The call comes on a Tuesday afternoon. A customer does not pay, invokes a clause in their own terms and conditions, and asks whose terms actually apply. No one in the company can answer that. The order has long since been executed, the material paid for, and a six-digit amount is outstanding in the accounting system. The crucial error is fourteen months old at this point, and occurred during the order confirmation.<\/p>\n\n\n\n
This is how legal problems in the SME sector almost always arise. They arise quietly, in a decision that no one perceives as a legal decision, and they become visible when the scope for action has already been exhausted. That is precisely why legal prevention is not a luxury issue for corporations but a business management issue.<\/p>\n\n\n\n
clience.legal is a digital business law firm for entrepreneurs. We advise managing directors not only in the event of a dispute, but also before decisions are made, keeping your obligations, liability, and financial goals in mind at all times. This article highlights the seven risk areas that most often become costly in the SME sector, and the measures that prevent damage in advance.<\/p>\n\n\n\n
Legal advice is often understood by many companies as a repair service. Something goes wrong, and the law firm repairs it. This view regularly leads to a mismatch: The cost of the repair exceeds the cost of the preventive measure many times over, and the result is still worse.<\/p>\n\n\n\n
The reason lies in the order of things. Before the signature, every clause is negotiable, every risk is deferrable, and every wording is open to interpretation. After the signature, the framework is fixed, and the legal work consists of making the best possible out of a bad starting position. In addition, there are costs that do not appear in any invoice: tied lead time, delayed projects, and damaged customer relationships.<\/p>\n\n\n\n
Prevention does not mean excluding every risk. Entrepreneurial action remains risky, and the law recognizes this. The point is to take risks consciously rather than unknowingly, and to document the decision in a traceable way. We describe how this is organized in day-to-day operations under external legal department<\/a>.<\/p>\n\n\n\n A few signals appear repeatedly in consultation sessions. If several of them apply to your company, the need for action is real and not theoretical.<\/p>\n\n\n\n Each of these points can be remedied with manageable effort. Together, they paint the picture of a company in which legal decisions are left to chance, and chance is the most expensive form of risk management.<\/p>\n\n\n\n The most common risk and at the same time the easiest to avoid. Typical sources of error are conflicting terms and conditions, missing limitations of liability, unclear specifications of services, and contracts that were freely modified by sales. The preventive measure is unspectacular: vetted contract templates with defined negotiating margins, an overview of contract terms and notice periods, and clear approval rules. We lay the groundwork for this in our Drafting of contracts and T&Cs<\/a>.<\/p>\n\n\n\n The question of whose terms apply when sets of terms conflict is particularly underestimated. Under German law, neither side prevails completely in such cases; instead, the conflicting provisions drop out and the statutory rules apply. Precisely the points one wanted to regulate are then left unregulated. A defensive clause and a deliberate approach to the other side\u2019s purchasing terms solve this problem in advance.<\/p>\n\n\n\n \u00a7 43(1) GmbHG requires the managing director to exercise the due care of a prudent businessperson; paragraph 2 makes him personally liable for damages in the event of a breach. This liability applies not only to wrong decisions but also to deficient organization. Anyone who delegates tasks must select, instruct, and supervise. The preventive measure consists of a written allocation of management responsibilities, documented decision-making grounds for major projects, and a regular review of one\u2019s own duties. For more detail, see our overview of personal liability in GmbH and UG<\/a> and the current developments in managing directors\u2019 liability<\/a>.<\/p>\n\n\n\n This is where the most serious personal risk lies. \u00a7 1 StaRUG requires ongoing monitoring of developments that threaten the company\u2019s continued existence. If illiquidity or over-indebtedness occurs, the duty to file for insolvency under \u00a7 15a InsO applies, with a deadline of three weeks for illiquidity and six weeks for over-indebtedness. Payments made thereafter trigger the duty to reimburse under \u00a7 15b InsO. In addition, \u00a7 49(3) GmbHG requires the managing director to convene a shareholders\u2019 meeting if half of the share capital has been lost. The preventive measure is rolling liquidity planning with fixed key figures and defined thresholds at which action is taken. We show how such a system is set up in our crisis early detection under the StaRUG<\/a>.<\/p>\n\n\n\n Employment law issues rarely threaten a company\u2019s existence, with one exception: if social security contributions are not paid, managing directors face personal criminal liability under \u00a7 266a StGB, and management is liable for taxes under \u00a7 69 AO. Bogus self-employment among long-standing freelancers is also underestimated, because back payments are claimed retroactively. The preventive measure includes a review of the contractual relationships, clean contract templates, and, in case of doubt, a status determination procedure.<\/p>\n\n\n\n The General Data Protection Regulation allows fines of up to twenty million euros or four percent of worldwide annual turnover. In practice, problems rarely arise from major data breaches, but from data subject requests, incomplete records of processing activities, and missing data processing agreements. The preventive measure is a structured self-check covering the points that are noticed first in audits, supplemented by a defined procedure for requests and security incidents.<\/p>\n\n\n\n Then there is the time factor. Data subject requests must generally be answered within one month, and reportable security incidents must be reported within 72 hours. Those who only design these procedures once an incident occurs lose the crucial first hours. A prepared response plan with designated responsible persons costs little and works exactly when it matters.<\/p>\n\n\n\n The Supply Chain Due Diligence Act applies directly to companies with a thousand or more employees in Germany. The reporting obligation to the supervisory authority has been abolished; risk analysis, preventive measures, complaints procedures, and documentation remain. At the European level, the EU supply chain directive was significantly slimmed down by the omnibus package and will in future mainly apply to very large companies. For smaller businesses, this is no reason to relax, because the requirements reach them through the contracts of large customers and through tenders. Anyone who cannot provide proof loses the contract. More on this under Supply Chain Due Diligence Act (LkSG) and sustainability obligations<\/a>.<\/p>\n\n\n\n AI tools have long been in use, mostly without internal rules. This creates three risks: confidential data leaking into external systems, unclear rights to generated content, and liability for erroneous results that were used without review. In addition, there are the obligations under the EU AI Act, whose requirements are taking effect in stages. The preventive measure is a written usage policy with a list of approved tools, data protection rules, and a binding duty to review results before use. We support this as part of our legally compliant use of AI<\/a>.<\/p>\n\n\n\n In larger companies, there are dedicated functions for this purpose. In medium-sized companies, responsibility is almost always with the management, and that is precisely the bottleneck. Legal issues compete with sales, production, and personnel there, and they regularly lose this competition because they rarely have urgent impact.<\/p>\n\n\n\n The practical solution consists of three elements. First, a designated person within the company who keeps track of everything without having to make legal decisions themselves. Second, a fixed meeting at which open issues are reviewed, usually quarterly and for no longer than an hour. Third, an attorney as contact person who knows the issues and can respond without needing time to get up to speed.<\/p>\n\n\n\n This structure costs little and noticeably changes the dynamics. Questions are asked before they become costly, because the path to getting there is short. In practice, the number of conflicts decreases significantly in the second year, because the recurring sources of error are eliminated by then.<\/p>\n\n\n\n Prevention rarely fails due to knowledge, and almost always due to implementation. A simple cycle keeps the effort manageable.<\/p>\n\n\n\n Beyond a certain size, it pays to turn this cycle into a formal system. We describe what such a system must achieve under Compliance management systems<\/a>. In addition, companies with fifty or more employees need an internal reporting channel, on which you can find more information under Whistleblower systems and ISO 37301<\/a> .<\/p>\n\n\n\n For most medium-sized companies, an initial review takes a few days. After that, ongoing maintenance is required, which is significantly less work. On the other side is the cost of a single conflict: attorney and court fees, tied-up management time, provisions, delayed projects, and in the worst case, the managing director being held personally liable.<\/p>\n\n\n\n In almost all cases, the math works out in favor of prevention, because it not only avoids costs but also preserves the ability to act. A company with orderly contracts can negotiate faster, calculate more reliably, and submit the required proof in tenders. In a sale or succession, the same order has a direct effect on the price. The professional framework for this is our advice on Compliance and managing director liability<\/a>.<\/p>\n\n\n\n The first mistake is the paper project. Guidelines, manuals, and forms are created that no one reads and that have no effect in day-to-day business. In a liability case, documentation that was clearly not put into practice can even be incriminating, because it shows that the risk was known.<\/p>\n\n\n\n The second mistake is the completeness trap. Anyone who wants to work on all areas at the same time gets nowhere. It makes more sense to start with the area in which the greatest damage can occur and to put the remaining topics in an order that is worked through over twelve months.<\/p>\n\n\n\n The third mistake is the lack of accountability. As long as a measure does not have a name and a date, it remains a declaration of intent. Instead, determine who is responsible, by when something is ready, and who will verify the implementation. In smaller companies, a single table is sufficient, reviewed twice a year. Those who address these six points have already reduced most of the risk. For a broader framework, see our overview of online coaching law<\/a>.<\/p>\n\n\n\n Getting started with prevention is easier than it seems. Tell us your industry, the size of your company, and the three issues that make you most uneasy. We will assess which obligations actually apply to you, where there is an urgent need for action, and what can wait. To do so, schedule an free initial consultation<\/a> of 15 to 20 minutes.<\/p>\n\n\n\nHow to recognize when it\u2019s time<\/h2>\n\n\n\n
\n
The seven risk areas in medium-sized companies<\/h2>\n\n\n\n
1. Contracts and Terms<\/h3>\n\n\n\n
2. Duties and liability of management<\/h3>\n\n\n\n
3. Liquidity and early detection of crises<\/h3>\n\n\n\n
4. Personnel and social security contributions<\/h3>\n\n\n\n
5. Data protection and IT security<\/h3>\n\n\n\n
6. Supply chain and sustainability<\/h3>\n\n\n\n
7. Artificial Intelligence in the workplace<\/h3>\n\n\n\n
Who in the company takes responsibility for prevention<\/h2>\n\n\n\n
The prevention cycle in four steps<\/h2>\n\n\n\n
\n
What prevention costs and what it saves<\/h2>\n\n\n\n
Three mistakes that make prevention ineffective<\/h2>\n\n\n\n