Software development agreement: what it must include and what to watch for

0114 clauses your software development agreement needs

02Custom software development contract: what kind of contract it is

In Czechia, custom development is usually a contract for work (smlouva o dílo). Under Section 2586 of the Civil Code, the contractor agrees to deliver the work at its own cost and risk, and the client agrees to accept it and pay the price (Czech Civil Code, Section 2586). In Slovakia, contracts for work between businesses usually fall under the Commercial Code (Slovak Commercial Code, Section 536). Alongside it you need a license, the right to use the work, a data processing agreement as soon as the vendor touches personal data, and once the system is live, a support agreement.

In practice this is often a framework agreement or general terms plus individual quotes with annexes. Check which document wins when they conflict. By law, terms you negotiate in the contract itself take precedence over general terms (Czech Civil Code, Section 1751; Slovak Commercial Code, Section 273(2)), but with a framework agreement, a quote and annexes in play, it can still be unclear which text applies, so state the order explicitly.

Our order of precedence is spelled out: an individual contract, the data processing agreement in matters of personal data, the non-disclosure agreement in matters of confidentiality, the accepted quote with its annexes and finally our general terms (LISTIFY terms and conditions).

03Scope and specification: what exactly gets built

Under the Czech Civil Code, work is defective if it does not match the contract (Section 2615). The Slovak Commercial Code says the same: work is defective if it does not match the result set out in the contract (Section 560). That gives you the most important practical rule: what is not in the contract or its annex is hard to claim later. A sentence like “development of a web application as agreed” leaves the meaning to whoever remembers the conversation better.

• Features and roles: who logs in, what each role may do, and which screens or processes the system covers.
• Data and integrations: which systems connect (accounting, online store, bank), who arranges access to their APIs, and what happens if a third party changes them.
• Technical requirements: supported browsers and devices, speed, accessibility, languages, and where the system will run.
• What is out of scope: copy, photos, third party licenses, migration of old data. A clear list of exclusions prevents more disputes than a long feature list.

In agile projects the specification evolves as you go. Even then, the contract should state the goal, the budget and how the next phase gets approved. We compare both approaches in Agile vs. waterfall.

04Price: fixed or hourly

Czech law distinguishes several ways to set the price, each with different consequences. With a fixed price, neither side may ask for a change just because the work took more or less effort (Section 2620). With a price set by estimate, a contractor who finds it will be substantially exceeded must tell you without undue delay, or it loses the right to the difference. You may then withdraw, but you must do so without undue delay after receiving the notice; otherwise you are deemed to have accepted the higher price (Section 2612). Czech and Slovak law have a similar rule for budgets: if the budget was non-binding or its completeness was not guaranteed and the contractor asks for more than 10% above it, the client may withdraw without undue delay (Czech Civil Code, Section 2622; Slovak Commercial Code, Section 547).

Tie payments to accepted milestones. Deposits are normal, but they should not run ahead of actual progress. Between Czech businesses, payment is due in 30 days unless agreed otherwise, and terms over 60 days must be agreed explicitly and must not be grossly unfair to the creditor (Section 1963). In Slovakia, contractual payment terms may not exceed 60 days unless the parties explicitly agree on longer terms that are not grossly disproportionate (Section 340a).

Our fixed price covers only the scope of the quote, including two rounds of feedback for each phase, unless the quote says otherwise. Hourly work is billed in 15-minute increments from a time log you see in your client account. We invoice a 50% deposit when you accept the quote and the rest according to the payment schedule, with 14-day payment terms (terms and conditions).

05Change requests and the schedule

Changes during development are normal. The problem is a change discussed in a meeting but never priced. If the parties agree to reduce the scope and say nothing about the price, Czech law adjusts the price for the difference in necessary work and costs (Section 2614). That leaves the price to be argued over after the fact. A change control process is better: who submits a change, how quickly the vendor prices it, what it does to the deadline, and that work starts only after approval.

Split the schedule into milestones and mark which dates are binding. If no deadline is agreed, Czech law only requires a “time reasonable for the nature of the work” (Section 2590). Also write down what the vendor needs from you and by when. If the client fails to cooperate even within a reasonable period, the contractor may arrange substitute performance at the client’s expense or, after a warning, withdraw (Section 2591). If a grant pays for the project, align the schedule and paperwork with the program rules described in Digitalization grants in Czechia and Slovakia 2026.

We price a change request within 3 business days, including its effect on the deadline, and work starts only after you approve it. If we miss a binding deadline for reasons on our side, you get a discount of 0.05% of the milestone price per day, up to 10%. If we are more than 30 days late with a binding deadline for reasons on our side, you may withdraw from the affected part of the contract after giving us written notice with an additional period of at least 14 days. We then refund the price paid for the undelivered part (terms and conditions).

06Acceptance and the acceptance protocol

Under Czech law, the work is performed when it is completed and handed over, and it is completed once it has been shown to be fit for its purpose (Sections 2604 and 2605). If you agree on acceptance tests, the work is completed only when they are passed (Section 2607). That is why the contract needs acceptance criteria: which scenarios are tested, on what data, and who signs off for you.

Be careful about accepting the work without reservations. Under Czech law, a court will not grant rights for an obvious defect to a client who accepted without reservations, if the contractor objects that the claim came too late (Section 2605(2)). In Slovakia, you must inspect the work as soon as possible after handover and report defects without undue delay (Slovak Commercial Code, Section 562). Write obvious issues into the protocol, even small ones. On larger projects, accept in phases.

A common catch is deemed acceptance: the work counts as accepted if you do not respond within a set period. That is fair enough, since a vendor cannot wait forever. The period must still be long enough for a real review. With us you have 5 business days, then we remind you and another 3 business days run. The work also counts as accepted once you start using it in live operation. Minor defects that do not prevent use do not block acceptance, and we fix them by the agreed date (terms and conditions). What to put in the protocol is covered in Website and app handover checklist.

07Defects, quality warranties and free fixes after launch

Under Czech law, you must report a defect without undue delay after you found it or should have found it, and no later than two years after handover. Otherwise a court will not grant the claim if the contractor objects that it is late (Section 2618). Slovak law has the same two-year limit for hidden defects (Section 562(2)). A quality warranty on the work exists only if the contractor gives one, and it runs from handover (Czech Civil Code, Section 2619). Whenever a quote says “warranty,” ask what exactly it covers and for how long.

In the contract, separate a defect (a feature does not work as described) from a new request (it works, you just want it different). Without that line, many comments turn into arguments about who pays. Also agree on how defects are reported, how priority is set, and how quickly the vendor responds.

We fix defects free of charge if you report them within 180 days of acceptance. This is a free fix period, not a quality warranty. It does not cover issues caused by someone else’s changes or by changes in the environment, such as an update to a third-party API (terms and conditions).

08Copyright, licenses and source code

This is where most misunderstandings start. A computer program is protected as a literary work (Czech Copyright Act, Section 65). Under both Czech and Slovak law, economic copyright is not transferable (Czech Copyright Act, Section 26; Slovak Copyright Act, Section 20(2)). A sentence like “we transfer all copyrights to you” should be replaced with something precise: either a license with a defined scope, or an assignment of the right to exercise the economic rights.

When a vendor’s employee writes the program, the employer exercises the economic rights unless agreed otherwise. Here the two countries differ. In Czechia, the employer may pass the exercise of those rights to a third party, such as you, only with the author’s consent, unless the business itself is transferred (Section 58(1)). In Slovakia, the employer may do so without the author’s consent unless agreed otherwise (Slovak Copyright Act, Section 90(5)). The EU Software Directive sets the same baseline: the employer exercises the economic rights in a program written by an employee unless the contract provides otherwise (Article 2(3)). In both countries, a program created on commission, for example by a freelance developer, is treated as an employee work, with the client in the role of employer (Czech Copyright Act, Section 58(7); Slovak Copyright Act, Section 91(4)). In our reading, the practical takeaway is: ask the vendor to confirm in the contract that it holds the authority from all actual authors (employees and subcontractors) to grant you the rights, including, for Czech employees, their consent to passing on the exercise of the rights.

If the vendor grants you a license without defining its scope or term, the law first assumes whatever the purpose of the contract requires. Only if the purpose does not indicate otherwise is the license presumed to be limited to the country’s territory and to the usual term, at most one year (Czech Civil Code, Section 2376; Slovak Copyright Act, Sections 67 and 68). So the license does not simply expire after a year. Still, relying on how the purpose will be read is an unnecessary risk for a system meant to last for years. An exclusive license must be in writing in both countries. For a system meant to serve the company for years, write the scope, term and territory down explicitly.

Check that the contract covers:

• Changes and development: whether you may modify the code yourself and have another vendor modify it.
• Other parties: whether you may sublicense or assign the license to a subsidiary, a buyer of the company or a new operator. Without an agreement or consent, the law does not allow it (Czech Civil Code, Sections 2363 and 2364; Slovak Copyright Act, Section 72).
• Source code: in what form you get it (a repository with full history), with what documentation, and by when.
• Accounts: domain, cloud, app stores and payment gateway registered to your company.
• Vendor know-how: for general libraries and tools the vendor uses across projects, a non-exclusive license sufficient to use and develop the system is enough.

Until full payment, you receive a non-exclusive license for testing and approval. On full payment of the project or milestone price, we assign to you the exercise of the economic rights without limitation and for their full duration. After payment, we hand over on request, within 10 business days at the latest, the source code in a repository with its full Git history, access and documentation to the extent agreed in the quote (ownership and copyright). A detailed list of license questions is in Source code ownership and licensing.

09Open source and third-party components

Modern apps are built on dozens of open source libraries. That is fine, as long as you know each one has its own license. Under Czech law, the contractor is liable if using the work threatens or infringes someone else’s intellectual property and it knew or must have known this when signing (Section 2616). The contract should list the components and their licenses and set a rule for licenses that could require you to publish your own code.

We do not use a library whose license would force you to publish the source code of the work (for example GPL in a distributed app) without telling you first and getting your consent. We provide the list of licenses on request (ownership and copyright).

10Personal data: a processing agreement under Article 28 GDPR

Once the vendor processes personal data of your customers or employees on your behalf during development, testing or support, it is a processor. GDPR then requires a contract setting out the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and eight processor obligations (Article 28(3) GDPR).

1. process data only on your documented instructions,
2. make sure people with access are bound by confidentiality,
3. take the security measures required by Article 32,
4. engage another processor only with your prior written authorization,
5. help you respond to data subject requests,
6. help with the obligations under Articles 32 to 36, for example after a data breach,
7. at your choice, delete or return the data when the service ends,
8. provide information and allow audits.

The agreement must be in writing, which includes electronic form (Article 28(9) GDPR). We sign it with you in the client account or together with the quote (data processing agreement). How to design data protection into the app itself is covered in GDPR in a web application.

11Security, NIS2 and cloud hosting

If your company provides a regulated service under the Czech Cybersecurity Act in force since November 1, 2025, and implements security measures through a supplier, you must choose that supplier in line with the security measures and include their requirements in the contract (Act No. 264/2025 Coll., Section 13(5)). The implementing decrees list what the contract should cover where relevant: 14 points in the lower-tier obligations regime (Decree 410/2025, Annex 2) and 18 points for significant suppliers in the higher-tier obligations regime (Decree 409/2025, Annex 5), including authorship of program code, an exit strategy and secure development rules. In Slovakia, an operator of an essential service that uses a third party for activities directly related to the availability, confidentiality and integrity of its networks and information systems must generally sign a contract with it covering security measures and notification duties, and the third party must submit to audits (Slovak Act No. 69/2018 Coll., Section 19(2) and (3)).

If the vendor also runs the app for you as a cloud service, the EU Data Act has applied to it since September 12, 2025. The contract must set out the switch to another provider in writing: a notice period of no more than two months to start the switch, a transitional period of generally no more than 30 days, and a list of the data you can take with you (Article 25 Data Act). From January 12, 2027, providers may not charge any switching fees (Article 29). For services whose main features were mostly custom built for a single customer and that the provider does not offer in its regular service catalog, the ban on switching fees and some technical obligations do not apply. The contract terms under Article 25 still apply, and the provider must tell you about the exceptions in advance (Article 31).

If you make the app, or a device that uses it, available to other customers as a product, even free of charge, keep an eye on the EU Cyber Resilience Act (CRA). Manufacturers have had to report actively exploited vulnerabilities and severe incidents since September 11, 2026, and most other obligations apply from December 11, 2027 (Article 71 CRA). The contract should then say which of you is the manufacturer and who monitors vulnerabilities and updates. More in App security for executives: NIS2 and CRA. If the system will include AI features, specify who handles the obligations under the AI Act (AI Act: what businesses must do).

We do not provide hosting ourselves. By default, your system runs on Vercel and Neon under accounts held in your company’s name, primarily in the Frankfurt region for clients from Czechia and Slovakia. We notify you of a security incident affecting your services or data without undue delay and within 24 hours of discovery at the latest. If you provide a regulated service, tell us before signing, and we will agree on and price the security requirements in the quote or contract (terms and conditions).

12Support, SLA and maintenance

After launch, the development contract usually turns into a support contract. A good SLA answers five questions: how a request is reported, how its priority is set, how fast the vendor responds, what monitoring and backups cover, and what you get when the response time is missed. Note the difference between response time (the first reply) and resolution time.

Under our Business plan, for example, we respond to a critical (P1) request within 4 hours during business hours. If we miss the response time for a P1 or P2 request for reasons on our side, you can ask for a 5% discount on that month’s fee for the service for each miss, up to 30% per month. We test restoring from backup at least once a quarter (SLA and support).

13Liability, penalties and damage caps

Vendors usually cap damages, often at the contract price. That is legitimate, but it has limits. Under Czech law, a clause that excludes or limits in advance liability for harm caused intentionally or through gross negligence is disregarded (Section 2898). The Slovak Commercial Code goes further: a party cannot waive a claim for damages before the breach that may cause it, and the parties cannot contract out of this rule (Sections 386(1) and 263). In our reading, this makes a damages cap under Slovak law uncertain, so have a lawyer check such a clause. The EU Data Act adds a narrower rule: in contracts concluded after September 12, 2025, a term on data access and use, or on liability for breaching data-related obligations, that one business imposes unilaterally on another is not binding if it excludes or limits liability for intentional acts or gross negligence (Articles 13 and 50 Data Act).

Contractual penalties most often secure deadlines or confidentiality. Under Czech law, once a penalty is agreed, the creditor cannot claim damages for the breach the penalty covers (Section 2050). If you want both, discuss with your lawyer how to say so explicitly in the contract. On the debtor’s motion, a court may reduce an excessive penalty (Section 2051).

Our total liability for damages on one project is capped at what you actually paid us for that project in the 12 months before the damage occurred. The cap does not apply to intent, gross negligence, harm to life or health, or cases where the law does not allow it, and you agree to it with a separate confirmation (terms and conditions).

14Ending the relationship and handing over

The end is what people think about least, yet it decides whether you continue with a new vendor next week or in six months. The contract should state when you can give notice and when you can withdraw, what you pay for work in progress, what you get and in which format (code, data, documentation, access), and what cooperation the vendor provides during the switch.

We do not charge any exit fee beyond unpaid invoices when you move to another vendor. Handover cooperation beyond 4 hours is billed at the hourly rate in the quote. The data you put into the system is yours from day one, and we export it in a machine-readable format even after the relationship ends, within a reasonable time (ownership and copyright). If you are dealing with the opposite situation and your old vendor has gone quiet, see How to take over a website from an unresponsive developer.

15Governing law and disputes

Between two Czech or two Slovak companies, the governing law is usually obvious. With a vendor from another country, and that includes a Czech vendor for a Slovak client, agree on the governing law and the competent court explicitly. Otherwise a dispute starts with arguing about where and under which law to argue. A step before court also helps: a period for negotiation and named people who speak for each side.

We are a Czech company, so our contracts are governed by Czech law, including for clients in Slovakia. We say so upfront so you can take it into account when reviewing the contract. We first try to resolve any dispute through negotiation within 30 days of written notice (terms and conditions).

16When a simple order is enough

Not every project needs a 30-page contract. A simple order, or an accepted quote with general terms, is usually enough when:

• it is a one-off small change or fix to an existing website,
• you are building a simple brochure site with no personal data and no integrations,
• you are ordering support hours with a time log you can see as work happens,
• you are testing a short prototype that you will throw away afterward,
• the vendor has public terms that cover the clauses in the table above, and you read them before signing.

Even a short order should state the scope, price, deadline, your rights to the result and how it is handed over. Once the system handles personal data, connects to accounting or a bank, or your operations depend on it, invest in a full contract and have a lawyer review it.

17How to prepare and review the agreement

1. List the situations the contract must handle: development by another firm, sale of the company, an outage, the vendor leaving.
2. Ask for the general terms and a sample contract before the quote. If the vendor publishes them, you can read them calmly in advance.
3. Go through the 14-clause table and note where each one is in the contract.
4. Have a lawyer review the contract, especially rights to the code, liability, termination and governing law.
5. Sign and store all annexes in one place. Electronic signatures are covered in Electronic signatures.

You can read our terms and conditions, ownership rules, SLA, data processing agreement and non-disclosure agreement before you even ask for a quote. The How we work page walks through the collaboration step by step.

18FAQ: software development agreements

19Sources

• Czech Civil Code, Act No. 89/2012 Coll. (in Czech)
• Czech Copyright Act, Act No. 121/2000 Coll. (in Czech)
• Czech Cybersecurity Act, Act No. 264/2025 Coll. (in Czech)
• Czech Decree No. 410/2025 Coll. (in Czech)
• Czech Decree No. 409/2025 Coll. (in Czech)
• Slovak Commercial Code, Act No. 513/1991 Coll. (in Slovak)
• Slovak Copyright Act, Act No. 185/2015 Coll. (in Slovak)
• Slovak Cybersecurity Act, Act No. 69/2018 Coll. (in Slovak)
• Regulation (EU) 2016/679, GDPR
• Regulation (EU) 2023/2854, Data Act
• Regulation (EU) 2024/2847, Cyber Resilience Act
• Directive 2009/24/EC on the legal protection of computer programs
• Directive (EU) 2022/2555, NIS2
• Eurostat: ICT functions and external suppliers (isoc_ske_fct)

This article reflects legislation as of October 17, 2026. This article is general information, not legal advice. Always have a lawyer review your specific contract.