Startup Legal Checklist for First-Time Founders

Legal problems in a startup have a strange billing cycle. You make the mistake in month two, when you skip a piece of paperwork that would have taken twenty minutes. You get the invoice in month twenty, when an investor's lawyer asks for a document you never signed and your round stalls for six weeks while you chase down a contractor who built your first prototype and hasn't answered an email since.

That gap is why first-time founders underrate this stuff. Nothing bad happens immediately. The code still works. The product still ships. The consequences sit in a drawer until someone with a checkbook opens it.

The good news: the list is short. A startup legal checklist covers four things, and everything else is a variation on them. Who owns the company. Who owns the work. Who you're allowed to pay and how. What you have to tell the people using your product.

Notice what isn't on that list. You don't need a lawyer on retainer, a 40-page shareholders' agreement, or a trademark in week one. Startups that get burned in diligence almost never get burned on something exotic. Techstars, which has run thousands of companies through a formal seed process, reports the same red flags over and over: missing IP assignments, founder equity that never vested, contracts with change-of-control clauses nobody read. Boring problems, not hard ones.

What follows is what to handle in your first year, in rough order of how expensive it gets to fix later. It is not legal advice, and I'm not a lawyer. It's a map of where founders reliably step in the hole.

Which legal documents do you need on day one?

Six documents, and a competent formation service produces five of them for you. In rough order:

1. Certificate of incorporation. Delaware C-corp if you plan to raise money, and the reasons are covered in detail in our guide on how to incorporate a startup. If you're not raising, an LLC in your home state is cheaper and simpler.
2. Bylaws and initial board consent. Formulaic, generated automatically, and the thing that makes your board decisions legally real.
3. Founder stock purchase agreements, with vesting. This is the one founders skip because it feels absurd to put yourself on a vesting schedule for your own company. Standard is four years with a one-year cliff. If your cofounder leaves in month seven with 50% of the company and no vesting, you have handed a permanent dead weight to every future investor. The cofounder equity split conversation is where this belongs.
4. Confidential Information and Invention Assignment Agreement (CIIAA). Every founder signs one. Every employee signs one. Every contractor signs one or an equivalent.
5. EIN from the IRS. Free, takes fifteen minutes online, and blocks you from opening a bank account until you have it.
6. 83(b) election. Its own section below, because the deadline is brutal.

Two services handle almost all of this. Stripe Atlas does a flat $500 Delaware C-corp including state filing, EIN, share issuance and the first year of registered agent service. Clerky's pay-per-use plan runs about $427 with documents drafted by Orrick, and its $819 lifetime plan covers every SAFE, option grant and advisor agreement you'll ever issue. A common pattern is Atlas to form and bank, then Clerky for fundraising paperwork. Filing yourself saves maybe $300, and the failure mode is a defective document you won't discover for two years.

Why the 83(b) election is the one deadline you cannot miss

You have 30 calendar days from the date your restricted stock is issued to file an 83(b) election with the IRS, and there is no extension, no grace period, and no cheap way to fix it.

Here's what it does. When your founder stock vests over four years, the IRS treats each tranche as income at the moment it vests, valued at what the stock is worth that day. Pre-revenue, your shares are worth close to nothing, so that's fine. After a Series A at a $24M post-money valuation, it is very much not fine. An 83(b) election tells the IRS to tax the whole grant up front, at today's near-zero valuation, instead of piece by piece as the company gets more valuable.

The mechanics got easier recently. The IRS published Form 15620 as a standard form, revised it in April 2025, and opened an electronic filing portal in July 2025, which gives you immediate confirmation of receipt. Use the portal. Under USPS rules effective December 2025, mail is postmarked when it reaches a processing facility, not when you drop it in the box, so a paper filing on day 30 no longer reliably lands on day 30.

Miss the window and your only remedy is a section 301.9100 private letter ruling, which is expensive, slow, and not guaranteed. Thirty days. Calendar it the same afternoon you sign your stock purchase agreement.

Who actually owns your code?

Not you, unless somebody signed something that says so. This is the single most common diligence failure in early-stage startups, and it has three flavors.

The pre-incorporation flavor. You wrote the first version of the product in your kitchen four months before the company existed. Legally, that code belongs to you personally, not to the entity. You need an assignment document moving those rights into the company, usually executed at formation as part of the founder paperwork. Most formation services include it. Verify that yours did.

The contractor flavor. You paid a freelancer $3,000 to build the onboarding flow. In the United States, work-for-hire doctrine does not automatically apply to independent contractors for most software. Absent a written assignment, they own what they built and you have a license at best. Every contractor agreement needs present-tense assignment language: "I hereby assign," not "I agree to assign." Courts have treated the second as a promise rather than a transfer, and that distinction has cost real companies real money.

The open-source flavor. This one got worse fast. The 2026 OSSRA report found 68% of audited commercial codebases contained license conflicts, the highest figure recorded. AI coding tools are a big part of why: when a model reproduces a chunk of GPL-licensed code, it strips the attribution and license header on the way out, so a copyleft obligation lands in your repo with nothing to signal it. Estimates put licensing irregularities in roughly 35% of AI-generated code, and an AGPL dependency found in technical diligence has already caused a documented $10M valuation cut on one deal.

If your MVP was largely AI-assisted, run a license scan before you raise. FOSSA, Snyk and the free ScanCode toolkit will do it in an afternoon. More on the downstream costs in the real cost of vibe-coded technical debt.

Employee or contractor: how do you classify your first hires?

If you control how, when and where someone works, they're probably an employee, regardless of what the invoice says. The label on the contract does not decide this. The working relationship does.

The federal test is unsettled right now. The DOL has a 2024 six-factor economic reality rule on the books, has told its own investigators not to rely on it, and published a proposed replacement in February 2026 that moves to a five-factor test with two core factors weighted more heavily. As of mid-2026 the ground is still moving. Several states, California most aggressively, apply their own stricter tests regardless of what the DOL does.

The exposure is asymmetric, which is what matters for a startup. Get it right and you save some payroll tax. Get it wrong and you're looking at two years of back wages (three if willful), liquidated damages matching those wages, federal civil penalties above $2,300 per violation, unpaid employer payroll taxes, and in some states fines reaching $25,000 per worker. Three misclassified people is an existential number for a company running on a $4M seed.

The practical rule: true project-based specialists with their own tools, their own clients and their own schedule are contractors. Anyone doing core product work, full time, on your systems, to your direction, is an employee. If you're not sure, you already know the answer. Our guide to hiring your first startup employee covers the cost side of that decision.

Do you need a privacy policy and terms of service yet?

Yes on the privacy policy, almost certainly. Yes on terms of service the moment you take money.

Twenty US states now have broad consumer privacy laws in effect, with Indiana, Kentucky and Rhode Island joining on January 1, 2026. Most use applicability thresholds that a seed-stage startup won't hit: Indiana's kicks in at 100,000 consumers annually, or 25,000 if you sell personal data. Rhode Island set its bar at 35,000, roughly a third of the usual threshold. Texas skipped consumer counts entirely, so if you do business there and you're not an SBA-defined small business, you're covered with no revenue floor.

So the letter of the law may not reach you yet. Three other things do. Apple and Google require a privacy policy URL for app store listings. Stripe and most processors require published terms. Enterprise buyers send security questionnaires asking for both. A missing privacy policy costs you deals long before it costs you a fine.

Generated policies from Termly, iubenda or your processor are fine at this stage, as long as they describe what you actually do with data. A policy promising you never share data with third parties while you pipe events into four analytics tools is worse than no policy. Now it's a misrepresentation.

When should you trademark your startup name?

File when the name is worth defending, which usually means after you have paying customers and before you spend real money on a brand.

USPTO restructured its fees on January 18, 2025. The old TEAS Plus and TEAS Standard tiers are gone, replaced by a single base fee of $350 per class for electronic filings, plus surcharges: $100 if the application is missing required information, $200 if you write custom goods and services descriptions instead of picking from the Trademark ID Manual, and $200 per extra 1,000 characters. Pick from the ID Manual and you pay $350.

Before filing, run a knockout search on the USPTO database and check domain and handle availability. Finding a conflict after you've built a following is the expensive version of this lesson. If you're still naming the thing, Foundra's free startup tools include a name generator worth running alongside a trademark search, not instead of one.

What does it cost to stay compliant each year?

Under $1,000 for a typical Delaware C-corp, assuming you file on time and use the right calculation method.

• Delaware franchise tax and annual report: due March 1 each year. Delaware defaults to the Authorized Shares Method, which routinely generates an alarming notice: a seed-stage company might see $85,215 on the bill. Recalculate under the Assumed Par Value Capital Method, which charges $400 per million of assumed par value capital with a $400 minimum, and the same company typically owes something closer to $850. The $50 annual report fee is on top. Miss March 1 and it's a $200 penalty plus 1.5% monthly interest.
• Registered agent: roughly $100 to $150 per year after the first.
• Home state foreign qualification: if you're a Delaware corp operating in California, New York or Texas, you also register there. California's minimum franchise tax is $800 a year and catches founders by surprise constantly.
• Tax filings: you file a federal return even at zero revenue. A startup-focused accountant runs $1,000 to $2,500 for a first year.

The failure mode here isn't the cost, it's forgetting. A Delaware corporation that skips two annual reports goes void, and a void entity cannot legally issue stock, which means your fundraise stops until you pay reinstatement fees and back taxes.

What can you handle yourself and what needs a lawyer?

Do it yourself: formation through Atlas or Clerky, EIN, 83(b) filing, standard CIIAAs from Clerky or Cooley GO's free document library, generated privacy policy and terms, trademark search, annual Delaware filings.

Get a lawyer for: a cofounder departure, any priced round, a customer contract above roughly $50,000 or one with unusual indemnities, anything involving regulated data (health, financial, children), an equity arrangement that deviates from standard four-year vesting, and the first time someone sends you a letter with the word "cease" in it.

Startup-focused firms often defer fees on a first priced round, and accelerators usually have preferred rates. The right budget for legal in year one is a few hundred dollars and a calendar, not a retainer.

Key takeaways

• Four categories cover almost everything: who owns the company, who owns the work, who you pay and how, and what you tell your users.
• File your 83(b) within 30 days of your stock grant, through the IRS electronic portal. There is no fix for missing it.
• Every founder, employee and contractor signs an invention assignment with present-tense "I hereby assign" language. Pre-incorporation code needs its own assignment.
• Run an open-source license scan before you raise. AI-assisted code has made copyleft contamination a live diligence risk, not a theoretical one.
• Misclassifying employees as contractors carries penalties large enough to end a seed-stage company. When in doubt, classify as employee.
• A privacy policy is a sales requirement before it's a legal one. App stores, payment processors and enterprise buyers all ask.
• Budget under $1,000 a year for Delaware compliance, and recalculate your franchise tax under the Assumed Par Value method.

FAQ

Do I need to incorporate before I have customers?
Not necessarily, but incorporate before you take money from anyone, sign a contract, or bring on a cofounder. Those three events all create liability or ownership questions that are much cheaper to answer inside an entity than outside one.

What happens if I already missed my 83(b) deadline?
Your options are a section 301.9100 private letter ruling from the IRS, which is costly and uncertain, or restructuring the grant. Talk to a startup tax attorney quickly, because some remedies depend on how recently the grant happened.

Can I use a template for contractor agreements?
Yes, if it contains present-tense IP assignment language and a confidentiality clause. Cooley GO and Clerky both publish templates built for startups. What you cannot do is use a generic freelance agreement that stays silent on IP ownership.

Do I need a lawyer to raise a SAFE round?
Usually no. Y Combinator's standard SAFE documents are designed to be used without modification, and Clerky generates and countersigns them. The moment anyone redlines the SAFE, get a lawyer.

How much should I budget for legal in year one?
Between $500 and $1,500 for most pre-seed startups: formation, annual Delaware filings, registered agent, and a trademark filing if the name matters. Anything beyond that is usually a sign you're solving a problem that a template would have prevented.