Tech & Sourcing @ Morgan Lewis

Planning for major service disruptions and disasters, such as prolonged power failures, fires, flooding, and other extreme weather events, is an important element of strategic technology and service agreements.

Changes to complex commercial contracts are inevitable. These contracts, such as large outsourcing agreements, typically include a master services agreement (MSA) and a high number of exhibits and attachments describing the scope, performance standards, financials, and other contractual requirements in detail. Some deals can end up containing over 50–75 documents (or more!) in total. Given their strategic importance, these agreements often require numerous amendments as the relationship evolves over time and changes need to be formally documented.

For UK companies choosing between hiring employees or using independent contractors, there are important legal risks that must be taken into consideration. In addition, agile and remote workforces are a hot topic as companies around the world are considering new ways of working following the COVID-19 pandemic. However, in the post-Brexit United Kingdom, the idea that people can work in any place at any time presents tax, data protection, and employment law challenges.

Autorenewal provisions (sometimes referred to as evergreen provisions) are common in commercial agreements for the provision of technology and related services. Vendors may want their agreements to autorenew to save time negotiating new contracts and to continue the customer relationship. Customers often desire to terminate an agreement, thinking they have the right to do so, only to realize the term of the agreement has been automatically renewed for another year or number of years.

There are often misconceptions in connection with negotiating intellectual property (IP) development agreements with developers located in Russia. This post details five common misconceptions and provides tips for complying with applicable laws in connection with such agreements.

The European Securities and Markets Authority (ESMA) on May 10 published final guidelines on outsourcing to cloud service providers (ESMA Guidelines) to help firms and competent authorities identify, address, and monitor the risks and challenges arising from cloud outsourcing arrangements. Subject to a few clarifications, the ESMA Guidelines are broadly consistent with the draft guidelines.

Last week, we posted on the guidance issued by the US Department of Labor (DOL) for plan sponsors, plan fiduciaries, recordkeepers, and plan participants on cybersecurity best practices. Last week’s post focused on the guidance provided for hiring a service provider. In this week’s post, we will highlight some the DOL’s cybersecurity program best practices for use by recordkeepers and other service providers responsible for plan-related IT systems and data.

The US Department of Labor (DOL) recently announced guidance for plan sponsors, plan fiduciaries, recordkeepers and plan participants on cybersecurity best practices. The guidance focuses on three areas: (1) tips for hiring a service provider; (2) cybersecurity program best practices; and (3) online security tips. In this post, we will focus on the DOL’s tips for plan sponsors and plan fiduciaries in selecting a service provider.

When negotiating a digital health collaboration agreement between a tech company and a life sciences company, whether for the development of artificial intelligence or other software, the provision of data hosting and analysis services, or a more complex collaboration, the parties should consider the following.

The UK Prudential Regulation Authority (PRA) published a policy statement (PS7/21) and a supervisory statement (SS2/21) on clarifying and modernizing regulatory expectations of outsourcing and third-party risk management on March 29. The expectations in PS7/21 and SS2/21 are relevant to banks, PRA-designated investment firms, insurers, and branches of overseas banks and insurers and apply not just to “outsourcing” but also non-outsourcing material or high-risk service arrangements. The expectations apply at a legal entity level rather than at a group level (save for expectations on intragroup arrangements).