SaaS license agreement: 2026 template and legal points to watch

A well-drafted SaaS license agreement combines a right to use the software with ongoing services (hosting, support, maintenance, security). In 2026, the agreement must incorporate the French IP framework, GDPR compliance, the new portability and interoperability obligations under the Data Act, and the transparency requirements of the SREN law.

What is a SaaS license agreement in 2026?

A SaaS license agreement grants a non-exclusive, non-transferable and limited right to use the software, while governing associated services (SLA, support, updates). Legally:

• Copyright protects the software and governs exceptions (particularly for interoperability) under the Code de la propriété intellectuelle (CPI).
• Personal data processing requires an agreement compliant with the GDPR (particularly Article 28 governing processors).
• The Data Act (EU 2023/2854), applicable from 12 September 2025, requires data portability, cloud-service interoperability and the reduction of contractual and technical obstacles to switching providers.
• The SREN Law no. 2024‑449 strengthens cost transparency and regulates lock-in practices for digital services in France.

SaaS license agreement template: recommended structure

This framework covers 95% of B2B needs, to be adapted to your product, GDPR exposure and cloud architecture.

1) Parties, definitions and contractual documents

• Full identification of the parties, document hierarchy (main agreement, technical/SLA/pricing/DPA annexes, order forms).
• Precise glossary (authorized user, Customer Data, Personal Data, Service Data, Availability, Critical Incident…).

2) Subject matter and right of use (license)

• Non-exclusive, non-assignable right of use, limited to the scope (modules, environment, user volume, territory, purposes).
• Restrictions (no reverse engineering or unauthorized access), subject to statutory interoperability exceptions under the CPI.

Reference: Code de la propriété intellectuelle.

3) Services, support and SLA

• Service levels (e.g. monthly availability, maintenance windows, restoration times), penalties or service credits.
• Support (business hours, channels, response times by severity), updates and functional enhancements.

4) Security, hosting and compliance

• Technical and organizational measures, logging, encryption, vulnerability management, recovery plan (RTO/RPO).
• Data location, list of subprocessors, security incident and personal data breach notification.

References: GDPR and recommendations from CNIL.

5) Data protection (DPA annex — GDPR Article 28)

• Roles (Controller/Processor), documented instructions, confidentiality, security, audits, subprocessors and transfers outside the EU.
• Transfer mechanisms (Standard Contractual Clauses where applicable) and records of processing activities.

References: GDPR; guidance from CNIL.

6) Data, portability and exit arrangements

• Export on first request in open, machine-readable formats, with API documentation and field mapping.
• Exit plan (duration, milestones, technical assistance), caps on and transparency of switching charges in accordance with the Data Act and SREN law.

References: Data Act ; SREN law.

7) Interoperability and APIs

• Interoperability commitments (open standards, SDK), reasonable compatibility with target solutions and stable documentation.
• Versioning policy and notice of breaking changes.

Reference: Data Act.

8) Financial terms

• Pricing model (users, consumption, tiers), indexation, revisions, billing arrangements, late-payment penalties.
• Cost transparency (storage, egress, exit assistance) in accordance with SREN.

References: SREN law; practical information from Service Public Pro and économie.gouv.fr.

9) Intellectual property and warranties

• Supplier’s retention of ownership, Customer’s license to use, rights over Customer content, and clauses on open-source components.
• IP infringement warranty for the SaaS, with workarounds or cessation-of-use mechanisms.

References: CPI; resources from INPI.

10) Confidentiality

• Definition of Confidential Information, exceptions, confidentiality period, reasonable security, return/destruction.

11) Liability and insurance

• Limitations and exclusions (indirect loss), caps (e.g. subscription amount), professional indemnity/cyber insurance obligations.
• Specific clauses for availability/SLAs and data damage (separate regime).

12) Term, termination and end of agreement

• Initial term, renewal, termination for material breach, force majeure, change of control.
• Exit procedure: timetable, assistance, post-contract deletion/security.

References: Data Act (no contractual/technical obstacles to switching).

Major legal points to watch

• Scope of the right of use: specify modules, environments, license metrics and restrictions in light of the CPI interoperability exceptions.
• Exit/portability: deliverables, open formats, timelines, assistance, API documentation and capped/transparent fees (Data Act, SREN).
• Effective interoperability: versioning policies, compatibility tests, notice of breaking changes (Data Act).
• GDPR: Article 28 DPA, subprocessor mapping, transfers outside the EU, breach notification and proportionate audits (CNIL).
• Realistic SLAs: guaranteed availability, controlled exclusions, credits/penalties and alignment with technical redundancy.
• Intellectual property: IP infringement warranty and management of open-source components; consider targeted escrow if a critical on-premises component is needed for continuity.
• Pricing changes: reasonable indexation mechanisms, caps on increases and termination rights for material changes.
• Embedded AI features: transparency on third-party model use, data flows, output rights and GDPR compliance.

For an overview of the core clauses in a SaaS agreement, see our guide to the essential clauses of a SaaS contract. If your solution uses AI models, incorporate a dedicated contractual clause on AI use.

Negotiation checklist (practical)

• GDPR roles, attached DPA and safeguards for transfers outside the EU (see our DPA guide for SaaS and guide to transfers outside the EU).
• Portability: complete export, open formats, timelines and capped fees; documented API and trial extraction tests.
• SLA: measured availability, automatic penalties, escalation process, RTO/RPO aligned with your business needs.
• IP: license to use, IP infringement warranty, open-source policy and, if required, escrow or a continuity mechanism.
• Pricing: indexation, variations, ancillary costs (storage, egress, assistance), exit rights for abnormal increases.
• Interoperability: standards, breaking-change notice, sandbox and SDK provided.
• Termination: grounds, notice, exit plan, data deletion/security and deletion certificate.

Sample clauses (template to adapt)

For more on the differences between licensing models and open-source implications, consult our dedicated article on the software license agreement (SaaS, open source, proprietary).

Penalties and risks of non-compliance

• GDPR: risk of formal notices and financial penalties from CNIL for non-compliance (e.g. no DPA, transfers without safeguards).
• Data Act: contractual disputes, injunctions and administrative penalties from the competent authorities for obstacles to switching and interoperability failures.
• SREN: oversight of lock-in practices and cost transparency, with risk of penalties for non-compliance.

Legislation: GDPR ; Data Act ; SREN law.