Subcontracting agreement: legal obligations and good practice

Subcontracting provides flexibility, but exposes the commissioning party to greater liability. In France, it is strictly governed by Law no. 75-1334 of 31 December 1975, a mandatory law applying to both private and public contracts. Here are the essential rules and a practical guide to securing your agreements.

1) Definition and mandatory legal framework

The 1975 law defines subcontracting as an arrangement in which a contractor entrusts another party (the subcontractor), under the contractor’s responsibility, with performance of all or part of the contract concluded with the project owner. This regime is mandatory and cannot be excluded by contrary clauses (Law no. 75-1334). The project owner must accept the subcontractor and approve its payment terms before any performance.

2) Due-diligence obligations of the commissioning party

The commissioning party must check its subcontractor’s legal identity (e.g. Kbis extract), tax and social-security compliance, and repeat these checks every 6 months during performance. In the event of non-compliance (undeclared work, unpaid contributions), it may be held jointly and severally liable, with administrative and financial penalties. Refer to official DREETS recommendations (due-diligence obligations) and the procedures summarized on Service Public Pro.

• Before signing: subcontractor identity, URSSAF certificates, tax compliance, list of foreign employees where applicable.
• During performance: six-monthly certificate renewals, traceability of work and hours.
• For subcontracting chains: apply the same diligence at each tier.

3) Payment guarantees and direct action

The 1975 law protects the subcontractor through two main mechanisms:

• Payment guarantee through a personal and joint-and-several guarantee or delegated payment arrangement agreed by the project owner. Without this arrangement, the subcontractor is exposed to non-payment risk. See the legal framework and procurement forms on economie.gouv.fr.
• Direct action by the subcontractor against the project owner if the main contractor fails to pay (subject to statutory conditions). Reference legislation: Law no. 75-1334.

Good practice for the commissioning party: make establishment of the guarantee or delegated payment arrangement a condition precedent to the agreement taking effect.

4) Construction and public procurement specifics (DC4)

In public contracts, each subcontractor must be accepted by the public purchaser and its payment terms approved before performance, usually through form DC4 (subcontracting declaration) published by the government. Practical information and templates: economie.gouv.fr.

• Unaccepted subcontractor = no direct payment and risk of payment-statement processing being blocked.
• For construction work, safety and prevention requirements (PPSPS, authorizations) apply in addition to social-compliance checks.

5) Personal data, security and compliance

If the subcontractor processes personal data on your behalf, you must enter into an agreement compliant with GDPR Article 28 (the status of “processor” in data law). CNIL lists mandatory clauses (subject matter, duration, security measures, audits, breach notification, etc.) and provides practical guides: CNIL — Working with a processor. Provide security SLAs (encryption, access management, logs) and exit/portability commitments at the end of the agreement.

6) Essential clauses to include

• Subject matter and scope: deliverables, exclusions, acceptance criteria, dependencies.
• Schedule and milestones: delay penalties, graduated remedies, right to suspend for non-payment.
• Pricing and payment: arrangements, advances, retention money, compliance with the statutory B2B payment-period cap (generally 60 days, see economie.gouv.fr; legislation available on Légifrance).
• Quality and liability: obligation to achieve a result or use reasonable efforts, insurance, liability cap. For drafting detail, see our guide to the limitation of liability clause.
• Intellectual property: ownership of background IP/developments, assignment or licensing of rights, IP infringement warranties. Useful guidance on rights management: INPI.
• Confidentiality and security: NDA, technical and organizational measures, further subcontracting subject to written agreement.
• Specific compliance: GDPR (see CNIL), export, regulated sector.
• Governance and oversight: committees, KPIs, audit rights, change management.
• End of agreement: exit/portability, document transfer, assistance, return/deletion of data.

If you are deciding between a services framework and complete outsourcing, compare your options with our article on the services agreement.

7) Recommended process (operational checklist)

1. Map what is outsourced (data, IP, IT-system access, critical dependencies).
2. Select the subcontractor (references, insurance, compliance, risk scoring).
3. Check identity, URSSAF and tax compliance (initially + every 6 months), following DREETS (due-diligence guide) and Service Public Pro.
4. Obtain acceptance of the subcontractor and approval of payment terms from the project owner (or public purchaser through DC4 where applicable, see economie.gouv.fr).
5. Establish a payment guarantee (named guarantee or written delegated payment arrangement).
6. Sign the subcontracting agreement (key clauses above). If the subcontractor processes data, attach a compliant GDPR agreement (see CNIL).
7. Oversee performance (committees, KPIs, quality assurance plans, audits).
8. Archive due-diligence evidence and certificates for traceability.

To save time tracking deadlines and documents (URSSAF, insurance, KPIs), you can use no-code contract management tools.

8) Risks and penalties for non-compliance

• Undeclared work / due-diligence failures: joint-and-several liability of the commissioning party (payment of wages/contributions, fines), see DREETS.
• Lack of acceptance/approval: no direct payment to the subcontractor and risk of delays for the project owner (see economie.gouv.fr).
• Failure to establish a payment guarantee: increased exposure to non-payment and litigation (the subcontractor’s direct action remains a statutory safety net).
• GDPR non-compliance: formal notices and penalties from supervisory authorities (see CNIL).

9) Negotiation good practice

• Align commitments: mirror obligations owed to the project owner in the subcontract (SLA, security, penalties, intellectual property).
• Secure financial flows: clear billing milestones, payment periods compliant with statutory B2B caps (economie.gouv.fr), adjustment mechanisms for contingencies.
• Ensure auditability: audit rights, access to compliance evidence, remediation plan.
• Plan the end: priced exit assistance, knowledge transfer, business continuity.

If non-payment nevertheless occurs, expedited remedies are available, such as the payment order procedure.

10) Quick FAQ

Useful official resources

• Law no. 75-1334 (subcontracting): Légifrance
• Due-diligence obligations: DREETS
• Public procurement, DC4, B2B payment periods: economie.gouv.fr
• Business formalities: Service Public Pro
• Data protection and processors: CNIL
• Applicable legislation (codes): Légifrance
• IP good practice: INPI

To structure your commercial relationships end to end, also see our practical advice on key SaaS terms of sale clauses and the distinction between terms of use and terms of sale.