Outsourcing Blunders: Who Does the Client Sue?

A lawyer's letter arrives at your office. It is not because of something your internal team did, but because a freelance developer you hired left a security vulnerability in a client's system, causing a three-day shutdown. Your first instinct might be to tell the client to talk to the freelancer. In the logic of the law, however, that letter is addressed to you for a reason. For small and medium enterprises (SMEs), subcontracting is a standard way to manage costs or fill technical gaps. Yet, many business owners overlook how legal liability flows between the prime contract with the client and the subcontract with the vendor. We will examine how the Civil Code dictates this flow and how AgreeGold suggests you structure your agreements to prevent financial disaster.

Why is your company liable for a subcontractor's mistake?

In legal terms, a 'privity of contract' exists between you and your client. This means the client only recognizes the entity that signed the contract: you. When you hire a subcontractor, a part-timer, or an external consultant to fulfill your obligations, these parties are classified as 'performance assistants' (履行輔助人) under the law.

Article 224 of the Civil Code states: 'A debtor shall be responsible for the intentional or negligent acts of his agent or of any person whom he employs in performing his obligation, to the same extent as for his own intentional or negligent acts.' This article establishes a core principle: you cannot use a subcontractor as a firewall. If a subcontractor is negligent while performing a task you assigned, the law treats that negligence as your own. The client does not need to prove that you failed to supervise the subcontractor; they only need to prove that the work was not performed as agreed. Once that is proven, you bear the full weight of default or damages.

This allocation of risk exists because the client signed the contract based on trust in your company. How you choose to get the work done is an internal decision. The client should not bear the risk of your poor choice of vendors. Therefore, if a subcontractor delivers a product that infringes on third-party intellectual property or fails to meet quality standards, the client is legally entitled to seek compensation from you under Article 227 of the Civil Code regarding incomplete performance. You cannot defend yourself against the client by claiming the fault lies solely with the subcontractor.

Does the legal nature of your service agreement change your liability?

While Article 224 is a general rule, the depth of your liability changes depending on whether your contract is classified as a 'Hire of Work' (承攬) or a 'Mandate' (委任). This distinction dictates how you should write your subcontracting clauses.

If you signed a Hire of Work contract (Civil Code Article 490), the focus is on the 'completion of work.' Unless the contract explicitly prohibits it, a contractor is generally allowed to subcontract parts of the work. However, as established, you remain fully responsible for the result. If the subcontractor produces defective work, the client can demand damages from you under Article 495 of the Civil Code. The burden of proof lies in the result: if the work is defective, the liability is yours.

If you signed a Mandate contract (Civil Code Article 528), the situation is more restrictive. Article 537 of the Civil Code stipulates that the mandatory (you) shall handle the mandated affair personally. You cannot delegate the task to a third party unless you have the principal's consent, it is a local custom, or there are unavoidable circumstances. If you subcontract without permission, Article 538, Paragraph 1 makes you liable for all acts of that third party. Even if you have the client's consent to subcontract, Article 538, Paragraph 2 states that you are liable for the 'selection' of the third party and the 'instructions' given to them. Proving you were not negligent in selection and instruction is a high bar in legal disputes.

AgreeGold recommends defining subcontracting authority clearly in the main contract. If your business model relies on outsourcing, ensure the prime contract includes a clause allowing it, and ensure the subcontract mirrors the quality standards of the prime contract. Consider a clause similar to this:

The Party B (You) may subcontract parts of the services to a third party. However, Party B shall be liable for the performance of the subcontractor’s obligations under this Agreement to the same extent as for Party B’s own intentional or negligent acts. Party B shall ensure that the subcontractor complies with the confidentiality and intellectual property provisions of this Agreement.

How do you draft back-to-back indemnity clauses that actually work?

Since you are legally required to pay the client first, the next step is recovering that money from the subcontractor. This is the exercise of the 'right of recourse.' If your subcontract is poorly drafted, you might find yourself paying a million dollars to a client but only being able to recover a fraction from the subcontractor because you missed a key indemnity clause.

An effective transfer of risk requires a 'back-to-back' approach. Whatever you promised the client in the prime contract, you must demand from the subcontractor in the subcontract. If the client requires you to be liable for consequential damages, your subcontract should reflect the same. The scope of indemnity must include all legal liabilities you incur toward the client, including attorney fees, court costs, fines, and business interruption losses claimed by the client.

We suggest including a clause in the subcontract such as:

If a third party (including but not limited to the Client) makes a claim, files a lawsuit, or initiates an administrative action against Party A (You) due to the subcontractor’s negligence in performing the work, the subcontractor shall handle the matter and bear all costs. If Party A suffers damages (including compensation paid to third parties, attorney fees, and loss of reputation), the subcontractor shall provide full indemnification.

Beyond indemnity, you need to establish checkpoints. While Article 188 of the Civil Code specifically governs employer-employee relationships, the logic of 'supervisory duty' is often applied when examining subcontracting disputes. If you can demonstrate that you conducted regular progress reviews, quality inspections, and provided written instructions, you reduce the likelihood of errors. These records serve as evidence that you fulfilled your contractual obligations and can be used to clarify the division of responsibility if a dispute arises.

What specific evidence proves you fulfilled your duty of supervision?

When a dispute reaches a stage where liability is contested, the focus shifts to the burden of proof. Under Article 538, Paragraph 2, if you have consent to subcontract, your liability is tied to your selection and instruction. To defend against a claim of negligence, you must produce tangible evidence.

First, the selection process must be documented. This includes the subcontractor’s credentials, past performance records, and the criteria used to hire them. If a subcontractor has a history of failed deliveries and you hired them solely based on the lowest price without checking references, a claimant may argue you failed your duty of selection.

Second, the instructions must be in writing. Verbal instructions are difficult to prove and often lead to 'he-said-she-said' scenarios. We recommend using a project management tool or formal email threads to issue technical specifications and deadlines. If the subcontractor deviates from these written instructions, the fault is more clearly theirs, which strengthens your position when seeking recourse.

Third, the inspection and acceptance process must be rigorous. Article 490 focuses on the completion of work, but Article 495 allows for damages if the work is defective. If you sign off on a subcontractor's work without performing the agreed-upon tests, you are essentially adopting their errors as your own. Keeping a log of 'Acceptance Testing' (UAT) results and 'Notice of Defect' letters sent to the subcontractor is vital for showing you were not negligent in your supervisory role.

FAQ

Can the client skip me and sue the subcontractor directly?

In most cases, the client cannot sue the subcontractor for breach of contract because no contract exists between them. This is the principle of privity of contract. The client’s primary path for recovery is to sue you. The only exception is if the subcontractor’s actions constitute a 'tort' under Article 184 of the Civil Code, such as intentionally deleting the client’s data or stealing trade secrets. For general service quality issues, the client will always target you first.

Is a clause stating I am not responsible for subcontractors valid?

Such a clause is generally valid between you and the subcontractor, but it is usually invalid against the client. You cannot use an agreement with a third party to waive your legal obligations to your client. Unless the client explicitly signs a waiver in the prime contract stating they will not hold you liable for subcontractor errors, the mandatory nature of Article 224 of the Civil Code remains in effect. Most clients will not agree to such a waiver.

What happens if the subcontractor has no money to pay for damages?

This is a significant business risk. Even if you win a lawsuit against a subcontractor, you may find they have no assets to seize. To mitigate this, AgreeGold recommends implementing a 'retention money' system where a portion of the payment is held until the client has fully accepted the work. Alternatively, you can require the subcontractor to carry professional liability insurance and name you as an additional insured or beneficiary to ensure a source of funds exists if a claim arises.

What is the legal difference between total subcontracting and partial subcontracting?

In practical terms, if you hand over the entire contract to someone else and stop participating, this is closer to an 'assignment of rights and obligations,' which almost always requires the client’s written consent. If you only outsource specific tasks while remaining the lead for integration and delivery, it is standard subcontracting. Under Article 224, your liability is the same in both scenarios: you are responsible for the actions of those you use to fulfill your obligations.

Can I limit the amount of compensation the subcontractor owes me?

Yes, under the principle of freedom of contract, you can set a liability cap. However, you must be careful. If the cap in your subcontract is lower than the liability cap in your prime contract with the client, your company must absorb the difference. We recommend that the subcontractor’s liability limit should at least match the limit you have with your client, or be based on a multiple of the subcontract value rather than just the project fee itself.

Outsourcing risk prevention and liability transfer checklist

• Verify subcontracting clauses in the prime contract: Check if your agreement with the client allows subcontracting. Does it require prior written consent? Subcontracting without permission may constitute a material breach, leading to contract termination.
• Align the scope of indemnity: Ensure the indemnity clause in the subcontract covers third-party claims from the client and includes legal fees. The liability cap should be sufficient to cover the maximum potential payout to the client.
• Maintain written instructions and acceptance records: For every subcontractor task, keep clear specifications, meeting minutes, and phase-based acceptance reports. These are the primary evidence to prove you fulfilled your duties under Article 538.
• Confidentiality and IP ownership: Verify that the subcontractor has signed a Non-Disclosure Agreement (NDA) with the same strength as your prime contract. Confirm that the intellectual property rights of the subcontractor’s output are assigned to you so you can legally transfer them to the client.
• Financial risk buffers: For high-risk projects, use retention money (e.g., paying the final 20% only 30 days after client acceptance) or performance bonds. These provide immediate financial protection that does not rely on winning a subsequent lawsuit.