I know a founder who found out his company didn’t own its own product. Not during a lawsuit. During due diligence, with a term sheet on the table. His co-founder had written the first version of the core pipeline before they incorporated, they never signed an IP assignment, and when the co-founder walked away, the code walked with him. Legally. The round died that week.
That story lives rent-free in my head, because it was a paperwork problem. Not a product problem. Not a market problem. Paperwork. The boring legal setup founders postpone until “after launch,” and then launch turns into fundraising turns into oh no.
Look, I’m not a lawyer, and this isn’t legal advice. Talk to a real startup attorney before you bet the company on anything here. But I’ve watched enough AI startups step on the same rakes to know which ones actually matter. This is the checklist I wish someone had handed me: the legal setup that protects an AI startup, in the order you should do it. Most of it costs under $2,000 and takes one focused week. The alternative costs… well, let’s not find out.
Quick note on where this fits: if you’re still figuring out starting an AI startup from scratch, do this checklist in parallel with building. Legal and product aren’t sequential. They’re simultaneous.
1. Form the Right Entity Before You Do Anything Else
The entity question has a boring, correct answer. If there’s even a chance you’ll raise venture capital someday, form a Delaware C-Corporation. VCs require it: preferred stock, option pools, and standard fundraising documents are all built for C-Corps. If you’re bootstrapping forever and never taking outside money, an LLC is simpler and the taxes are friendlier. But converting an LLC to a C-Corp later is possible the way root canal is possible. Technically fine. You’d rather not.
The good news: formation is a solved problem. Stripe Atlas charges a $500 one-time fee and handles Delaware incorporation, your EIN (tax ID), founder equity issuance, and even the 83(b) election filing we’ll get to in a minute. Their legal templates were built with Cooley LLP, a legit startup law firm, and more than 100,000 founders have gone through it. Two business days and you’re a real company.
A few things people get wrong at this step:
- Delaware franchise tax sounds scary and isn’t. The default calculation (Authorized Shares Method) produces a terrifying number. Every startup elects the Assumed Par Value method instead, which lands around $400 a year while you’re small. Don’t panic at the big number.
- Foreign-qualify in your home state. Incorporating in Delaware doesn’t exempt you from registering where you actually operate. It’s an extra filing, not an optional one.
- Open a separate bank account on day one. Commingling personal and company money is how you accidentally destroy your liability protection. Mercury, Brex, or a boring local bank. Just separate.
One genuinely good piece of 2026 news: FinCEN issued a final rule in August 2026 permanently exempting U.S. companies from beneficial ownership (BOI) reporting under the Corporate Transparency Act. After years of on-again-off-again chaos, that’s one federal filing you can cross off. The law firm breakdown of the final rule is worth a skim if you want the details.
And yes, what it really costs to launch includes this stuff. Formation is one of the cheapest line items on that list, which tells you something about priorities.
2. Get the Founder Paperwork Signed (Yes, Even With Your Best Friend)
Here’s the conversation nobody wants to have: “Hey, we’ve been working together for six months, let’s write down what happens if one of us quits.” It feels awkward. It’s also the highest-leverage awkward conversation in your company’s life.
The standard setup, and I mean standard enough that any startup lawyer will nod along:
- Founder vesting: 4 years, 1-year cliff. Nobody owns their full stake on day one. If a co-founder leaves after eight months, they leave with nothing vested, and the company isn’t held hostage by a ghost holding 40%. I’ve seen the handshake-split version of this. Two friends, 50/50, no vesting. One checked out in month seven. The other spent two years and a pile of legal fees buying back dead equity before any investor would touch the company.
- The 83(b) election: 30 days, no extensions, ever. When founders buy restricted stock at formation, you file an 83(b) with the IRS within 30 days of the stock issuance. Miss it and there’s no fix: you get taxed on every vesting chunk at its value when it vests. If the company 100x’s, you owe tax on money you never received. Mail it certified, keep the receipt, staple a copy to your tax return. This is the single most expensive piece of paper in startup law, and it costs a stamp.
- Write down roles and exit terms. Who’s CEO? Who can sign contracts? What happens on a co-founder departure, and what counts as a good vs. bad exit? Boring now. Priceless later.
3. Make the Company Own Every Scrap of IP
This is the one from my opening story, so let me be blunt: every founder signs an IP assignment agreement (usually called a PIIA or CIIA: Proprietary Information and Inventions Assignment). It assigns to the company everything each founder creates related to the business, including work done before incorporation. That pre-formation prototype? The weekend model experiments? The docs? All assigned, in writing, before money or momentum makes anyone reconsider.
Three IP traps that are specific to AI startups:
Prior employer and university claims
Read every founder’s old employment agreement. Some of them claim ownership of everything you invent, including nights-and-weekends work, sometimes for a period after you leave. Universities are the same with research done on their dime. An investor’s lawyer will ask about this in diligence. Find the answer before they do.
Training data rights
If your moat is a fine-tuned model, you need actual rights to the data you trained on. “We scraped it” is not a rights strategy. Licensed data, public domain data, data you collected with consent: fine. A pile of copyrighted material with a shrug: a lawsuit waiting for a plaintiff. This is also where open-source license contamination bites. Copyleft code in your training pipeline or your shipped product can infect your proprietary code. Audit it early.
Who owns the outputs?
Your terms of service should say explicitly who owns what your AI generates for users. Most major API providers assign output rights to the customer (you), and then your terms decide what your users get. Spell it out. Don’t leave ownership to vibes.
“If the company doesn’t own the IP, there is no company. Everything else on a legal checklist is fixable later. IP ownership is not.”
4. Protect the Brand Before Someone Else Does
Founders treat trademarks as a “later” problem, right up until a cease-and-desist arrives the week of launch. Do the cheap version now:
- Search first, fall in love later. Run your name through the USPTO trademark database before you print the t-shirts. If someone in your class of goods or services already owns something confusingly similar, find out now, not after you’ve built brand equity on a name you can’t keep.
- File early, even before revenue. You can file on an “intent to use” basis, meaning you don’t need to be selling yet. The base application fee is around $350 per class, and registration typically takes 12 to 18 months. The clock starts when you file, so filing early is free optionality.
- Lock the domain and handles simultaneously. The .com, the obvious social handles, the backup spellings. This costs almost nothing and prevents the most annoying form of extortion in business.
One honest caveat: descriptive AI names make weak trademarks. “AI-powered invoice thing” describes a product; it doesn’t distinguish yours. The more distinctive the name, the stronger the protection. Worth thinking about before you fall in love with the obvious one.
5. Paper Every Contractor and First Hire
Here’s a rule that surprises people: in the US, the person who creates the work owns it by default. Paying a freelancer does not transfer ownership. That developer you found on Upwork who built your landing page? They own the copyright to it unless a signed agreement says otherwise. The designer? Same. The “work for hire” doctrine that automatically assigns employee work to the employer generally does not cover independent contractors.
The fix is simple and non-negotiable: a signed IP assignment agreement before anyone writes a line of code or designs a pixel. Not after the invoice. Before the work. Every contractor, every advisor getting equity, every part-timer. One page, signed, filed. The number of startups I’ve seen discover their contractor owns their frontend during an acquisition… it’s not zero, and the acquirer’s lawyers always find it.
While you’re at it: advisors getting equity get small grants with vesting (a quarter point vesting over two years is plenty generous), and everyone with access to anything sensitive signs a confidentiality agreement. Standard stuff, but “standard” only works if it’s signed.
6. Privacy: Write a Policy That Matches Reality
Your privacy policy is not marketing copy. It’s a promise, and regulators treat broken promises as deception. The FTC has sued companies whose privacy practices didn’t match their privacy policies, and “we updated the code but forgot the policy” is not a defense. The rule is simple: write what you do, then do what you write.
What this means in practice for an AI startup:
- Know your regimes. GDPR applies if you have users in the EU. California’s CCPA/CPRA applies if you have California users and meet its thresholds. You don’t need EU offices for EU law to reach you. If you’re on the open internet, assume both apply eventually and build for them from the start. Retrofitting consent flows is miserable.
- Map where user data actually goes. Your servers, your analytics, your model API provider, your error tracker. Your policy should describe this accurately, and you should have data processing agreements with the vendors that touch personal data.
- Don’t train on customer data without clear opt-in consent. This is the AI-specific third rail. Using someone’s prompts, documents, or usage data to improve your models without explicit permission is the fastest way to turn a privacy policy into a lawsuit exhibit. If you want training rights, ask plainly and separately.
- Cookie consent for EU traffic. Yes, the banner is annoying. Yes, you still need it.
Real talk: most early-stage privacy work is just being honest and organized. A clear, accurate policy beats a 40-page template full of promises you don’t keep.
7. The EU AI Act Already Applies to Parts of Your Product
A lot of US founders still talk about the EU AI Act like it’s a future event. It’s not. It’s live, in phases, and the phase that matters most to startups is already enforceable. Here’s the timeline, straight from the European Commission’s official page:
- February 2025: prohibited practices banned outright. Social scoring, manipulative or subliminal AI, untargeted facial-recognition scraping. If your product does any of these, stop.
- August 2025: obligations for general-purpose AI model providers took effect. If you’re building on APIs from the big labs, this is mostly your provider’s problem. If you’re training your own foundation model, it’s yours.
- August 2026: Article 50 transparency obligations are live right now. Tell users they’re interacting with AI. Label AI-generated content as AI-generated. Fines run up to 15 million euro or 3% of global annual turnover for breaches. This is the deadline that catches startups off guard.
- December 2027: high-risk system obligations (hiring tools, education, biometrics, critical infrastructure) were deferred here by the Digital Omnibus. If you’re building in a high-risk category, you have runway, but the requirements (risk management, documentation, human oversight, logging) take real time to build.
The practical version: put an AI disclosure in your chatbot (“you’re chatting with an AI assistant”), label AI-generated images and text where users might mistake them for human-made, and check whether your use case falls in a high-risk bucket. That’s 80% of startup compliance with this law, and it costs an afternoon.
8. Don’t Let Your Marketing Write Checks Your Model Can’t Cash
The FTC has a phrase every AI founder should memorize: “keep your AI claims in check.” It’s from their 2023 guidance, and the message hasn’t softened since. If your landing page says “95% accurate,” you need real substantiation for that number, from real testing, under the conditions you’re advertising. Not a benchmark you ran once on a friendly dataset. Not a vibe.
The enforcement record is worth knowing. In September 2024 the FTC ran Operation AI Comply, five simultaneous enforcement actions against companies using AI hype to mislead customers. Fake review generators, bogus earnings claims, the works. Then in August 2026, the Air AI action extended the same principle to B2B marketing: deceptive claims about business growth and earnings potential aimed at small businesses. The message is consistent across consumer and B2B: AI claims get extra scrutiny, not less.
Three rules that keep you out of trouble:
- Substantiate every performance claim. Accuracy numbers, “better than” comparisons, speed claims. If you can’t prove it with testing data, don’t print it.
- You can’t blame the model. “The third-party API hallucinated, not us” is explicitly not a defense. If you ship it, you own what it does. Test accordingly.
- No fake social proof. AI-generated reviews presented as real customer reviews are deception, full stop. The FTC’s stance here is about as subtle as a fire alarm.
This pairs naturally with getting your AI startup’s marketing working in the first place. Growth tactics are great. Growth tactics built on claims you can’t defend are a liability with a marketing budget.
9. Terms of Service That Cover AI Weirdness
Standard SaaS terms assume deterministic software. Your AI product is not deterministic software. Your terms need a few AI-specific clauses on top of the usual (payment terms, acceptable use, termination rights):
- An AI accuracy disclaimer. The product can be wrong. Outputs should be verified. It’s not professional advice, especially for legal, medical, or financial use cases. This won’t save you from everything, but its absence will hurt you.
- Clear data-use terms. What happens to user prompts? Are they used for training? Stored? For how long? Say it plainly, in language a human can parse.
- A liability cap and sensible dispute terms. Cap damages at what the customer paid you (standard), pick a dispute resolution path, and reserve the right to terminate abusive accounts. You will eventually need that last one. AI products attract prompt-injection hobbyists like porch lights attract moths.
Getting this right means your site, your terms, and your data flows are designed coherently from day one instead of duct-taped together after your first enterprise prospect asks for your security questionnaire. If you’d rather have specialists handle that foundation, our web development studio AISquadX builds product sites with compliant architecture baked in from the start.
10. Insurance and the Boring Paperwork Nobody Posts About
Last category, and it’s the least glamorous: tech E&O (errors and omissions) insurance and cyber liability insurance. E&O covers you when your product fails a customer and they sue for the damages. Cyber liability covers data breaches and security incidents. Neither is expensive at early stage, and enterprise customers will ask for proof of both before signing anything serious. D&O (directors and officers) insurance comes after you raise; investors will require it.
And the truly boring stuff that still matters: real accounting from month one (not a spreadsheet you’ll “fix later”), state tax registrations where you have nexus, annual reports and franchise tax filings on a calendar someone actually checks. None of this is intellectually demanding. All of it is expensive to reconstruct retroactively.
One thing I’d add before you spend a dollar on any of this: validate your AI startup idea first. Legal setup protects a business. It doesn’t create one. The order is: idea worth protecting, then protection.
Frequently Asked Questions
Do I really need a lawyer, or can I DIY this with Stripe Atlas and templates?
Stripe Atlas genuinely covers formation well: entity, EIN, equity issuance, 83(b). Templates cover the standard stuff. Where you need a real startup lawyer: founder disputes, prior-employer IP claims, regulated industries (health, finance, anything with kids), and your first priced round. A few hundred dollars for a document review now beats tens of thousands to unwind a mess later. This article is education, not advice, and it’s not a substitute.
LLC or C-Corp for my AI startup?
If you might ever raise venture capital: C-Corp, Delaware, done. VCs structurally require it. If you’re bootstrapping indefinitely and want simpler taxes: LLC. The painful middle is starting as an LLC, succeeding, and converting under time pressure during a fundraise. Pick based on the future you’re actually building toward.
What actually happens if I miss the 83(b) deadline?
There’s no late filing, no extension, no fix. Without the election, each chunk of your founder stock is taxed as ordinary income at its fair market value when it vests. If your $400 of founding stock is worth $400,000 by the time it vests, you owe tax on $400,000 of income you haven’t received in cash. File within 30 days of issuance, certified mail, keep the receipt.
I’m US-based with no EU users. Does the EU AI Act matter to me?
If you genuinely have zero EU users, the Act doesn’t apply to you. But “no EU users” is a brave claim for anything on the open internet, and the transparency duties (disclose AI, label AI content) are cheap to implement and good practice everywhere. Build them in now; they’re the same disclosures US users increasingly expect anyway.
Who owns what my AI generates for users?
It depends on two documents: your model provider’s terms and your own terms of service. Most major API providers assign output rights to you, the customer. Your terms then decide what rights your users get. Spell it out explicitly in both directions: what users own, what you can use, and what happens on cancellation. Ambiguity here becomes a dispute the moment anything valuable is generated.
The Bottom Line
Here’s the whole checklist in one paragraph: form a Delaware C-Corp, vest founder equity over four years with a one-year cliff, file the 83(b) within 30 days, assign every scrap of IP to the company, search and file your trademark early, paper every contractor before they start, write privacy terms that match reality, disclose your AI under the EU AI Act, substantiate your marketing claims, cap your liability in your terms, and carry E&O and cyber insurance.
That’s one focused week and under two grand. It removes an entire category of startup death: the kind where the product worked, the market showed up, and the paperwork killed it anyway. Do the boring stuff now, while it’s cheap and nobody’s watching. Then go build the interesting stuff.
