Key market developments in IT outsourcing include:

• the proliferation and near dominance of artificial intelligence-based technologies (primarily generative and agentic) across nearly all types of transactions;
• a shift from labour-centric agreements to platform- or solution-based agreements;
• continued shift of physical IT assets to cloud environments and from software programs to Software-as-a-Service (SaaS) environments; and
• the digital transformation of traditional business data flows into revenue-generating products and analytical tools, as buyers of services continue to focus increasingly on the Internet of Things (IoT) and the transformation of their businesses into digital offerings.

From a legal perspective, these new technologies and approaches continue to disrupt the traditional sole-source mega agreement model, by shifting the focus away from human labour and toward various forms of technology, most notably, artificial intelligence. As a result, more providers are competing for and providing smaller chunks of services, with more demand being placed on client procurement departments.

Of the above-mentioned factors, the proliferation of artificial intelligence across all forms of technology transactions is currently having the most significant impact on providers and customers. The following are among the other issues arising in this context.

• IP ownership in generative AI and agentic AI outputs and learnings remains a “hot button” issue, as many cases litigating ownership of the various outputs continue to work their way through the courts.
• Litigation arising from the training of large language models continues to make headlines, with over a billion-dollar settlement recently reached with one of the foundational AI providers.
• AI models may have been trained on “biased” models or models that are overly reliant on data without additional context, thereby increasing the potential for discriminatory hiring practices.
• Privacy concerns are also front-of-mind as concerns grow over the potential of AI models to “scrape” personal information and use it in a manner not intended by the data subject.
• Given the potential for these technologies to remove the “human” element from the workforce, there may be personnel issues for HR to review.
• Agentic AI involves the most autonomous form of AI that is commercially available, so identifying and adequately describing outside limitations and liability for exceeding those limitations are paramount. This is particularly true given recent news that a foundational AI provider’s AI model, without human intervention, escaped a controlled test environment and accessed a client’s environment.

Key market developments in BPO include:

• increased use of technology for the delivery of services, with provider personnel serving in more of a support role;
• swings in emphasis between value/innovation and cost savings, depending on industry-specific conditions and opportunities; and
• an increased focus on chat bots and social media as the primary tools for communicating with customers.

From a legal perspective, these developments present issues that are unique to the outsourcing market, but not necessarily unique to technology lawyers.

The use of various forms of AI in the BPO market presents similar issues to those noted in respect of IT outsourcing market developments (see 1.1 IT Outsourcing). Not surprisingly, the business processes most likely to be outsourced at the moment are legal, tax, HR, finance, and manufacturing/procurement. Why? Because these processes also represent areas that are ripe for increased efficiency through the use of AI. Of course, the use of AI does not come without risk, particularly in these areas. False case citations have already resulted in the suspension of attorneys in the litigation space. Multiple lawsuits are currently underway as a result of alleged biased hiring practices due to AI filtering out resumes of minority candidates. Human interaction, review and observability are paramount when outsourcing critical functions.

As companies increase their presence on – and use of – social media, they open themselves up to potential exposure in a more public and less controlled environment in the following ways.

• Managers of social media websites may inadvertently post proprietary or confidential information.
• Customer complaints are now more public and companies risk a “piling on” of complaints.
• Customers may post proprietary, defamatory or harassing information on a company’s social media site. In addition, companies must be aware of the unique terms applicable to each social media platform, as the companies’ rights and obligations vary by platform.

Similarly, the use of chat bots is exploding in the outsourcing space. Outside of legally required disclosures when introducing others to chat bots, who is responsible for the advice they give? Are humans confirming the advice they give? Practitioners must be cognisant of these and similar issues, and ensure that they are appropriately addressed in the governing documents.

The impact of new technology is most evident in the IT workforce. Low-skilled workers across all industries are being replaced by various forms of technology that are able to perform the same tasks as those workers more cheaply, without sick days, without raises and without vacations. Low-skilled workers are feeling the brunt of these new technologies, in addition to more restrictive immigration policies being used to prevent lower-skilled workers from entering the USA. However, higher-skilled workers tasked with the development and management of such technologies (eg, developing platforms for the cryptocurrency market) have greater opportunities.

As various industry leaders contemplate using provider AI offerings to optimise their core competitive advantages, negotiations over IP ownership now involve much higher stakes. Customers are concerned that their leadership positions will be eroded if their highest-value IP is shared and then incorporated into AI engines that are resold to their competitors or, worse, commoditised and distributed to thousands of users. Providers worry that the value of their innovations will be lost to customer-imposed restrictions or endless, complex IP battles. There does not currently appear to be a “one-size-fits-all” solution to managing AI risk. Instead, most advisers are advising clients to analyse each AI offering on a case-by-case basis and in the unique context in which it will be deployed.

The metaverse continues to scratch and claw its way along, surviving and adapting to change. The metaverse is no longer considered mainstream, and is somewhat dominated by gamers, users of virtual reality hardware, and “citizens” of blockchain-based virtual worlds. Nonetheless, the projected market for the metaverse remains in the hundreds of billions of dollars.

The most commonly outsourced services in the USA are:

• IT;
• HR;
• call centre;
• procure-to-pay/procurement;
• legal;
• service desk;
• accounting;
• security;
• facilities management;
• logistics;
• social media design/marketing; and
• web design/development.

IT encompasses a broad range of services, including application development/maintenance, data centre outsourcing, and SaaS/cloud/hosting services.

Private Sector

Despite law-makers’ efforts to pass sweeping legislation to regulate offshore outsourcing, there is currently no overarching federal framework in the USA that governs all outsourcing arrangements in the private sector. However, both federal and state law-makers continue to introduce legislation to discourage offshore outsourcing. For example, a federal bill, the “Keep Call Centers in America Act of 2025”, proposes to disqualify certain USA call centre providers that relocate their call centre operations to locations outside the USA from federal grant and guaranteed loan programmes, and to introduce civil penalties if they fail to self-report such relocation. While the bill is poised to lapse at the end of the 119th Congress, New York and New Jersey have enacted similar laws that penalise businesses that move call centres to offshore locations. Several other federal bills introduced in 2025 and intended to discourage offshore outsourcing are also stalled in the legislative process. The Halting International Relocation of Employment (HIRE) Act, for example, which was introduced in October 2025, would significantly increase the cost of outsourcing for USA companies, if enacted. The Hire Act proposes a 25% excise tax on outsourcing payments for services ultimately benefitting USA consumers and prohibiting corporate income tax deductions for such payments, with the proceeds directed to a domestic workforce fund. As of September 2026, the HIRE Act has not advanced beyond the Senate Finance Committee and its prospects remain uncertain.

The regulatory environment overlaying the outsourcing industry has also been impacted by actions taken in other areas of government. The Presidential Proclamation 10973, signed in September 2025, imposed a temporary supplemental fee of USD100,000 on most new H-1B petitions for certain workers outside the USA and directed the Department of Labor to raise prevailing wage levels for H-1B workers. Since a substantial percentage of H-1B visas issued each year are typically sponsored by IT services and staffing companies, the Proclamation threatened to disrupt the economics of outsourcing arrangements that rely on H-1B visas to place offshore personnel in USA service locations. Although the Proclamation was effectively blocked by a decision by the First Circuit as of 8 June 2026, and the Proclamation itself expired on 20 September 2026, a similar fee on H-1B visas has already been proposed by a different rule-making body. On 25 August 2026, the Department of Homeland Security (DHS) published a notice of proposed rulemaking soliciting comments on a new rule concerning requiring payment of a USD103,265 fee on H-1B petitions at the time of filing, which would apply to an even broader group of foreign workers and on a more permanent basis. Whether the new rule will ultimately survive future legal challenges remains to be seen. In the meantime, we can expect that outsourcing providers will respond with significant changes to their staffing models, including shifting further towards offshore and nearshore delivery for routine work and reserving onsite roles for senior personnel, and that customers who demand onshore staffing models will ultimately bear any visa-related cost increases.

As discussed in 2.2 Industry-Specific Restrictions, certain regulated industries – such as the financial services, energy, insurance and healthcare industries – are subject to federal and state regulatory frameworks that extend to the regulated entities’ third-party vendor relationships, including outsourcing arrangements. Generally, regulated entities that outsource operational responsibility of regulated functions to third-party vendors continue to be primarily responsible for compliance with those laws.

Public Sector

Public contracts are highly regulated at the federal, state and local levels. In addition to explicit restrictions on the performance of certain government functions by non-government employees and offshore resources, the highly complex public contract framework imposes onerous solicitation, review and approval procedures on government outsourcing initiatives. Even where offshore outsourcing is not prohibited outright, these requirements often have the practical effect of restricting large outsourcing arrangements in the public sector. Public contracts are often subject to scrutiny by elected officials, watchdog organisations, consumer groups and the media, which can complicate and delay negotiations.

Financial Services

In the USA, various state and federal regulators oversee financial institutions and other financial service companies through a system of functional regulations. Financial regulators have issued interpretative guidance regarding outsourcing to third parties. For decades, prudential regulators have charged banks with establishing and maintaining risk management practices – designed to ensure the safety and soundness of their activities and protect consumers – that are commensurate with the level of risk involved. The application of these practices extends not only to the bank’s own activities but also to those of any third party engaged by the bank, including outsourcing providers. The Consumer Financial Protection Bureau (CFPB) historically enforced third-party risk management guidance embodying similar principles on certain non-banks in the consumer financial markets, including mortgage originators, mortgage servicers, and private lenders.

In May of 2025, the CFPB withdrew 67 guidance documents, including interpretive rules, policy statements and advisory opinions, dismissed the majority of its pending enforcement actions, and sought to reduce its workforce by more than two-thirds. As a result, federal supervision of non-bank consumer financial companies’ third-party relationships has been significantly reduced, and state attorneys general and state banking regulators have moved to fill the gap through co-ordinated investigations and enforcement actions. The practical consequence is that vendor oversight expectations for non-banks are increasingly being set at the state level and vary by jurisdiction.

As of June 2023, the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) (the “Agencies”) jointly released guidance on the effective management of risks associated with third-party relationships by banking organisations. The resulting Interagency Guidance on Third-Party Relationships: Risk Management (the “Interagency Guidance”) identifies key drivers of risk in a banking organisation’s business arrangements with third parties, including outsourcing providers, and the strategies for managing these risks. On 11 September 2026, the Agencies published proposed rules for comment and announced that the Interagency Guidance would be rescinded and replaced with new guidance focused on tailoring risk management practices to the level of risk involved. Comments to the proposed rules are due on 10 November 2026.

In addition to the interpretative guidance issued by financial regulators, financial service companies are subject to a wide range of substantive laws and regulations governing their day-to-day activities and operations that would continue to apply to such companies, even if those activities and functions are outsourced to third-party outsourcing providers. These laws and regulations may include requirements addressing data protection, cybersecurity, anti-money laundering, auditing and reporting, securities, consumer protection and other regulated activities.

In addition, the final phase of the November 2023 amendments to the New York Department of Financial Services (DFS) Cybersecurity Regulation (23 NYCRR Part 500) took effect on 1 November 2025, requiring covered entities to implement multi-factor authentication for all individuals accessing their information systems – including third-party service provider personnel – and to maintain a comprehensive asset inventory. Because the regulation reaches service provider access as well as the covered entity’s own personnel, outsourcing agreements with DFS-regulated banks, insurers and other licensees increasingly contain prescriptive multi-factor authentication, privileged access management and asset-inventory obligations, together with 72-hour cybersecurity event notification and annual certification support obligations.

Healthcare

Within the healthcare industry, outsourcing is impacted by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), which seek to ensure the privacy and security of protected health information (PHI). HIPAA and HITECH (and their implementing regulations) impose significant and onerous obligations, including compliance with HIPAA’s Privacy and Security Rules, on:

• “covered entities” – ie, health plans, health clearing houses and healthcare providers that transmit any health information in electronic form in connection with a covered transaction; and
• their “business associates” – ie, vendors of covered entities with access to PHI that perform certain functions on behalf of such covered entities.

When entering into outsourcing arrangements with business associates, covered entities are required to enter into written agreements (in the form of business associate agreements) that protect the use and security of PHI. Under HITECH, business associates may be subject to direct civil and criminal penalties imposed by regulators and state authorities for failing to protect PHI in accordance with HIPAA’s Security Rule.

In addition to the federal HIPAA and HITECH, many states have enacted state healthcare laws governing the use of patient medical information. Although the federal HIPAA pre-empts any state law that provides less protection for PHI, state laws that are more protective will survive federal pre-emption.

On 6 January 2025, the US Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) published the proposed overhaul of the HIPAA Security Rule – which would strengthen cybersecurity protections for electronic PHI, through prescriptive and transformational security controls and processes. Among other things, the proposed rule mandates encryption of electronic PHI at rest and in transit and multi-factor authentication, requires annual technology asset inventories and network maps, annual penetration testing and semi-annual vulnerability scanning, imposes a 72-hour restoration requirement for critical systems, and requires business associates to verify their technical safeguards to covered entities annually and to notify them within 24 hours of activating a contingency plan. Following the public comment period, HHS pushed back the release date of the final rule by more than a year and expects to issue a final rule in July 2027. Despite the delay, industry members, including their service providers, are already incorporating the proposed standards – in particular encryption, multi-factor authentication, asset inventory and contingency-plan notification obligations – into business associate agreements and the security schedules of IT and BPO agreements, with a corresponding effect on the service provider’s cost of compliance.

Insurance

The insurance and reinsurance industry has continued to outsource a variety of functions, as well as implement emerging technologies that are designed to decrease costs and improve the efficiency of outsourced insurance functions. Outsourced functions often include:

• insurance and reinsurance accounting services;
• actuarial analytics;
• underwriting analysis;
• insurance policy and endorsement drafting and processing;
• claims reporting and handling;
• business process management;
• insurance software development;
• data entry; and
• customer service.

Companies in the insurance space – whether policyholders, captive insurers, insurers, agents, brokers, intermediaries or others – looking to outsource insurance functions in the USA face unique challenges because, unlike many other industries, insurance in the USA is primarily regulated at the state level. As a result, there is a patchwork of rules that may vary from state to state and may affect insurance outsourcing operations.

Insurance regulators have, however, converged on a common baseline for cybersecurity and third-party oversight. The NAIC Insurance Data Security Model Law (Model #668) – which requires persons licensed, authorised or registered under state insurance laws to maintain a written information security programme to protect non-public information, to exercise due diligence in selecting third-party service providers, to require those providers by contract to implement appropriate safeguards, and to establish an incident response plan that includes notifying the state insurance commissioner of a cybersecurity event within 72 hours – has been adopted in some form in at least 28 states as of 2026.

Energy

In the energy and utility sector, regulated entities must comply with the Critical Infrastructure Protection (CIP) Reliability Standards, which are mandatory proactive cybersecurity requirements issued and enforced by the North American Electric Reliability Corporation (and its subsidiary regional entities) and overseen and backstopped by the Federal Energy Regulatory Commission. The CIP standards are designed to protect and secure cyber-assets associated with critical assets that support North America’s power grid, the Bulk Power System. All owners, operators and users of the bulk power system (which may include both public and investor-owned utilities, generation and transmission co-operatives, and non-utility owners and operators of electric power generation) and transmission facilities are required to comply with the CIP standards.

A CIP compliance issue may arise in the context of outsourcing when a regulated entity outsources its IT infrastructure or those business processes that involve access to critical cyber-assets (eg, monitoring and maintenance functions). Regulated entities may run into challenges when choosing foreign outsourcing providers, even if the outsourcing agreement contains robust contractual obligations around compliance with the CIP standards.

Failure to comply with the CIP standards may result in fines and penalties of up to USD1 million per violation per day.

The CIP standards themselves were revised significantly in 2026, and several of the changes bear directly on outsourced IT and managed services. For outsourcing counsel, these changes mean that IT outsourcing and managed security service agreements with registered entities must now address internal network monitoring and log retention, vendor remote access controls (including multi-factor authentication and the ability to disable access), supply chain risk disclosures and, where cloud or virtualised infrastructure is used, the specific CIP controls applicable to shared environments. Registered entities remain solely responsible for compliance and should ensure that contractual audit rights, evidence-production obligations and remediation commitments are sufficient to support CIP audits.

As a general matter, the USA does not have a comprehensive federal data protection law. Rather, there are many sources of privacy and data security laws at the state, federal and local levels.

Federal Requirements

At the federal level, the different privacy and data security requirements tend to be sectoral in nature and apply to different industry sectors or particular data-processing activities. By way of an example, Title V of the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to ensure the security and confidentiality of the non-public personal information they collect and maintain. As part of its implementation of the GLBA, the Federal Trade Commission (FTC) issued the Safeguards Rule, which requires financial institutions to implement reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of non-public personal information and imposes certain security incident notification obligations on financial institutions.

Another key example is HIPAA, which was enacted to help ensure the privacy and security of PHI, as discussed in 2.2 Industry-Specific Restrictions. Industry standards are also relevant. By way of an example, the Payment Card Industry Association’s Data Security Standard specifies requirements for relationships between companies and their vendors that process cardholder data. Although industry standards do not generally have the force of law, they may help inform what is deemed “reasonable” security under applicable information security laws.

Another example at the federal level is a Department of Justice (DOJ) rule finalised in 2025 that imposes certain prohibitions and restrictions on access to certain data by “countries of concern” or “covered persons”. The rule is aimed at restricting access to “bulk U.S. sensitive personal data” and “government-related data” to protect against risk to US national security.

State Requirements

In addition to federal requirements, a number of states have enacted laws requiring organisations that maintain personal information about state residents to adhere to general information security requirements. California’s information security law requires businesses that own or license personal information about California residents to implement and maintain reasonable security procedures and practices to protect the information from unauthorised access, destruction, use, modification or disclosure. Additionally, information security laws in Massachusetts and Nevada impose more prescriptive requirements on organisations with regard to the processing of personal information.

All 50 states, plus DC, Guam, Puerto Rico and the Virgin Islands, have adopted legislation requiring notice to data subjects of certain security breaches involving personally identifiable information. Companies that have outsourced data-processing tasks to vendors remain responsible for security breaches by those vendors. As a result, outsourcing contracts usually address these issues in some detail, including extensive security requirements, reporting and audit obligations, incident notification and response obligations, and carefully constructed limitations of liability and indemnities. Customers seek to allocate these risks to providers, arguing that – as the providers manage and secure the IT and other infrastructure that is involved in the incident – risk and liability should sit with the provider.

Providers attempt to avoid liability for security breaches not caused by their breach of contract and to strictly limit their financial liability for those resulting from their fault. As providers have insisted on limiting their liability, many customers have sought their own insurance coverage for these risks.

The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, requires covered businesses to provide a number of rights to California consumers, including with regard to accessing, deleting, correcting and opting out of the sale of personal information or sharing personal information for purposes of cross-context behavioural advertising. In September 2025, regulations were finalised and approved under the CCPA that impose three new categories of compliance obligations:

• mandatory privacy risk assessments for processing activities that present a “significant risk” to consumer privacy (such as the selling or sharing of personal information, the processing of sensitive personal information, the use of automated decision-making technology for significant decisions, or other high-risk processing);
• annual independent cybersecurity audits for certain businesses; and
• obligations related to the use of automated decision-making technology (ADMT) for significant decisions about consumers.

The risk assessment requirements took effect on 1 January 2026. For processing activities already underway before that date, initial assessments must be completed by 31 December 2027, with initial attestations and summary risk assessment information submissions to the CPPA due by 1 April 2028. The cybersecurity audit certification deadlines are to be phased in beginning 1 April 2028. The ADMT requirements take effect on 1 January 2027. As a practical implication for outsourcing engagements, these obligations highlight the importance of ensuring that service provider agreements obligate the service provider to assist with compliance, including co-operation with risk assessments and cybersecurity audits.

As discussed in 4.5 Data Protection and Cybersecurity, the CCPA also includes requirements for different types of contracting parties, including “service providers” and “contractors”.

In addition, nearly half of the other states have enacted comprehensive data privacy laws that provide rights to residents of their respective states, including as to access, deletion, correction, and opting out of the sale of personal information and targeted advertising. These laws require contracts between “controllers” and “processors”, which must include certain provisions. Under these laws, a controller is the party that determines the purpose and means of processing the personal information, whereas a processor is the party that processes the personal information on behalf of the controller. Many of these laws also include requirements when sharing de-identified data. Notably, Connecticut amended its comprehensive data privacy law in 2025 to require controllers to disclose in their privacy notices whether personal data is collected, used, or sold for the purpose of training large language models (LLMs). This amendment underscores the importance of addressing AI- and LLM-related data uses in contracts that involve the processing of personal data. Without clear contractual terms governing whether and how a processor may use personal data for LLM training, controllers may be unable to make accurate disclosures in their privacy notices.

Companies in the USA also self-impose limits on the collection, use and sharing of personal information through representations made in privacy policies. Companies are held accountable to these representations through state and federal consumer protection laws.

Typically, outsourcing agreements take the form of a master agreement and accompanying statements of work – all of which are heavily negotiated. The master agreement provides an overall structure that should include provisions that are sufficiently detailed to cover a range of services, from long-term IT outsourcing services to one-off consulting projects. It usually includes a basic service-level methodology, security and data protection provisions, and legal terms of general application (such as compliance with laws, limitations of liability, indemnities, and dispute resolution). The statements of work include detailed statements of services, specific service-level commitments, pricing methodologies and any other terms that are unique to the services. It is important to note that many of these standard outsourcing agreements are being revisited to more appropriately govern a technology solution or platform that serves as a hub around which human resources operate and support the broader services relationship.

Agreements Covering Multiple Jurisdictions

Where multiple jurisdictions are involved, the master agreement typically provides a framework for local country agreements to be entered into between local affiliates. This may take into account payment using local currencies (including associated allocation of currency risk), unique IP or labour provisions, specific compliance issues involving local laws, and any country-specific enforcement requirements. Also, because the markets tend to reward software revenues with higher share price multiples than services revenues, providers continue to shift revenue from services-only agreements to services agreements coupled with separately priced and separately negotiated software licences.

Multi-Sourcing

While highly consolidated “mega” deals (ie, a single contract with a single vendor who provides the full suite of IT services to the customer) are still frequently negotiated, multi-sourcing remains the primary contracting model for most customers. Under a multi-sourcing model, customers engage multiple vendors (through individual contracts) to collectively provide the full suite of IT services desired by the customer. The multi-sourcing model permits customers to mix and match “best of” technologies provided by unrelated vendors in order to achieve a more optimal IT environment. This model is not without problems, however, as successfully integrating products offered by different vendors can be a challenge and more cooks in the kitchen can result in finger-pointing if there is an issue.

Shared Service and Global Business Services Models

Research also indicates that customers have generally increased their investments in various shared services and global business services (GBS) models. This trend reflects broader trends in the outsourcing and IT services market, including a collective desire for increased automation, standardisation of tools and processes, scalability, and the management of data as a strategic asset. By centralising services in a shared service centre and increasing the variety of those services by centralising into GBS models, customers may more easily adopt and implement these solutions at an enterprise level, rather than on a business-unit-by-business-unit basis. The adoption of hybrid shared services models (ie, those involving a third-party business processor) also continues to increase.

This particular trend is due to customers realising that there are certain areas of expertise and technologies that are still better performed by third-party vendors who specialise in those areas. Whether adopting a shared services model or a hybrid, contracts governing the provision of services must focus on accountability, quality of services and outputs. Of course, hybrid models including third parties involve risks not necessarily present in a purely in-house shared services model, and those risks should be mitigated as they ordinarily would be in a transaction involving a third-party provider. However, the impact of the COVID-19 pandemic on traditional delivery models knocked down many of the barriers associated with shared services and GBS models that previously caused customers to be hesitant in their adoption.

Captive Deals

While there has been a small handful of captive deals recently, adoption of captives appears to be on the decline. As with shared services models, the decline in the provision of services through captives appears to reflect broader trends in the outsourcing market, including a focus on value-over-cost savings, a reluctance to invest in owned IT assets, and policies of the current administration that favour retention and use of onshore resources. The inability to manage growth effectively and provide opportunities for employees within the captive model also continues to negatively impact the adoption of those models for customers. Contracts governing the creation and management of captives are far more complex than typical outsourcing arrangements and customers should be made aware of the legal risks and transaction costs associated with the adoption of this model upfront.

Build-Operate-Transfer (BOT) Deals

After peaking nearly two decades ago, BOT transactions continued to grow over the last 12 months. In a BOT transaction, the customer engages a provider to build a Global Capability Centre (GCC) in a desired area of expansion; the provider builds the GCC and operates the GCC on behalf of and for the sole benefit of the customer for an agreed period of time. Once that period of time expires, the provider transfers the now fully functioning operations centre to the customer. This approach allows customers to save capital costs and transition headaches on the front-end, while establishing and later receiving a fully functional GCC. For US practitioners, it is imperative to partner with strong “on-the-ground” resources physically located within the country of the GCC, as many of the most critical issues are governed by local law and practice.

Other Approaches

Unique situations are sometimes addressed with alternative structures, such as joint ventures (often in the form of contractual joint ventures but sometimes involving equity investments). These are highly negotiated responses to special commercial circumstances and are much less common in the market.

In response to the COVID-19 pandemic, companies around the world increased overall investments in remote work technologies and have undergone – or are in the process of undergoing – a complete digital transformation. In the process, many have adopted several of the models discussed in 3.2 Alternative Contract Models, using each to complement the other. There has been an increase across the board (albeit less so with captives) in companies returning to outsourced service models complemented by a shared services centre (often using third-party providers) or a GBS model, where on-site employees are no longer necessary or desirable, and where remote delivery is preferred.

As a result, providers are restructuring their commoditised outsourcing offerings to be delivered “-as-a-Service”. In such cases, the delivery and pricing models assume that there is little variation in the services, service levels, and the related risk allocations and contract terms. Accordingly, the service agreements are standardised and the providers are reluctant to negotiate terms. Customers will often hear that the services will be delivered using a “one-to-many” delivery model, which is the provider’s way of indicating that it is unwilling to make certain concessions that may be specific to that particular customer.

Protections for customers in outsourcing agreements come in many forms. The main protections for customers come in the form of:

• indemnification obligations;
• representations and warranties (eg, performance, malware/disabling code, and services not to be withheld (“no abandonment”));
• confidentiality and data security obligations;
• service levels;
• market currency provisions;
• disputed charges provisions;
• additional services provisions;
• cover services provisions; and
• detailed service definitions and gap-filler or “sweeps” clauses.

Indemnification Obligations

The claims covered by a party’s indemnification obligations are often the subject of intense negotiations. Typical indemnification obligations requested by the customer include:

• IP infringement/misappropriation (covering not only the supplier’s services and the customer’s use thereof but also all items and materials used by the supplier in the delivery of the services, including AI and the output created by AI);
• personal injury and property damages;
• violation of law;
• gross negligence and wilful misconduct;
• breach of confidentiality and data security;
• claims by the provider’s personnel; and
• tax liabilities of the provider.

Outsourcing providers may request reciprocal indemnities, although not every indemnity should be reciprocal in light of the asymmetrical relationship. Indemnities typically cover only third-party claims (and all of the losses associated therewith); claims by the customer for the provider’s breach are typically remedied through breach of contract actions.

Remedies

Remedies for breaches of representations and warranties are typically in the form of defect remediation and damages – although certain representations and warranties, such as services not to be withheld, include additional remedies such as injunctive relief. Remedies for breaches of confidentiality and data security typically take the form of damages (including notification-related costs) and injunctive relief. Remedies for service-level failures typically take the form of financial credits (which are not generally exclusive remedies and can sometimes be “earned back” by the provider) and termination rights.

Cost-Related Protections and Scope

“Market currency” provisions (eg, benchmarking) generally require the provider to make price concessions based on the results of a benchmarking or other market comparison and could result in a no-fee or low-fee termination right if the provider does not make those price concessions. “Disputed charges” provisions usually allow the customer to withhold payment for invoicing errors or deficient performance of services. “Additional services” provisions typically require the provider to perform out-of-scope but related services at a commercially reasonable price. “Cover services” provisions require the provider to cover the difference between the provider’s fees and a replacement provider’s fees when the original provider is unable to perform the services due to such things as a disaster or other force majeure event.

“Sweeps” clauses typically require the provider to perform all services that are an inherent, necessary or customary part of the services specifically defined in the agreement, as well as all services previously performed by any displaced or transitioned employees. However, detailed scope definitions tend to be the best defence against misunderstandings over the work to be done.

The customer typically has a myriad of reasons to terminate an outsourcing agreement. For example:

• material breach;
• persistent breach;
• convenience;
• data security breach;
• extended force majeure events;
• service-level termination events;
• insolvency of provider;
• regulatory changes;
• transition failures; and
• change of control of provider.

The provider, on the other hand, is generally only able to terminate for non-payment of material amounts.

Customers also require robust exit protections. These protections generally take the form of termination assistance, which often includes continued performance of the services for a period of time in order to allow the customer to transition the services either back in-house or to another provider, as well as other exit activities (eg, knowledge transfer, or return of data). Exit protections can also include rights to the provider’s equipment, software, personnel and facilities.

The parties’ liability exposure under an outsourcing agreement is often limited both by type and amount. Agreements typically provide that damages are limited to, among other things, actual “direct” damages (ie, no consequential or indirect damages). The amount that can be recovered – as well as whether such amount will serve as an aggregate cap on liability – tends to be heavily negotiated. The limit is usually defined as a multiple of monthly charges typically ranging from 18 to 36 months. In those agreements where the liability cap is not a per claim cap, a liability cap reset concept is generally included. These can take many forms – the most common being annual/biannual liability caps and the inclusion of a termination right in favour of the customer if the provider refuses to reset back to zero the damages that have contributed to the cap after the damages sustained by the customer have reached a certain percentage of the cap.

Exceptions to the consequential/indirect damages waiver and damages cap are also subject to intense negotiation. Typical exceptions include indemnification claims, gross negligence and wilful misconduct, breaches of confidentiality, and breaches of other material terms of the outsourcing agreement (eg, services not to be withheld, compliance with the law, and failure to obtain required consents). Although an exception for gross negligence and wilful misconduct is sometimes subject to negotiation, many states do not allow a party to disclaim liability for such conduct as a matter of public policy. Also, owing to the enormous potential liability exposure related to data breaches involving personal information, many providers will not agree to unlimited liability for such breaches. Instead, they will propose a “super-cap” for such damages, which is usually a multiple of the general damages cap.

Implied terms ‒ such as warranties for fitness for a particular purpose, merchantability, and non-infringement ‒ are typically disclaimed by the provider and only the express terms in the agreement apply.

In addition to required content that must be included in contracts pursuant to the CCPA and similar state privacy laws, businesses also are generally required to provide reasonable oversight and management of their service providers that process personal information.

Federal Level

At the federal level, under the FTC’s Safeguards Rule, financial institutions must require relevant service providers to agree contractually to maintain appropriate safeguards to protect non-public personal information. Pursuant to HIPAA’s Privacy Rule, which governs a covered entity’s interactions with third parties (“business associates”) that handle PHI in the course of performing services for the covered entity, the business associates’ obligations with regard to PHI are dictated by contracts with covered entities, known as “business associate agreements” (BAAs). BAAs must impose certain requirements on business associates ‒ for example, using appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by the BAA.

State Level

At the state level, certain state laws require businesses that disclose personal information to third parties to require those entities to contractually maintain reasonable security procedures. Regulations in Massachusetts, for example, require that covered businesses contract with service providers in addition to taking reasonable steps to “select and retain third-party service providers that are capable of maintaining appropriate security measures to protect ... personal information”.

Additionally, under the CCPA, businesses must enter into contracts with service providers, that include a number of restrictions and obligations. By way of an example, the contract must prohibit the service provider from:

• selling or sharing the personal information;
• combining the personal information that the service provider receives from (or on behalf of) the business with personal information that it receives from (or on behalf of) another person or persons ‒ or personal information that the service provider collects from its own interaction with the consumer ‒ except for limited permitted purposes; and
• retaining, using or disclosing the personal information either:
1. outside the direct business relationship between the service provider and the business; or
2. for any purpose other than for the business purpose(s) specified in the contract, including retaining, using or disclosing the personal information for a commercial purpose other than as specified in the contract or as otherwise permitted by the CCPA.

In addition, under the CCPA, service provider contracts must:

• specify that the personal information is disclosed by the business only for limited and specified purposes;
• identify the specific business purposes(s) for which the service provider is processing personal information (generic cross-references to the underlying services agreement do not satisfy this requirement);
• obligate the service provider to comply with applicable obligations under the CCPA and to provide the same level of privacy protection as required by the statute;
• require the service provider to notify the business if it determines that it can no longer meet its obligations under the CCPA;
• grant the business the right to monitor the service provider’s compliance with the contract through measures including, but not limited to, ongoing manual reviews and automated scans, as well as regular assessments, audits, or other technical and operational testing;
• grant the business the right, upon notice, to take reasonable and appropriate steps to stop and remediate the service provider’s unauthorised use of personal information;
• require the service provider to enable the business to comply with consumer rights requests made under the CCPA, or require the business to inform the service provider of applicable consumer requests and provide the information necessary for compliance; and
• if the service provider engages subcontractors, have a written contract with each subcontractor that includes substantially similar CCPA-compliant provisions.

The CCPA also includes requirements for contracts with “contractors” and “third parties” (each as defined in the CCPA). Also, as noted in 2.3 Restrictions on Data Processing or Data Security, other state comprehensive privacy laws require contracts between “controllers” and “processors”. Such contracts must include, among other things, obligations relating to the confidentiality and security of personal information. Furthermore, the New York State Department of Financial Services’ cybersecurity regulations require that covered entities develop and implement a third-party service provider policy that addresses minimum cybersecurity practices of vendors, due diligence processes used to evaluate vendors, periodic assessment of vendors’ cybersecurity adequacy, and guidelines for contractual protections in vendor agreements.

Even where there is no legal requirement to do so, it is common practice for companies in the USA to include privacy and data security terms in vendor contracts that establish use limitations and the vendor’s responsibility to protect the data it receives, and that assign liability as appropriate in the event of a data breach or other privacy or security violation.

There are myriad ways to manage and measure the supplier’s performance in outsourcing transactions, the most common being through service level agreements (SLAs). Approaches to SLAs can vary but generally the supplier will have a certain amount of its monthly fees at risk (typically between 10% and 20%) in the event that one or more SLAs are missed. Experience level agreements (XLAs) are another approach, where the focus is more on the customer experience and business impact rather than on more traditional SLAs like availability and response time. Another form of performance measurement and management is a robust governance model, which typically consists of an executive steering committee together with other service delivery and operational committees. Unlike SLAs, which provide a remedy in the event of a service failure, governance models help mitigate a service failure from even occurring by ensuring the parties are in regular communication.

Although several of the contract terms mentioned throughout 4. Contract Terms are relevant in cloud-based offerings, the customer’s ability to obtain concessions from a cloud provider on such contract terms is more challenging, owing to the commodity nature of such offerings. Cloud-based deals are also generally for a shorter term than traditional outsourcing agreements and narrower in scope, which reduces the need for certain terms (eg, market currency and sweeps clauses).

In the USA, employees are not transferred to the provider as a matter of law. If the parties wish to accomplish such a transfer, they must agree to that as part of the transaction documents. They must also put in place an offer and acceptance process to effectuate the transition.

If the employees are not transferred as part of the transaction, the employees will remain employed by the original employer who can in turn redeploy the employees on other matters or terminate their employment. In the absence of an employment contract stating otherwise, the employees are employed “at will” and ‒ in the absence of a WARN Act qualifying event (see 5.2 Role of Trade Unions or Workers’ Councils) ‒ can be terminated at any time for any reason, without notice and without severance or redundancy pay.

Notification to any labour unions will be governed by the terms of any applicable collective bargaining agreements.

The Worker Adjustment and Retraining Notification Act (the “WARN Act”) is implicated if the outsourcing transaction involves a “mass lay-off” or a “plant closing” as defined in the WARN Act. In the event of a mass lay-off or plant closing, the employer must provide 60 days’ advance notice prior to termination. Many states in the USA have their own “Mini-WARN Acts”, which must also be accounted for before implementing a termination programme as part of an outsourcing transaction.

One of the principal drivers for customers in all outsourcing transactions is reduced costs. Providers are generally more capable of achieving these cost-reduction goals when they employ their offshore resources. Accordingly, a significant portion of the provider’s delivery centres continue to be located offshore. Additionally, given global inflation rates, there may have been a slight uptick in “onshoring”.

However, on the whole, the USA is experiencing roughly the same allocation of deals among offshore, nearshore and onshore vendors as in previous years. Customer preferences that pertain to geographical considerations continue to be:

• whether sensitive personal information is in-scope;
• level of geography-specific risk;
• whether a particular service is customer-facing;
• talent of resources;
• cost savings; and
• criticality of services.

If employees are working remotely from a state other than the state where the employer-company has office locations, the company must evaluate the need to comply with the state laws of the states where the employees are working. This includes (but is not limited to) state leave, workers’ compensation, and unemployment compensation laws. The company should also evaluate whether employee presence in those states triggers an obligation to register to do business in those states and whether the employer would be subject to corporate tax obligations in those states due to the presence of employees in the states.