An IT subcontractor agreement is the written contract a primary technology contractor signs with an outside technician or firm brought in to deliver part of a larger project, and the clauses that matter most are the ones covering scope, worker classification, intellectual property, confidentiality, payment, liability, insurance, and termination. Get those right and the project runs. Get any one of them wrong and the engagement can cost more than it earns.
Parties, Prime Contract, and the W-9
Start with correct legal identification. You need the full legal name and registered business address of both the primary contractor and the subcontractor, matching what appears in each company’s formation documents and state registration. Each state’s Secretary of State maintains its own records showing legal name, entity type, incorporation date, and current status.1Commerce Research Library. Incorporation Status Confirming active status before signing is cheap insurance against discovering mid-dispute that your counterparty is suspended or dissolved.
Reference the prime contract. If the subcontractor’s work feeds into deliverables owed to a government agency or enterprise client, the prime contract often contains flow-down provisions that bind the subcontractor to the same obligations the primary contractor accepted upstream.
Before any money moves, collect a completed IRS Form W-9. That form captures the taxpayer identification number you need for year-end reporting. If the subcontractor refuses to provide a correct TIN, you are required to withhold 24% of each payment and remit it to the IRS as backup withholding.2Internal Revenue Service. Form W-9 (Rev. March 2024) Having the W-9 on file before work starts avoids payment delays and penalties on both sides.
Worker Classification
Calling someone a subcontractor in a contract does not make them one to the IRS. The agency evaluates three categories of evidence when deciding whether a worker is an employee or an independent contractor:
- Behavioral control: whether the business controls how the work is performed or only what result is expected. Dictating hours, requiring specific tools, or supervising day-to-day methods points toward employment.
- Financial control: how the worker is paid, whether expenses are reimbursed, and who supplies equipment. Independent contractors typically invest in their own tools and carry their own business expenses.
- Type of relationship: whether written contracts exist, whether the worker receives employee-type benefits, and whether the work is central to the business. A long-term, exclusive arrangement with benefits looks like employment regardless of label.
Misclassification is expensive. If the IRS determines you misclassified an employee as an independent contractor, you can be held liable for unpaid employment taxes, including income tax withholding, Social Security and Medicare taxes, and unemployment taxes.3Internal Revenue Service. Independent Contractor (Self-Employed) or Employee? IRC Section 3509 provides reduced penalty rates for unintentional misclassification, but the relief carries conditions, including consistent information-return filing.
On reporting, starting with the 2026 tax year the filing threshold for Form 1099-NEC rose from $600 to $2,000 per payee per calendar year. The threshold applies to total nonemployee compensation paid during the year.4Internal Revenue Service. Publication 1099 (2026), General Instructions for Certain Information Returns Payments below $2,000 are still taxable income to the subcontractor; you are simply not required to file the form.
Scope of Work and Performance Standards
A vague scope is the single most common source of subcontractor disputes. The agreement should describe the specific deliverables, the technical standards they must meet, and the timeline for each phase. Referencing external specifications, such as an API design document, a network architecture diagram, or a particular software framework version, gives both parties something concrete to point to when questions arise.
Service level agreements inside the contract set measurable benchmarks: system uptime, response times for bug fixes, throughput targets for data processing. When an SLA is missed, the contract should state the remedy, whether that is a credit against future invoices, a defined window to fix the issue, or in serious cases a right to terminate.
Acceptance testing gives the primary contractor a formal window to review deliverables before signing off. A typical provision allows seven to ten business days to run tests and flag defects, with a defined period for the subcontractor to correct and resubmit. Without acceptance testing language, you end up in a gray zone where the subcontractor considers the work done and you consider it broken.
Change Orders
Technology projects almost never finish with the scope they started with. The contract should require any change to deliverables, timeline, or price to be documented in a written change order signed by both parties before new work begins. Skipping that formality is where most budget overruns start. Some subcontractors will gladly do extra work and then present a surprise invoice. Some primary contractors will pile on requirements and then refuse to pay. The change order itself should describe the new or modified work, the schedule impact, and the cost adjustment, and either party should have the right to reject it.
Intellectual Property and Work Product
IP rights are often the most valuable thing in an IT subcontract, and this is where agreements most frequently misfire. Many contracts try to designate custom software as a “work made for hire” under copyright law. That designation does grant automatic ownership to the commissioning party, but under 17 U.S.C. § 101, work created by an independent contractor only qualifies as a work made for hire if it falls into one of nine specific categories, including contributions to a collective work, translations, compilations, instructional texts, and parts of audiovisual works.5Office of the Law Revision Counsel. 17 U.S. Code 101 – Definitions Custom software, standalone applications, and most subcontractor code do not fit any of those categories.
Even if the contract calls the deliverables a work made for hire, a court may disagree. That is why every IT subcontractor agreement needs a separate, express assignment clause transferring all right, title, and interest in the work product to the primary contractor or end client. Under 17 U.S.C. § 201(b), the commissioning party owns all rights in a true work made for hire, but the assignment clause is your backup when the work-for-hire designation fails, which in software is often.6Office of the Law Revision Counsel. 17 U.S. Code 201 – Ownership of Copyright
A further-assurances clause should require the subcontractor to sign any additional documents needed to perfect ownership, such as patent applications or copyright registrations. Pre-existing IP needs its own treatment. If the subcontractor builds code, tools, or libraries they already own into the deliverable, the contract should grant the primary contractor a perpetual, royalty-free license to use those components. Without that license, you may own the custom code and still lack the right to run it because it depends on the subcontractor’s proprietary framework.
Confidentiality and Data Protection
IT subcontractors routinely touch source code, production databases, customer records, and internal networks. The confidentiality section should define confidential information, restrict its use to the contracted work, and survive termination for at least two to five years. Mutual obligations usually make more sense than one-way restrictions because both parties typically have information worth protecting.
If the subcontractor will handle personal data, the agreement needs to address privacy law compliance. For businesses collecting data from California residents, the California Consumer Privacy Act requires contracts with service providers to include specific provisions: restricting use of personal information beyond the stated business purpose, prohibiting sale or sharing, and granting the business the right to audit compliance. Other state privacy laws impose similar terms, and international work can trigger additional frameworks. Identify which laws apply and allocate responsibility between the parties.
Breach notification is essential. Many state breach laws require notice to regulators and affected individuals within 30 to 60 days of discovery. HIPAA requires notification no later than 60 days after discovery.7U.S. Department of Health and Human Services. Breach Notification Rule Because the primary contractor usually carries the legal reporting obligation, the agreement should require the subcontractor to notify the primary contractor of any security incident within a much shorter window, often 24 to 72 hours, so the primary contractor has time to investigate and meet its own deadlines.
Compensation and Payment Terms
IT subcontracts generally use one of two pricing structures. A fixed fee sets a lump sum for defined deliverables and works well when the scope is clear. Time-and-materials bills for actual hours plus expenses, which fits ongoing support, discovery-phase work, or evolving scope. Hybrid structures are common: fixed fees for defined milestones, T&M for out-of-scope work approved through change orders.
Pay-When-Paid vs. Pay-If-Paid
Primary contractors often include contingent payment language tying the subcontractor’s payment to receipt of funds from the end client. The two forms look similar and are not. A pay-when-paid clause controls timing: the primary contractor can delay payment until the client pays, but the obligation to pay eventually still exists. A pay-if-paid clause makes client payment a condition precedent to any payment obligation at all, shifting the entire risk of client nonpayment to the subcontractor. Some states have voided pay-if-paid clauses as against public policy; others enforce them if the language is clear. If you are the subcontractor, read this clause carefully before signing.
Invoicing, Late Fees, and Expenses
Set a specific invoicing schedule, typically monthly or at milestone completion, with a defined payment period such as net-30 or net-45 from receipt. Late payment interest commonly runs 1% to 1.5% per month and generally falls well below state usury ceilings, which vary significantly and often do not apply to commercial transactions at all. Specify that the right to charge interest accrues automatically without a demand letter.
If the subcontractor will incur travel or other out-of-pocket costs, spell out what is reimbursable and what is baked into the fee. Common reimbursable categories include economy airfare, lodging capped at federal per diem rates, mileage at the GSA rate, and reasonable ground transportation. Personal items, travel time, entertainment, and penalties like parking tickets are typically excluded. Some contracts cap total reimbursables at a percentage of the overall fee. The working rule: if it is not listed as reimbursable, assume it is not.
Indemnification and Liability Caps
Indemnification clauses determine who pays when a third party comes knocking. In a well-drafted IT subcontract, indemnification is mutual. The subcontractor indemnifies the primary contractor against claims arising from the subcontractor’s work, such as a third party alleging that delivered code infringes a patent or copyright. The primary contractor indemnifies the subcontractor against claims arising from the primary contractor’s own actions or from specifications it supplied.
Liability caps put a ceiling on breach damages. A common structure ties the cap to total fees paid or payable under the contract, sometimes one-to-one or a low multiple. Certain obligations are almost always carved out and left uncapped: IP infringement, confidentiality breaches, and willful misconduct. Without a cap, a subcontractor on a $50,000 engagement could theoretically face millions in damages if a coding error causes a major outage. The cap forces both sides to carry risk proportional to the economic value of the deal.
Insurance Requirements
Primary contractors commonly require subcontractors to carry specific policies. The relevant types for IT work are professional liability (errors and omissions), which covers claims from mistakes in the subcontractor’s work; commercial general liability, which covers bodily injury and property damage; and cyber liability, which covers data breaches and incident response. Minimum coverage varies, but $1 million per occurrence is a common floor for each policy type. The agreement should require the subcontractor to name the primary contractor as an additional insured on the general liability policy and to provide certificates of insurance before work begins.
Cyber insurance carriers have tightened their requirements. Most now mandate multi-factor authentication on remote access and administrative accounts, endpoint detection and response tools, immutable backups, and regular phishing training. A subcontractor that cannot meet those controls may be unable to obtain coverage at all, which becomes a compliance problem under the agreement.
Non-Solicitation and Non-Compete
IT subcontractors work closely with the primary contractor’s employees and often interact directly with the end client. A non-solicitation clause prevents poaching staff or going around the primary contractor to win future work directly from the client. These clauses are generally enforceable when reasonable in scope: targeted at specific, direct outreach to people the subcontractor met through the engagement rather than blanket industry restrictions. Twelve to 24 months after the contract ends is typical.
Non-compete clauses are a different question. Restricting an independent contractor from working with competitors raises enforceability problems in many states, in part because independent contractors are, by definition, supposed to offer services to the general public. A well-drafted non-solicitation clause usually protects relationships more reliably than a broad non-compete that a court might void entirely.
Dispute Resolution and Governing Law
A governing law clause picks which state’s law controls interpretation. That matters because contract law, enforceability of restrictive covenants, and even the validity of pay-if-paid clauses can vary significantly by state. Choose at the outset rather than leaving it to a court.
A jurisdiction clause sets where disputes are heard. Exclusive jurisdiction limits both parties to a single forum; non-exclusive states a preference. When the parties sit in different states, an inconvenient forum can effectively block the smaller party from pursuing a claim, so this provision deserves real negotiation.
Many agreements require mediation before either party can file suit or demand arbitration, giving both sides a structured chance to resolve the dispute with a neutral before spending on formal proceedings. If mediation fails, the contract typically provides for binding arbitration rather than litigation, which keeps disputes private and usually moves faster. Specify the arbitration rules (the American Arbitration Association’s commercial rules are standard), the number of arbitrators, and who pays the fees.
Termination and Handover
The contract needs two separate termination mechanisms. Termination for cause covers material breach, such as missed major milestones, confidentiality violations, or unpaid invoices. The breaching party should receive written notice and a cure period, typically 15 to 30 days, before termination takes effect.
Termination for convenience lets either party walk away without a specific reason on adequate written notice. Thirty to 60 days is standard. Business needs change: a client may cancel the prime contract, budgets shift, or the subcontractor may decide the engagement is no longer worth continuing. Without a convenience clause, ending the relationship early can expose the terminating party to a breach claim.
Post-termination obligations are where contracts often fall short. The agreement should require the subcontractor to return or destroy all proprietary materials, hardware, software licenses, access credentials, and project data within a specified number of business days. A defined data handover procedure lets the primary contractor continue the project with a replacement. Address payment for work completed before termination as well: if the subcontractor has delivered partial milestones, they are entitled to compensation for that work even if the project ends early. Spell out how partial work will be valued, so no one has to fight about it during an already stressful transition.