Build a company you can sustain

Research date: September 15, 2026. Every statute, rule, court decision, fee schedule and effective date in this chapter was verified against primary or major-firm secondary sources as of that date. Legal and regulatory material has a short shelf life; several items covered here changed materially in the eighteen months before this date and at least four are still in motion.

Read this first

This chapter is general information. It is not legal advice, tax advice, accounting advice, or financial advice, and reading it creates no professional relationship of any kind. Requirements differ by state, by country, by industry, by company stage and by the specific facts of your situation. They change — sometimes between one quarter and the next. Several rules described here were struck down, revived, delayed or rewritten during the period this chapter covers, and some will have moved again by the time you read it. Where a decision carries real money or real liability, the correct response to anything in this chapter is to take it to a qualified professional licensed in your jurisdiction, not to act on it.

That warning is repeated deliberately throughout Part A, because the single most expensive pattern in early-stage company building is a founder who read something once, decided it applied to them, and did not check.

A second note, on Part B. The second half of this chapter deals with founder workload, financial stress, burnout, company failure and mental health. It reports what the research actually shows, including its limitations. It is not a substitute for clinical care. If you are struggling, professional support exists and is effective; a licensed therapist, psychiatrist or physician is the right person to talk to, and nothing here should be read as a treatment recommendation.

What this chapter does not cover. Equity splits between co-founders, vesting schedules, 83(b) elections, founder agreements, advisory shares, the mechanics of the first hires, and the prevention of co-founder conflict are treated at length in the founders and teams chapter. Company formation tools and vendor comparisons are in the tools and platforms chapter. This chapter covers the legal substance behind those choices, the compliance surface a company acquires as it grows, and what happens to the founder as a person over the years that takes.

PART A — Legal, ethical and operational responsibilities

How to use Part A

Each topic below follows the same structure: what it is, what a startup actually has to do, what it costs and how long it takes, what goes wrong, and — stated explicitly — whether a founder can handle it themselves or genuinely needs a professional.

That last judgment is the most useful thing in this chapter and the most frequently skipped. Founders systematically over-lawyer things that are commodity paperwork and under-lawyer things that are irreversible. The pattern to internalize: anything that can be fixed later with money is cheap to get wrong; anything that involves a third party's rights, a tax election with a deadline, or a signature that cannot be unwound is expensive to get wrong. Incorporation is cheap to get wrong. IP assignment is expensive to get wrong. A trademark class selection is cheap to get wrong. An 83(b) deadline is expensive to get wrong.

1. Incorporation and entity choice

What it is

A business entity is a legal person separate from you. It can own property, sign contracts, be sued, and — critically — shield your personal assets from most business liabilities. Until you form one, you are a sole proprietorship or a general partnership by default, and "general partnership" means you are personally liable for what your co-founder does in the business's name.

The realistic options

Delaware C-corporation. The default for any company that intends to raise institutional venture capital. Roughly two-thirds of Fortune 500 companies and the overwhelming majority of VC-backed startups are Delaware corporations.

LLC (any state). Simple, flexible, pass-through taxation, low maintenance. Excellent for a consultancy, an agency, a bootstrapped software business, a real-estate holding entity, or anything where profits will be distributed to owners rather than reinvested indefinitely.

S-corporation. Not an entity type but a tax election available to corporations and LLCs meeting restrictions: no more than 100 shareholders, only US individuals and certain trusts as shareholders, one class of stock. Useful for profitable small businesses to reduce self-employment tax. Fatal for venture financing — a single VC fund as a shareholder breaks the election.

Home-state corporation. A C-corp incorporated where you live. Perfectly valid; slightly cheaper; a modest friction point if you later raise from institutional investors.

Non-US entities. A UK limited company, a Singapore private limited, an Estonian OÜ via e-Residency, a German GmbH. Appropriate when your customers, your team and your investors are all in that region.

Why investors expect Delaware C-corps

Four reasons, none of them mystical:

1. Case law depth. The Delaware Court of Chancery is a specialized business court with no juries and centuries of accumulated corporate precedent. When a dispute arises about fiduciary duty, preferred stock rights or a merger, the answer is usually already written down.
2. Familiarity and speed. Every venture lawyer, every fund's standard documents, and every financing template assumes a Delaware corporation. Using anything else means custom drafting and more billable hours — paid by the company.
3. Preferred stock. Venture financing is built on multiple classes of stock with different rights. A C-corp handles this natively. LLCs can be contorted into similar arrangements, but it is expensive and unfamiliar.
4. Fund tax constraints. Many venture funds have limited partners — university endowments, pension funds, foundations — that are tax-exempt and must avoid unrelated business taxable income (UBTI). A pass-through LLC generates UBTI for those LPs. A C-corp does not. This, more than anything else, is why funds will not invest in your LLC.

There is a fifth reason that matters for founders directly: Qualified Small Business Stock (Section 1202) is only available on stock in a domestic C-corporation. LLC interests do not qualify. This is covered in detail in section 10.

The "DExit" question

Since 2024 there has been genuine, sustained discussion of companies reincorporating away from Delaware — mostly to Texas or Nevada — driven by Delaware Chancery decisions that founders and controlling shareholders perceived as unfavorable, and by Texas's creation of specialized business courts. Delaware responded with legislative amendments in 2025 narrowing controlling-stockholder liability.

[Analysis] For an early-stage startup this is close to irrelevant. The controversy concerns controlling-shareholder conflict transactions at large public and late-stage private companies. A seed-stage company gets no benefit from Texas or Nevada incorporation and pays a real cost in investor friction. Follow the debate if you like; incorporate in Delaware.

Cost and timing

The franchise tax reality

This is the single most common Delaware panic. In February, a first-time founder receives a Delaware notice for $75,000 and assumes catastrophe. It is almost always an artifact of the default calculation method.

Delaware offers two methods and you pay the lesser (Delaware Division of Corporations, franchise tax calculation):

• Authorized Shares Method (the default shown on the notice): $175 for 5,000 shares or fewer; $250 for 5,001–10,000; plus $85 for each additional 10,000 shares or part thereof. A company with 10,000,000 authorized shares owes roughly $85,165 under this method.
• Assumed Par Value Capital Method: $400 per $1,000,000 of assumed par value capital, with a $400 minimum. A typical startup with 10,000,000 authorized shares at $0.0001 par value and modest total assets lands at or near the $400 floor.

Both methods cap at $200,000 for most filers (higher for "large corporate filers"). The annual report fee is $50 for domestic corporations, on top of the tax. Corporations owing $5,000 or more must pay quarterly estimates (40% June 1, 20% September 1, 20% December 1, balance March 1). The annual report and tax are due March 1.

[Practical] To use the lower method you must report total gross assets (from your federal Form 1120, Schedule L) and issued shares. Recalculate on the Delaware portal before paying. Formation services and startup accountants do this automatically. Do not authorize far more shares than you need — the authorized-shares method is a function of authorized, not issued, shares.

What goes wrong

• Forming an LLC, then converting. The most common and most expensive formation error. Converting an LLC to a Delaware C-corp costs roughly $3,000–$10,000 in legal and filing fees, can trigger taxable events for members depending on structure, and — importantly — restarts the QSBS five-year clock and the qualifying-stock analysis from the date of conversion.
• Not foreign-qualifying. A Delaware corporation with employees and an office in California must register to do business in California, pay California's $800 minimum franchise tax, and file California returns. Failure to qualify can mean penalties and, in some states, inability to bring a lawsuit in state court until you cure it.
• Missing the March 1 deadline. $200 penalty plus 1.5% monthly interest, and the entity eventually loses good standing — which blocks financings and acquisitions until cured.
• Issuing founder stock without paying for it. Stock must be issued for consideration. "I'll pay later" creates a defect that surfaces in diligence.
• Authorizing 100,000,000 shares "to be safe." Inflates franchise tax under the default method and signals inexperience.

Can a founder do this alone?

Mostly yes — with a caveat. Straightforward formation for a two-founder company with standard terms is genuinely a commodity. Clerky, Stripe Atlas and similar services generate the same documents a firm would, and they include the parts founders forget (IP assignment agreements, 83(b) filing instructions, board consents).

You need a lawyer when: there are more than two or three founders; anyone is contributing IP developed elsewhere; anyone has a current employer with an invention-assignment agreement; there is a prior entity to convert or unwind; a founder is a non-US person or there are non-US entities involved; anyone is putting in real cash on non-standard terms; or there are already promises made to advisors, early contributors or "handshake co-founders."

2. Intellectual property assignment — the single most common early mistake

What it is

By default in US law, the person who creates something owns it. Not the company they work for, not the company they founded, not the company that paid them. Ownership transfers only through the operation of specific doctrines or an express written assignment.

For employees, there is a partial default: work created by an employee within the scope of employment is generally "work made for hire" under copyright law, and belongs to the employer. For patents, even employees do not automatically assign — an express agreement is needed.

For independent contractors, there is no useful default at all. The Copyright Act's work-made-for-hire provision applies to commissioned works only in nine enumerated categories, and software is not one of them unless it qualifies as a contribution to a collective work or similar. Absent a written assignment, the contractor who wrote your code owns the copyright in it. Your company has, at best, an implied license.

And founders, before the company exists, are not employees of anything. Everything built pre-incorporation is personally owned until assigned.

What a startup actually has to do

Four documents, no exceptions:

1. Founder IP assignment. Executed at incorporation, assigning to the company all pre-existing work related to the business — code, designs, domain names, social handles, brand names, research, customer lists, prototypes. This is usually bundled into the Confidential Information and Invention Assignment Agreement (CIIAA) or into the restricted stock purchase agreement as a "Technology Assignment Agreement."
2. Employee CIIAA / PIIA. Signed by every employee before or on the first day of work, not after. Contains a present-tense assignment ("I hereby assign," not "I agree to assign"), confidentiality obligations, and a schedule for listing prior inventions the employee is carving out.
3. Contractor agreement with express assignment. Every contractor, every agency, every freelance designer, every offshore development shop. Include both a work-made-for-hire clause and a backup present assignment, because the WFH clause may not operate.
4. Advisor and intern agreements. Same logic. Interns and unpaid contributors are the most frequently missed category.

The "hereby assign" problem

This detail matters more than it sounds. In Board of Trustees of the Leland Stanford Junior University v. Roche Molecular Systems (US Supreme Court, 2011) and the Federal Circuit's line of cases interpreting it, courts distinguished a promise to assign in the future ("I agree to assign") from a present assignment ("I hereby assign"). A present assignment transfers rights automatically as inventions are created. A promise to assign requires a further act — and if the person has already signed a present assignment with someone else (a prior employer, a university), the earlier present assignment wins.

[Practical] Read your agreements for "hereby assign." If they say "agree to assign," have them redrafted.

The prior-employer problem

The most dangerous version of this issue has nothing to do with your own paperwork. If a founder or early engineer:

• built any part of the product while still employed elsewhere,
• used their employer's laptop, accounts, or network,
• worked on it during business hours,
• or works in a field related to their employer's business,

then their prior employer's invention-assignment agreement may capture the work. Some states limit this — California Labor Code §2870, Washington RCW 49.44.140, Delaware, Illinois, Kansas, Minnesota, North Carolina, Utah and others have statutes carving out inventions developed entirely on the employee's own time without employer equipment and unrelated to the employer's business. But the carve-outs are narrower than founders assume, and "related to the employer's business or anticipated research" is a broad phrase.

[Analysis] This is the fact pattern that kills deals. It usually surfaces during acquisition diligence, years later, when the acquirer's counsel asks where the original code came from and whether anyone was employed elsewhere at the time. The resolution is often a payment to the prior employer, an indemnity escrow, or — in bad cases — a collapsed transaction.

What goes wrong, ranked by frequency

1. A contractor built the MVP with a one-page scope-of-work and no IP clause. The company does not own its own product.
2. A founder left before the company had assignment paperwork. They still own their contributions and have every incentive to remember that during a financing.
3. "Agree to assign" instead of "hereby assign."
4. Employees onboarded without a CIIAA, signed months later, creating a gap and a consideration problem in some states.
5. Open-source contributions by employees to outside projects without a policy, creating ambiguity about what the company owns.
6. AI-generated code with unclear provenance. The US Copyright Office has consistently held that purely AI-generated material without sufficient human authorship is not copyrightable. This does not usually break a startup — most software's value is in trade secrets, execution and data, not copyright — but it is a question acquirers now ask.

Cost and timing

Near zero if done at formation. Standard templates are free from Cooley GO, Orrick, Gunderson, Y Combinator and the major formation services. The cost of fixing it later ranges from a few thousand dollars in cleanup to the entire enterprise value of the company.

Can a founder do this alone?

Yes for the paperwork; no for the diagnosis. Using a standard CIIAA template and having everyone sign it on day one is a founder task and takes an afternoon. But if anyone on the team built anything relevant while employed elsewhere, or if a contractor built material code without an assignment, that is a lawyer conversation immediately — not at the next financing. Remediation gets harder and more expensive with every month that passes and every person who leaves.

3. Trademarks

What it is

A trademark protects a brand identifier — name, logo, slogan — as applied to specific goods and services. In the US, rights arise from use in commerce, not registration. Federal registration with the USPTO adds substantial benefits: nationwide constructive notice, a presumption of validity and ownership, the ability to sue in federal court, a basis for foreign filings, recordation with Customs, and after five years of continuous use, incontestability.

What a startup actually has to do

Before naming anything: search. A knockout search covers the USPTO's TESS/Trademark Search database, state registers, common-law use (web search, app stores, social handles), and domain availability. A comprehensive clearance search by a trademark attorney or search firm covers much more, including phonetic equivalents and foreign-language marks.

Then, if the name survives: file an application. Two bases matter for startups:

• §1(a), use in commerce — you are already selling under the mark.
• §1(b), intent to use — you are not yet, but have a bona fide intention. This reserves priority from the filing date. You later file a Statement of Use once you begin selling.

Cost and timing (USPTO fees effective January 18, 2025)

The USPTO restructured trademark fees on January 18, 2025, replacing TEAS Plus / TEAS Standard with a single base fee plus behavior-based surcharges (Gerben IP summary of the 2025 fee changes; Reed Smith):

Attorney fees, if used: roughly $500–$1,500 per mark per class for preparation and filing, plus hourly work for office actions. A comprehensive clearance search runs $500–$2,000.

Timing: realistically 12–18 months from filing to registration in a clean case; longer with office actions or oppositions. USPTO examination backlogs have been substantial. Intent-to-use applications can take considerably longer because the Statement of Use follows allowance.

What goes wrong

• Naming the company before searching. Rebranding after eighteen months of marketing costs far more than a clearance search.
• Descriptive marks. "CloudInvoice" for invoicing software is descriptive and either refused, or pushed to the Supplemental Register with weak rights. Distinctive, arbitrary or coined marks are harder to love and much easier to protect.
• Filing in the wrong class or too narrow a description. Classes cannot be added after filing; you file a new application.
• Using free-form descriptions and eating the $200-per-class surcharge unnecessarily. The USPTO ID Manual has pre-approved language for almost everything.
• Ignoring international. US registration has no effect abroad. If the EU, UK or China matter, the Madrid Protocol (within six months of the US filing, to claim priority) or direct national filings are the route. China in particular operates first-to-file with a persistent squatting problem.
• Letting Section 8 lapse at year five or six. The registration dies.

Can a founder do this alone?

Yes for a simple, distinctive mark in one class. The USPTO's Trademark Center is usable by non-lawyers, and the office publishes plain-language guidance. Filing your own application for a coined word mark in one class is reasonable.

Use an attorney when: the search turns up anything remotely similar; you receive a substantive office action (likelihood of confusion, descriptiveness); someone opposes your application; you need more than two classes; you are filing internationally; or the brand is genuinely central to company value. Note also that foreign-domiciled applicants are required to be represented by a US-licensed attorney before the USPTO.

4. Patents

What it is

A patent is a government-granted right to exclude others from making, using, selling or importing an invention for twenty years from the filing date, in exchange for public disclosure. It is not a right to practice your own invention; it is a right to stop others.

Provisional vs. non-provisional

A provisional application is not examined and never becomes a patent. It establishes a priority date and gives you twelve months to file a non-provisional claiming that date, during which you can say "patent pending." It requires a specification that adequately describes the invention but no formal claims.

A non-provisional application is the real thing: formal claims, examination by an examiner, office actions, argument and amendment, and — eventually, maybe — issuance.

Cost and timing

USPTO fees changed substantially on January 19, 2025, with new surcharges for continuation applications filed late and for excessive claims (USPTO fee schedule). Entity status drives cost: micro entity (income and prior-filing limits) pays 20% of the standard fee; small entity (fewer than 500 employees) pays 40%; large entity pays full freight.

Timing: first office action typically 18–30 months after filing; issuance commonly 2–4 years. Track One prioritized examination (extra fee) can produce a final disposition in about twelve months.

When patents matter — and when they don't

[Analysis] Be honest about this. For most software startups, patents do not matter.

Patents matter substantially in:

• Biotech and pharmaceuticals. The entire business model is patent-dependent. No patent, no investment.
• Medical devices, diagnostics, semiconductors, materials science. Physical inventions with long development cycles and clear claim boundaries.
• Hardware with a genuine mechanical or electrical innovation.
• Deep tech where a licensing model is plausible.

Patents matter marginally or not at all in:

• Most SaaS and application software. Since Alice Corp. v. CLS Bank (US Supreme Court, 2014), abstract ideas implemented on a generic computer are not patent-eligible under §101. Many software patents are unenforceable or expensively defended. Meanwhile, by the time a patent issues in three years, the software has been rewritten twice.
• Consumer products and marketplaces, where the moat is network effects, brand and execution.
• Anything where the competitive threat is a well-funded fast follower — who will design around your claims, or simply litigate you into exhaustion because they can afford to and you cannot.

The honest reasons software startups still file:

1. Defensive posture. Having something to countersue with.
2. Investor signaling. Some investors, particularly outside software, treat patent filings as a proxy for technical substance. This is a weak reason but a real one.
3. Acquisition value. Acquirers sometimes ascribe value to a patent portfolio, especially in adjacent hardware or infrastructure.
4. Genuinely novel algorithms with a concrete technical improvement — which can survive Alice if drafted properly.

[Practical] A defensible default for a software startup: file a small number of well-drafted provisionals covering the genuinely novel technical mechanisms, and make the non-provisional decision at the twelve-month mark with a year more information about whether the thing matters. That costs a few thousand dollars and preserves optionality. Filing a dozen provisionals to look impressive is money burned.

The disclosure trap

The US has a one-year grace period from the inventor's own public disclosure. Most of the rest of the world has none. Present at a conference, publish a blog post describing the mechanism, or launch publicly, and you have likely destroyed your European, Chinese and Japanese patent rights the same day. If international patents matter at all, file before you disclose, full stop.

Can a founder do this alone?

A provisional, yes — with a serious caveat. You can file a provisional yourself. But a provisional only provides priority for what it actually describes and enables. A thin, hand-waved provisional gives you a false sense of security and no priority for the claims you eventually want. If the invention matters, pay for a properly drafted provisional.

A non-provisional, no. Claim drafting is a specialized craft. Amateur claims are either too narrow to be useful or too broad to survive. Use a registered patent attorney or agent (they must pass a separate USPTO bar and have a technical degree).

5. Trade secrets

What it is

A trade secret is information that derives independent economic value from not being generally known and that is subject to reasonable measures to keep it secret. Protected federally by the Defend Trade Secrets Act of 2016 (18 U.S.C. §1836), which created a federal civil cause of action, and by state law in nearly every state under a version of the Uniform Trade Secrets Act.

Unlike patents, trade secrets have no registration, no fee, no expiry — and no protection against independent discovery or lawful reverse engineering.

What a startup actually has to do

The doctrinal requirement is "reasonable measures under the circumstances." In practice, for a startup, that means being able to demonstrate:

• Confidentiality agreements with employees, contractors, vendors and (selectively) counterparties.
• Access controls. Least-privilege access to source code, customer data, model weights and financial information. SSO, role-based permissions, logged access.
• Marking and identification. Knowing what you consider secret, and labeling it.
• Offboarding discipline. Access revoked on the day someone leaves; exit interviews reminding departing people of continuing obligations; device returns documented.
• Vendor and cloud hygiene. Not posting internal code to public repositories or pasting proprietary material into third-party tools whose terms permit training on inputs.

One statutory detail with a real consequence: the DTSA requires that any contract governing use of trade secrets — employment, consulting, NDA — include a notice of immunity for whistleblowers who disclose trade secrets in confidence to a government official or attorney for the purpose of reporting a suspected legal violation. If the notice is absent, the employer cannot recover exemplary (double) damages or attorney's fees against that employee in a DTSA action. It is one sentence. Most modern templates include it; older ones often do not.

What goes wrong

• Treating everything as secret, which courts read as treating nothing as secret.
• No offboarding process. Departing engineers retain GitHub access for months.
• Confusing trade secret with non-compete. In California and other ban states, you cannot stop a former employee from working for a competitor — but you can stop them from using your trade secrets. The distinction is the whole ballgame, and the "inevitable disclosure" doctrine is rejected in California.
• Choosing secrecy for something that will be visible in the product. Trade secrecy protects the back end — training pipelines, ranking algorithms, cost structures, customer economics. It does not protect a user-facing feature that any competitor can observe.

Can a founder do this alone?

Yes. Trade-secret hygiene is an operational discipline, not a legal filing. Templates plus consistent access control plus an offboarding checklist gets you most of the way. A lawyer is needed when you are enforcing (seeking an injunction against a departing employee or a competitor) or defending (accused of taking someone else's). Both are high-stakes, fast-moving litigation.

6. Open-source license compliance

What it is

Essentially every modern application is mostly other people's code. Each dependency carries a license, and licenses carry obligations. Failing to meet them is copyright infringement and, increasingly, a diligence blocker.

The categories that matter

Permissive — MIT, BSD, Apache 2.0, ISC. Obligations: retain the copyright notice and license text, and for Apache 2.0, state significant changes. Apache 2.0 also includes an express patent license and a patent-retaliation termination clause. These are safe for commercial use; just ship the notices.

Weak copyleft — LGPL, MPL 2.0, EPL. Obligations attach at the file or library level. You can generally use them in a proprietary application if you keep the boundary clean (dynamic linking for LGPL; modified MPL files disclosed). Usable, but requires care.

Strong copyleft — GPL-2.0, GPL-3.0. If you distribute a work that is a derivative of GPL code, you must distribute the complete corresponding source of the whole work under the GPL. For a SaaS company that never distributes binaries, the classic GPL is often a non-event — the "distribution" trigger is not pulled. For anyone shipping software to customers, on-premise, in a mobile app, or in firmware, it is a serious constraint.

Network copyleft — AGPL-3.0. This is the one that catches startups. AGPL §13 extends the source-disclosure obligation to users who interact with the software over a network. If you modify AGPL software and let users interact with it remotely, you must offer them the corresponding source. Many companies (Google's open-source policy being the best-known example) ban AGPL use outright. Numerous popular infrastructure projects — and several that have relicensed to AGPL or to source-available licenses — sit in this bucket.

Source-available / non-open-source — SSPL, BUSL (Business Source License), Elastic License, Commons Clause. These are not open source by the OSI definition and typically restrict offering the software as a competing managed service. Read them individually; the restrictions differ and some convert to a permissive license after a delay (BUSL typically after four years).

Public domain / unlicensed. Code on GitHub with no license file is all rights reserved. The absence of a license is not permission.

What a startup actually has to do

1. Run an automated scan. Software composition analysis is a commodity: GitHub Dependabot and dependency review (free on public repos and in GitHub's paid tiers), license-checker for npm, pip-licenses, OSS Review Toolkit, Syft/Grype, FOSSA, Snyk, Black Duck, Mend. Even a free scan catches the AGPL and GPL surprises.
2. Maintain a NOTICE/attributions file or page. Most permissive licenses require you to reproduce the license text and copyright notices. A /licenses page in the app or a THIRD-PARTY-NOTICES.txt in the distribution satisfies this cheaply.
3. Write a one-page policy. Which license categories are pre-approved (MIT/BSD/Apache/ISC), which require review (LGPL/MPL), which are prohibited without an explicit exception (GPL if you distribute; AGPL; SSPL; anything unlicensed). Engineers will follow a clear rule.
4. Generate an SBOM if you sell to enterprises or government. CycloneDX and SPDX are the two standard formats; Syft generates both for free. Enterprise security questionnaires increasingly ask for one, and US federal software procurement requirements have pushed SBOMs into standard practice.
5. Watch relicensing. Several widely used projects changed license in recent years. A dependency that was Apache 2.0 when you adopted it may be BUSL or AGPL in its current version.

What goes wrong

• Finding AGPL in the dependency tree during acquisition diligence. The remedy is to rip it out and rewrite — under deal time pressure, at maximum cost. This is a recurring, documented deal-friction item in technology M&A.
• Copying a Stack Overflow answer or an AI-suggested snippet that originated in GPL code. Provenance is untraceable and the risk is real but usually small; the diligence answer is that you have a policy and scanning.
• Shipping an Electron or mobile app without realizing you are now "distributing," which changes the GPL analysis entirely.
• Missing attribution. Low-severity but trivially avoidable and embarrassing in diligence.

Can a founder do this alone?

Yes, almost entirely. Scanning is automated, the policy is a page, and the attribution file is generated. Get a lawyer when: you have found strong or network copyleft in something you distribute or host; you are structuring your own open-core business and choosing a license; you receive a compliance demand letter; or an acquirer's counsel raises it in diligence.

7. Employment law

Reminder: general information only, not legal advice. Employment law is among the most state-specific and fastest-moving areas covered here.

At-will employment, and its limits

In every US state except Montana, employment is presumed at will: either party may end it at any time, for any reason or no reason, with no notice. Montana's Wrongful Discharge from Employment Act imposes a good-cause requirement after a probationary period.

The presumption has substantial exceptions:

• Protected characteristics. Title VII, the ADA, the ADEA, the Equal Pay Act, and state equivalents prohibit discharge based on race, color, religion, sex (including pregnancy, sexual orientation and gender identity per Bostock v. Clayton County, 2020), national origin, age (40+), disability, and additional categories under state law. Federal coverage thresholds vary — Title VII and the ADA generally apply at 15 or more employees, the ADEA at 20 or more — but many state statutes apply at one employee, which catches startups that assume they are too small to be covered.
• Retaliation. For complaints about discrimination, safety, wage violations, or securities/accounting issues.
• Contract and implied contract. An offer letter promising a term, or a handbook written like a promise, can undercut at-will status. Offer letters should state at-will status explicitly and disclaim contract formation.
• Public policy. Firing someone for refusing to break the law, serving on a jury, or filing a workers' comp claim.

[Practical] At-will does not mean consequence-free. It means you do not need cause. You still need a documented, consistent, non-pretextual reason, because the claim will be that the stated reason was cover for a prohibited one.

Wage and hour — the exposure founders underrate

The Fair Labor Standards Act requires minimum wage and overtime at 1.5x the regular rate above 40 hours per week, unless an exemption applies. The common exemptions — executive, administrative, professional, outside sales, and computer employee — each require both a salary basis test (a minimum salary, paid regardless of hours or quality of work) and a duties test.

Both tests must be met. Paying a salary does not make someone exempt. This is the most common wage-and-hour error in startups: a "salaried" junior operations, support, or sales-development employee who does not meet any duties test is non-exempt and owed overtime.

The federal salary threshold has been contested. The Department of Labor's 2024 rule raising it was vacated nationwide by the Eastern District of Texas in November 2024, restoring the prior $684 per week ($35,568 annually) threshold. State thresholds are frequently higher — California and New York both exceed the federal figure substantially and adjust annually. Verify your state's current threshold; do not rely on the federal number.

Other wage-and-hour items that generate claims:

• Unpaid interns. The FLSA "primary beneficiary" test governs. An intern doing productive work that displaces an employee is an employee.
• Meal and rest breaks. No federal requirement; California, Oregon, Washington, Colorado and others require them with premium pay for violations.
• Final pay timing. Several states require final wages immediately on termination or within a short window, with waiting-time penalties. California's are severe.
• Expense reimbursement. California Labor Code §2802 and similar statutes require reimbursement of necessary business expenses — including a reasonable portion of home internet and phone for remote workers.
• Pay transparency. Colorado, California, Washington, New York, Illinois, Minnesota, Vermont, Massachusetts and others now require salary ranges in job postings, with different triggers and effective dates.

Required insurance and registrations

For every state where you have an employee, generally:

• Workers' compensation insurance. Required in nearly every state, usually from the first employee (Texas is the notable exception, where it is elective for most private employers). Cost for software companies is low — often 0.1%–0.5% of payroll — because the risk classification is favorable. Penalties for operating without it are severe, including personal liability for officers in some states.
• State unemployment insurance (SUI) registration and contributions, at a state-assigned experience rate.
• State income tax withholding registration (in states with income tax).
• New hire reporting to the state directory, typically within 20 days of hire.
• Disability insurance in California, New York, New Jersey, Rhode Island, Hawaii and Puerto Rico.
• Paid family and medical leave contributions in a growing list of states.
• Required posters and written notices. Wage-theft-prevention notices in New York and California; harassment-prevention training mandates in California (at 5 employees), New York, Illinois, Connecticut, Delaware and Maine.

[Practical] A modern payroll platform (Gusto, Rippling, Justworks, a PEO) handles registration, withholding, new-hire reporting and posters in exchange for a per-employee fee. For a startup with employees in several states this is not optional infrastructure; doing it manually is where the errors are.

Non-competes: the 2025–26 reality

This changed decisively, and the popular understanding has not caught up.

The FTC's rule is dead. The Commission issued a final rule in April 2024 banning most non-competes nationwide. A federal court in the Northern District of Texas (Ryan LLC v. FTC) set the rule aside nationwide in August 2024, holding the FTC lacked authority to issue substantive competition rules. In September 2025, under Chair Andrew Ferguson, the FTC withdrew its appeals, formally abandoning the rule (Foley & Lardner, Noncompete Agreements in 2026: A Federal and State Overview, July 2026).

What the FTC does instead: case-by-case enforcement against specific employers, plus warning letters to healthcare and staffing employers. Activity has been limited. Federal legislation (the Workforce Mobility Act, S. 2031, reintroduced June 2025) has not advanced.

So the answer is entirely a matter of state law, and the landscape is a patchwork (Foley & Lardner, 2026):

• Effective total bans: California, Minnesota, North Dakota, Oklahoma, Washington, Wyoming (effective July 1, 2025), and the District of Columbia.
• Partial restrictions in 35+ states: income thresholds (Colorado, Illinois, Washington, Oregon, Maine, Maryland, Virginia, Nevada), profession-specific bans (physicians and other healthcare workers in a growing list), notice and timing requirements, and garden-leave requirements.
• Moving the other direction: Florida's CHOICE Act, effective July 1, 2025, strengthened enforceability for high-wage earners with a presumption of enforceability and a burden shift to the employee.
• New in 2026: Tennessee H.B. 1034 (compensation thresholds and statutory presumptions, July 1, 2026); Virginia S.B. 128 (healthcare restrictions) and S.B. 170 (no enforcement against discharged employees absent severance), both July 1, 2026. Washington's HB 1155 takes effect June 30, 2027 and will render non-competes unenforceable, with retroactive reach.

[Analysis] What this means practically for a startup:

1. Check your own exposure first. If you or a co-founder signed a non-compete with a prior employer, its enforceability depends on the state whose law governs — and California's ban is strong enough that California courts will generally refuse to enforce out-of-state non-competes against California employees, and California Business & Professions Code §16600.5 (effective January 1, 2024) makes it unlawful to even attempt to enforce one against a California employee, with attorney's fees for the employee.
2. Do not put a non-compete in a California offer letter. Beyond being void, presenting one is itself a violation.
3. Rely on the things that work everywhere: confidentiality obligations, IP assignment, non-solicitation of customers (enforceable in more states than non-competes, but restricted in California), and — for employee non-solicits — awareness that California treats even those as suspect.
4. Non-competes are not what actually protects you. Trade-secret protection, real switching costs, and being a place people want to stay do more work.

What goes wrong

• Misclassifying non-exempt employees as exempt salaried. Cumulative, compounding, and surfaces in diligence or in a departing employee's claim.
• Hiring in a new state without registering. Creates payroll tax delinquency and, separately, state income-tax nexus for the company (see section 10).
• No employee handbook and no documented performance process, then a termination that looks arbitrary.
• Firing someone shortly after they raised a complaint, with no contemporaneous record of the pre-existing performance problem.
• Treating an offer letter as a negotiation document and accidentally promising a term of employment.

Can a founder do this alone?

Partly. Standard offer letters, at-will language, and onboarding paperwork are template work. Payroll platforms handle the registration and filing mechanics.

You need an employment lawyer for: the first termination of anyone who has complained about anything, or who is in a protected class and might plausibly attribute the decision to that; any reduction in force (see Part B); any accommodation request under the ADA or a pregnancy-related request; any harassment complaint (which also requires a documented investigation); classification review once you have more than a handful of employees; and drafting a handbook if you operate in California, New York or Washington. Employment claims are the most common lawsuit a small company faces, and EPLI insurance (section 17) exists for a reason.

8. Contractor agreements and worker classification

The classification test itself and the strategic question of contractors versus employees are covered in the founders and teams chapter. What follows is the legal-operations layer: the paperwork, the current federal posture, and what to do about it.

Current federal status

The Department of Labor's classification standard under the FLSA has been rewritten twice in four years. The 2024 rule (a six-factor totality-of-circumstances economic-reality test) was itself the subject of litigation; the Department subsequently moved to restore the 2021 rule and rescind the 2024 version, with a proposed framework centered on economic dependence, two heavily weighted core factors (control, and opportunity for profit or loss), and three secondary factors. The comment period closed April 28, 2026. The DOL declined to adopt an ABC test at the federal level.

Independently of the FLSA, the IRS applies its own common-law control test (behavioral control, financial control, type of relationship) for employment-tax purposes, and state agencies apply their own tests — several states, most prominently California under Dynamex and AB 5, apply the stricter ABC test, where the "B" prong (work outside the usual course of the hiring entity's business) is nearly impossible to satisfy for a contract engineer building your core product.

[Analysis] The practical implication of three simultaneous, differing tests is that a worker can be correctly classified as a contractor for one purpose and misclassified for another. Startups that want a single answer will not get one.

What a contractor agreement must contain

1. Present-tense IP assignment ("hereby assigns"), plus a work-made-for-hire clause as a belt-and-braces backup. Without this, the contractor owns the code. This is the point that matters most and the one most often missing.
2. Confidentiality, with the DTSA whistleblower-immunity notice.
3. Scope, deliverables, and payment terms, defined by outcome rather than by hours where possible.
4. Contractor status representations — helpful but not dispositive; agencies look at conduct, not labels.
5. Contractor's responsibility for own taxes, own tools, own insurance.
6. Termination and transition — including return/deletion of company data and credentials.
7. No benefits, no equity by default. If you do grant equity to a contractor, it must be NSOs, not ISOs (ISOs are available only to employees).

Practical mechanics

• Form W-9 before the first payment; Form 1099-NEC filed for US contractors paid $600 or more in a year (due January 31).
• Form W-8BEN or W-8BEN-E for non-US contractors; generally no 1099 and no US withholding where services are performed entirely outside the US, but the analysis is fact-dependent.
• Foreign contractors introduce permanent-establishment risk. A long-term, full-time "contractor" in another country who represents your company can create a taxable presence there. Employer-of-record services (Deel, Remote, Velocity Global, Oyster) exist for exactly this and typically cost $500–$700 per person per month on top of salary.

Can a founder do this alone?

Yes for the agreements — templates are standard and adequate. No for the classification judgment when the relationship looks like employment. If a "contractor" works full time, exclusively for you, on your core product, on your schedule, using your equipment, the correct advice is almost always to make them an employee (or engage them through an EOR), and a lawyer will tell you that in one conversation for a few hundred dollars. The alternative is finding out from a state labor agency.

9. Equity compensation mechanics

Founder equity splits, vesting and 83(b) elections are covered in the founders and teams chapter. This section covers the option-plan machinery.

ISOs vs. NSOs

Two kinds of stock option exist in US tax law (IRS Topic No. 427, Stock options):

Incentive Stock Options (ISOs) — statutory options, available only to employees of the company or a parent/subsidiary:

• No ordinary income at grant or exercise.
• But the spread at exercise (FMV minus strike) is an alternative minimum tax preference item. This is the trap: an employee can exercise, owe a large AMT bill in April, and hold stock they cannot sell to pay it.
• If the stock is held more than two years from grant and more than one year from exercise, the entire gain is long-term capital gain (a "qualifying disposition"). Otherwise it is a disqualifying disposition and the spread becomes ordinary income.
• $100,000 limit: ISOs first becoming exercisable in any calendar year are limited to $100,000 of grant-date value per employee; the excess is automatically treated as NSOs.
• Three-month post-termination rule: ISOs must be exercised within three months of leaving employment (twelve months for disability, longer on death) or they convert to NSOs. This is why standard 90-day exercise windows force departing employees into a choice between finding cash and forfeiting equity.
• Company must furnish Form 3921 to the employee and the IRS after an ISO exercise.

Non-Qualified Stock Options (NSOs) — everything else, and the only option type available to contractors, advisors, board members and non-employees:

• Ordinary income at exercise on the spread, subject to payroll tax withholding for employees, reported on Form W-2 (or 1099-NEC for non-employees).
• Subsequent gain is capital gain from the exercise date.
• The company gets a corresponding compensation deduction — which ISOs generally do not produce.

409A valuations

Section 409A requires that options be granted with a strike price at least equal to fair market value on the grant date. Granting below FMV triggers, for the recipient, immediate income inclusion on vesting, a 20% additional federal tax, and interest — plus state penalties, which in California add another 5%.

Safe harbor: a valuation by a qualified independent appraiser is presumed reasonable, and the IRS must show it was "grossly unreasonable" to overturn it. The presumption lasts 12 months, or until a material event.

When you need one:

• Before the first option grant.
• After each priced financing round.
• Every 12 months regardless.
• After any material event: a large customer win or loss, a significant pivot, a term sheet, an acquisition approach, a secondary transaction at a different price.

Cost in 2026 (Burkland, August 2026):

Cap-table platforms (Carta, Pulley, Fidelity Private Shares) bundle 409A valuations with their subscriptions; the bundled valuation is legitimate, though be aware the provider has a commercial relationship with you and an incentive to retain your business. Founders, company counsel and the company's accountant cannot perform a safe-harbor 409A themselves.

Early exercise

An "early exercisable" option lets the holder exercise before vesting, receiving restricted stock subject to the company's repurchase right that lapses on the original vesting schedule.

Why it is attractive: exercising immediately after grant, when strike price equals FMV, means the spread is zero — no ordinary income, no AMT. The holder files an 83(b) election within 30 days of exercise to be taxed on the (zero) spread at exercise rather than on the spread as the repurchase right lapses. The capital gains holding period starts at exercise, so the whole subsequent appreciation can be long-term capital gain, and the QSBS five-year clock starts running.

Why it is not free:

• The holder pays cash for shares that may become worthless. The money is gone.
• The 83(b) election has a hard 30-day deadline from the exercise date, with no extensions and no cure. Missing it converts the benefit into a liability — the holder now owes ordinary income on the spread at each vesting date, on stock they cannot sell.
• It creates a larger shareholder base — more parties in a financing, more signatures, more cleanup.
• It complicates the cap table if the person leaves and shares are repurchased.

[Practical] Early exercise is most valuable for the first handful of people, when the strike price is negligible and the check is small. It becomes progressively less attractive as valuation rises.

Other mechanics that matter

• Option pool. Typically 10–20% of post-money, established at or before the first priced round. Investors often require the pool to be created pre-money, which dilutes founders rather than the new investors — this is the "option pool shuffle" and it is negotiable at the margin.
• Extended exercise windows. A growing minority of companies extend the post-termination exercise window from 90 days to 5 or 10 years. This is materially better for employees. The cost: ISOs convert to NSOs after 90 days regardless, and the company carries a larger overhang of outstanding options.
• RSUs generally do not make sense for early-stage private companies (they create taxable income at vesting with no liquidity), but become standard at late stage where a double-trigger (time plus liquidity event) can be used.
• Rule 701 is the federal securities exemption that lets private companies issue compensatory equity without registration. It has volume limits and, above a threshold of securities sold in a 12-month period (raised to $10 million by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018), requires delivery of risk factors and financial statements to recipients. Most startups stay under it; it is worth knowing it exists.
• State blue-sky filings may also be required for equity grants.

Can a founder do this alone?

No. Adopting an equity incentive plan, setting up the 409A cadence, and issuing grants correctly is a lawyer-and-cap-table-platform job. The individual errors are small in effort and large in consequence: a grant dated before board approval, a strike price below FMV, an ISO granted to a contractor, a missed 83(b), a grant that exceeds the authorized pool. Every one of these surfaces in diligence and several are expensive to fix.

What the founder must personally own: telling every option recipient, in writing, that they should get their own tax advice; making sure 83(b) elections are actually mailed and proof of mailing retained; and never letting a promise of equity exist only in a Slack message.

10. Taxes

Emphatically not tax advice. Tax positions are fact-specific, several items below have elections with hard deadlines, and the amounts at stake are large enough that a competent startup accountant pays for themselves many times over.

Federal income tax

A C-corporation pays federal corporate income tax at a flat 21% and files Form 1120 (due the 15th day of the fourth month after year end — April 15 for calendar-year filers; six-month extension available). Losses generate net operating losses, which can be carried forward indefinitely but offset only 80% of taxable income in a given future year under current law. Most startups have NOLs and owe no federal income tax for years, which founders sometimes misread as "we have no tax obligations." The filing obligation exists regardless.

Section 382 limits the use of NOLs after an "ownership change" (broadly, a greater-than-50-percentage-point shift in ownership by 5% shareholders over a rolling three-year period). Successive venture rounds routinely trigger this. The practical consequence is that a company's accumulated NOLs are often worth far less at exit than the balance sheet suggests — something to know before treating them as an asset in an acquisition negotiation.

R&D: Section 174 and the credit

This is the item that caused the most damage to small software companies in recent years, and it has largely been fixed.

The Tax Cuts and Jobs Act required, beginning with tax years after December 31, 2021, that research and experimental expenditures be capitalized and amortized — five years for domestic research, fifteen for foreign — rather than deducted. Because "research" for §174 purposes includes software development broadly, a pre-revenue startup spending its entire budget on engineers could show taxable income and owe real cash tax while losing money. Numerous small companies received unexpected five- and six-figure tax bills.

The One Big Beautiful Bill Act (enacted July 4, 2025) created new §174A, which permanently restores immediate expensing of domestic research and experimental expenditures for taxable years beginning after December 31, 2024 (Morgan Lewis, July 2025; Grant Thornton).

Three things follow, and startups should act on all of them:

1. Foreign research is still capitalized over 15 years. §174A applies only to domestic R&E. Offshore engineering teams remain a capitalization item. This asymmetry is deliberate.
2. Small businesses can elect retroactivity. Taxpayers meeting the §448(c) gross receipts test — average annual gross receipts of $31 million or less — may elect to apply §174A retroactively to taxable years beginning after December 31, 2021, and file amended returns for 2022–2024. The deadline is the earlier of July 6, 2026, or the due date for filing a refund claim. For a startup that paid cash tax under the old rules, this is a refund. As of this chapter's research date that window has largely closed — if you have not addressed it, ask your accountant immediately whether any claim remains open.
3. Catch-up options for previously capitalized amounts. For unamortized 2022–2024 R&E, a taxpayer may continue the existing amortization, deduct the entire remaining balance in the first tax year beginning after December 31, 2024, or spread it ratably over two years (2025 and 2026). Which is best depends on projected income; a pre-revenue company may prefer to defer deductions into years with income to shelter.

The R&D credit (Section 41) is separate from the deduction and remains available. It is a credit of roughly 6–10% of qualified research expenses in practice. §41(d) was amended to require that expenditures be treated as domestic R&E under §174A to qualify, and §280C(c) restores the pre-2017 coordination — you reduce the deduction by the credit amount, or elect a reduced credit instead.

The payroll tax offset is the part that matters to pre-revenue startups. A "qualified small business" — broadly, gross receipts under $5 million for the year and no gross receipts more than five years before — may elect to apply up to $500,000 of the research credit against the employer portion of Social Security and Medicare payroll taxes rather than income tax. For a company with no income tax liability, this converts an otherwise useless credit into actual cash. It requires an election on a timely filed original return using Form 6765, and the credit is claimed against payroll tax on Form 8974.

[Practical] R&D credit studies are a crowded vendor market with wide quality variance and contingency-fee pricing that should make you cautious. IRS scrutiny of research credit claims has increased and documentation requirements for refund claims are specific. Use a reputable provider or your regular accountant, keep contemporaneous project documentation, and do not let anyone talk you into claiming that routine product work is qualified research.

State income tax and nexus from remote employees

This is the item that ambushes distributed startups.

An employee working in a state generally creates income-tax nexus for the company in that state, obligating it to register, apportion income, and file a return there — even a loss return. Public Law 86-272 provides narrow protection for companies whose only in-state activity is soliciting orders for tangible personal property, and the Multistate Tax Commission's revised interpretation treats many ordinary internet activities as exceeding that protection. P.L. 86-272 does not protect software or services companies in most states.

Consequences of one remote employee in a new state:

• Payroll tax registration and withholding (section 7).
• Corporate income/franchise tax registration and filing.
• Possible minimum taxes regardless of profitability — California's $800 minimum franchise tax, for instance, plus a Secretary of State registration.
• Sales tax nexus in most states, because physical presence still creates nexus independently of economic thresholds.

[Practical] Before approving a hire in a new state, know what it costs. It is usually a few thousand dollars a year in registration, filing and compliance, which is fine if you decided it deliberately and unpleasant if you discover it two years later with penalties.

Sales tax on SaaS after Wayfair

This is the single most common expensive tax surprise for B2B SaaS companies.

South Dakota v. Wayfair (US Supreme Court, 2018) eliminated the physical-presence requirement for sales-tax nexus. Every state with a sales tax now has an economic nexus threshold — commonly $100,000 in sales or 200 transactions into the state in a year, though the details vary considerably and several states have dropped or raised the transaction prong.

Then the second question: is SaaS taxable in that state? The answer differs state by state, and the categories are inconsistent. A rough map as of 2026:

• Clearly taxable in a substantial group including New York, Texas (as a taxable data processing service, with a 20% exemption), Washington, Pennsylvania, Massachusetts, Ohio, Arizona, Utah, South Dakota, Tennessee, Connecticut (at a reduced rate for business use), Hawaii, New Mexico, South Carolina, Rhode Island, Iowa, Mississippi, West Virginia, and the District of Columbia.
• Generally not taxable in California, Florida, Georgia, Virginia, North Carolina, Illinois (with Chicago's separate lease transaction tax as a notable local exception), Missouri, Nevada, Michigan, Kansas, Oklahoma, Idaho, Arkansas, and others.
• Changing. Maryland began taxing certain data and IT services in 2025. Several states have expanded digital-service taxation recently. This list is a starting point for a conversation, not an answer.

The startup failure mode is straightforward: two years of selling nationally, no sales tax collected anywhere, then an acquirer's diligence finds uncollected sales tax liability plus penalties and interest — a liability the company owes even though it never collected it from customers. It comes straight out of the purchase price or into an escrow.

[Practical] The fix is cheap and boring. Tools like Avalara, TaxJar, Anrok, Numeral and Stripe Tax monitor thresholds and register/file automatically, typically $100–$1,000+ per month depending on volume and state count. Anrok and Numeral are built specifically for SaaS. Turn this on before you need it. If you are already exposed, voluntary disclosure agreements with individual states typically limit the lookback period (often to three or four years) and waive penalties — but only if you come forward before they find you.

Outside the US: EU VAT on digital services is due in the customer's country regardless of your location, with the One Stop Shop (OSS/IOSS) providing a single registration for EU-wide reporting; non-EU sellers use the non-Union OSS. The UK has a £90,000 domestic registration threshold but no threshold for non-established businesses, meaning a US company's first UK sale can create a registration obligation. Canada, Australia, India, Japan, Norway, Switzerland, Singapore and many others have digital-services registration regimes with their own thresholds. Merchant-of-record platforms (Paddle, Lemon Squeezy, FastSpring) take on the seller-of-record role and handle this entirely, at a higher transaction fee than a plain payment processor — for a small company selling internationally that trade is usually worth making.

QSBS / Section 1202 — including the 2025 changes

This is the largest single tax benefit available to startup founders and employees, and it was substantially expanded in 2025.

Section 1202 allows a non-corporate taxpayer to exclude gain from the sale of qualified small business stock from federal income tax. The requirements, all of which must be met:

1. Stock in a domestic C-corporation (LLCs and S-corps do not qualify; this is the QSBS argument for incorporating as a C-corp).
2. Acquired at original issuance from the corporation, for cash, property or services — not purchased from another shareholder.
3. The corporation's aggregate gross assets did not exceed the threshold immediately before and after issuance.
4. The corporation uses at least 80% of assets in an active qualified trade or business throughout substantially all of the holding period.
5. The business is not in an excluded field — health, law, engineering, architecture, accounting, actuarial science, performing arts, consulting, athletics, financial services, brokerage, any business whose principal asset is the reputation or skill of its employees, banking, insurance, farming, extractive industries, or hotels and restaurants. "Consulting" and "reputation or skill of employees" are the ambiguous ones, and they matter for services-flavored startups.
6. Holding period met.

What OBBBA changed, for stock issued or acquired after July 4, 2025 (Mintz, July 2025; The Tax Adviser, November 2025):

Two traps worth stating plainly:

• Stock issued on or before July 4, 2025 keeps the old rules — $10M cap, five-year cliff — even if sold later. You cannot reset the acquisition date by exchanging old stock for new.
• The non-excluded portion of gain for stock held three or four years is taxed at the 28% §1202 rate, not the usual 15%/20% long-term capital gains rates. The partial exclusions are worth less than the headline suggests.

State conformity is not automatic. California does not conform to §1202 at all — QSBS gain is fully taxable for California purposes. Pennsylvania, New Jersey, Alabama, Mississippi and others have their own positions. A founder planning around QSBS must model state tax separately.

[Practical] Two things founders should do and often do not: (a) get a QSBS attestation letter from the company documenting that the gross-asset and active-business tests were met at issuance, ideally contemporaneously rather than reconstructed years later; and (b) understand Section 1045 rollover, which allows QSBS held more than six months to be rolled into new QSBS within 60 days, preserving the holding period — useful when an exit happens before the five-year mark.

Other federal and state items

• Form 5471 / 5472. A US corporation with a foreign subsidiary files Form 5471; a US corporation with 25%+ foreign ownership files Form 5472 with a $25,000 penalty per form for failure to file. Startups with foreign founders or foreign parents miss this constantly.
• FBAR / FinCEN Form 114 for foreign financial accounts exceeding $10,000 in aggregate.
• Corporate Transparency Act beneficial ownership reporting. After extensive litigation and successive Treasury actions, an interim final rule in March 2025 exempted domestic reporting companies and US persons from BOI reporting, narrowing the requirement to foreign entities registered to do business in the US. The rulemaking remained subject to further action; verify the current position before concluding you have no obligation.
• Payroll taxes. The single obligation with the harshest personal consequences. The Trust Fund Recovery Penalty (26 U.S.C. §6672) imposes personal liability on "responsible persons" — including founders and officers — equal to 100% of unpaid withheld payroll taxes. This survives the corporate veil and, generally, bankruptcy. Never, under any circumstances, fund operations by delaying a payroll tax deposit.
• Franchise and gross receipts taxes that apply regardless of profit: Delaware (section 1), California's $800 minimum, Texas margin tax, Washington B&O, Ohio CAT, Oregon CAT, New York fixed dollar minimum, San Francisco gross receipts tax.

Can a founder do this alone?

No, and this is the clearest "hire a professional" in Part A.

Bookkeeping can be founder-run early with Xero/QuickBooks plus a bookkeeper at $200–$800/month. Tax returns, elections, and nexus analysis should not be. A startup-focused CPA firm typically charges $2,000–$5,000 for a first-year 1120 plus state returns, and more as complexity grows.

The specific moments that require a tax professional, without exception: the first tax filing; any 174A election or amended-return decision; R&D credit and payroll-offset elections; a QSBS analysis before any exit or secondary sale; any foreign subsidiary, foreign parent or foreign founder; the first employee in a new state; crossing a sales-tax threshold; a conversion between entity types; and any acquisition.

11. Privacy and data protection

General information only. Privacy is the area of Part A where the rules changed most between 2024 and 2026, and where the number of applicable regimes grows with every state legislative session.

GDPR

The EU General Data Protection Regulation applies extraterritorially (Article 3): to any organization, anywhere, that offers goods or services to people in the EU or monitors their behavior. A US startup with EU users is in scope. The UK GDPR operates in parallel for the UK.

Core obligations: a lawful basis for each processing purpose (consent, contract, legal obligation, vital interests, public task, or legitimate interests); data subject rights (access, rectification, erasure, restriction, portability, objection, rights regarding automated decision-making) with a one-month response deadline; Article 30 records of processing; Article 28 data processing agreements with every processor; privacy by design and default; DPIAs for high-risk processing; breach notification to the supervisory authority within 72 hours of awareness, and to affected individuals without undue delay where risk is high; an Article 27 EU representative for non-EU controllers without an EU establishment; and a DPO where processing involves large-scale systematic monitoring or special-category data. Maximum fines: €20 million or 4% of global annual turnover, whichever is higher.

International transfers out of the EEA require a mechanism: an adequacy decision (including the EU–US Data Privacy Framework, for US companies that self-certify with the Department of Commerce), Standard Contractual Clauses with a transfer impact assessment, or binding corporate rules. The DPF replaced Privacy Shield after Schrems II; it has been challenged and its durability is not guaranteed. Most startups should maintain SCCs as a fallback even if DPF-certified.

Cost: an Article 27 representative runs roughly €200–€1,500/year. A basic privacy program (policy, DPAs, records, cookie consent, request workflow) is $3,000–$15,000 with counsel, less with templates. A DPIA for a genuinely high-risk product is more.

US state privacy laws

Twenty states have comprehensive privacy laws on the books as of 2026 (MultiState, February 2026). Indiana, Kentucky and Rhode Island took effect January 1, 2026. Connecticut amendments, Arkansas and Utah changes land July 1, 2026.

Most follow the Virginia template: applicability thresholds based on numbers of consumers whose data is processed (commonly 100,000 consumers, or 25,000–35,000 with a revenue-from-sale trigger), rights of access/deletion/correction/portability/opt-out, opt-in consent for sensitive data, data protection assessments for high-risk processing, and attorney-general-only enforcement with a cure period. Rhode Island's thresholds are unusually low — 35,000 consumers, or 10,000 if more than 20% of revenue comes from selling personal data.

California is the outlier and the one to design for. The CCPA as amended by the CPRA applies at $25M+ gross annual revenue, or buying/selling/sharing the personal information of 100,000+ California residents or households, or deriving 50%+ of revenue from selling personal information (California Attorney General, CCPA). It requires "Do Not Sell or Share My Personal Information" mechanisms, honoring Global Privacy Control browser signals, and responses within defined windows. It has a limited private right of action for data breaches involving certain unencrypted personal information — the only such provision among the state comprehensive laws, and the reason California breaches produce class actions.

The CPPA's 2025 regulations took effect January 1, 2026, with phased compliance (CPPA announcement, September 2025):

• Automated decision-making technology (ADMT) obligations for significant decisions: compliance from January 1, 2027.
• Risk assessments: obligation begins January 1, 2026; attestations and summaries due to the CPPA by April 1, 2028.
• Cybersecurity audits: phased by revenue — April 1, 2028 (>$100M), April 1, 2029 ($50–100M), April 1, 2030 (<$50M).

Washington's My Health My Data Act deserves separate mention: it covers "consumer health data" defined expansively, applies with no revenue or volume threshold, requires opt-in consent, and has a private right of action under the state consumer protection act. A wellness, fitness or symptom-tracking app is squarely in scope.

Illinois's Biometric Information Privacy Act (BIPA) likewise has a private right of action, statutory damages, and has produced nine-figure settlements. Any product doing face, voice or fingerprint recognition needs written consent and a retention schedule before launch.

Children's privacy

COPPA applies to operators of websites and online services directed to children under 13, and to general-audience services with actual knowledge of collecting from under-13s. It requires verifiable parental consent before collection, a compliant privacy notice, and parental rights of review and deletion.

The amended COPPA Rule was published April 22, 2025, took effect June 23, 2025, with a full compliance date of April 22, 2026 (Federal Register, 16 CFR Part 312). New requirements include: a written information security program; data retention and deletion policies with a prohibition on indefinite retention; separate verifiable parental consent for disclosure to third parties (including for targeted advertising); an expanded definition of personal information covering biometric identifiers (fingerprints, voiceprints, facial templates, gait, iris and retina patterns) and government-issued identifiers; a new mixed-audience definition with age-screening obligations; and new consent methods including text message. Civil penalties are assessed per violation and have exceeded $20,000 per violation in recent inflation-adjusted amounts, with FTC settlements in this area reaching hundreds of millions of dollars.

Separately, a growing set of state age-appropriate design codes and age-verification laws (Nebraska's took effect January 1, 2026; several others are in litigation on First Amendment grounds) impose obligations on services likely to be accessed by minors. This area is unsettled.

Health and financial data

HIPAA applies to covered entities (providers, health plans, clearinghouses) and to business associates — vendors that handle protected health information on their behalf. A digital health startup selling to providers is a business associate and must sign Business Associate Agreements, implement the Security Rule's administrative, physical and technical safeguards, and comply with the Breach Notification Rule (individuals without unreasonable delay and within 60 days; HHS within 60 days for breaches affecting 500+, annually for smaller). A proposed HIPAA Security Rule update would make several previously "addressable" controls mandatory, including MFA and encryption; check its final status.

A direct-to-consumer health app is usually not covered by HIPAA — and founders routinely misstate this in both directions. Such an app is instead covered by the FTC Health Breach Notification Rule (amended 2024, expressly reaching health apps and connected devices), by state health-data laws like My Health My Data, and by general FTC Section 5 authority. The FTC has brought substantial enforcement actions against health apps for sharing data with advertisers.

Financial data: GLBA and its Safeguards Rule reach "financial institutions" defined more broadly than banks — including many fintechs and some lenders and advisers. The amended Safeguards Rule requires a written information security program, a designated qualified individual, risk assessments, access controls, encryption, MFA, vendor oversight, and notification to the FTC within 30 days of a breach affecting 500 or more consumers. PCI DSS v4.0 governs card data; using Stripe, Adyen or similar with tokenization and hosted fields keeps most startups in the lightest self-assessment tier, which is a strong argument for never touching raw card numbers.

Can a founder do this alone?

The baseline, yes. A privacy policy from a reputable generator, DPAs with your subprocessors, a cookie consent tool, a documented deletion process, and a subprocessor list gets a B2B SaaS company most of the way.

A lawyer is required for: any product handling health, biometric, financial or children's data; any GDPR high-risk processing or DPIA; any decision about lawful basis for training AI models on personal data; any breach; and any enterprise contract where you are negotiating privacy terms rather than accepting them.

12. Security obligations and breach notification

All 50 states, DC and the US territories have breach notification statutes. They differ on the definition of personal information, the trigger (many use a risk-of-harm threshold), the timing (some specify "without unreasonable delay," others impose hard deadlines of 30, 45, 60 or 90 days), whether the attorney general must be notified and at what threshold, and whether credit monitoring must be offered. A breach touching users in twenty states means twenty analyses. Layered on top: GDPR's 72 hours, HIPAA's 60 days, the GLBA Safeguards Rule's 30 days, the FTC Health Breach Notification Rule, sector regulators, and contractual notification commitments in customer agreements — which are frequently shorter than any statute, sometimes 24 or 48 hours.

What a startup should actually have, in rough priority order: MFA everywhere and SSO as soon as affordable; least-privilege access with a documented offboarding checklist; encryption in transit and at rest; centralized logging; managed dependency scanning; encrypted, tested backups; a written incident response plan naming who decides, who calls counsel, and who talks to customers; vendor security review for anything touching customer data; and security awareness basics. SOC 2 Type II is not a legal requirement but is a commercial one — enterprise buyers ask for it, and compliance automation platforms (Vanta, Drata, Secureframe) plus an audit typically cost $15,000–$40,000 in year one.

[Practical] The single most useful pre-incident decision: identify breach counsel before you need them, so that the forensic investigation can be run under attorney-client privilege from hour one. Cyber insurance policies usually include a panel of breach counsel and forensics firms; using the panel is typically a condition of coverage.

13. Accessibility

United States

The Americans with Disabilities Act contains no web-specific regulation for private businesses, and the Department of Justice has repeatedly declined to issue Title III web rules. Courts have nonetheless applied Title III to websites and apps, with a circuit split on whether a website must have a nexus to a physical place of public accommodation. The de facto standard cited in consent decrees and settlements is WCAG 2.1 Level AA (WCAG 2.2 AA increasingly).

Litigation exposure is real and sustained. There were 8,667 ADA Title III federal lawsuits in 2025, down 2% from 8,800 in 2024, against a 2021 peak of 11,452 (Seyfarth Shaw, ADA Title III blog, February 2026). California (3,252), Florida (1,823), New York (1,471) and Illinois (659) dominate. A notable 2025–26 shift: New York federal courts have tightened standing requirements in website cases, pushing plaintiffs into New York and New Jersey state courts — so federal filing counts now understate total exposure. Most website claims settle in the $5,000–$25,000 range including plaintiff's fees, with an agreement to remediate; serial plaintiffs and firms file in volume.

DOJ's Title II rule (April 2024) requires state and local government entities to meet WCAG 2.1 AA by April 24, 2026 (entities serving 50,000+ people) or April 26, 2027 (smaller). This matters to startups indirectly but forcefully: if you sell software to cities, counties, public universities or school districts, your product must meet the standard, and procurement will ask for a VPAT/ACR.

European Accessibility Act

Directive (EU) 2019/882 required transposition into national law by June 28, 2025, and obligations for covered products and services placed on the market apply from that date (Greenberg Traurig, July 2025; Davis Wright Tremaine).

Covered services include e-commerce, consumer banking, e-books, electronic communications, transport ticketing, and access to audiovisual media services; covered products include computers, smartphones, e-readers, ATMs, ticketing machines and payment terminals. The technical reference is EN 301 549, which incorporates WCAG 2.1 AA.

It applies to non-EU companies offering covered services to EU consumers. There is a microenterprise exemption for services — fewer than 10 employees and annual turnover or balance sheet total not exceeding €2 million — but note that it applies to services, not products, and that the exemption is measured at the company level. Enforcement is by member states; penalties vary, with Germany's implementing law permitting administrative fines up to €100,000 plus orders to withdraw non-compliant services. There is a transition allowance for service contracts concluded before June 28, 2025, running to June 28, 2030.

[Analysis] A US B2B SaaS company selling to businesses, not consumers, is generally outside the EAA's service scope. A consumer-facing e-commerce site, subscription app or fintech with EU consumers is not.

What a startup should do

Accessibility is unusual among Part A topics in that doing it properly is cheaper than the alternatives and produces a better product. Practically: semantic HTML; keyboard navigability; visible focus states; sufficient color contrast; alt text; labeled form fields; ARIA only where native elements will not do; captions on video; and automated checks (axe-core, Lighthouse, Pa11y) in CI. Automated tools catch roughly a third of issues; manual and assistive-technology testing catches the rest.

Do not rely on an accessibility overlay widget. Overlays are marketed as one-line compliance fixes; accessibility practitioners have criticized them extensively, plaintiffs have sued companies using them, and the FTC has brought action against an overlay vendor's advertising claims. They do not confer a defense.

Can a founder do this alone?

Yes for the engineering work — this is a developer skill, learnable from the WAI guidance. Bring in a specialist for: a formal audit/VPAT if you sell to government or large enterprises; remediation of a complex application; and — immediately — a demand letter or lawsuit, which is counsel's job.

14. Consumer protection and advertising law

FTC Act Section 5 prohibits unfair or deceptive acts or practices. Everything below is a specific application of it, and it applies to startups at any size.

Advertising substantiation. Objective claims must be substantiated before dissemination — "competent and reliable scientific evidence" for health, safety or efficacy claims. Startups get into trouble with performance claims ("cut your costs 40%") and AI claims. The FTC's "Operation AI Comply" has brought multiple actions against companies overstating AI capabilities, and the Commission has stated plainly that there is no AI exception to consumer protection law. Do not claim your product is AI-powered if it is a human in a loop; do not claim accuracy figures you cannot evidence.

Endorsements and reviews. The Endorsement Guides require clear and conspicuous disclosure of material connections — payment, free product, employment, family relationship, affiliate commission, or contest entry (FTC Endorsement Guides FAQ). Employees promoting the company's product must disclose the employment relationship, in the post itself, not just on a profile.

The Rule on the Use of Consumer Reviews and Testimonials (final rule announced August 2024, effective 60 days after Federal Register publication) goes further and, critically, carries civil penalty authority, which the Endorsement Guides do not (FTC press release, August 2024). It prohibits: creating, buying or selling fake or AI-generated reviews; compensation conditioned on a particular sentiment; undisclosed insider reviews by officers, managers or their relatives; company-controlled websites presented as independent review sites; using unfounded legal threats or intimidation to suppress reviews, or misrepresenting that displayed reviews are all reviews; and buying or selling fake social media indicators.

[Practical] Two startup practices that violate this rule and are still common: seeding a launch with reviews written by employees and friends without disclosure, and offering a discount "for a 5-star review." Offering an incentive for a review is permissible with disclosure; conditioning it on a positive review is not.

Negative option / "click to cancel." The FTC's 2024 Negative Option Rule was vacated in its entirety by the Eighth Circuit on July 8, 2025, days before its compliance date, on procedural grounds (failure to conduct a required preliminary regulatory analysis). In March 2026 the FTC issued an Advance Notice of Proposed Rulemaking to revive it, with comments due April 13, 2026 (Jones Day, May 2026; Gibson Dunn). As of September 2026 no replacement rule is in force.

Do not read that as permission to make cancellation hard. Three things remain fully in force:

1. ROSCA (15 U.S.C. §8403) requires clear and conspicuous disclosure of all material terms before obtaining billing information, express informed consent to the charge, and a simple mechanism to stop recurring charges. The FTC continues to bring ROSCA cases actively.
2. FTC Act Section 5 reaches dark patterns and deceptive enrollment or cancellation flows independently.
3. Roughly 30 states have automatic-renewal statutes, several stricter than the vacated federal rule. California's requires that consumers who signed up online be able to cancel online, in the same number of steps, and requires annual renewal reminders for certain terms. State AGs and private class actions enforce these.

[Practical] Build cancellation to the California standard and you are compliant almost everywhere, whatever the FTC does next.

Pricing and fees. The FTC's Rule on Unfair or Deceptive Fees ("junk fees" rule) took effect May 12, 2025 for live-event ticketing and short-term lodging. It does not reach SaaS, but its logic — total price disclosed up front, mandatory fees not hidden until checkout — reflects where enforcement and state law are heading.

15. Advertising and marketing communications law

CAN-SPAM governs commercial email in the US. Requirements: accurate header and "from" information; a subject line that is not deceptive; identification of the message as an advertisement; a valid physical postal address; a clear opt-out mechanism; honoring opt-outs within 10 business days; and responsibility for what your vendors send on your behalf. Civil penalties run up to $53,088 per violating email (FTC CAN-SPAM Compliance Guide). Note what CAN-SPAM does not require: prior consent. US commercial email is opt-out, not opt-in — which is why cold email is lawful in the US and largely unlawful in the EU (GDPR/ePrivacy), Canada (CASL, opt-in with penalties up to CAD $10 million) and elsewhere.

TCPA governs calls and texts, and it is the highest-litigation-exposure statute in this chapter for a consumer-facing startup. Statutory damages are $500 per violation, trebled to $1,500 for willful or knowing violations, uncapped and per message. A single automated text campaign to 20,000 numbers without proper consent is a theoretical $10–30 million exposure. The plaintiffs' bar is organized, well-capitalized and specialized.

Current status:

• The FCC's "one-to-one consent" rule was vacated by the Eleventh Circuit on January 24, 2025 in Insurance Marketing Coalition v. FCC, which held the FCC exceeded its statutory authority. The FCC subsequently repealed it. Lead-generation practices that the rule would have banned are not, therefore, federally prohibited by that rule (Kelley Drye; Morrison Foerster, January 2025).
• The FCC's consent revocation rule — requiring that a revocation be honored across all marketing messages and channels, within 10 business days — has had its remaining compliance obligations delayed to January 31, 2027.
• None of this reduces baseline TCPA risk. Prior express written consent is still required for marketing calls and texts using an automatic telephone dialing system or prerecorded voice, the National Do Not Call Registry still applies, and state mini-TCPAs (Florida, Oklahoma, Washington, Maryland and others) add their own, sometimes stricter, requirements and private rights of action.

[Practical] If your product sends SMS, treat consent capture as a first-class engineering concern. Record the exact consent language shown, the timestamp, the IP address, and the page. In litigation, the company that can produce that record wins early and cheaply; the company that cannot pays.

16. AI-specific obligations

This is the fastest-moving area in Part A. Two of the three major frameworks below were rewritten or delayed within the twelve months before this chapter's research date. Verify everything.

EU AI Act

The AI Act (Regulation (EU) 2024/1689) entered into force August 1, 2024 with a phased application schedule. That schedule was substantially rewritten by the "Digital Omnibus" agreement reached in 2026 (Gibson Dunn, EU AI Act Omnibus Agreement).

Current timeline:

[Analysis] What this means for a small startup. The overwhelming majority of startups are neither prohibited-practice operators nor GPAI model providers nor high-risk system providers. What most will actually face is Article 50 from August 2, 2026: if your product includes a chatbot or generates synthetic media, users must be told. That is a UI change and a disclosure line, not a compliance program.

The companies that should take this seriously now are those building recruitment screening, credit decisioning, educational assessment, or medical software for the EU — Annex III and Annex I categories, where conformity assessment, risk management systems, data governance, logging, human oversight and post-market monitoring apply, and where the cost is a genuine multi-hundred-thousand-euro program. The deferral to December 2027 is breathing room, not a reprieve. Penalties reach €35 million or 7% of global turnover for prohibited practices and €15 million or 3% for most other breaches.

US state AI laws

Colorado. SB 24-205 — the first comprehensive US state AI law, imposing duties of reasonable care to prevent algorithmic discrimination, risk management programs and impact assessments — was delayed from February 2026 to June 2026, and then repealed and replaced by SB 26-189 in May 2026, effective January 1, 2027 (Crowell & Moring). The replacement is much narrower: it drops the risk management program, impact assessment and duty-to-prevent-discrimination requirements entirely, and instead imposes four operational duties on deployers of "covered automated decision-making technology" making consequential decisions in employment, housing, credit, insurance, healthcare, education and government services — (1) notify before ADMT interaction, (2) disclose within 30 days of an adverse outcome, (3) correct inaccurate personal data on request, (4) provide meaningful human review and reconsideration. Enforcement is AG-only, as a deceptive trade practice, with a 60-day cure period that sunsets January 1, 2030. No private right of action.

Texas. TRAIGA (HB 149) took effect January 1, 2026 (Haynes Boone; Baker Botts). It is intent-based: it prohibits developing or deploying AI intended to incite violence or crime, infringe constitutional rights, or unlawfully discriminate — and expressly provides that disparate impact alone is insufficient to show discriminatory intent. Most substantive disclosure duties fall on government agencies, not private companies. There is a 36-month regulatory sandbox, and a safe harbor for entities following the NIST AI Risk Management Framework. Enforcement is AG-only with a 60-day cure period; penalties $10,000–$200,000 per violation plus $40,000 per day for continuing violations. For a typical private startup, TRAIGA imposes very little affirmative work — the practical response is to adopt NIST AI RMF language and not build anything in the prohibited categories.

California. Several laws, most of which do not reach small companies (Latham & Watkins):

• SB 53 (Transparency in Frontier Artificial Intelligence Act) applies to models trained above 10^26 FLOPs and, for the heavier obligations, developers with over $500M annual revenue. Penalties up to $1M per violation. Effectively no startup is in scope.
• SB 942 (AI Transparency Act), requiring a free AI detection tool and content provenance from providers of "highly trafficked" generative AI systems, was delayed from January 1, 2026 to August 2, 2026 by AB 853.
• SB 243 (companion chatbots) requires disclosure that the bot is not human, protections around self-harm content, three-hourly reminders to minors, and restrictions on sexually explicit output to minors. Customer service bots, game NPCs and voice assistants are exempt. This one does reach small consumer AI startups.
• AB 2013 requires generative AI developers to publish a summary of training data.
• CCPA ADMT regulations (section 11) apply from January 1, 2027.
• California Civil Rights Department regulations on automated decision systems in employment took effect October 1, 2025.

Illinois amended its Human Rights Act (HB 3773, effective January 1, 2026) to bar discriminatory use of AI in employment decisions and require notice when AI is used. New York City Local Law 144 requires annual independent bias audits and candidate notice for automated employment decision tools. Utah's AI Policy Act requires disclosure on request in consumer interactions, with heightened duties for regulated professions.

The practical compliance burden on a small startup

[Analysis] Stated plainly, because the discourse here is unhelpfully alarmist in both directions:

• If you are using AI as a feature in an ordinary B2B product: your obligations in 2026 are approximately (a) tell EU users when they are talking to a bot, from August 2, 2026; (b) do not make unsubstantiated AI claims in marketing (FTC); (c) get your data processing and training-data lawful basis right (GDPR, state privacy laws); (d) if you handle personal data, expect enterprise customers to ask about AI in security questionnaires. That is a week of work, not a program.
• If you are making consequential decisions about people — hiring, credit, housing, insurance, education, healthcare — you are in the regulated category in multiple jurisdictions simultaneously, with different tests, and you need counsel. This is the real dividing line.
• If you are training frontier models, you know it, and you have lawyers.

The cheapest durable investment is adopting the NIST AI Risk Management Framework vocabulary and a lightweight version of its practices: an inventory of AI systems and their uses, documented testing, a human-review path for adverse outcomes, and a record of what you did. It is voluntary, it is the express safe harbor in Texas, it maps onto ISO/IEC 42001, and it is what enterprise buyers and most regulators are converging on.

17. Industry-specific regulation

A compressed map. Each of these is a "you need a specialist lawyer before you launch" category, without exception.

Fintech and payments. Moving other people's money generally requires money transmitter licenses in most of the ~50 US jurisdictions — each with its own application, surety bond (commonly $25,000–$500,000 per state), minimum net worth requirement, background checks, and audited financials. All-in costs to license nationally are commonly cited in the $1–3 million range over 18–36 months. FinCEN MSB registration and a BSA/AML program (written policy, designated officer, KYC/CIP, SAR/CTR filing, independent testing) are federal overlays. Lending brings state lender licensing, usury caps, TILA, ECOA, FCRA and UDAAP. The startup answer is almost always to operate under a sponsor bank or a licensed partner — BaaS providers, or agent-of-payee / payment-facilitator arrangements under Stripe, Adyen, Unit, Treasury Prime, Synapse-style models — which trades margin and dependency for not needing 50 licenses. Note that this market has had notable failures; diligence your sponsor's regulatory standing carefully.

Healthcare. HIPAA (section 11); FDA regulation of Software as a Medical Device — where the dividing line between a wellness product and a regulated device turns on intended use claims, and 510(k) or De Novo pathways cost six figures and take a year or more; Clinical Decision Support guidance; state telehealth licensure and the corporate practice of medicine doctrine (which in many states requires a friendly-PC/MSO structure); Anti-Kickback Statute and Stark Law for anything touching referrals; 42 CFR Part 2 for substance use disorder records; and information blocking rules under the Cures Act.

Insurance. Producer licensing state by state; MGA/MGU arrangements; rate and form filing with each state DOI; a full carrier requires capital in the tens of millions. Most insurtechs start as agencies or MGAs.

Education. FERPA for student records (flowing through to vendors as "school officials"); COPPA for under-13 users; state student privacy laws (California SOPIPA and roughly 40 state analogues) restricting targeted advertising and profiling; and accessibility obligations that bite hard when selling to public institutions (section 13).

Food, beverage and supplements. FDA registration and FSMA preventive controls; labeling and nutrition rules; state cottage food and licensing regimes; alcohol requires TTB permits plus a three-tier state system; supplements fall under DSHEA with structure/function claim limits and no pre-market approval but real FTC and FDA enforcement on claims.

Other categories with their own regimes: cannabis (still federally illegal, with banking consequences), firearms, tobacco/vapor, gambling and sweepstakes, transportation and drones (FAA Part 107 and beyond), real estate and mortgage, securities (broker-dealer, RIA, transfer agent, crowdfunding portals), telecom, and anything defense-related (ITAR/EAR).

18. Insurance

Four lines matter to almost every startup, plus workers' comp (section 7). Median 2026 premiums from a startup-focused broker's book of business (Vouch, Startup Insurance Costs in 2026) — these are medians across a self-selected client base, so treat them as orientation, not quotes:

[Practical] Sequence: general liability when you sign a lease or a first enterprise contract; E&O when a customer contract requires it (they will); D&O at the first priced round, because the first outside director will ask; cyber once you hold meaningful customer data; EPLI once you have a real team, particularly in California and New York. Workers' comp from the first employee.

Two things founders get wrong: buying D&O late (it is claims-made, so it must be in force when the claim is made, and prior-acts coverage is negotiable), and buying limits that do not match contractual requirements — read the insurance clause of your enterprise agreements before you bind coverage.

Can a founder do this alone? Yes, through a broker — which costs nothing extra, since brokers are paid by carriers. Use a broker who works with startups; the difference in how they structure D&O and E&O is material.

19. Terms of service, privacy policies, DPAs and subprocessors

Terms of service. Enforceability turns on assent: clickwrap (affirmative checkbox or button with the terms linked adjacent) is regularly enforced; browsewrap (a footer link, no affirmative act) frequently is not. Record what version each user accepted and when. Substantively, a SaaS ToS should address: license grant and restrictions; acceptable use; ownership of IP and of customer data; usage/feedback rights (carefully — an overbroad grant over customer data is a deal-killer in enterprise sales, and increasingly so where AI training is implied); fees, taxes, auto-renewal and cancellation (section 14); warranty disclaimers; limitation of liability (typically capped at 12 months of fees, with carve-outs for indemnity, confidentiality and IP); indemnification (yours for IP infringement, the customer's for their content); termination and data return/deletion; governing law, venue, and whether you want arbitration and a class action waiver; modification mechanics with notice; and export control and sanctions representations.

Privacy policy. Legally required by CalOPPA, every state comprehensive law, GDPR Articles 13–14, COPPA and others. It must accurately describe what you actually do. The most common enforcement theory in this area is not "you had no policy" — it is "your policy said one thing and your product did another." That is a Section 5 deception claim and a state AG claim simultaneously. Review it whenever you add a vendor or a data flow.

Data processing agreements and subprocessors. Under GDPR Article 28, a controller must have a written contract with each processor covering subject matter, duration, nature and purpose, types of data and categories of data subjects, and a defined set of processor obligations — including that the processor may not engage a sub-processor without authorization, and must flow the same terms down. US state laws impose analogous contractual requirements.

Practically, a startup is a processor for its business customers' data and a controller for its own users' and employees' data — and is usually both at once. That means: publish a DPA (and sign the customer's when they insist); maintain a public subprocessor list with a notification mechanism for changes (typically 30 days' advance notice with a right to object); execute SCCs for transfers; sign DPAs with your own vendors — your cloud provider, analytics, support tool, email provider, error tracker, and every AI API you send customer data to; and maintain Article 30 records.

[Practical] Two failure modes worth naming. First, adding a new AI subprocessor without notice — increasingly the item enterprise customers object to, and the one most likely to be caught by a contractual notification clause you forgot you signed. Second, an internal tool sending customer data somewhere your subprocessor list does not mention. Keep the list accurate; it is the document customers check.

Can a founder do this alone? Templates are adequate for a self-serve, low-price product. Get counsel when you sell to enterprises (where you will be negotiating, not presenting, and the liability cap and indemnity are real money), handle regulated data, operate in the EU, or are drafting anything involving customer data and AI training.

20. International operations

Entity structure. Do not create foreign subsidiaries speculatively. The usual sequence: sell internationally from the US entity; hire internationally through an employer of record (roughly $500–$700 per person per month); form a local subsidiary only when headcount, tax efficiency, regulatory requirement or customer expectation demands it. A UK or Irish subsidiary as an EU/EEA base costs roughly $3,000–$10,000 to establish and $5,000–$20,000/year to maintain in accounting, filings and local director requirements.

Permanent establishment. The core risk of operating abroad without an entity. A fixed place of business, or a dependent agent habitually concluding contracts in a country, can create a taxable presence there — triggering corporate tax, filing obligations and penalties. Sales staff closing deals abroad is the classic trigger. A senior employee working remotely from another country for an extended period can be another.

Transfer pricing. Once you have two related entities in different countries, transactions between them must be priced at arm's length. The standard startup arrangement is a cost-plus arrangement: the foreign subsidiary provides R&D or support services to the US parent and is compensated at cost plus a markup (commonly 5–15%, depending on function and benchmarking). You need an intercompany services agreement and, above modest thresholds, contemporaneous documentation. Penalties for unsupported positions are meaningful, and this is an early diligence item in cross-border acquisitions.

VAT/GST. Covered in section 10. The headline: digital services are taxed where the customer is, thresholds for non-established sellers are often zero, and a merchant of record is a legitimate way to avoid the problem entirely.

Data residency and localization. Beyond GDPR transfers (section 11): China's PIPL requires security assessments or standard contracts for outbound transfers and localization for critical information infrastructure operators; India's DPDP Act permits transfers except to restricted countries; Russia, Vietnam, Indonesia, Saudi Arabia, Nigeria and others have localization requirements of varying breadth. Separately, EU enterprise and public-sector customers increasingly demand EU data residency contractually, independent of any legal requirement. Building region-selectable data storage early is much cheaper than retrofitting it.

Sanctions and export control. Often ignored by software startups and genuinely risky. OFAC sanctions are strict liability. Screen customers against the SDN list, block access from comprehensively sanctioned jurisdictions, and note that encryption in your product may make it subject to EAR export classification — most commercial software qualifies for mass-market treatment under ECCN 5D992 with a self-classification report, but this requires a deliberate determination, not an assumption.

21. What to do and when — a prioritized sequence

Approximate, and dependent on business model. A consumer health app and a developer-tools company have different orders.

Before writing any code, or immediately after:

1. Confirm nobody on the team has a prior-employer agreement that captures the work. If in doubt, ask a lawyer now, not later.
2. Trademark knockout search before committing to a name.

At formation (week 1–2): 3. Incorporate (Delaware C-corp if venture-track; LLC if not). 4. Founder IP assignment and CIIAAs signed by everyone, with "hereby assign" language. 5. Restricted stock issued, purchased for actual consideration, with vesting. 6. 83(b) elections filed within 30 days — this deadline cannot be cured. 7. EIN, business bank account, registered agent. 8. Founder agreement / bylaws / initial board consents.

First 90 days: 9. Contractor template with IP assignment — use it for every contractor, with no exceptions. 10. Privacy policy and terms of service matching what the product actually does. 11. Bookkeeping set up; do not commingle personal and company funds. 12. Open-source scanning turned on and a one-page license policy. 13. Trademark application if the name is settled. 14. Basic security hygiene: MFA, SSO where possible, access control, backups.

First employee: 15. Payroll platform; state registrations; workers' comp; new hire reporting. 16. Offer letter with at-will language; CIIAA before day one. 17. Equity incentive plan adopted; first 409A valuation before the first grant. 18. Employment practices basics: handbook if in CA/NY/WA, required trainings, posters.

First revenue: 19. Sales tax nexus monitoring turned on. 20. E&O insurance if customer contracts require it; general liability. 21. DPA and subprocessor list published if you handle customer data.

First priced round: 22. D&O insurance. 23. Clean cap table; all consents and stock issuances papered; diligence-ready data room. 24. Board formalities: real minutes, real consents, real approval of option grants.

Scaling (25+ people, multi-state, enterprise customers): 25. SOC 2 Type II. 26. Formal privacy program; GDPR representative if EU users. 27. Accessibility audit and VPAT if selling to government or large enterprise. 28. Employment counsel relationship established before you need it. 29. Sales-tax registrations and filings in nexus states; voluntary disclosure for any backlog. 30. AI governance inventory if AI touches consequential decisions.

Ongoing, annually: Delaware franchise tax and annual report by March 1; 409A refresh; insurance renewal; privacy policy review; corporate minute book updated; tax returns and elections; trademark Section 8 at year 5–6.

22. The moments that genuinely require a professional

A lawyer, without exception:

• Any founder or employee who built relevant work while employed elsewhere.
• Any material code written by a contractor without a signed IP assignment.
• Any financing, convertible instrument, SAFE at non-standard terms, or priced round.
• Any co-founder departure, removal, or equity renegotiation.
• The first termination of anyone who has complained about anything, any accommodation request, any harassment complaint, and any layoff.
• Any acquisition, letter of intent, or term sheet — including a "friendly" acqui-hire.
• Any lawsuit, demand letter, cease-and-desist, subpoena, or regulatory inquiry.
• Any data breach — engaged early, so the investigation is privileged.
• Entering fintech, healthcare, insurance, education, cannabis, gambling or anything defense-adjacent.
• Building anything that makes consequential decisions about people.
• Any patent non-provisional application.
• Company wind-down, dissolution, or assignment for the benefit of creditors.

An accountant or tax professional, without exception:

• The first tax return and every one after.
• Any entity conversion.
• Any equity compensation design, 409A cadence, or QSBS analysis.
• R&D credit, payroll offset election, and §174A decisions.
• The first employee or contractor in a new state or country.
• Crossing a sales-tax nexus threshold.
• Any foreign subsidiary, foreign parent, or foreign founder.
• Pre-exit planning, ideally 12+ months before a transaction.

A specialist:

• Insurance broker (free to you; use one).
• Registered patent attorney or agent for anything patentable.
• Trademark attorney for a contested application or international filings.
• Accessibility auditor for a VPAT or a demand letter.
• Privacy counsel for regulated data or GDPR high-risk processing.
• Investment banker or M&A advisor for a sale above a modest size (see Part B).

Where the money goes wrong: founders spend $5,000 on formation they could have done for $500, then skip the $1,500 conversation about a prior-employer agreement that ends up costing the company a million dollars in an acquisition adjustment. Spend on the irreversible, save on the routine.

PART B — Founder survival and sustainability

How to read Part B

Part A was about obligations to other people. Part B is about what running a company does to the person running it, and what can be done about that.

A note on the evidence. Research on founder wellbeing is weaker than the confidence with which it is usually cited. Most of it comes from self-selected online surveys with unknown response rates, samples drawn from the networks of the organization running the survey, and outcome measures that are self-reported rather than clinically assessed. That does not make the findings useless — consistent results across independent samples mean something — but it does mean the precise percentages should be held loosely. Where a number below comes from such a sample, that is stated.

A note on mental health. This section uses clinical terms only where sources use them, distinguishes between diagnosed conditions and self-reported distress, and does not dramatize. Burnout is a recognized occupational phenomenon, not a medical diagnosis. Depression and anxiety disorders are medical conditions that respond to treatment. If any of this describes you: professional support exists, it works, and seeking it is not a referendum on your fitness to run a company. Nothing here is a treatment recommendation.

B1. The workload, honestly

The founder workload discourse has two failure modes: the hustle-culture claim that 100-hour weeks are the price of admission, and the reactive claim that nobody should ever work hard. Neither is accurate.

What is defensible:

• Hours are high but not uniformly extreme. Surveys of founders consistently land in the 50–70 hour range for typical weeks, with spikes — fundraising, launches, crises, due diligence — that go well beyond. The 100-hour week exists; it is not the steady state for most people, and the founders who sustain it longest are usually the ones who protect recovery between spikes.
• The load is qualitatively different from employment, not just quantitatively. Three features do most of the damage: there is no one to escalate to; the decisions are consequential and the information is always inadequate; and the work is never finished, because the boundary of "my job" is "everything not otherwise assigned." Founders often describe the cognitive load — the constant background process of unresolved problems — as harder than the hours.
• Context-switching is the specific tax. A founder's day fragments across fundraising, product, hiring, customer escalations, payroll and legal. Fragmentation reduces the quality of the deep work that actually determines whether the company succeeds.
• The asymmetry compounds. Employees can leave a failing company. Founders usually cannot, because leaving destroys the value of everything they have already invested and carries obligations to everyone who joined.

[Analysis] The useful reframing is that founder workload is a capital allocation problem, not a virtue test. Your attention is the scarcest input the company has. Spending it on things that do not move the outcome — including the performance of working hard — is a misallocation. The founders who last are not the ones who work least; they are the ones who are ruthless about what they work on.

B2. Burnout and mental health: what the research actually shows

The best-known study

Michael Freeman and colleagues (UCSF and UC Berkeley), "Are Entrepreneurs 'Touched with Fire'?" — pre-publication manuscript dated April 17, 2015, with a later peer-reviewed version (Freeman's research page; full manuscript text). The study surveyed 242 entrepreneurs and 93 demographically matched comparison participants using an anonymous online self-report instrument.

Findings as reported:

• 49% of entrepreneurs reported one or more lifetime mental health conditions, versus a significantly lower rate in the comparison group; 32% reported two or more, and 18% three or more.
• Depression: 30%. ADHD: 29%. Substance use conditions: 12%. Bipolar diagnosis: 11%.
• Anxiety: 27% among entrepreneurs versus 26% in the comparison group — no significant difference. This is routinely omitted when the study is cited, and it matters: the study does not show entrepreneurs are more anxious.
• Entrepreneurs without symptoms themselves reported significantly more mental health conditions among first-degree relatives; 23% were asymptomatic members of highly symptomatic families. The authors' interpretation is that some traits associated with these conditions may be adaptive for entrepreneurship at subclinical levels.

The authors' own stated limitations are worth reproducing: reliance on self-report rather than clinical assessment, possible selection bias, shared method variance, differences between the comparison group and the entrepreneur sample, and a cross-sectional design that cannot establish causation. The study cannot tell you whether entrepreneurship causes distress, whether people prone to these conditions are drawn to entrepreneurship, or both. The comparison group of 93 is small.

[Analysis] The honest summary: this is a suggestive, widely cited, methodologically limited study, and it is usually cited far more confidently than it deserves. "49% of founders have a mental health condition" is a self-reported lifetime prevalence in a self-selected sample of 242 people. It is not a population estimate.

More recent survey data

Startup Snapshot's "The Untold Toll" (2023), surveying over 400 founders, reported that 72% said entrepreneurship had affected their mental health, with 44% reporting high stress, 37% anxiety, 36% burnout, 13% depression and 10% panic attacks. It also found 81% were not open about their stress, fears and challenges; 77% had not sought professional psychological help; and that founders' primary support was spouses or family (76%), then co-founders (49%), with only 10% turning to investors (Startup Snapshot, The Untold Toll; Forbes coverage, April 2023).

Caveats: self-selected respondents, an outreach base skewed toward the report sponsors' network, self-reported measures, and a topic that likely attracts respondents who have something to say about it. Later surveys from accelerators, VC firms and founder communities report figures in similar ranges, and they share the same design weaknesses. Several 2025–26 "founder burnout statistics" circulating online cite figures with no traceable methodology at all; treat those as marketing.

What survives the caveats. Across independent samples with different sponsors, two findings replicate robustly enough to act on:

1. Founders report high rates of stress, burnout symptoms and mood difficulty — higher than matched comparison groups where comparisons exist.
2. Founders disclose far less than they experience. The 81%-not-open figure, or something close to it, appears repeatedly. This is the more actionable finding, because concealment is both a consequence of the environment and a cause of further harm: it isolates people, delays help-seeking, and creates a false baseline where every founder believes everyone else is coping better than they are.

Burnout specifically

The World Health Organization classifies burnout in ICD-11 as an occupational phenomenon, not a medical condition, characterized by three dimensions: exhaustion, mental distance or cynicism toward the work, and reduced professional efficacy. The third dimension is the one founders notice last and that damages companies most — the work still gets done, but judgment degrades, decisions get deferred, and the quality of thinking falls while the volume of activity stays constant.

Practical markers that something has changed, drawn from the occupational literature rather than founder folklore: sleep disruption that persists after the immediate stressor resolves; irritability disproportionate to events; loss of interest in parts of the work that were previously engaging; avoidance of specific tasks (often the ones involving other people); physical symptoms; and a growing gap between hours worked and output produced.

What helps, stated without prescription:

• Sleep is not negotiable and is the first thing sacrificed. The evidence that sleep deprivation degrades judgment, emotional regulation and risk assessment is among the most robust in the field.
• Structural fixes beat willpower fixes. Delegating a category of work permanently does more than resolving to manage time better.
• A confidential outlet that is not your co-founder, your investors or your spouse. Founder peer groups, an executive coach, or a therapist. Each does something different; the therapist is the one qualified to treat a clinical condition.
• If symptoms are persistent, severe, or include thoughts of self-harm, that is a medical situation and a physician or licensed mental health professional is the right contact — promptly. In the US, the 988 Suicide and Crisis Lifeline is available by call or text.

B3. Financial stress and founder pay

What founders actually pay themselves

Kruze Consulting's 2026 benchmarks, drawn from actual payroll records of roughly 800 US venture-backed startup clients rather than a survey — a meaningfully better methodology than self-report, though limited to VC-backed companies that use one accounting firm (Kruze Consulting, Startup CEO Salary Report 2026):

Context this needs. These are funded companies. The distribution across all founders is dramatically wider and lower. Pre-seed and bootstrapped founders frequently pay themselves nothing, or something below market for years. Solo founders of profitable small businesses may pay themselves more than a Series A founder. The figures above describe a specific, well-capitalized minority.

The norms that actually govern

[Analysis] Three principles hold across stages:

1. Pay yourself enough not to be financially distressed. A founder worrying about rent makes worse decisions — shorter-horizon, more risk-averse in the wrong places, more susceptible to bad terms. Investors who understand this say so explicitly; the "founders should suffer" position is both cruel and counterproductive.
2. Pay yourself less than you would earn elsewhere. The gap is the signal — to investors, to employees, and to yourself — that you are betting on the equity. A founder paying themselves a full market senior-engineer salary at seed stage is asking investors to fund a lifestyle.
3. Raise it at inflection points, transparently, with board approval. Founder compensation should be a board decision documented in minutes, not a self-service adjustment. It is also a common diligence flag.

The financial risk profile nobody explains in advance

• Opportunity cost is the largest number and is invisible. Five years at a $100,000 discount to market is $500,000 in foregone income, plus foregone 401(k) match, plus foregone RSU appreciation at a large employer. That is the real cost of the attempt, and it should be compared to the realistic expected value of the equity, not the dream case.
• Illiquidity is near-total. Founder equity is typically unsaleable for years. You can be worth ten million dollars on paper and be unable to make a mortgage down payment.
• Personal guarantees convert limited liability into unlimited liability. Landlords, equipment lessors, some lenders and some credit lines will ask. Resist, negotiate a cap, or understand precisely what you are signing — a personal guarantee on a five-year office lease has ended founders' personal finances after the company itself failed cleanly.
• Exercise cost. Founders holding options rather than stock (rare) and employees generally face the problem that exercising costs real cash plus tax. This is the mechanism by which people who built a company end up owning none of it.
• Health insurance. Leaving employment means COBRA (expensive, time-limited) or the individual marketplace. For a founder with a family or a chronic condition, this is a material and frequently underestimated line item.

[Practical] A defensible personal financial baseline before starting: 6–12 months of personal runway in cash, health coverage arranged, any personal debt with aggressive terms addressed, and an explicit conversation with anyone whose finances are tied to yours about how long the attempt lasts before you re-evaluate. Setting a time or money limit in advance is not defeatism; it is the only way to make the decision to stop with a clear head, because you will not have one later.

B4. Hiring pressure and the boundary problem

Hiring pressure is the specific distortion created by having raised money: the round is sized against a hiring plan, the plan becomes a commitment, and the commitment becomes hiring people you would not otherwise hire, at a pace you cannot support, to demonstrate progress. The pattern is well documented in post-mortems — scale ahead of product-market fit, then a layoff.

Two guardrails that hold up:

• Hire against demonstrated, repeated pain, not against a plan. If a role's absence is not currently causing a specific, recurring failure, the role is speculative.
• A bad hire costs far more than an unfilled seat. Recruiting cost, ramp time, management attention, the opportunity cost of the work not done, the severance, and — in small teams — the damage to everyone else's sense of what the standard is.

Work-life boundaries. The honest position is that early-stage founding does not permit clean separation, and pretending otherwise produces guilt rather than balance. What does work:

• Defend a small number of non-negotiable commitments absolutely rather than trying to bound the whole job. One dinner, one morning, one weekly obligation that does not move. Small, absolute commitments survive; large, aspirational ones do not.
• Separate urgency from importance explicitly, because in a startup everything presents as urgent and almost nothing is.
• Recognize that always-on is a management choice with team consequences. A founder who sends messages at 2am establishes an expectation regardless of what they say about it. This is one of the few places where founder behavior directly determines whether the company burns out its staff.
• Take actual time off, and be visible about it. Not for virtue — because the alternative is that nobody else does either, and because a company where nothing can happen without you is a company with a structural problem you have not fixed.

B5. Co-founder conflict: managing it once it exists

Prevention — vesting, role clarity, tie-breakers, testing the relationship — is covered in the founders and teams chapter. This is the harder problem: what to do when it has already happened.

Diagnose the category first. Most founder conflict is one of four things, and the remedies are different:

1. Jurisdictional — unclear decision rights. Fixable by writing down who decides what, with a real tie-breaker. The most common and the most tractable.
2. Performance — one founder is not delivering, and everyone knows. The hardest to name and the most corrosive to leave unnamed.
3. Directional — genuine disagreement about strategy. Resolvable by agreeing on what evidence would settle it and going to get that evidence.
4. Relational — accumulated resentment that has detached from any specific issue. This is the one that needs outside help.

What actually helps:

• Name it early and specifically. The cost of the conversation rises every week it is postponed, and unspoken conflict routes itself into proxy disputes about hiring, spending and product.
• Use a third party before it is a crisis. A trusted board member, an experienced founder, or a professional mediator. Bringing in a mediator is not an admission of failure; it is cheaper than the alternative by orders of magnitude.
• Separate the relationship question from the equity question. Conflating them makes both unsolvable.
• If a founder departs, do it cleanly and paper it completely. Separation agreement, release, treatment of unvested shares under the repurchase right, negotiated acceleration if warranted, resignation from the board and all officer positions, return of company property, reaffirmation of IP assignment and confidentiality, and an agreed external narrative. An un-papered founder departure is a permanent cloud on the cap table and a diligence problem forever. This is a lawyer moment, without exception.
• Vesting is what converts catastrophe into expense. A founder who leaves at eighteen months with a four-year schedule keeps roughly 37.5% of their grant rather than all of it. Without vesting, they keep everything, contribute nothing, and hold a blocking position.

B6. Conducting layoffs

Legal mechanics. The federal WARN Act applies to employers with 100 or more employees (excluding certain part-timers, or with part-timers counted where total weekly hours exceed 4,000). It requires 60 days' written notice before a plant closing (shutdown of a single site causing employment loss for 50+ employees in a 30-day period) or a mass layoff (reduction in force at a single site affecting at least 33% of active employees and at least 50 employees, or 500+ employees regardless of percentage). Notice must go to affected employees or their representatives, the state dislocated worker unit, and the chief elected official of the local government unit (20 CFR Part 639). Limited exceptions exist for faltering companies, unforeseeable business circumstances and natural disasters — they reduce, not eliminate, the notice obligation.

State "mini-WARN" acts are stricter and catch smaller companies. California's applies at 75 employees; New York's at 50 employees with a 90-day notice period; New Jersey requires severance. A 60-person startup can be exempt federally and fully covered by state law. Check before you plan the date.

Other legal requirements: final pay timing under state law; accrued PTO payout where required; COBRA notices; and — if you offer severance in exchange for a release of claims, to employees 40 or older — the Older Workers Benefit Protection Act requires 21 days to consider (45 in a group termination, with disclosure of the ages and job titles of those selected and not selected) and 7 days to revoke after signing. Getting the OWBPA mechanics wrong voids the release, which is the entire reason you paid severance.

Doing it decently. The operational advice that experienced operators converge on:

• Cut once, and cut deeper than feels necessary. Serial layoffs destroy trust more thoroughly than one larger one. The second round is when the people you most wanted to keep start interviewing.
• Decide on roles, not people, and document the criteria before you apply them. Then run an adverse-impact check across age, sex, race and protected leave status before finalizing. This is both the right thing and the thing that prevents a discrimination claim.
• Tell people individually, in real time, by a human they know. Not a mass email, not a calendar invite with no context. The 15-minute conversation should be direct in the first sentence.
• Be generous within your means, and say what your means are. Severance, extended health coverage, and — where possible — an extended option exercise window, which costs the company nothing in cash and is worth a great deal to someone who has just lost their income.
• Communicate to everyone remaining within the hour, with the actual reasoning, the actual numbers, and whether more is coming. Say "we do not anticipate further reductions" only if it is true.
• Expect the survivors to be worse off than you think for several weeks. Productivity drops; so does trust. Neither is fixed by encouragement.

[Practical] Do not run a layoff without employment counsel. The cost is a few thousand dollars. The cost of a defective release, a WARN violation (back pay and benefits for the notice period, plus civil penalties), or a discrimination claim is very much more.

B7. Pivoting

A pivot is a change in strategy without a change in vision. Most successful startups made at least one substantial one.

The decision is genuinely hard because both failure modes are real: pivoting too early abandons something that needed more time, and pivoting too late burns the runway that made the next attempt possible.

Signals that favor pivoting:

• Retention curves that do not flatten, across cohorts, after real attempts to fix them. This is the strongest single signal, because it is the hardest to explain away.
• Sales that require heroic founder effort per deal and do not become repeatable.
• The market is real but you are the wrong entrant, or the market is not real.
• The team's energy is going into rationalizing the data rather than acting on it.

Signals that argue against:

• The problem is execution — distribution, pricing, onboarding — and you have not seriously tried fixing it.
• A small group of users would be genuinely upset if the product disappeared. That is a seed worth cultivating.
• You are reacting to a single bad quarter or a competitor's announcement.

Mechanics that matter: decide before you are at three months of runway, because a pivot needs capital to execute; tell investors early rather than presenting it as a fait accompli; be explicit with the team about what is being kept (the people, the technology, the customer relationships) and what is being abandoned; and keep the thing you learned. The most valuable asset from a failed direction is usually the customer understanding, not the code.

B8. Shutting down

The least-written-about part of the founder experience, and the one where founders most often make expensive mistakes because they are exhausted and ashamed.

Decide early, while you still have money

[Analysis] The single most common error is waiting too long. A company that decides to wind down with six months of cash can pay severance, settle creditors, return something to investors and give employees a runway to find work. A company that runs to zero can do none of those things, and its officers acquire personal exposure they did not have before. Deciding to stop while there is still money is a form of competence, not a failure of nerve.

The mechanics

Corporate dissolution (solvent company): board and stockholder approval; file a certificate of dissolution; notify creditors and provide for claims; pay all taxes including final payroll and franchise taxes; file final tax returns marked final; distribute remaining assets per the liquidation preference stack; cancel registrations, licenses, foreign qualifications and insurance; preserve records. Delaware dissolution typically runs $2,000–$10,000 in legal and filing fees and several months. Skipping formal dissolution does not make the entity go away — franchise taxes and penalties accrue, and the founders remain on the hook for filings.

Assignment for the Benefit of Creditors (ABC) (insolvent company, an orderly alternative to bankruptcy): the company assigns all assets to an independent assignee, who liquidates them and distributes proceeds to creditors in priority order. Common in California and Delaware for venture-backed companies. Advantages over Chapter 7: faster (months rather than a year-plus), cheaper, private rather than a public docket, and the assignee can often sell the assets (including IP) as a going concern to a buyer who wants them. Cost typically $15,000–$50,000+ depending on complexity and asset value.

Chapter 7 bankruptcy: a court-appointed trustee liquidates; a public, court-supervised process; slower and more expensive; sometimes necessary where creditors are litigious, where there are disputed claims, or where the discharge and automatic stay are genuinely needed. Chapter 11 (reorganization) is almost never appropriate for a small startup — the cost is prohibitive.

[Practical] The choice among these is a lawyer's judgment call based on solvency, creditor composition and asset value. Get that advice before spending the last of the cash, because engaging counsel is itself something you need money to do.

Obligations that survive

• Employee wages are a priority claim and, for withheld payroll taxes, a personal one. The Trust Fund Recovery Penalty (section 10) makes responsible officers personally liable for withheld-but-unremitted payroll taxes. Pay final payroll and remit the taxes. This ranks above everything else.
• Accrued PTO where state law requires payout.
• Final pay timing under state law, which is unforgiving in several states.
• COBRA notices, WARN if applicable (section B6), and benefit plan terminations.
• Fiduciary duties shift. When a corporation approaches insolvency, directors' duties are generally understood to run to the corporate enterprise for the benefit of creditors as residual claimants. Practically: stop preferring insiders. Repaying a founder loan, or a friendly investor's bridge, ahead of trade creditors when the company is insolvent is exactly the transaction that creates personal liability and can be clawed back.
• Contract terminations, landlord claims (often the largest single creditor, and a place where a personal guarantee bites), and customer data obligations — you must still delete or return customer data per your contracts and privacy policy. Selling a customer list in a wind-down is constrained by what your privacy policy said.

The emotional side

[Analysis] Founders who have shut companies down describe a consistent pattern, and naming it in advance helps: a period of relief immediately after the decision, followed by a longer and harder period of grief, identity loss and shame — particularly for founders whose public identity had become the company.

Things that appear to help, from accounts rather than from controlled research: telling people directly rather than disappearing; writing the post-mortem, which converts an amorphous failure into a set of specific, learnable decisions; taking a real break before the next thing rather than starting immediately to avoid feeling it; maintaining relationships with the people who were there, who are the only ones who fully understand; and separating "the company failed" from "I failed." Companies fail for reasons founders do not control — market timing, macro conditions, a competitor's balance sheet — and the base rates in the ecosystem chapter make clear how ordinary this is.

If shutting down is accompanied by persistent depressive symptoms, hopelessness, or thoughts of self-harm, that is a medical situation requiring professional care, and it is common enough in this circumstance that no one should treat seeking care as unusual.

B9. Selling the company

What acquirers actually pay for

Four things, roughly in descending order of how often they drive a deal:

1. Revenue with retention. Recurring revenue with demonstrated net retention, at a multiple. The multiple is a function of growth rate, gross margin, retention and market conditions — not of how hard you worked.
2. Strategic fit. Filling a gap in the acquirer's roadmap faster than building it. This is where the highest multiples live, and it is not predictable from your financials.
3. The team. Acqui-hires: priced roughly per engineer, with most of the consideration going to retention packages rather than to the cap table. In these deals common stockholders frequently receive little or nothing after the liquidation preference, while the founders receive employment offers. That distinction is worth understanding before you celebrate.
4. Technology and data. Rarely on a standalone basis for software; more often in infrastructure, ML tooling and proprietary datasets.

What acquirers do not pay for: your effort, your total capital raised, your last round's valuation, or your narrative.

Process and timeline

A typical sale runs 4–9 months from first serious conversation to close: outreach and initial meetings (1–2 months), indication of interest, letter of intent with an exclusivity period of typically 30–90 days, due diligence (1–3 months, and the most demanding phase), definitive agreement negotiation, then closing with any regulatory clearance. Inbound acquisitions that skip the outreach phase are faster, and worse priced, because a single bidder is not a market.

Diligence is where Part A comes due. The items that generate purchase-price reductions and escrows are exactly the ones listed earlier: IP assignment gaps, contractor agreements without assignment, misclassified workers, uncollected sales tax, open-source license problems, undocumented equity grants, missing 83(b) elections, un-papered founder departures, and privacy or security commitments the company did not meet. A clean company sells for more than a messy one at the same revenue, and the difference is frequently larger than the cost of having kept it clean.

Use an advisor above a modest deal size. An M&A banker or boutique advisor typically charges a retainer plus 1–5% of transaction value (higher percentages on smaller deals). For a first-time founder in a competitive process, the advisor generally earns their fee in price and terms. For a small acqui-hire with a single predetermined buyer, they often do not.

Earnouts, honestly

An earnout defers part of the price, contingent on post-close performance. Acquirers propose them to bridge valuation gaps and retain founders.

[Analysis] What founders should understand before agreeing to one:

• You will not control the variables. After close, the acquirer controls the budget, the headcount, the pricing, the roadmap, the sales compensation plan, and where your product sits in their portfolio. Any of those can move your metric without anyone intending harm.
• Earnout disputes are one of the most litigated areas of M&A. The governing agreement usually says the acquirer has no affirmative obligation to maximize the earnout, only (sometimes) not to act in bad faith — a much lower bar than founders assume.
• Revenue-based earnouts are more defensible than EBITDA-based ones, because the acquirer has fewer levers over revenue than over allocated costs.
• Negotiate the protections, not the number. Specific operating covenants (budget floors, headcount commitments, no reallocation of your sales team), a defined calculation methodology with worked examples in an exhibit, information rights and periodic reporting, acceleration on termination without cause or on a subsequent change of control, and a dispute mechanism with a neutral accountant.
• Value the deal at the guaranteed consideration. Treat the earnout as upside. Founders who accept a lower certain price because the earnout "gets us there" frequently do not get there — and the reasons are often ordinary corporate reorganization rather than bad faith.
• The same logic applies to retention packages and unvested rollover equity, which are compensation contingent on your staying — and on your remaining willing to stay, which depends on things you will learn only after close.

B10. Founder liquidity and secondaries

The problem: a founder can be worth a great deal on paper and have no money. This produces genuinely bad decisions — refusing a good acquisition because it does not solve the personal problem, or accepting a bad one because it does.

Secondary sales — selling existing shares to an investor rather than issuing new ones — have become a normal part of the market rather than a signal of distress. Carta reported in August 2026 that tender-offer activity reached a four-year high, with total transaction value in offerings administered on its platform rising 200% in the first half of 2026 (Carta Data).

How it works in practice:

• Most commonly, a founder sells a portion of holdings alongside a priced round, with the lead investor or an existing investor buying.
• Company consent is required; transfer restrictions in the charter, bylaws and investor agreements (rights of first refusal, co-sale rights) apply, and the board must approve.
• Amounts are typically modest and bounded — often framed as "enough to remove financial pressure," commonly 5–15% of a founder's holdings, and investors often cap it explicitly.
• Price is usually at a discount to the preferred price, because common stock lacks the preference and protective provisions. The discount is negotiated and varies widely.
• Tax treatment differs from what founders expect. A sale of founder common stock is capital gain; QSBS may apply if the requirements and holding period are met (section 10), which is a reason to check the five-year clock before selling. A sale at a price above the current 409A may also force a 409A revaluation, raising strike prices for everyone hired afterward.

[Analysis] The case for taking some. A founder with no personal financial cushion is systematically biased toward risk-reducing decisions that harm the company — selling too early, accepting worse terms, avoiding the aggressive move. Investors increasingly recognize this, which is why secondary participation is now often offered rather than merely tolerated. The case against taking too much is equally real: it changes your incentive alignment, and investors will notice if it looks like you are de-risking out of the outcome rather than into it. The norm that has settled is: enough to be comfortable, not enough to be done.

Employee liquidity — tender offers open to employees, extended exercise windows, company-funded exercise loans (which carry their own risks) — is a separate and increasingly expected part of retaining people through a long private period. Founders who take secondary liquidity while offering none to employees should expect that to be noticed.

B11. Returning capital, and what founders owe investors

If a company winds down with cash remaining, the liquidation preference stack governs distribution: preferred stockholders get their preference (typically 1x non-participating for venture rounds) before common. In most wind-downs there is nothing left for common, and often not enough for preferred either. Distributing to founders ahead of the stack is a breach of duty and is reversible.

What founders actually owe investors is narrower than guilt suggests and broader than the legal minimum:

• The legal obligations are fiduciary duty, the covenants in the financing documents, information rights, and honesty. Venture investment is equity, not a loan. You do not owe investors their money back, and a founder who treats a failed company as a personal debt is misunderstanding the instrument.
• The professional obligations are: tell them early rather than late, tell them the truth, do not spend the last of the money on a low-probability miracle without saying so, and wind down in a way that does not create liability for the directors they appointed.

[Analysis] Good investors distinguish sharply between founders who failed and founders who behaved badly while failing. The first group raises again routinely. The second does not. The variable is conduct during the ending, and that is entirely within the founder's control.

B12. Restarting

The evidence on serial entrepreneurship is more nuanced than either the "failure is a badge of honor" narrative or its cynical opposite. Research generally finds a modest performance advantage for previously successful founders and a smaller, less consistent advantage for previously failed founders relative to first-timers — the learning is real but not large, and the advantage is partly reputational access to capital and talent rather than skill.

Reentry after failure is also not evenly distributed. A study of 8,171 entrepreneurs across 35 countries found systematic gender gaps in the decision to restart after business failure, mediated by the public stigma of failure and public fear of failure in a given country — that is, the cost of failure is partly a function of where you are and who you are, not only of what happened (Simmons, Wiklund, Levie, Bradley & Sunny, Small Business Economics, 2019).

What appears to transfer: network, credibility with investors and recruits, pattern recognition about people, calibration about how long things take, and a much lower tolerance for building things nobody asked for. What does not transfer: market-specific knowledge in a different market, and — importantly — the assumption that the thing that killed the last company is the thing to defend against this time.

Practical guidance: take a genuine break first, long enough that the decision to start again is a choice rather than an avoidance; write the post-mortem before you need it as a pitch; be honest about the failure in fundraising conversations, because investors will find out and the way you describe it is itself the signal; and re-examine whether the venture model is what you actually want, which is the subject of the final section.

B13. The legitimate case for building something smaller

[Analysis] Almost all startup advice is written by and for participants in the venture model, which optimizes for a small number of very large outcomes and accepts a high failure rate as the cost. That is a rational model for a fund holding a portfolio. It is not obviously a rational model for an individual founder holding one company and one life.

The alternative is not failure. It is a different design:

• A profitable company at $1–5 million in revenue with a small team can produce founder income well above what most venture-backed founders ever realize, with a fraction of the risk and no obligation to grow at a pace set by someone else's fund cycle.
• The outcome distribution is completely different. Venture returns are power-law: most companies return nothing to founders. A bootstrapped company that reaches modest profitability pays its founder every month, and pays them again if it sells — and small profitable software companies do sell, at multiples that are life-changing for one or two people even when they are unremarkable to a fund.
• You keep control, which means you keep the ability to decide when it is enough.
• The constraint is real: some businesses genuinely require capital to exist — hard technology, biotech, anything with large upfront infrastructure or a winner-take-most market structure. If yours is one of those, this is not available to you, and taking venture money is the correct decision.

The honest trade: venture capital buys you a shot at an outcome you cannot reach otherwise, in exchange for control, a specific growth obligation, and a much higher probability that you personally end up with nothing. That is a real trade with real upside, and plenty of people should take it. It should be taken deliberately, with the alternative understood, rather than by default because it is what the surrounding culture assumes.

What sustainability actually looks like

Not balance — that is the wrong frame for a demanding job. Rather:

1. Financial base. Personal runway, adequate salary once the company can afford it, no unnecessary personal guarantees, health coverage, and a pre-agreed limit on how much of your own money goes in.
2. Time structure. A small number of absolutely defended commitments, and real time off taken visibly.
3. Support structure. At least one person outside the company you can be honest with; a peer group of other founders; and a professional relationship — therapist or coach — established before you need it rather than during the crisis.
4. Decision structure. Clear decision rights with co-founders, a real board or advisor who will disagree with you, and written criteria set in advance for the decisions you know are coming: when to pivot, when to stop, what outcome you would accept.
5. Identity structure. Something you are besides this company. This is the one founders most often skip and most often regret, because it is the difference between a company failing and a life failing.

[Analysis] The founders who last a decade are not distinguished by intensity — everyone in this population is intense. They are distinguished by having built a structure that keeps working when they are not at their best, because over ten years there will be long periods when they are not.

Closing note

Everything in Part A is general information current as of September 15, 2026 and is not legal, tax, accounting or financial advice. Several items — the negative-option rule, federal contractor classification, the Corporate Transparency Act, state AI and privacy laws, and the EU AI Act's high-risk deadlines — were unsettled on that date and will have moved. Requirements vary by jurisdiction, industry, stage and facts. Verify before acting, and use a qualified professional for anything in section 22.

Part B reports what the research shows, including its limitations. The founder wellbeing literature is thinner and more methodologically compromised than its citation frequency implies; the figures should inform your thinking, not define it. If you are struggling with your mental health, professional support exists and is effective. A licensed clinician is the right person to talk to.

Sources

All URLs accessed and verified September 15, 2026. Primary sources (government, regulator, court and official materials) are listed first within each group.

Incorporation, entity and corporate

• Delaware Division of Corporations — How to Calculate Franchise Taxes — official franchise tax methods, rates, minimums and maximums
• Cooley GO — free startup legal document templates

Intellectual property

• USPTO fee schedule — official, effective January 19, 2025, last revised August 14, 2026
• Gerben IP — USPTO Trademark Fee Changes for 2025 — fee table effective January 18, 2025
• Reed Smith — USPTO announces trademark fee increases effective January 18, 2025
• Finnegan — USPTO Trademark Fees: Changes for 2025

Employment and non-competes

• Foley & Lardner — Noncompete Agreements in 2026: A Federal and State Overview (July 2026) — FTC rule history, September 2025 appeal withdrawal, state-by-state landscape
• FTC — FTC Announces Rule Banning Noncompetes (April 2024) — the original rule, now set aside
• US DOL — WARN Act compliance assistance
• 20 CFR Part 639 — WARN regulations (eCFR) — coverage thresholds, plant closing and mass layoff definitions, notice recipients
• Jackson Lewis — DOL's proposed 2026 independent contractor rule
• US DOL — worker misclassification rulemaking

Equity compensation

• IRS Topic No. 427 — Stock options — ISO vs NSO treatment, AMT, Form 3921
• Burkland — 409A Valuations for Startups: Cost, Timing & Rules (August 2026)

Tax

• Morgan Lewis — New Section 174A Restores Domestic R&E Deductibility (July 2025)
• Grant Thornton — Permanent full expensing for U.S. research in OBBBA — §448(c) $31M threshold, July 6, 2026 retroactive election deadline, catch-up options
• Plante Moran — OBBBA restores expensing of domestic Section 174 R&E costs
• Mintz — QSBS Benefits Expanded Under One Big Beautiful Bill Act (July 2025) — tiered exclusions, $15M cap, $75M asset test, July 4, 2025 effective date
• The Tax Adviser — QSBS gets a makeover (November 2025) — qualification requirements, 28% rate trap, state conformity
• Baker Tilly — Changes to section 1202 in the One Big Beautiful Bill Act
• McLane Middleton — OBBBA Changes to the QSBS Regime under Section 1202

Privacy and data protection

• California Attorney General — California Consumer Privacy Act (CCPA) — official thresholds, rights, GPC
• California Privacy Protection Agency — regulations announcement (September 23, 2025) — January 1, 2026 effective date; ADMT compliance January 1, 2027; risk assessment and cybersecurity audit deadlines
• CPPA — regulations index
• Federal Register — Children's Online Privacy Protection Rule, 16 CFR Part 312 (April 22, 2025) — effective June 23, 2025; full compliance April 22, 2026
• FTC — Children's privacy business guidance
• FTC — COPPA Rule legal library entry
• MultiState — All of the comprehensive privacy laws that take effect in 2026 (February 2026) — 20 state laws; Indiana, Kentucky, Rhode Island effective January 1, 2026
• Koley Jessen — New State Privacy Laws Effective January 1, 2026
• GDPR.eu — What is GDPR? — Article 3 scope, lawful bases, Article 27/28, 72-hour breach notice, fines
• Privacy Rights Clearinghouse — Data Breach Notification Laws: A 50-State Survey (2026 Edition)

Accessibility

• Seyfarth Shaw, ADA Title III blog — ADA Title III Federal Lawsuit Filings Fall Slightly to 8,667 in 2025 (February 2026) — filing counts by year and state
• Seyfarth Shaw — Federal Court Website Accessibility Lawsuit Filings Bounce Back in 2025 (March 2026)
• Greenberg Traurig — European Accessibility Act Compliance (July 2025) — June 28, 2025 transposition, microenterprise exemption, German penalty example
• Davis Wright Tremaine — European Accessibility Act Goes Live (July 2025)

Consumer protection and advertising

• FTC — Rule banning fake reviews and testimonials (August 2024) — prohibited categories, civil penalty authority
• FTC — The FTC's Endorsement Guides: What People Are Asking — material connection disclosure, employee endorsements
• FTC — CAN-SPAM Act: A Compliance Guide for Business — seven requirements, $53,088 maximum penalty per email
• Jones Day — FTC Revives Click-to-Cancel Rule (May 2026) — ANPRM March 2026, comments due April 13, 2026, ROSCA and state law status
• Gibson Dunn — FTC Restarts Negative Option Rulemaking After Eighth Circuit Vacatur
• Mayer Brown — Eighth Circuit Vacates FTC's Revised Negative Option Rule (July 2025)
• Latham & Watkins — Eighth Circuit Vacates FTC Click-to-Cancel Rule
• Kelley Drye — Eleventh Circuit Vacates TCPA 1:1 Consent Rule
• Morrison Foerster — Eleventh Circuit Vacates FCC's TCPA One-to-One Consent Rule (January 2025) — Insurance Marketing Coalition v. FCC, January 24, 2025
• Womble Bond Dickinson — FCC Repeals One-to-One Consent Rule
• ComplianceHub — TCPA 2026: consent revocation, one-to-one rule vacated — revocation rule delayed to January 31, 2027 (secondary source; verify against FCC orders)

AI regulation

• Gibson Dunn — EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines — Annex III to December 2, 2027; Annex I to August 2, 2028; Article 50 unchanged at August 2, 2026
• DLA Piper — The Digital AI Omnibus: proposed deferral of high-risk AI obligations
• Crowell & Moring — Colorado Hits Reset on AI Regulation: SB 26-189 Repeals and Reenacts the Colorado AI Act — effective January 1, 2027, four deployer duties, AG-only enforcement
• Norton Rose Fulbright — Colorado enacts revised AI law
• Hunton — Colorado AI Act Amended and Effective Date Delayed
• Texas Legislature — HB 149 bill analysis (TRAIGA) — primary source
• Haynes Boone — Texas Responsible Artificial Intelligence Governance Act — intent standard, sandbox, NIST safe harbor, penalties
• Baker Botts — Texas Enacts Responsible AI Governance Act
• K&L Gates — Pared Back Version of TRAIGA Signed Into Law
• Latham & Watkins — California Assumes Role as Lead US Regulator of AI — SB 53 thresholds, SB 942 delay to August 2, 2026, SB 243
• WilmerHale — Transparency in Frontier Artificial Intelligence Act (SB 53)
• Future of Privacy Forum — California's SB 53: The First Frontier AI Law, Explained
• Seyfarth Shaw — AI Legal Roundup: Colorado postponement, California employment regulations, Illinois disclosure law

Industry-specific regulation

• Finextra — Money Transmitter License in 2026: Requirements, Costs, and a Practical Roadmap for Fintechs
• ComplyOne — Money Transmitter License by State: Timeline, Cost & Requirements

Sales tax and nexus

• TaxCloud — SaaS Sales Tax by State: Is SaaS Taxable in 2026? — vendor source; state taxability map should be re-verified with a tax professional
• Ordway — The Complete Guide to SaaS Sales Tax 2026

Open source

• Mend — Open source license compliance for M&A activity
• Revenera — Open Source License Compliance Field Guide

Insurance

• Vouch — Startup Insurance Costs in 2026 — median and range premiums by line; broker's own client book, so treat as orientation rather than market-wide data

Founder compensation, wellbeing and liquidity

• Kruze Consulting — Startup CEO Salaries 2026 — drawn from actual payroll records of ~800 VC-backed clients
• Kruze Consulting — 2026 CEO Compensation Benchmarks (press release)
• Michael A. Freeman, MD — Entrepreneurship research page — "Are Entrepreneurs Touched with Fire?" summary and manuscript
• "Are Entrepreneurs 'Touched with Fire'?" — full manuscript text — n=242 entrepreneurs, n=93 comparison; authors' stated limitations
• Startup Snapshot — The Untold Toll: The Impact of Stress on the Well-being of Startup Founders and CEOs — 400+ self-selected respondents
• Forbes — Startup Founders Report Entrepreneurship Is Taking A Toll On Their Mental Health (April 2023)
• Brad Feld — The Impact of Stress on the Well-being of Startup Founders and CEOs
• Simmons, Wiklund, Levie, Bradley & Sunny — Gender gaps and reentry into entrepreneurial ecosystems after business failure, Small Business Economics (2019) — n=8,171 entrepreneurs across 35 countries
• Carta Data — tender-offer activity at a four-year high; transaction value up 200% in H1 2026

Sources consulted but treated with caution

The following were reviewed during research and are not relied on for factual claims in this chapter, because they lack traceable methodology, are marketing content for compliance products, or report statistics without identifiable sources. They are listed for transparency:

• Various "founder burnout statistics 2026" aggregator pages, which circulate percentages with no published sample, instrument or date
• Accessibility overlay and ADA-scanning vendor blogs reporting lawsuit statistics
• Formation-service and compliance-tool blogs on Delaware franchise tax and 409A pricing, used only where corroborated by primary sources or professional-services firms

End of chapter. Everything above is general information as of September 15, 2026 and is not legal, tax, accounting or financial advice. Requirements vary by jurisdiction and change frequently. Consult qualified professionals licensed in your jurisdiction before acting.