to the agreed standard. [Customer] will accept or reject each deliverable within [10] business days of delivery, giving reasons for any rejection. [Supplier] will correct and redeliver rejected deliverables at its own cost. Payment for milestone deliverables is due only after acceptance.
Why: Paying for a test plan or an automation suite that does not run leaves the buyer with little leverage. Acceptance criteria agreed in advance let the buyer check the work before paying for it. Source: FAR Subpart 37.6: Performance-Based Acquisition (https://www.acquisition.gov/far/subpart-37.6); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
20. Limitation of liability with carve-outs
Each party's total liability under this Agreement is limited to [the greater of X and Y percent of the charges paid or payable in the preceding 12 months]. The cap does not apply to: breach of data protection obligations [or a separate higher cap of X], breach of confidentiality, the IP indemnity, death or personal injury caused by negligence, fraud, or wilful misconduct. Service credits do not count toward the cap. This is a starting point for review by [Customer]'s counsel.
Why: A general liability cap is normal, but some losses should sit outside it, because a small cap would leave the buyer carrying most of the harm. Common carve-outs cover data protection, confidentiality, IP infringement and deliberate misconduct. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
21. Insurance
[Supplier] will maintain, for the term and [6] years after, professional indemnity insurance of at least [amount] per claim, cyber liability insurance of at least [amount], and employer's liability and public liability insurance as required by law. [Supplier] will provide certificates of insurance on signature and on each renewal, and will notify [Customer] of any cancellation or material reduction in cover within [10] business days.
Why: Liability terms only help if the vendor can pay. Required insurance, with evidence on request, supports the liability position the buyer agreed to. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)
2 / 2