Who Owns the Code When You Outsource: Read This Clause

Published by CodeNicely, the product studio founded by Meghal Agrawal and Ujjwal Agrawal in 2017

For: A seed-to-Series-A founder in Dubai who has just received a development contract from an offshore studio and is staring at an IP clause that says 'upon full payment' — and is not sure whether that wording actually gives them clean title to the product they are about to spend AED 300K building

If your IP assignment clause transfers ownership 'upon full payment', you do not own the code during the build. You own it only after the final invoice clears. If the engagement ends at milestone three over a scope dispute — which is how most offshore engagements actually fail — the studio legally owns everything shipped to that point, including any model you trained on your own proprietary data. This post walks through the exact wording that fixes that, the carve-outs most contracts quietly miss, and the questions to put to the vendor before you sign anything. It is not legal advice. Get a UAE-qualified lawyer to review the final document.

A note on scope. This piece covers one clause family: IP assignment and the related ownership language around code, model weights, and background IP. It does not cover the DPA, source-code escrow, acceptance criteria, or termination mechanics — each deserves its own read.

Why this clause matters more than it used to

Outsourced development is now the default, not the exception. The global IT outsourcing market was valued at USD 744.6 billion in 2024 and is projected to reach USD 1.22 trillion by 2030, and 92% of the world's largest 2,000 companies already outsource IT services. If you are a Dubai founder sending an SOW to a studio in Bangalore, Lahore, Warsaw, or Ho Chi Minh City, you are doing exactly what everyone else is doing.

The volume is the problem. When outsourcing is routine, founders stop reading the contract carefully. They scan for the price, the timeline, and the payment terms. The IP clause gets a glance because it contains the word 'assigns' and that sounds reassuring. It is not.

Under UAE Federal Law No. 38 of 2021 (Copyright Law), Article 28, when work is created by an independent contractor — not an employee — ownership stays with the developer absent an express written assignment. Without one, you hold at best an implied licence to use the software for its commissioned purpose. You do not own the underlying IP. You cannot sublicense it, sell it with the business, or stop the developer from building something similar for your competitor next quarter.

And this is not a theoretical UAE quirk. In the US case Aymes v. Bonelli, a court ruled the developer was an independent contractor and therefore owned the copyright to software the company had paid for — even though the contract used 'work-for-hire' language. The company had to go back and negotiate for rights it believed it already owned.

The 'upon full payment' trap, in plain terms

Here is the clause as it typically appears in an offshore studio's template:

'Upon full payment of all Fees under this Agreement, Developer hereby assigns to Client all right, title, and interest in and to the Deliverables.'

Read that again. The assignment is conditional. The trigger is full payment. Until that trigger fires, every line of code, every schema migration, every fine-tuned model weight, every prompt template — all of it is owned by the studio.

Now imagine a realistic failure mode. You are four months into a six-month build. The studio has delivered three of five milestones. There is a dispute: scope creep, a missed integration, a founder who changed their mind about the data model. You withhold milestone four. The studio downs tools. You want to take what has been built and finish it with another team.

You cannot. You do not own it. Vendors sometimes attempt to retain IP ownership until the final dollar of a multi-month contract is paid — and if the relationship breaks before that, the client ends up with zero code and spent capital. In your case, spent capital in the AED 300K range.

Worse, if the product is AI-heavy and the studio trained a model on data you provided — customer transactions, support tickets, regulated health records — the model weights sit in the same bucket. They belong to the studio until payment is complete. The studio can, in principle, use what they learned building your system to accelerate the next client's build.

Wording that actually protects the buyer

You want three things in the assignment clause: present-tense assignment, unconditional transfer, and explicit scope that includes AI artefacts.

1. Present-tense, immediate assignment

Replace 'upon full payment… Developer hereby assigns' with language that assigns ownership at the moment code is created, with a security interest for the developer until payment:

'Developer hereby irrevocably assigns to Client, on creation, all right, title, and interest, including all intellectual property rights, in and to the Deliverables and Work Product. Developer retains a security interest in the Deliverables until payment of the corresponding milestone fee, exercisable solely as a right to pursue the unpaid fee and not as a right to reclaim, revoke, or restrict Client's ownership of the Deliverables.'

The security interest is the compromise the studio should accept. They are protected against non-payment. You are protected against the studio walking away mid-build with your IP in their repo.

2. Define 'Deliverables' and 'Work Product' broadly

Most template contracts define Deliverables as the final shipped artefacts. That leaves out the interesting things: documentation, test suites, CI/CD configuration, infrastructure-as-code, prompt libraries, evaluation datasets, fine-tuned model weights, embeddings, and any synthetic data the studio generated from your real data. Spell them out:

'Work Product includes, without limitation: source code, object code, scripts, configuration files, infrastructure definitions, database schemas, migrations, test suites, documentation, design files, prompt templates, system prompts, fine-tuned model weights and adapters, embeddings derived from Client Data, evaluation datasets, and any derivative works of the foregoing.'

If you are building anything AI-shaped, the model weights and prompt library may be more valuable than the application code wrapping them. Our team covers this in more detail on the AI Studio page — the short version is that in an LLM-era product, the glue is often the moat.

3. Carve out background IP, do not ignore it

Custom software is almost never 100% new code. Agencies routinely incorporate open-source libraries, internal boilerplates, and pre-existing developer frameworks. If your contract claims to assign everything to you, it is either lying or the studio will quietly refuse to include their internal tooling — which means the delivered code will not run without their proprietary scaffolding.

The honest structure is a three-part split:

• Foreground IP — created specifically for you under this SOW. Assigned to you, unconditionally, on creation.
• Background IP — pre-existing vendor tools, libraries, internal frameworks. Owned by the vendor. Licensed to you under a perpetual, irrevocable, worldwide, royalty-free, sublicensable licence to use, modify, and distribute as part of the delivered product.
• Third-party IP — open-source libraries, SaaS APIs, pretrained models. Listed in an appendix. Governed by their own licences. The vendor warrants the licences are compatible with your intended commercial use.

The specific phrase to insist on in the background IP licence is 'sublicensable to successors, assigns, and acquirers.' If you ever sell the company, the acquirer's lawyers will ask whether the licence transfers. If it does not, your valuation takes a hit at diligence. UAE IP due diligence reviews specifically flag this as one of the pitfalls that derails tech M&A deals.

4. The waiver of moral rights

Under UAE copyright law and most civil-law jurisdictions, authors retain moral rights — the right to be attributed, the right to object to modifications — even after assigning economic rights. In practice this rarely bites, but if your vendor is a studio and the individual developers are the authors, you want:

'To the maximum extent permitted by applicable law, Developer and its personnel irrevocably waive all moral rights in the Work Product in favour of Client and its successors and assigns.'

5. The sub-contractor chain

This one bites founders who hire smaller studios. The Legal 500 UAE TMT guide notes that when offshore developers are engaged through intermediary companies, multiple layers of IP assignment may be required. If the studio you contracted with sub-contracts to freelancers, and those freelancers never assigned their work to the studio, the studio cannot assign it to you. You are at the end of a broken chain.

Insert:

'Developer warrants that it has, and will maintain throughout the Term, written assignment agreements with all personnel and sub-contractors contributing to the Work Product, sufficient to vest in Developer the rights it assigns to Client under this Agreement. Developer shall provide copies of such agreements on reasonable request.'

Wording that quietly does not protect you

Watch for these. They sound like ownership language. They are not.

Specific risks when the product is AI

If the studio is fine-tuning models on your data, three things need explicit handling that generic templates miss:

1. Model weights and adapters. These are a work product. They should be assigned to you with the same wording as source code. Insist on delivery of the raw weights, not just API access to a hosted endpoint.
2. Training data provenance. If the studio augmented your data with third-party datasets, you need to know. Some pretrained models have licences that prohibit commercial use of derivative weights. The warranty should cover this.
3. Embeddings and vector stores. Embeddings derived from your proprietary content are, in effect, a compressed representation of that content. They should be treated as your data, not the vendor's.

Founders building regulated AI products — anything touching patient data, financial transactions, or KYC — face a compounded version of this problem. If you want a sense of how the IP structure plays out in a regulated AI product, our HealthPotli case study walks through an e-pharmacy build with an AI drug-interaction layer, and the Cashpo case study covers an AI credit-scoring and KYC product. The IP architecture in both is deliberately simple: client owns the application, the model weights, and the training data derivatives; the studio retains only genuinely general tooling.

The questions to put to the vendor before you sign

If the clause is on 'upon full payment' wording, send the vendor this list. Their response tells you more than the contract does.

1. Will you change the assignment language from 'upon full payment' to 'on creation, with a security interest until payment'? If not, why not?
2. What specific items of background IP will be incorporated into our product? Can we have a list before signing?
3. What licence terms govern that background IP after termination? Is the licence perpetual, irrevocable, and sublicensable to acquirers?
4. Do you sub-contract any part of the work? If so, can we see the assignment language in your sub-contractor agreements?
5. If we train a model on our data during this engagement, do we own the weights, the adapters, and any embeddings derived from our data?
6. If the engagement terminates at milestone three, what exactly do we walk away with? Code? Documentation? Model weights? Access to the repository?
7. Do you retain any right to use the specific business logic, data model, or workflow we design together, in any form, for any other client?

A vendor who is comfortable with their IP position will answer these in writing without friction. A vendor who gets defensive, insists their template is 'market standard', or wants to escalate to their legal team to respond to question one is telling you something.

What to do before you sign the contract in front of you

1. Mark up the IP clause with the present-tense, on-creation wording above. Send it back as a redline.
2. Ask for the background IP list and the sub-contractor warranty.
3. Add the AI-specific definitions if your product uses models.
4. Have a UAE-qualified technology lawyer review the final text — not a general corporate lawyer, one who has handled offshore development disputes. This is the single highest-ROI legal spend in the entire build. Industry surveys suggest over 30% of outsourced projects experience conflict tied to unclear contractual terms, and IP is near the top of the list.
5. If the vendor refuses the on-creation assignment and insists on 'upon full payment', treat it as a signal. You are not negotiating with a partner. You are negotiating with a counterparty who has priced in the option to walk away with your code.

For founders building in the UAE specifically, our Dubai software development page has more on how we structure engagement terms, and the broader offerings overview covers the IP posture across different engagement models.

Frequently Asked Questions

Does UAE law automatically give me ownership of software I pay a developer to build?

No. Under UAE Federal Law No. 38 of 2021, Article 28, work created by an independent contractor remains owned by the developer unless there is an express written assignment. Paying for the work gives you an implied licence to use it for the purpose it was commissioned for — not ownership. This is the opposite of the employment default, where work created by an employee in the course of their duties generally belongs to the employer.

Is 'work made for hire' language enough to transfer ownership in a UAE contract?

Not on its own. 'Work made for hire' is a specific doctrine under US copyright law with no direct equivalent in UAE or most civil-law jurisdictions. A UAE court will look for an express, written assignment of specific intellectual property rights — not a US-style doctrine imported through contract language. Use explicit assignment wording and have a UAE-qualified lawyer confirm it.

What should I do if the vendor refuses to change 'upon full payment' to 'on creation'?

Offer the compromise: present-tense assignment on creation, with a security interest in the vendor's favour until payment of the relevant milestone. This gives the vendor what they actually need — recourse if you do not pay — without leaving you exposed if the engagement ends mid-build. If the vendor still refuses, that is useful information about how the relationship is likely to go when something gets difficult.

How do I handle IP for AI models trained on my data?

Define model weights, fine-tuned adapters, prompt templates, and embeddings explicitly as Work Product in the contract. Require delivery of the raw artefacts, not just hosted API access. Separately, require the vendor to warrant the provenance and licence terms of any pretrained base model they build on — some open-weight models have licences that restrict commercial use of derivative weights, and you need to know before you ship.

What does a proper IP review of an offshore development contract cost and how long does it take?

The cost is driven by three things: the length and complexity of the contract, whether the lawyer needs to coordinate with counsel in the vendor's jurisdiction, and how many rounds of redlines the vendor will put you through. A single-jurisdiction review of a standard MSA and SOW is typically a few hours of a technology lawyer's time; a multi-jurisdiction review with sub-contractor chain diligence and AI-specific clauses is materially more. To turn that into a real quote, your lawyer will want to see the contract itself, know the vendor's jurisdiction, and understand whether the product involves regulated data or AI models trained on your data.

This article is general information, not legal advice. UAE copyright law and contract interpretation turn on specific facts. Have a qualified technology lawyer review your actual contract before signing.