Agency legal guide: Contracts, insurance, and compliance

An agency legal setup has three layers: the business entity that separates your personal assets from the business, the contracts that limit what you can owe a client, and the insurance that pays when something goes wrong anyway. Running an agency without them works until the first serious dispute, and then a single claim can reach your savings, your reputation and the business itself.

The good news is that most agency legal risk is manageable with a sensible entity, a standard set of contracts, the right insurance and a few operating habits. This guide covers all of them, plus when it is worth paying a lawyer.

Important: This guide describes common US practice in general terms. It is not legal, tax or insurance advice. Laws differ by state and country, so have a lawyer, accountant and insurance broker in your jurisdiction review your specific setup and contract language.

In this guide:

• Liability protection works in three layers: entity, contracts and insurance. You need all three.
• An LLC is the usual starting entity for a US agency, and it only protects you if you keep business and personal finances separate.
• Every agency needs an MSA, SOW and NDA, plus contractor agreements that assign IP to you.
• Professional liability (E&O) is usually the most important policy for a service agency.
• Cap your liability, disclaim business outcomes and put IP ownership in writing in every contract.

The three layers of liability protection

Each layer catches what the one above it misses:

1. Entity structure. A properly maintained LLC or corporation puts a legal wall between business debts and your personal assets.
2. Contracts. Liability caps, indemnification and warranty clauses limit your exposure on each engagement and assign risks to the party that controls them.
3. Insurance. Policies pay defense costs, settlements and judgments when a claim gets through anyway.

Skipping one layer leaves a gap the others may not cover. A liability cap does not help if you signed the contract in your personal name, and an LLC does not pay a lawyer to defend you.

Your legal setup, step by step

Work through these in order. Each step links to the section that explains it.

Business entity selection

The entity you choose affects liability, taxation and your ability to raise money or sell. Switching later is possible but can be costly.

Sole proprietorship

• Structure: You and the business are legally the same. Usually no separate filing is required.
• Liability: Unlimited. Your personal assets are at risk if the agency is sued.
• Taxation: Pass-through. Income and expenses go on your personal return.
• When to use: Only while testing an idea with minimal risk. Upgrade once you have real clients.

Limited liability company (LLC)

• Structure: A separate legal entity formed by filing with your state, usually with an operating agreement.
• Liability: Generally limited to business assets, as long as you maintain the separation described below.
• Taxation: Flexible. It can be taxed as a sole proprietorship, a partnership or, by election, an S corporation.
• When to use: The usual default for agencies. A good balance of protection, simplicity and flexibility.

S corporation election

• Structure: A tax election available to qualifying corporations and LLCs, not a separate type of company.
• Liability: Same as the underlying LLC or corporation.
• Taxation: Pass-through. Owners who work in the business pay themselves a reasonable salary through payroll and can take remaining profit as distributions, which can reduce self-employment tax.
• When to use: When profit is high enough that the tax savings outweigh the cost of running payroll and the extra filings. Your CPA can run the numbers for your state.

C corporation

• Structure: A standard corporation with its own legal and tax identity.
• Liability: Limited.
• Taxation: Profits are taxed at the corporate level, and dividends are taxed again for shareholders.
• When to use: When you plan to raise outside investment or structure for certain kinds of sale. Usually unnecessary for small agencies.

The SBA's guide to choosing a business structure compares these in more detail.

Keeping the liability shield intact

Forming the entity is only the first step. Courts can "pierce the corporate veil" and hold owners personally liable when the business is not run as a separate entity. To keep the protection:

• Use separate business bank accounts and cards
• Sign contracts in the entity's name, with your title, not as an individual
• Pay business expenses only from business accounts, and never mix personal spending in
• Keep an operating agreement and basic records, especially with more than one owner
• File annual reports and pay state fees on time

Mixing personal and business money is one of the most common ways small agency owners weaken their own protection.

Essential contracts for agencies

Contracts define the relationship, set expectations and protect both sides. Do not rely on handshakes or email threads.

Master services agreement (MSA)

The MSA sets the general terms for the whole client relationship. It typically covers:

• Scope of relationship: what services you provide, at a high level
• Payment terms: due dates, deposits and late fees
• Term and termination: how long it lasts, how either side can end it, and what happens to work in progress
• Intellectual property: who owns what, and when (see below)
• Confidentiality: obligations to protect each other's information
• Liability limits: a cap on damages and exclusion of consequential damages
• Indemnification: who covers which third-party claims
• Warranties and disclaimers: what you promise and what you do not
• Dispute resolution: governing law, and arbitration or court
• Insurance: the coverage you maintain

Once signed, the MSA stays in place and each project gets its own statement of work that references it, so you do not renegotiate legal terms for every project. A master services agreement template is a useful starting point for your lawyer.

Statement of work (SOW)

The SOW defines a specific project or engagement:

• Deliverables: exactly what you will produce
• Timeline: milestones and completion dates
• Pricing: fixed fee, hourly or retainer amount
• Assumptions: for example, the client provides copy, or one round of revisions is included
• Client dependencies: inputs the client must supply, and what happens to dates if they are late
• Exclusions: what is out of scope
• Approval process: how feedback and sign-off work
• Change order process: how scope changes are requested and priced

A clear SOW is your best defense against scope creep. Use a scope of work template or the scope of work generator, and see our guide to preventing scope creep.

Non-disclosure agreement (NDA)

An NDA protects confidential information shared between you and a client or prospect. Use one when:

• A prospect shares strategy, financials or proprietary data before you are hired
• A client shares customer data, trade secrets or unreleased products
• You partner with another agency or vendor on a project

Key elements: a definition of confidential information, the obligations, the term, standard exclusions (already public, independently developed) and return or destruction of materials at the end. Start from an NDA template, and do not sign one-sided client NDAs without reading them.

Freelancer and subcontractor agreements

When you use freelancers or subcontractors, your agreement should:

• Define the work, deliverables and payment
• Establish that they are independent contractors, and treat them that way in practice
• Assign IP in their work to your agency, so you can pass ownership on to the client
• Include confidentiality, and non-solicitation of your clients where enforceable
• Flow down any client requirements (NDAs, security, insurance)

A freelance contract template can be adapted for agency-to-contractor work. Misclassifying workers or failing to secure IP from contractors can cause problems with both the tax authorities and your clients.

Retainer agreements

Ongoing retainers need clear terms on monthly scope (hours, deliverables or both), rollover or use-it-or-lose-it rules, billing schedule, termination notice and what happens to unused hours. See the retainer agreements guide and the retainer agreement template.

Contract clauses that limit liability

Limitation of liability

This is often the most important clause in an agency contract. A common structure:

• Total liability capped at the fees paid under the engagement in the 12 months before the claim
• Exclusion of consequential, incidental and special damages, such as lost profits or lost data
• Carve-outs the client will usually ask for, such as gross negligence, willful misconduct and confidentiality breaches

Without a cap, a small project can in theory produce a claim far larger than the fees. With one, your exposure is bounded and easier to insure. Be very cautious about agreeing to unlimited liability or uncapped indemnities, and have a lawyer review any request for them.

Indemnification

Indemnification clauses decide who pays when a third party makes a claim. A balanced clause has each side indemnify the other for claims arising from its own materials, actions or breaches. For example, you cover IP infringement in original work you created, and the client covers materials it supplied.

Watch for one-sided language asking the agency to indemnify "any and all claims" arising from the engagement. Narrow it to your own conduct and your own work.

Warranties and disclaimers

Warrant only what you control. A typical agency warranty is that services will be performed in a professional and workmanlike manner consistent with industry standards. Then disclaim the rest explicitly:

• No guarantee of business outcomes such as revenue, traffic, conversions or rankings
• No warranty for third-party platforms, plugins or services used in delivery
• A disclaimer of implied warranties, to the extent the law allows

Promising outcomes you cannot control is a fast route to a breach of contract claim.

Force majeure and client dependencies

A force majeure clause excuses delays caused by events outside either party's control, such as natural disasters, government action, major outages or cyberattacks. Pair it with a dependency clause: if the client is late supplying inputs or approvals, your deadlines move by the same amount. For more clause-by-clause guidance, see agency contract essentials.

Insurance for agencies

Insurance moves risk from you to the insurer, and many clients ask for proof of coverage before signing. Limits below are common starting points, not recommendations; premiums vary widely with revenue, services, location and claims history, so get quotes from a broker who works with agencies.

Professional liability (E&O)

E&O covers claims that your professional services were negligent, contained errors or omissions, or caused a client financial harm. For example, a website you built had a security flaw that led to a breach, or a campaign error cost a client money. Defense costs alone can be significant even for claims without merit. Many enterprise clients require E&O in the MSA.

Cyber liability

Most agencies hold some client data, passwords or admin access. Cyber coverage pays for breach response: forensics, notification, legal costs and sometimes business interruption. Insurers increasingly ask about basic controls such as multi-factor authentication and backups; the FTC's cybersecurity guide for small businesses is a good baseline.

What insurance costs

Premiums depend on revenue, services, claims history and limits, so only a broker quote tells you your price. For a reference point, Insureon reports these 2026 figures for its small business customers, most of whom have fewer than five employees:

These are cross-industry small business figures, not agency benchmarks. Agencies with larger teams, higher limits or regulated clients pay more.

Review all policies once a year with your broker, and whenever your services, revenue or client mix change.

Intellectual property ownership

Who owns the work is one of the most common sources of agency disputes. Put it in writing in every contract.

The default without a contract

Under US copyright law, the creator generally owns the work unless there is a written agreement transferring it. "Work made for hire" applies automatically to employees' work within their job, but for outside contractors and agencies it only covers nine specific categories of commissioned work and requires a signed agreement (US Copyright Office Circular 30). Most agency deliverables, such as logos and websites, do not fit those categories. Without an explicit assignment, a client may only have an implied license to use what you delivered.

Common contract structures

• Assignment on full payment: the client owns the final deliverables once paid in full. This is the most common structure and also protects you against non-payment.
• Agency keeps pre-existing IP: your tools, methods, templates and generic code stay yours, and the client gets a license to use them as embedded in the deliverables.
• Portfolio rights: you can show the work in your portfolio and case studies, with confidential work excluded.
• Third-party assets: fonts, stock images and plugins come under their own licenses, which you list and the client maintains after delivery.

Our guide to agency intellectual property covers ownership models, AI-generated content and sample clause language.

Operating habits that prevent claims

The cheapest claim is the one that never happens.

Document decisions

Keep written records of scope discussions, change requests and approvals, client feedback, delivery acceptance and any delays. Email works; a project management system or client portal where all of this lives per client is better. Verbal-only agreements are where disputes start.

Get explicit approval before you ship

Build approval into delivery so every deliverable has a recorded sign-off. In AgencyPro, versioned proofing and approvals are on the Pro plan, and the client approvals page shows how that record works.

Train your team

Many disputes trace back to operational mistakes: missed deadlines, scope assumptions or miscommunication. Make sure your team knows the contract terms for each client, how to handle change requests, when to escalate, and what client information they must not share.

Review contracts before signing

Have someone who knows what to look for read every client contract. Watch for:

• Indemnification that covers far more than your own conduct
• Warranties that promise specific results
• Missing liability caps, or caps far above the fees
• IP terms that take your pre-existing materials
• Termination terms that let the client leave without paying for work done

Keep insurance current

Coverage only helps if it is in force and the insurer hears about a potential claim in time. Assign one person to own insurance renewals and notifications, and update coverage when services or revenue change.

Special risk areas

• Healthcare and financial clients: rules such as HIPAA and PCI DSS create specific obligations. Allocate compliance responsibility in the contract and confirm your insurance covers regulated work.
• Performance-based deals: if your fee depends on outcomes, the contract must define them precisely, and your pricing must absorb the risk of not hitting them.
• International work: liability rules, IP defaults, tax and enforcement differ by country. Get legal review for cross-border contracts.
• AI-assisted work: disclose AI use where relevant, keep human review in the process, and check outputs before delivery.

Compliance requirements

Basic business compliance

• Business licenses: check city, county and state requirements.
• Sales tax: in the US, many services are not taxed, but rules vary by state and some digital products and services are taxable. Ask your accountant.
• Employment law: follow wage, hour and anti-discrimination rules and classify contractors correctly.

Data and privacy

• GDPR (EU and UK GDPR): applies if you process personal data of people in the EU or UK. Expect clients to ask you to sign a data processing agreement.
• US state privacy laws: California's CCPA/CPRA and a growing number of other state laws set obligations for handling personal information.
• Industry rules: HIPAA for healthcare clients, PCI DSS where card data is involved. Client obligations often flow down to you by contract.

Client-driven requirements

Enterprise clients may send security questionnaires, ask for SOC 2 reports or require specific insurance limits. Find out during sales, not after signature, and make sure subcontractors meet any requirements that flow down.

Annual liability review checklist

Copy this list and run it once a year with your lawyer, broker and accountant:

• Entity in good standing; annual report filed and state fees paid
• Business and personal finances still fully separate
• Contracts signed in the entity's name, with your title
• MSA, SOW and NDA templates reviewed in the last 12 months, or since any law change in your state
• Every active client has a signed MSA or engagement letter and a current SOW
• Liability cap, outcome disclaimer and IP clause present in every active client contract
• Any client paper with uncapped liability or broad indemnities listed and reviewed
• Every contractor has a signed agreement with IP assignment and confidentiality
• Insurance limits meet or exceed what client contracts require
• Policies match current services (for example, new hosting, paid media or regulated-industry work)
• Data processing agreements in place where clients require them
• One named person owns insurance renewals and claim notifications

When something goes wrong

1. Notify your insurer promptly. Late notice can put coverage at risk.
2. Collect and preserve everything related to the issue.
3. Avoid admitting fault or promising compensation before talking to a lawyer or your insurer.
4. Keep communication with the client in writing.
5. Bring in legal counsel early if the client threatens action.

A calm, prompt and documented response resolves many issues before they become claims.

When to hire a lawyer

Templates are usually fine for

• Standard contracts based on vetted templates (freelance contract, NDA, scope of work)
• Simple single-owner LLC formation
• Routine renewals on terms you have already had reviewed

Get a lawyer involved for

• Your core templates: have your MSA and SOW reviewed once, properly, in your jurisdiction
• Large or long engagements: when the fees or the risk are big enough that a dispute would hurt
• Client paper: contracts drafted by the client, especially with unusual indemnity, liability or IP terms
• Disputes: demand letters, threatened litigation or formal complaints
• Ownership questions: multiple owners, equity, partnerships or a sale
• Regulated industries and international work

Many business lawyers offer flat fees for contract review or entity formation, so ask for a quote up front.

Protect your agency with proper legal foundations

Choose the right entity and keep it separate from your personal finances. Use an MSA, SOW and NDA with every client, cap your liability and disclaim outcomes you cannot control. Carry E&O, general liability and cyber cover as your work requires, and put IP ownership in writing. Then build the habits that keep a written record of every scope change and approval.

To check that your pricing leaves room for insurance and risk, run it through the profit margin calculator.

Frequently asked questions

What entity type is best for a new agency?

In the US, an LLC is the usual starting point because it offers personal liability protection with pass-through taxation and modest paperwork. An S corporation tax election can reduce self-employment tax once profit is high enough to justify running payroll. Ask a CPA to model it for your state before you elect.

What insurance does an agency actually need?

Most agencies need professional liability (E&O), general liability and cyber liability, plus workers' compensation once they have employees. Employment practices liability becomes important as the team grows. Many enterprise clients set minimum limits in their contracts, so check those before you buy.

What is a reasonable liability cap in an agency contract?

A common cap is the fees paid under the engagement in the previous 12 months, with consequential damages excluded. Larger clients sometimes negotiate a multiple of fees or carve-outs for specific risks. Avoid unlimited liability, and have a lawyer review any request for it.

Who owns the work an agency creates?

By default, the creator owns it unless a written agreement transfers it. Most agency contracts assign the final deliverables to the client on full payment, while the agency keeps its pre-existing tools and methods and the right to show the work in its portfolio. Put this in writing; relying on defaults leads to disputes.

Can a client sue an agency for missing a deadline?

A client can claim breach of contract if a missed deadline breaks a specific obligation in the contract and causes them a loss. Protect yourself with realistic dates, a dependency clause that moves deadlines when client inputs are late, a cure period before termination, and written records of the cause of any delay.

What is the difference between an MSA and an SOW?

The MSA (master services agreement) sets the legal terms for the whole relationship: payment, IP, liability and termination. The SOW (statement of work) defines one project's deliverables, timeline and price under that MSA. New projects need a new SOW, not a new MSA.

Should I start work before the contract is signed?

No. Without a signed contract, scope, payment and IP ownership are all open to dispute. If timing is tight, a short signed engagement letter with payment terms and a first-phase scope is better than starting on an email.

Want contracts, approvals and delivery records in one place? AgencyPro stores each client's files, messages and request history in a branded portal on every plan; documents (quotes, proposals, contracts with e-signature) and versioned approvals are on the Pro plan. Book a demo.