Every startup can rattle off its tech stack in seconds: frontend framework, backend infrastructure, deployment pipeline. But ask about the legal stack? Crickets.
From dozens of conversations with founders across Europe, the same pattern emerges: you ship product fast, hire your first team, close your first customers—yet the legal foundations lag behind. Not out of neglect. Out of uncertainty.
Nobody gives founders a clear, startup-friendly map of the legal documents they actually need. So they patch together free templates, defer everything, or react only when an investor, customer or regulator forces their hand.
Here's the good news: legal doesn't have to be a black-box. If you think of it like your tech stack—built in layers—it becomes predictable and manageable.
In this guide you'll understand what to build, when to build it, and why it matters. Let's dive into the five-layer legal stack every European startup should have in year 1.
Why Founders Struggle with Legal (and Why It Matters)
The cost of legal uncertainty
Legal mis-steps aren't theoretical—they're costly, time-consuming, and can kill your startup.
- Breaching the General Data Protection Regulation (GDPR) can trigger fines starting at €20 million or 4% of global annual revenue.
- Misclassifying employees in Portugal can trigger significant back-dated social-security payments plus heavy penalties.
- Co-founder IP (intellectual property) disputes have destroyed companies worth millions.
- Using U.S.-based templates in a European context often leads to compliance failures in consumer-protection laws.
The data suggests that while legal isn't usually the primary cause of startup failure, it often acts as an accelerator of other problems.
The "build first, legal later" trap
Technical founders understand technical debt. You skip tests, ignore architecture—until it slows you down.
Legal debt works the same way—but the interest rate is higher and the consequences are more unpredictable.
You can't roll back a signed contract with the wrong terms. You can't undo a poorly documented employment relationship. And you definitely can't un-process personal data that should have been processed properly.
The good news: most startup legal is predictable, structured work, not novel litigation. If you get the fundamentals right, you avoid the hidden land-mines. (For routine vs complex legal decisions, see our guide on when to use AI vs human lawyers.)
The Legal Stack Framework: 5 Layers Every Startup Needs
Think of your legal setup like your tech architecture: layers that build on each other. Skip or mis-order layers and you'll feel it later.
The five layers:
- Foundation Layer – Incorporation, founders' agreement, cap-table
- IP Layer – IP assignments, NDAs, trademarks
- People Layer – Employment contracts, option/equity plans, internal policies
- Privacy Layer – Privacy policy, cookie policy, vendor DPAs, data transfers
- Commercial Layer – Terms of Service, customer contracts, MSAs
Let's break down each layer.
Layer 1: Foundation Layer (Base Infrastructure)
This is where everything starts. If you get this wrong, everything built on top will have cracks.
What's in the Foundation Layer
- Company incorporation documents: certificate of incorporation, articles/associations.
- Founders' agreement: the contract between founders and the company.
- Cap-table: who owns what and how equity is tracked.
Incorporation – more than just paperwork
In many EU jurisdictions incorporation is relatively quick and affordable:
- UK Ltd: ~£12 online via Companies House, ~30 minutes
- Estonia (e-Residency route): ~€200 for setup via e-Residency programme
- Portugal: ~€360 via Empresa Online, typically 1-2 weeks
- Germany (GmbH): ~€300-500 (or more depending on capital)
But choosing the right jurisdiction matters: tax treatment, investor expectations, employment-law complexity, substance requirements. Don't pick just the cheapest option—pick the one aligned with your growth plan.
Founders' Agreement – the one many skip (until too late)
Here's a stat: ~73% of co-founder relationships experience some form of conflict. Yet many founders skip putting expectations into a formal agreement.
Your founders' agreement should cover:
- Equity splits & vesting (standard: 4 years, 1-year cliff)
- Roles & responsibilities (who does what, full-time vs part-time)
- Decision-making rights, deadlock resolution
- Leaving scenarios (good leaver / bad leaver)
- Exit scenarios: acquisitions, share sales, new investors
- IP assignment: ensure all pre-existing & future IP is assigned to the company
- Confidentiality obligations, non-compete clauses (if enforceable)
- Dispute resolution process
Don't skip this—even if you're best friends. It's insurance for the business.
Layer 2: IP Layer (Protect Your Ideas)
Once the foundation is set, move to protecting your core asset: IP.
What's in the IP Layer
- IP assignments from founders/employees
- Non-disclosure agreements (NDAs) for third-party access or early talks
- Trademark filings / brand protection
- Patent strategy (if applicable)
- IP ownership documentation (ensures the company owns the work)
Layer 3: People Layer (Your Team Infrastructure)
With people onboard and scale in sight, you need proper agreements and policies.
What's in the People Layer
- Employment contracts (appropriate to jurisdiction)
- Independent contractor or consultant agreements (to avoid misclassification)
- Equity/option plans: grant letters, exercise terms, vesting schedules
- Internal policies: e.g., code of conduct, data security, remote-working
- HR registers (where required by law)
Layer 4: Privacy Layer (Data Protection & Compliance)
In almost every tech business, data flows through your stack. If you're dealing with personal data of EU residents, you must be compliant from day-one under the General Data Protection Regulation (GDPR).
What's in the Privacy Layer
- Privacy policy (clear, accessible)
- Cookie policy & banner (if you use tracking)
- Data-processing agreements (DPAs) with vendors/processors
- Data-transfer agreements (if data moves outside the EU)
- Internal data-protection procedures: mapping, retention, breach response
Layer 5: Commercial Layer (Revenue & Customers)
You ship product. Customers pay. Revenue flows. This is the commercial layer.
What's in the Commercial Layer
- Terms of Service or Terms of Use (ToS)
- Customer contracts or service agreements
- Subscription terms (if SaaS)
- Payment terms, refund and cancellation policies
- Supplier and vendor contracts
Summary: The Year-1 Legal Checklist
Here's a practical checklist to track your legal stack progress:
- Foundation: Incorporation complete, founders' agreement signed, cap-table maintained
- IP: IP assignments from all founders, NDAs ready, trademark filed
- People: Employment contracts for all employees, contractor agreements, equity plan
- Privacy: Privacy policy published, cookie consent, DPAs signed with vendors
- Commercial: ToS/Terms of Use live, customer contracts ready
Each layer builds on the last. Don't skip ahead.
