Get the legal basics right

Why this step matters

Early-stage legal work is mostly about avoiding preventable problems: a contractor who still owns the code they wrote, a product name you have to abandon after launch, a privacy policy that does not match what your app collects, or a missing tax registration. None of these is expensive to fix early. All of them become expensive during a fundraise, an acquisition or a dispute.

You do not need a lawyer for everything. Use good templates for routine work and pay for advice where the stakes or the risks are high. Rules differ by country, so what follows covers the US by default with notes for the UK and EU.

How to do it

1. Secure your intellectual property. Every founder, employee and contractor who creates anything for the company should sign an agreement assigning that work to the company, plus confidentiality terms. This is the document investors most often find missing.
2. Search and protect your name. Before you invest in a brand, search the trademark register in your main markets (the USPTO in the US, the UK Intellectual Property Office, the EUIPO for the EU) and check domains and social handles. Filing a trademark for your core name is worth considering once you are confident in it. In the US, apply through USPTO's TEAS online system using the Trademark ID Manual to describe your goods or services, which avoids a surcharge (see costs below).
3. Publish customer-facing terms. Terms of service set out what you provide, payment and refunds, acceptable use, liability limits and how disputes are handled. B2B products often also need a data processing agreement.
4. Write an accurate privacy policy. It must describe what personal data you actually collect, why, who you share it with and how people can exercise their rights. If you have users in the UK or EU, GDPR applies (the UK GDPR in the UK), including rules on lawful basis, cookies and data transfers. In the US, state privacy laws such as California's apply above certain thresholds. If your product uses third-party AI models on user data, say so.
5. Use standard contracts for people. Contractor agreements, offer letters and employment contracts should fit local law. Misclassifying employees as contractors can lead to back taxes and penalties in the US, the UK and elsewhere.
6. Register for the right taxes. In the US, sales tax obligations for software and digital goods vary by state and depend on where your customers are. In the UK and EU, VAT registration becomes mandatory above a turnover threshold, and selling digital services to consumers across the EU has its own VAT rules. Check before you start charging.
7. Check sector rules. Health data, financial services, children's products, AI decision-making and regulated professions all carry extra obligations. In the EU, the AI Act applies on a staggered timeline by risk category and already bans a short list of prohibited practices and sets transparency duties for general-purpose AI; check which obligations apply to your product today rather than assuming they are all still in the future. Get specific advice if you work in a regulated sector.
8. Keep a document folder. Store signed agreements, board and shareholder decisions, filings and policies in one shared, organised place. Due diligence later will ask for exactly these.

What it costs and how long it takes

Templates and generators cover terms, privacy policies and simple contracts for little or no cost. In the US, USPTO's base trademark application fee is $350 per class (current as of October 2026, after the old TEAS Plus/TEAS Standard tiers were merged into one base fee); using the free-text box instead of the ID Manual to describe goods or services adds a $200-per-class surcharge, and incomplete applications add $100 per class. Outside the US, fees depend on the office and the number of classes. A startup lawyer's review of your core documents is the largest optional cost. Allow one to three weeks to put the basics in place.

Free credits, perks and services that help

Many startup law firms publish free document libraries and offer fixed-fee or deferred-fee packages for early companies; compare them at /best/legal. Accelerators often include legal office hours or discounted legal partners; see /accelerators. Privacy, cookie consent and contract tools sometimes appear in perk bundles at /perks. For tax registration and filings, see /best/accounting-tax.

Common mistakes

• Copy-pasted policies. Someone else's privacy policy describes their data practices, not yours, and can be misleading.
• No IP assignment for freelancers. Paying for work does not automatically transfer ownership.
• Falling in love with an unsearched name. Rebranding after launch costs time, domains and search rankings.
• Ignoring VAT or sales tax. These obligations build up quietly and are painful to fix retroactively.
• Treating legal as one-off. Update terms and policies when your product, data use or markets change.
• Assuming AI rules do not apply yet. If you build with or on AI, check the current state of the EU AI Act and similar rules rather than assuming all obligations are still years away.

Go deeper

Compare startup-friendly law firms and legal tools at /best/legal, and see Split equity and sign a founder agreement for the documents between founders.