# Software testing services: clauses to include

_ChooseQAVendor framework v1.0. Situation: Replacing an underperforming vendor. 12 clauses. Nothing you enter in the toolkit is sent anywhere._

Schedule of clauses proposed by Example Product Ltd for the agreement with [Supplier]. The wording is a starting point for your counsel, not legal advice. Numbers in square brackets are placeholders to agree.

## Checklist

| No | Clause | Status |
| --- | --- | --- |
| 1 | Ownership of test code and test assets | Agreed / In negotiation / Missing |
| 2 | Repository and tool accounts held by the buyer | Agreed / In negotiation / Missing |
| 3 | Knowledge transfer on exit | Agreed / In negotiation / Missing |
| 4 | Exit plan and exit assistance period | Agreed / In negotiation / Missing |
| 5 | Staff replacement terms | Agreed / In negotiation / Missing |
| 6 | Key personnel | Agreed / In negotiation / Missing |
| 7 | Service levels with measurable targets | Agreed / In negotiation / Missing |
| 8 | Data processing agreement | Agreed / In negotiation / Missing |
| 9 | Security obligations and incident notification | Agreed / In negotiation / Missing |
| 10 | Confidentiality | Agreed / In negotiation / Missing |
| 11 | Change control | Agreed / In negotiation / Missing |
| 12 | Termination for convenience and for cause | Agreed / In negotiation / Missing |

---

## Clauses

**1. Ownership of test code and test assets**

All test code, automation frameworks built for Example Product Ltd, test cases, test data, test plans, reports and related documentation created under this Agreement ("Test Assets") are assigned to Example Product Ltd on creation, and [Supplier] hereby assigns to Example Product Ltd all rights, title and interest in them. To the extent any Test Asset is not a work made for hire, this assignment applies. [Supplier] may keep pre-existing tools listed in [Schedule X] and grants Example Product Ltd a perpetual, royalty-free licence to use them as part of the Test Assets. [Supplier] will sign any further documents needed to record this assignment. This is a starting point for review by Example Product Ltd's counsel.

_Why: Test scripts, automation frameworks, test data sets and test documentation are paid for by the buyer and are needed to keep testing after the contract ends. In the US, software written by an outside company is usually not a work made for hire, so ownership moves to the buyer only through a written assignment. Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)_

**2. Repository and tool accounts held by the buyer**

[Supplier] will store all Test Assets in source control, test management and CI accounts owned and administered by Example Product Ltd, and will not keep the only copy of any Test Asset in systems controlled by [Supplier]. Example Product Ltd will grant and revoke [Supplier] access to those accounts. On request, and in any case on exit, [Supplier] will return any Test Assets held elsewhere in a usable, documented format within [10] business days.

_Why: If the test code lives in the vendor's repository, the buyer depends on the vendor's cooperation to get it back. Holding the repository, pipelines and test management accounts in the buyer's name keeps access and return of the work simple. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)_

**3. Knowledge transfer on exit**

On expiry or termination, [Supplier] will deliver a knowledge transfer to Example Product Ltd or its nominated replacement supplier covering the test strategy, the structure and running of the automation suite, open defects, known flaky tests, environment setup and test data. Knowledge transfer will include up to [40] hours of working sessions and written handover notes, at no extra charge [or at the rates in Schedule X]. Example Product Ltd will confirm in writing when the knowledge transfer is complete.

_Why: The buyer needs a way to move testing to another supplier or in-house without losing what the outgoing team knows. Regulators ask firms to plan exit so that the service can be transferred without disruption. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)_

**4. Exit plan and exit assistance period**

[Supplier] will deliver a draft exit plan within [60] days of the start date and update it [annually]. On notice of termination or expiry, [Supplier] will continue to provide the services and reasonable exit assistance for an exit period of up to [90] days, as requested by Example Product Ltd, on the terms of this Agreement. During the exit period [Supplier] will cooperate with any replacement supplier and will not reduce the team or service levels without Example Product Ltd's written approval.

_Why: A written exit plan agreed early is easier to negotiate than one agreed during a dispute. An exit assistance period keeps the service running while the buyer moves it elsewhere. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)_

**5. Staff replacement terms**

[Supplier] will give Example Product Ltd at least [20] business days' written notice before replacing any member of the assigned team, except for resignation, illness or dismissal. Any replacement will have skills and experience at least equal to the person replaced and will be subject to Example Product Ltd's reasonable approval. [Supplier] will provide an overlap of at least [10] business days in which the replacement shadows the departing person, at no charge to Example Product Ltd.

_Why: Rotating testers take product knowledge with them, and the buyer ends up paying for the new person to learn. Notice and an overlap period at the vendor's cost keep that cost with the party that caused the change. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO 37500:2014 Guidance on outsourcing (https://www.iso.org/standard/56269.html)_

**6. Key personnel**

The individuals listed in [Schedule X] are Key Personnel. [Supplier] will not remove or reassign Key Personnel during the first [12] months without Example Product Ltd's prior written consent, except for resignation, illness or dismissal. Any replacement is subject to the staff replacement terms in clause [X]. Repeated or unapproved changes of Key Personnel are a material breach.

_Why: The people presented during selection are often part of why the vendor was chosen. Naming them in the contract stops a switch after signature without the buyer's agreement. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)_

**7. Service levels with measurable targets**

[Supplier] will meet the service levels in [Schedule X]. Each service level states what is measured, the target, the data source, the measurement period and who reports it. Examples to agree: regression run completed within [X] hours of a release candidate, critical defects triaged within [4] business hours, test reports delivered by [day] each [week]. [Supplier] will report performance against each service level [monthly] with the underlying data.

_Why: Service levels only help if both sides can measure them the same way. Each one needs a definition, a target, a measurement method and a reporting cycle. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); FAR Subpart 37.6: Performance-Based Acquisition (https://www.acquisition.gov/far/subpart-37.6)_

**8. Data processing agreement**

Where [Supplier] processes personal data on behalf of Example Product Ltd, it does so as processor under the data processing terms in [Schedule X], which set out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects. [Supplier] will process personal data only on Example Product Ltd's documented instructions, ensure its staff are bound by confidentiality, apply appropriate security measures, assist Example Product Ltd with data subject requests and breach obligations, delete or return the data at the end of the services, and make available the information needed to show compliance.

_Why: When a testing vendor handles personal data for the buyer, the GDPR requires a written contract with specific content. Testers can see personal data in test environments, logs and screenshots even when that is not the plan. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Contracts and liabilities between controllers and processors (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/)_

**9. Security obligations and incident notification**

[Supplier] will maintain the security measures in [Schedule X], including access control, multi-factor authentication for Example Product Ltd systems, device encryption and removal of access within [1] business day when a team member leaves. [Supplier] will notify Example Product Ltd without undue delay, and in any case within [24] hours, after becoming aware of a security incident affecting Example Product Ltd systems or data, and will provide the information and cooperation Example Product Ltd needs to investigate and report it.

_Why: Test teams often hold credentials to staging and sometimes production systems. The buyer needs stated minimum controls and early notice of any incident so it can meet its own reporting duties. Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)_

**10. Confidentiality**

[Supplier] will keep confidential all information received from Example Product Ltd, including unreleased product details, defect and vulnerability information, source code and test results, and will use it only to provide the services. [Supplier] will share it only with staff and approved subcontractors who need it and are bound by equivalent obligations. These obligations continue for [5] years after the end of this Agreement, and indefinitely for source code and vulnerability information.

_Why: Testers see unreleased features, defects and security weaknesses before anyone else. Confidentiality needs to cover that information and survive the end of the contract. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)_

**11. Change control**

Either party may request a change to the services by written change request. [Supplier] will respond within [10] business days with the effect on scope, charges, timetable, service levels and risk. No change takes effect, and no additional charge is payable, until both parties sign the change. [Supplier] will not reduce the services or team size as a way of absorbing a change without Example Product Ltd's approval.

_Why: Scope in testing work changes often. A written change procedure keeps price, timing and service levels tied to what was actually agreed. Source: Model Services Contract (https://www.gov.uk/government/publications/model-services-contract); ISO 37500:2014 Guidance on outsourcing (https://www.iso.org/standard/56269.html)_

**12. Termination for convenience and for cause**

Example Product Ltd may terminate this Agreement or any statement of work for convenience on [30] days' written notice, paying only for services delivered up to the termination date [and any agreed termination charge in Schedule X]. Either party may terminate for cause on written notice if the other commits a material breach that is not remedied within [20] business days of notice, or immediately for a breach that cannot be remedied. Example Product Ltd may also terminate where required by a regulator. The exit plan and exit assistance terms apply in all cases.

_Why: The buyer should be able to leave a relationship that is not working without having to prove breach, and should be able to leave quickly when there is a serious breach. Both routes should trigger the exit terms. Source: Regulation (EU) 2022/2554 (DORA), including Article 30 key contractual provisions (https://eur-lex.europa.eu/eli/reg/2022/2554/oj); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)_