Most companies that work with IT services, whether they buy them or deliver them, have contracts in place. What they often don't have is a clear picture of what those contracts actually say, or what they're missing.

‍That gap matters more than it used to.

An IT contract typically operates on three levels. The first is familiar territory: scope, price, and timing. Most businesses handle this reasonably well. The second level is where things get more complex; intellectual property ownership, liability arrangements, warranty clauses. Who owns what gets built? What happens if it doesn't perform as expected? These questions rarely come up until something goes wrong, and by then the contract is already signed.

The third level is the one most often overlooked: the operational layer. Governance structures, service level agreements, audit rights, agreed security measures. As Niele Dams, IT contracting expert at Legile, puts it: "IT contracts are not meant to end up in a drawer, they need to be closely monitored, and non-compliance can come with serious penalties."

That operational layer is precisely what European regulation is now targeting. GDPR established the baseline, but the regulatory landscape has expanded significantly. DORA requires financial institutions to include specific contractual clauses with IT vendors, and those requirements extend to the vendors themselves when they support critical functions. NIS2 introduces security obligations that businesses need to pass through their supply chain. The Cyber Resilience Act adds another layer for companies bringing software or connected products to market.

For many businesses, the instinct is to treat these as compliance exercises, something to handle once and file away. The more practical approach is to review what your contracts actually say, and whether your internal processes can back them up. Do you know who has access to what data? Are there documented procedures for security incidents? Can you demonstrate to a client or auditor that what's written in your contracts reflects how you actually operate?

"It's important to know how to get your internal processes in order and how to negotiate your contracts properly," Niele says. ‍

‍At Legile, we help companies work through both.

‍