You’ve won the customer. Now can your business survive the paperwork?

Winning a significant new customer should feel like the hard part is over. You’ve sent the proposal, agreed the commercials and got the yes.

Then the paperwork arrives.

A customer agreement. A data processing agreement. A security questionnaire. Insurance requirements. Questions about subcontractors, intellectual property, where data is hosted, and whether customer information is being used with AI tools.

For many growing businesses, this is the point at which things become more complicated. Not because anything has gone wrong, but because the customer is bigger, the relationship matters more and the level of scrutiny has changed. It is often the first real test of whether the legal and operational side of the business has kept pace with everything else.

That does not mean a startup needs to start behaving like a large corporate. Over-engineering the legal side too early can be just as unhelpful as ignoring it. The aim is simply to have enough in place so that a good commercial opportunity does not get slowed down by issues that could have been dealt with earlier.

Know your position before the contract arrives

Early customer contracts are often dealt with pragmatically. You might have your own terms, sign the customer’s paper, or negotiate only the points that obviously matter and move on. That is often perfectly sensible. The issue is that the stakes change as the value and importance of the customer grows.

A larger customer may ask the business to accept things it has not really had to consider before: broad indemnities, high or uncapped liability, demanding service levels, unfavourable termination periods, wide-ranging warranties, or rights over intellectual property.

It helps to have a basic view of what your business can sensibly accept before a live negotiation starts. What level of liability would genuinely hurt if something went wrong? What happens if the customer wants to terminate early? Are you committing to service levels the team can actually meet? Are you giving away rights over IP that you need elsewhere in the business?

There is no universally “correct” position. The answer depends on the deal, the customer, the risk, and how much leverage you have. What matters is knowing where you can flex and where you should not. That makes negotiations quicker and, importantly, more commercial.

Know what happens to the data

Data protection often becomes much more tangible once a larger customer starts asking detailed questions. Where is our data hosted? Who can access it? Which third parties process it? Does it leave the UK? How long do you retain it? What happens when the contract ends?

A privacy notice on your website will not answer those questions.

You do not need everybody in the business to become a data protection specialist, but somebody should be able to explain, in straightforward terms, what happens to customer, and personal data. That means understanding the important systems you use, the suppliers behind them and the promises you are making to customers.

AI is now part of that conversation too. Many businesses are using AI tools for drafting, coding, research, customer support and analysis. That is not inherently problematic, but it does mean understanding what information is going into those tools and whether any customer commitments restrict that use.

The aim is not to create fear around AI or data. It is simply to avoid being caught off guard when a customer asks a reasonable question.

Make sure the company owns what it relies on

Intellectual property can sit quietly in the background until somebody wants certainty.

A freelancer may have built an early version of the product. An agency may have created the brand. A consultant may have developed content or software. A founder may have created something important before the company existed. Commercially, everyone may understand who the work was intended for. Legally, the ownership position can be less clear.

The practical approach is to identify the assets the business genuinely relies on and make sure the ownership position is documented. If something is missing, it is usually much easier to deal with while the people involved are still around and everyone remembers what was agreed.

Expect questions beyond the contract

Larger customers rarely stop at legal terms. You may be asked about cybersecurity, business continuity, insurance, accessibility, disaster recovery, subcontractors, or internal policies. Some requests will be proportionate and sensible. Others may have been designed for suppliers far larger than you.

The answer is not to build a large compliance function overnight, but nor is it to say yes to everything because the customer wants the paperwork back quickly.

If a requirement does not make sense for the size or nature of the business, it is reasonable to explain that and propose an alternative. Larger customers will often understand that a 20-person supplier will not operate in the same way as a multinational.

What matters is being accurate about what you do have in place. A rushed “yes” to a security or compliance question can easily turn into difficulties later.

Get key information out of people’s heads

In a young business, a surprising amount of important information can still sit with one or two people. Someone remembers that a key customer has a special termination right. Someone else knows which supplier hosts a particular category of data.

That is normal when a business is moving quickly. It simply becomes less sustainable as the business grows.

A small amount of structure goes a long way. Keep signed contracts somewhere easy to find. Record key renewal and notice dates. Keep a basic list of important suppliers. Know where your core IP came from. Keep track of unusual customer commitments and maintain a simple picture of where customer and personal data goes.

This is not about creating process for the sake of it. It is about making sure ordinary customer questions can be answered without a forensic search across inboxes, drives, and memories.

Don’t lawyer everything

Not every contract needs the same level of legal input, and not every customer request is worth resisting. A low-value, low-risk agreement should not necessarily go through the same process as a strategically important customer contract. Some terms are worth negotiating hard. Others are not.

The useful question is not whether there is any legal risk. There is legal risk in almost every commercial decision. The better questions are: how material is it, how likely is it to matter, what happens if it goes wrong, and is the time and cost of fixing it proportionate?

Good legal support should help founders make those calls. It should make the business more decisive, not more cautious.

Be ready before the deal is waiting

The ideal time to discover that a customer needs a data processing agreement is not two days before quarter-end. The ideal time to find an IP ownership gap is not halfway through a funding round. And the ideal time to decide how much liability the company can accept is not during negotiations with its largest customer.

None of this means a startup should behave like a large corporate before it needs to. The aim is to put enough structure in place that the business can keep moving as the opportunities get bigger.

At a certain stage, legal and compliance are no longer separate from growth. They become part of whether customers are comfortable buying from you, whether deals move at a sensible pace and whether the business looks credible when somebody starts asking harder questions.

The goal is not to become more corporate. It is to become easier to buy from.

And that is what good legal infrastructure should do: remove friction, give customers confidence, and make it easier for the business to grow into the opportunities it has worked hard to win.

For more startup news, check out the other articles on the website, and subscribe to the magazine for free. Listen to The Cereal Entrepreneur podcast for more interviews with entrepreneurs and big-hitters in the startup ecosystem.