Master Service Agreement

A Master Service Agreement in the United States sets out the terms on which a service provider performs work and is paid by the client.

The Master Service Agreement is governed by the general US law of contracts — the Restatement (Second) of Contracts — and in some contexts by Article 2 of the Uniform Commercial Code (UCC) if goods are involved, though courts in most jurisdictions apply the predominant purpose test to determine whether a mixed goods-and-services contract is governed by UCC Article 2 or by common law. In Anthony's Pier Four, Inc. v. HBC Associates, 411 Mass. 451 (1991), and similar decisions, courts have distinguished between service-predominant contracts governed by common law and goods-predominant contracts governed by the UCC.

For MSAs involving the development or licensing of software, the intellectual property provisions are governed by the Copyright Act of 1976 (17 U.S.C. § 101 et seq.) — particularly the work-for-hire doctrine under 17 U.S.C. § 101, which determines whether custom software developed by a contractor automatically vests in the client (if it qualifies as a work made for hire in a written agreement for certain specially ordered or commissioned works) or requires a written assignment. The landmark Supreme Court decision in Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989), clarified the multifactor test for determining whether a developer is an employee (in which case copyright vests in the employer automatically) or an independent contractor (in which case copyright vests in the developer unless assigned in writing).

MSAs between US companies and European Union-based clients must address the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, which requires a Data Processing Agreement (DPA) between any EU data controller and its service providers (processors) that process EU personal data on the controller's behalf. The GDPR's Article 28 mandatory DPA provisions must be incorporated into or appended to the MSA for cross-border engagements. Similarly, MSAs involving California residents' personal data must comply with the California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act (CPRA).

In federal government contracting, Master Service Agreements are often structured as Indefinite Delivery/Indefinite Quantity (IDIQ) contracts governed by the Federal Acquisition Regulation (FAR) at 48 C.F.R. Parts 1–53, under which the government issues individual task orders against the IDIQ framework contract. The GSA Multiple Award Schedule (MAS) program — administered by the General Services Administration — provides a pre-competed MSA-like vehicle for federal agencies to procure IT, professional, and management consulting services from approved vendors without a full competitive procurement for each task.

A US Master Service Agreement is needed whenever a service provider and a client anticipate an ongoing, multi-project relationship and want to negotiate the fundamental legal terms once — avoiding the cost and delay of re-negotiating a full contract for each new project — while retaining the flexibility to launch new engagements quickly through simplified Statements of Work.

Technology companies, IT consulting firms, software development agencies, cloud service providers, and professional services firms — including management consulting firms such as McKinsey & Company, Boston Consulting Group, Deloitte Consulting, Accenture, and regional IT service providers — use Master Service Agreements as the contractual foundation for all client engagements. A company that signs hundreds of consulting contracts per year benefits enormously from having an MSA in place with repeat clients: each new project requires only a short SOW rather than a full contract negotiation cycle.

Enterprise software vendors and SaaS (Software as a Service) providers including Salesforce, SAP, Oracle, Microsoft Azure, and AWS use MSAs — often called Enterprise License Agreements (ELAs) or Enterprise Subscription Agreements — with their large enterprise customers to govern all software licenses, professional services engagements, and support contracts under a single legal framework. These enterprise MSAs are typically the product of extensive negotiation between procurement teams and are updated periodically as the commercial relationship evolves.

Marketing agencies, creative agencies, advertising holding companies such as WPP Group, Publicis Groupe, Omnicom Group, and Interpublic Group, and independent creative studios use Master Service Agreements with their brand and agency clients to govern ongoing creative services relationships — brand strategy, campaign development, media buying, content creation, and digital marketing — with individual campaigns documented in project SOWs.

Staffing companies and technology staffing firms — including Robert Half International, Kforce, Staffmark, and Apex Group — use Master Staffing Agreements (a variant of the MSA) with corporate clients to govern the ongoing placement of contract workers, temporary employees, and direct-hire candidates, with individual placements documented in placement orders or staffing schedules attached to the MSA.

Government contractors seeking to win federal, state, and municipal IT and consulting contracts benefit from MSA-like pre-competed contract vehicles: the GSA MAS Schedule (formerly GSA Schedule 70 for IT), HHS NITAAC (National Institutes of Health Information Technology Acquisition and Assessment Center) CIO-SP3 and CIO-SP4 contracts, and state-level IT procurement frameworks such as Texas DIR (Department of Information Resources) cooperative contracts all provide pre-negotiated MSA-like frameworks that individual agencies issue task orders against.

A professionally drafted US Master Service Agreement must contain the following essential provisions to clearly establish the parties' legal relationship, protect both parties' commercial interests, comply with applicable data privacy law, and provide a clear framework for individual project engagements through Statements of Work.

The Statement of Work (SOW) framework clause must define the structure and hierarchy of the MSA and its incorporated SOWs: the MSA establishes the general terms; each SOW specifies project-specific details (scope, deliverables, timelines, fees, acceptance criteria); and where the MSA and a SOW conflict, the SOW controls for project-specific terms while the MSA controls for general legal provisions. The clause should specify the required SOW format, the procedure for executing SOWs (signed by both parties, referencing the MSA), and whether a SOW can be modified by change order without executing a new SOW.

The intellectual property ownership clause is the most commercially significant legal provision for technology, creative, and consulting engagements. The MSA must specify: (1) for custom deliverables created specifically for the client — whether the client receives full ownership via a work-for-hire arrangement under 17 U.S.C. § 101 or via a written IP assignment (present-tense language — 'hereby assigns' — is required under FilmTec Corp. v. Allied-Signal Inc., 939 F.2d 1568 (Fed. Cir. 1991) to effectuate an immediate transfer of future IP rights); (2) for the service provider's pre-existing IP (tools, frameworks, methodologies, libraries) used in creating deliverables — the service provider retains ownership and grants the client a limited, non-exclusive license sufficient to use the deliverables; (3) improvements to the service provider's background IP made during the engagement — typically retained by the service provider with a license back to the client; and (4) third-party open-source or licensed components embedded in deliverables — the service provider must identify these and confirm the client's right to use them under the applicable licenses.

The confidentiality clause must define what constitutes confidential information (business plans, technical specifications, financial data, customer lists, trade secrets), the obligation of each party to protect the other's confidential information using at least the same care used to protect their own confidential information (but not less than reasonable care), the permitted uses (only for the purpose of the engagement), the exclusions (publicly known information, independently developed information, information received from third parties without restriction, information required to be disclosed by law), and the survival period (typically 3 to 5 years after termination, or indefinitely for trade secrets).

The limitation of liability and indemnification clause must address: (1) the aggregate liability cap — typically capped at fees paid or payable in the prior 12 months; (2) the mutual exclusion of consequential, indirect, incidental, special, and punitive damages; (3) carve-outs from the cap for death or personal injury caused by negligence, fraud, willful misconduct, breach of confidentiality, data security breaches, and IP indemnification obligations; and (4) the parties' mutual indemnification obligations for third-party claims arising from their respective breaches, negligence, or IP infringement.

The data privacy and security clause must address each party's obligations regarding personal data processed in connection with the engagement. For engagements involving EU personal data, the clause must incorporate GDPR Article 28 processor obligations or reference a separate DPA. For engagements involving California consumer data under the CCPA/CPRA, the service provider's obligations as a 'service provider' or 'contractor' must be specified. The clause must address data security standards, breach notification obligations, data retention and deletion, and audit rights.

The payment terms clause must specify: invoicing frequency and format; payment due dates (net 30 is standard; larger enterprises often push for net 45 or net 60); interest on late payments (typically the lesser of 1.5% per month or the maximum rate permitted by applicable state usury law); expense reimbursement procedures and required documentation; and the service provider's right to suspend services for non-payment after notice.

The term and termination clause must specify the MSA's initial term, renewal mechanism, each party's right to terminate for cause (material breach after 30-day cure period), each party's right to terminate for convenience (typically 30 to 90 days' advance written notice), survival of key provisions after termination, and obligations for transition assistance upon termination.