When to call a lawyer: key moments in a startup's life

In a startup, speed only has value if it is legally sustainable. Knowing when to involve a lawyer helps avoid blind spots, accelerate deals and preserve value (cap table, digital assets, reputation). Here are the key moments when legal support becomes a competitive advantage.

The 10 moments when calling a lawyer creates the most value

• Before formation: choosing the form (SAS/SARL), capital allocation, shareholders' agreement, governance.
• Registration and licences: single window, regulated activities, VAT and local EU obligations.
• Intellectual property: founder/freelancer assignments, trademarks, patents, trade secrets.
• Data and product compliance: GDPR/CNIL, cookies, security by design.
• Digital services: DSA compliance (platforms, marketplaces) and AI Act roadmap.
• Key contracts: terms of sale/use, SaaS, partnerships, distribution, SLAs, liability/insurance.
• HR and equity: employment contracts, employee inventions, BSPCE/ESOP, international mobility.
• Fundraising: term sheet, due diligence, shareholders' agreement, BSA/BSPCE and protective clauses.
• International expansion: establishment, indirect tax, data transfers, local law.
• Crises and litigation: formal demands, mediation/arbitration, insolvency proceedings.

1) Before launch: structure the business without regrets

Company form, governance and shareholders' agreement

Initial structuring shapes future funding rounds: preference shares, liquidity clauses, founder vesting, approval/exclusion, governance. A solid shareholders' agreement and consistent articles avoid deadlocks. Refer to the applicable codes on Legifrance and anticipate their interaction with option plans (BSPCE) and delegations of authority.

Registration, permits and single window

In the EU, procedures are centralised through single windows and online services in each Member State; some activities require specific licences/insurance. See the European Commission's “Starting a business in the EU” portal here. In France, organise accounting and VAT registration from the outset if your thresholds/activities require it.

2) Secure intangible assets and data

IP: assignments, trademarks, patents, secrets

• Have founders/employees/freelancers sign assignments of rights (code, design, content, datasets).
• Register your trademarks and assess patentability; introduce a trade-secret policy (NDAs, restricted access, logs).
• Check open-source licences and third-party dependencies in your SBOM.

GDPR and CNIL: privacy by design

From the MVP stage, establish processing rules: records, lawful bases, minimisation, DPAs with processors, transfers outside the EU, cookies/UI. Anticipate DPIAs for risky processing and be ready for inspections: see CNIL resources and inspection practices here.

3) Digital products: DSA, AI Act and cybersecurity

DSA: digital services obligations

If you provide intermediary services (hosting, marketplace, platform), the DSA imposes transparency, reporting/removal of illegal content, moderation reports and enhanced obligations depending on service size and nature. See the Ministry of the Economy's summary here and consult legislation through EUR-Lex.

AI Act: compliance roadmap

The AI Act introduces a risk-based approach: targeted prohibitions, requirements for high-risk systems (data governance, risk management, documentation, human oversight, CE marking), and transparency duties for other uses. See the Service-Public AI Act factsheet and the Bpifrance operational guide here. Regulatory sandboxes can accelerate product iterations.

Cybersecurity: minimum requirements and evidence

Dependency updates, MFA, secrets management, encryption, backups, logging and incident response plans: draw on ANSSI frameworks and alerts here. These measures support your compliance evidence (DSA/AI Act/GDPR) and B2B contracts.

4) Commercial contracts and liability

• Terms of sale/use & SLAs: scope, availability, support, exit and data return, security, data ownership, vulnerability handling, critical subcontractors.
• Limitation clauses: liability caps, exclusions, penalties; align them with your insurance cover.
• Partnerships/distribution: exclusivity, non-solicitation, joint IP, compliance.

Need a ready-to-use contractual foundation? Explore AI and law resources and our Discover the Initial journey to systematise negotiations.

5) HR, governance and equity

• Employment contracts: duties, IP/inventions, confidentiality, remote work, payroll compliance.
• BSPCE/ESOP: define eligibility, allocations, vesting/cliff, departures (good/bad leaver), liquidity and associated tax treatment.
• Governance: powers/delegations, committees, minutes; check consistency between articles, shareholders' agreement and internal rules on Legifrance.

6) Fundraising and M&A

• Before fundraising: data room, legal housekeeping (cap table, IP, key contracts, GDPR, disputes), term sheet and timetable.
• Audit and closing: due diligence responses, shareholders' agreement adjustments (liquidation preference, anti-dilution, governance), instruments (BSPCE/BSA, convertible bonds).
• Public funding: programmes and support through Bpifrance.

7) International expansion

Cross-border sales, permanent establishment, VAT, local consumer law, choice of law and jurisdiction, data transfers: map risks country by country. Commission networks (e.g. Startup Europe) facilitate introductions.

8) Managing crises and insolvency proceedings

Pre-litigation and amicable resolution

Build a file (facts, evidence, quantified claims), send a proportionate formal demand and consider mediation/arbitration. A lawyer optimises outcomes and timing.

Financial difficulties

Anticipate ad hoc mandate/conciliation proceedings. Where the business cannot pay debts as they fall due, safeguard, judicial reorganisation or liquidation proceedings are governed by the Commercial Code: see Insolvency proceedings. Acting early protects directors (mismanagement, disqualification, etc.).

Operational checklists

Before contacting a lawyer

• Pitch, business model and organisation chart (founders, holdings, commitments).
• Articles/shareholders' agreement (even drafts), main contracts (SaaS, customers, suppliers), DPIA/GDPR records.
• Product map: data flows, architecture, dependencies.
• Timetable and constraints (fundraising, launch, compliance, customer audits).

Warning signs that warrant an immediate call

• Major deal with high penalties or one-sided clauses.
• Sensitive-data processing or CNIL requests.
• Launching a platform service subject to the DSA.
• AI product in a regulated sector (health, finance, education) under the AI Act.
• Cash-flow pressures affecting the business's ability to continue operating.

Regulatory developments to monitor

• DSA: graduated obligations according to service nature/size – summary by the Ministry of the Economy.
• AI Act: risk classification, CE marking for high-risk systems – Service-Public factsheet and Bpifrance guide.
• GDPR/CNIL: inspections and penalties – see CNIL.
• Cybersecurity: good practices and alerts – ANSSI.
• Official legislation: check current versions on EUR-Lex and Legifrance.
• Regulated professions & legaltech: professional framework and reforms under the 2015 Macron Act where relevant.

To explore these topics and equip your team, you can also browse our legal ops content.