Seven contract issues for an England buyer of hosted creative software

This is an issue-spotting list for an organisation in England buying hosted creative software. It is not model wording or a ranking of suppliers.

Inclusion method: an issue was included when it can change whether the buyer may use an asset, control personal data, evidence delivery or recover work on exit. Research date: 5 September 2026. Geography: UK official sources, applied to an England-based buyer. Exclusions: employment terms, tax, competition law, sector licences, international-transfer analysis and negotiated liability positions. Qualified legal and security reviewers should adapt the list to the actual service.

What to take away

1. Service scope and acceptance

Describe enabled functions, user numbers, environments, integrations, support and output formats. Tie acceptance to observable delivery rather than a general promise that the service is suitable. Record what happens when a supplier changes or withdraws a function needed by the approved workflow.

2. Rights in uploaded material

State who may upload copy, photographs, fonts, marks, recordings and customer material, and on what authority. The Intellectual Property Office's digital images copyright notice explains that online availability does not remove copyright and that permission, a licence or an exception may be required. The contract should not imply that possession proves clearance.

3. Ownership and permitted use of outputs

Separate ownership from licence. Define territories, channels, duration, modification, sublicensing and post-termination use. Address generated and jointly developed material without assuming the software settles the legal position. The IPO's ownership guidance notes that commissioned work normally remains with its creator unless the parties agree otherwise, and that a copyright assignment must be written and signed.

4. Data roles and instructions

Identify each processing purpose and decide which party determines it. If the supplier processes personal data for the buyer, cover documented instructions and any separate uses. The ICO's controller and processor contract guidance identifies minimum subjects such as confidentiality, security, sub-processors, assistance, audits and end-of-contract handling. Its current review warning means counsel should verify the latest position.

5. Security evidence and incident handling

Ask what evidence supports access control, tenant separation, secure development, supplier management, service administration, logging and recovery. The NCSC's cloud security principles provide fourteen assessment areas and emphasise evaluating the service and provider evidence. They do not certify a vendor. Allocate notification routes, investigation support and evidence preservation for incidents.

6. Change, audit and record access

Provide a route to assess material changes in hosting, sub-processors, product behaviour or terms. Preserve approval history, asset provenance and version data for as long as the buyer genuinely needs them. Define audit evidence proportionately, including what can be supplied without exposing other customers' information.

7. Exit and continuity

Specify export formats, timing, deletion or return, administrator access during transition, and treatment of backups. Test whether usable files, rights records and approval trails can leave the service, not merely whether an archive button exists. Decide who verifies deletion and how a dispute or insolvency affects access.

Turn issues into negotiated decisions

Give each unresolved point an owner and record the supplier's response beside the proposed business treatment. Some gaps shrink through configuration, process or restricted use; others need a contractual change or rejection.

Keep marketing material outside the agreement column unless the signed terms incorporate it. A sales demonstration must not be mistaken for an enforceable service commitment.

Use these headings to produce questions for counsel and the supplier. The final contract must reflect the actual data, content, bargaining position and risk appetite; ticking seven headings cannot make an unsuitable arrangement safe.

Before you act

Common questions

Who owns the outputs created using the software?

The article says to separate ownership from licence and define territories, channels, duration, modification, sublicensing and post-termination use. It notes the IPO's ownership guidance that commissioned work normally remains with its creator unless the parties agree otherwise, and that a copyright assignment must be written and signed.

What should the contract say about personal data roles?

Identify each processing purpose and agree which party decides it. If the supplier handles personal data for the buyer, the contract should cover documented instructions and any separate uses, following ICO guidance on minimum terms.

How can a buyer check security before signing?

Ask what evidence supports access control, tenant separation, secure development, supplier management, service administration, logging and recovery. The NCSC's cloud security principles provide fourteen assessment areas and emphasise evaluating the service and provider evidence. They do not certify a vendor, so allocate notification routes and evidence preservation for incidents.