Ghosts in the machine: who really owns the IP in your commercial contracts?

Growth often means outsourcing: an agency may build your website, a developer may create software or a designer may shape your brand. But when someone outside your business creates something for you, who actually owns it?

Outsourcing brings valuable external skills into the business, but commercial and intellectual property (IP) strategies must move together. Effective ‘ghostbusting’ means finding hidden rights and dependencies before they disrupt the business.

The real ‘ghosts in the machine’ are the creators, subcontractors or technology providers whose rights or control sit outside the business’s reach. They may control an asset the business believes it owns and will often surface at the worst time: during a supplier change, product launch, investment round or sale.

Possessed, but by whom?

Paying for work doesn’t automatically transfer the IP. Under UK copyright law, the creator is usually the first owner. Work created by an employee as part of their job is the main exception and will normally belong to the employer.

An agency, consultant or contractor will therefore usually keep the copyright unless the contract says otherwise. Transferring copyright requires a written, signed agreement called an assignment. Without one, the customer may have only limited permissions, such as a licence to use the work. That licence may not support the business’s next commercial step.

What else is lurking in the machine?

A supplier may use material it already owns, known as ‘background IP’, to create new ‘foreground IP’ for the business. Bespoke software may combine new code with the supplier’s tools, third-party software or open-source code. If the product depends on those elements, owning the new code alone may be of little value.

Another ghost may be digital. If a third party hosts the website, software or data, who controls the passwords, backups and security arrangements? Could the business keep operating, recover from an incident or change supplier without their cooperation?

Generative AI creates another hidden risk. A supplier might enter confidential information into a tool, while the provider’s rules may restrict the use of its output. The contract should cover permitted tools, checks, reporting and responsibility for claims. Ownership on paper is little help if the work can’t be used safely.

While a business should own its key assets where possible, this may not be practical for everything it outsources. The key distinction is between ownership and practical control. The business should therefore have proper oversight, reliable access, clear rights and supplier assurances, as well as a plan for disruption or exit. Without these safeguards, lurking ghosts may threaten continuity and growth.

How do you exorcise the ghosts?

To keep the business running and growing, identify and deal with the ghosts before they surface:

• Audit key assets: record who created them and what agreements were signed
• Trace ownership: obtain assignments from anyone who still owns relevant rights
• Check outside materials: identify pre-existing, third-party and open-source content
• Match licences to the business plan: check whether the business can change, transfer, license or sell the asset
• Obtain supplier assurances: confirm the promised rights and responsibility for claims
• Plan for disruption: agree AI, cyber security, hosting, backup and exit arrangements.

Commercial and IP strategies should grow together. Effective ghostbusting means understanding where the business depends on others, securing the rights and access it needs and planning for disruption. Deal with the ghosts early, before they obstruct continuity or growth.

This article was drafter by Grant Heywood, Part Qualified Trade Mark Attorney.