Owning your startup's code: IP assignments, consents and confidentiality

Because a company does not exist as a legal person until it is registered with ASIC (Corporations Act 2001 (Cth) s 119), any code, inventions, or brand assets created before incorporation start in the personal ownership of the individual founders (and if a founder signed a contract on behalf of the not-yet-existing company, the company needs to ratify it after registration within the agreed period or a reasonable time (s 131) to be bound; otherwise the founder who signed may be personally liable). After incorporation, 'co-founder' is a commercial description rather than a legal category: unless a founder is employed by the company under a contract of service, holding shares or acting as a company director does not automatically vest legal title to their work in the company without a signed written assignment, though fiduciary duties may give the company an equitable claim.

Due diligence also checks whether any founder created early IP while employed by a former employer or enrolled at or employed by a university whose IP or confidentiality terms could give them a claim over the work. Separately, using a former employer's confidential information or code can lead to a claim even where the employer does not own the new product. Code or inventions created jointly by co-founders are usually co-owned: neither co-owner of copyright can license or assign the whole without the other's consent, and for granted patents, no co-owner can license or assign any interest without the others' consent (Patents Act 1990 (Cth) s 16), meaning a departed co-founder who never assigned can block a licence or sale, not just demand money. Founders should not wait until a term sheet is signed to chase former contractors or a departed co-founder for a confirmatory assignment deed. Once a former contributor knows a funding round depends on their signature, they gain leverage to demand cash or equity. Founders should sign assignment deeds as soon as the company is incorporated, and contractors before work begins. Assigning IP to the company may have tax implications for the founder, so speak to your tax adviser about the assignment, particularly if the IP already has value.

Under section 35(6) of the Copyright Act 1968 (Cth), automatic employer ownership of copyright applies only where the work is made by an employee 'in pursuance of the terms of his or her employment' under a contract of service, and even that default rule can be excluded or modified by agreement (s 35(3)). Courts look closely at what the employee was actually employed to do.

Crucially, section 35(6) covers copyright only. It does not cover inventions, and it does not cover work outside an employee's duties. For inventions, an employer's entitlement under section 15(1)(b) of the Patents Act 1990 (Cth) rests on common law implied terms and depends on whether the employee was engaged with a duty to invent. In University of Western Australia v Gray [2009] FCAFC 116, the court held that an academic had no such implied duty, so the inventions were his. Since then, universities have relied on express IP policies and contractual terms (particularly for university staff, funded or postgraduate research students, and work using significant university facilities or grant funding), which is why founders who were researchers or students need those terms checked. Similarly, where early prototypes were developed through a university incubator, accelerator, corporate hackathon, or research or government grant, check the program or grant terms early to confirm they do not impose IP ownership claims, licensing restrictions, revenue-share royalties, commercialisation conditions, or change-of-control conditions. Employment agreements, including those for employee-founders, should therefore always contain express IP assignment and confidentiality clauses.

Copyright protects the expression of code, not the underlying ideas, algorithms, or functionality (Data Access Corporation v Powerflex Services Pty Ltd (1999) 202 CLR 1). Patent protection is separate and requires a patentable invention under section 18 of the Patents Act 1990 (Cth); in Australia, a computer-implemented invention is patentable where an abstract idea is implemented on a computer to produce an artificial state of affairs and a useful result, rather than merely manipulating an abstract idea or scheme on a computer, and no advance in computer technology itself is required (Aristocrat Technologies Australia Pty Ltd v Commissioner of Patents [2025] FCAFC 131, High Court special leave refused February 2026; cf Encompass Corporation Pty Ltd v InfoTrack Pty Ltd [2019] FCAFC 161), so for many software startups copyright, confidentiality, and contractual protection still do most of the work. If you plan to patent an invention, speak to a registered patent attorney before any public disclosure. A startup IP Assignment Deed should still assign all Intellectual Property Rights (including copyright, inventions, and the right to apply for and be granted a patent as the entitled person under section 15 of the Patents Act 1990 (Cth)) alongside confidentiality obligations protecting confidential information and know-how (Australia has no general civil trade secrets statute and protects trade secrets through contract and the equitable duty of confidence). Code generated by AI tools without sufficient human authorship may not be protected by copyright (Telstra Corporation Ltd v Phone Directories Company Pty Ltd [2010] FCAFC 149; Acohs Pty Ltd v Ucorp Pty Ltd [2012] FCAFC 16), so founders should check the AI tool's terms on output ownership, ensure AI coding tools are configured on commercial plans that do not train external models on proprietary code inputs (and comply with customer contract restrictions), keep version-control records of human contribution to core modules, and cover AI-assisted outputs under confidentiality obligations.

Under sections 196(3) and 197 of the Copyright Act 1968 (Cth), an assignment of present or future copyright must be in writing and signed by or on behalf of the assignor. While a signed written assignment can pass legal title to existing copyright without consideration, an assignment of future copyright should be supported by real consideration (such as the engagement fee, salary, or an issue of shares; a nominal sum may not be enough in equity) so that, under s 197(1), legal title vests in the assignee automatically when the copyright comes into existence; executing the document as a deed alone may not be enough. Likewise, where a startup asks a founder or contractor for a retrospective assignment after the work has already been completed and paid for, past payment is 'past consideration' and will not support the contractual promises in a retrospective assignment, such as warranties, further assurance, confidentiality, and power of attorney. Executing the assignment as a deed (or providing fresh consideration) solves this, and also helps ensure any moral rights consent cannot later be withdrawn.

Experienced developers and software agencies will rarely agree to assign their pre-existing tools or boilerplate code libraries (Background IP). Market practice is to take an outright assignment of all Project or Developed IP while taking an irrevocable, perpetual, worldwide, non-exclusive, royalty-free, transferable, and sub-licensable licence over any Background IP incorporated into the product (including the right to modify and surviving termination). Because Background IP often includes third-party and open-source code that the developer cannot license on those terms, the agreement should require prior disclosure and approval of third-party components. Where you engage a development agency, ensure the contract also requires the agency to hold written back-to-back IP assignments from any freelance or offshore sub-contractors it uses, and take local advice on whether assignments and consents from overseas sub-contractors are effective in their country.

Under sections 190 and 195AN(3) of the Copyright Act 1968 (Cth), moral rights belong only to individual authors and cannot be assigned. US template agreements that purport to 'assign or waive all moral rights' are ineffective under the Copyright Act, which does not recognise a general waiver outside its statutory consent regime (McCallum v Projector Films Pty Ltd [2026] FCA 173, a first-instance decision under s 195AW). While failing to attribute an author or subjecting a work to derogatory treatment is not an infringement if the act or omission was reasonable in all the circumstances (ss 195AR and 195AS), startups and investors do not rely on a reasonableness defence alone. Instead, for literary and artistic works (including source code), Australian agreements should include a written moral rights consent under section 195AWA (or section 195AW where works are films or included in films). Under section 195AWA(3), a non-employee consent (including for contractors, non-employee founders, and an employee-founder's pre-incorporation work) must relate to specified existing works or specified works of a particular description, and to specified acts or omissions (or specified classes or types of acts or omissions). In practice, contractor and founder consents should list the classes of acts broadly, such as not attributing authorship, attributing authorship to others, and altering, adapting, combining, or reproducing the work, so that normal product development is covered. Under section 195AWA(4), an employee may give a broader consent covering all or any acts or omissions for all works made in the course of employment (and under section 195AW(2), a film consent may also cover all or any acts or omissions). Under section 195AWB, a consent obtained by duress, or by a statement the person knew to be false or misleading and made to persuade the author to consent, has no effect. While the Act presumes that a consent given to the copyright owner or prospective owner extends to their licensees and successors in title unless the instrument states otherwise (ss 195AWA(5) and 195AW(5)), good drafting states this expressly. Where sub-contractors are based overseas, take local advice on whether moral rights consents or waivers are effective in the creator's country.

Alongside IP assignments and moral rights consents, due diligence checks how open-source software (OSS) libraries are licensed and deployed. Strong copyleft licences, such as modified AGPL code (which triggers on remote network interaction under AGPLv3 s 13; unmodified internal use does not trigger disclosure, though investors still flag AGPL dependencies) or GPL in software distributed to users (such as mobile, desktop, on-premise, SDK, or client-side code), attach strict conditions; if those conditions are not met, the licence can end (subject to the GPLv3/AGPLv3 cure provisions), exposing the company to a copyright infringement claim; the usual ways out are to comply (which can mean releasing proprietary source code) or to stop distributing and replace the component. By contrast, GPL or LGPL libraries used only in server-side code of a hosted product do not usually trigger source-code disclosure unless distributed, while distributed LGPL libraries must meet the licence's notice, relinking and reverse-engineering conditions (customer terms must permit reverse engineering to debug modifications) so proprietary code stays separate. Even permissive licences (such as MIT, Apache 2.0, and BSD) require retaining copyright notices, licence texts, and attribution files (NOTICE), and investors increasingly ask for a software bill of materials (SBOM) or a dependency report. If you open-source any of your own code, require outside contributors to sign a contributor licence agreement (or a clear inbound licence) so the company remains free to relicense or commercialise the combined codebase.

Registering a company or business name with ASIC, or holding a domain name, does not give you exclusive rights to your brand and does not stop you infringing someone else's trade mark. A registered trade mark gives exclusive rights for the goods and services it covers. After a clearance search, file trade marks for the product name in the company's (or group IP company's) name early, and if a founder registered trade marks, filed patent applications, or registered domain names personally before incorporation, assign them to the company (with associated goodwill for trade marks) and record the assignment with IP Australia (for trade marks, either the registered owner or the assignee must apply to have the assignment recorded under section 109 of the Trade Marks Act 1995 (Cth), or section 107 for a pending application; for patent applications, request under section 113 of the Patents Act 1990 (Cth) that the application proceed in the company's name, or register the assignment for granted patents) or transfer domains through the domain registrar (noting that .au domain names have auDA eligibility rules), alongside ensuring the company (or a company in its group), not an individual founder, holds all GitHub organisations, cloud accounts, app store developer accounts (Apple and Google), API keys and third-party service accounts. Finally, confirm that the company's IP is not encumbered by early commercial contracts or security interests: check enterprise pilot agreements, statements of work, and partner contracts to ensure clauses assigning 'deliverables' or granting exclusivity are strictly limited to bespoke customer outputs while the company retains all Background IP and platform or product improvements, and search the Personal Property Securities Register (PPSR) so that any security interests over IP or all assets (such as from venture debt, working-capital loans, or R&D tax incentive advances) are either discharged by the lender if repaid or, where the facility terms require it, covered by a lender consent letter before completion.