CCPA audit requirements start with calendar year 2027. Here is who is in scope, when the first CalPrivacy certifications are due, why the audit report can come back to bite you, and what your customers will ask you to sign.
Almost every fight I get pulled into is a version of “I thought you were doing that.” Build three responsibility charts, one per stage of the relationship, and stop pretending nothing is shared.
Most auto-renewal statutes only protect individuals buying for personal use, so your enterprise deals sit outside them. A few do not. Virginia covers small businesses, Colorado deleted the consumer limit, and two old New York laws have always applied to companies.
Short answer: an SLA in software is a promise about availability and support with a price tag attached. It has six moving parts, and the one that decides what it costs you is not the uptime percentage everybody argues about. It is the definition of downtime sitting underneath it. I
Most US AI rules put the disclosure duty on your customer, not on you. If you added AI features by calling a third-party foundation model, you are a service provider. Here are the three assistance duties you actually owe, the one obligation nobody can make you take on, and the mistake that flips you into controller status.
Most software vendors cap liability at fees paid. In a 2025 Eighth Circuit decision, that language barred an Omaha vendor from recovering a dollar of the $1,884,000 its enterprise customer walked away from. Here is what to change in your own agreement.
Six states now make you register as a data broker if you sell or license personal data about people who never dealt with you, and the definition is a lot wider than the reputation. California has already fined S&P Global $62,600 over an administrative error. Here is how to tell if it reaches you.
A good data retention policy makes three promises and backs each one with proof: delete on a schedule, limit who can read customer data, and let the customer verify both. Here is what goes into one that survives a security review.
Last updated: June 27, 2026 Precise geolocation data is location information that pinpoints a person within a radius of about 1,750 feet, and if your mobile app collects it, you are sitting on one of the most heavily regulated categories of personal data in the United States. Here is the
Courts do not enforce the terms you wrote. They enforce the click your user made, on the screen you showed. Four questions decide whether your clickwrap holds up, and the GM OnStar ruling shows what happens when it does not.
If you sell an auto-renewing subscription, your SaaS subscription agreement (and the cancellation flow that goes with it) is under more legal pressure now than it was a year ago, even though the FTC’s federal “click-to-cancel” rule was struck down in 2025. Enforcement didn’t stop. It just shifted to older
Short answer: An indemnity forces the vendor to spend money defending the customer on a mere allegation, with very few defenses, while a breach of contract claim puts the cost and the burden of proof on the customer. That is why customer paper is full of indemnities. When negotiating a
Short answer: AI and machine learning agreements are not standard software licenses. Three issues drive everything: how the system works and who does what, who has what rights to the trained model, and who owns the underlying software and algorithm. Training-data rights and output liability are the two modern battlegrounds.
Short answer: security due diligence is the primary bottleneck in enterprise SaaS deals today. The Vendor Security Alliance standardizes the security questionnaire buyers send vendors, letting you prove your security posture once in a trusted format rather than answering a custom questionnaire for every enterprise deal. As a SaaS attorney,
Short answer: the three nuggets every enterprise SaaS vendor should remember are: set expectations early, link price to terms, and keep the agreement simple. We represent lots, literally 100s and 100s, of SaaS companies, and there are a few nuggets of useful information we want to share with other SaaS
Get started with a free initial consultation. Fill out the form below to connect with our experts today!