How to Review Subcontractor Flow-Down of MSA Obligations

Ned, Ops at a 20-person UK marketplace, is about to treat a blank subcontracting line as a courtesy. Finance signed off. Knowing how to review subcontractor flow-down of msa obligations is a 25-minute hunt: demand prior written consent for core work, name confidentiality, IP, security and ABC as flow-downs, keep the prime liable, then insist on seeing the extract.

September 2026. English law; exclusive courts of England and Wales. The packet — MSA, SOW, and any subcontracting exhibit — attached schedule or appendix, dated today. Clause 12: “Supplier may subcontract without consent.” Clause 9 discloses to “personnel.” IP is silent on freelancer code. Security is “reasonable.” ABC is “all anti-corruption laws.” Not a DPA (data processing agreement) annex tour.

AE Slack, Thursday: “The freelancer on Friday is already booked — we used a sub last time when the API slipped.” Ned asks to see the flow-down. They refuse: “That’s our commercial paper.” Kickoff is Friday. The rush is the problem. The hidden risk is a blank cheque. The AE line is the pressure that lets him sign.

Silence is not a lock — and “Supplier may subcontract without consent” is worse than silence. LegalVision UK (17 October 2024): unless the paper prohibits it or the work is personal, a party can subcontract without consent, while remaining liable. Clause 12 writes that default in. CCS Joint Schedule 6 wants a copy within ten (10) Working Days, if asked. Ned asked. They refused.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

How to review subcontractor flow-down of msa obligations when they may subcontract without consent?

English law’s default often allows subcontracting without consent unless the paper forbids it or the work is personal. Clause 12 writes that default in. A Friday freelancer who will touch listings, APIs or customer data is core work, not the coffee machine. Write prior written consent, or log “without consent — fail.”

Do: demand prior written consent for core work, or a named Schedule X. Don’t: treat “everyone uses freelancers” as customer approval of subcontractors. For example, Morgan Lewis Contract Corner treats a Material Subcontractor as a significant portion of the Services, Customer Data, or IP development. CCS General Terms 26.2 wants prior written consent — public-sector colour, not Ned’s statute. In practice, Friday is core if they touch listings.

What must the named flow-down cover — confidentiality, IP, security and ABC?

“Comply with all applicable laws” is not a named flow-down. “Personnel” with no “no less restrictive” line is not one either. Write confidentiality, IP, security and ABC in writing before disclosure, no less onerous than the MSA. Log “unnamed — fail” if the four are missing.

ReviewMyContract (20 March 2026): recipients must be bound no less restrictively — that is the flow-down confidentiality to subcontractors. Sharing before the written flow-down is already a miss. Sprintlaw UK (10 December 2025) names those four as the usual set. Cummings (7 June 2026): “all prime terms apply” is rarely sufficient — cite clause numbers. MoJ Bribery Act 2010 guidance para 39: ask the counterparty to take a similar ABC approach with the next party — one named item, not the whole adequate-procedures hunt: anti-bribery ABC compliance covenant. Do: name the four. Don’t: accept “all laws.”

Why does the prime stay liable — and why is “we used a sub” not a defence?

There is no privity with the freelancer. The supplier tries to park a missed integration on “we used a sub.” Write that the Supplier is responsible for subcontractors as if they were its own — the prime remains liable. A subcontract does not transfer MSA liability.

LexisNexis Commercial: even where the customer consents, the contractor remains liable — vicarious performance, not a transfer. CCS 8.4.1 colour: responsible as if they were its own. GovCon Source (5 June 2026): the government holds the prime, not the sub. Do: write “as if its own.” Don’t: leave the defence open.

When is this commercial hunt not a DPA sub-processor list?

If the fight is an Article 28 sub-processor list — prior authorisation, notice plus object, equivalent processor terms — that is a different hunt: data-processing-agreement checklist. Stay here for consent, named four, prime liable, and the extract.

ICO on what the contract must include: prior specific or general written authorisation; equivalent Article 28(3) terms; processor liable for the sub-processor. A sub-processor URL does not fix clause 12, name IP or ABC, or stop “we used a sub.” Do: one sentence then that checklist. Don’t: spend Friday on an annex tour.

What right do you need to see the flow-down, not the whole sub contract?

You cannot check a flow-down you cannot see. They refuse “that’s our commercial paper.” Require a redacted extract of the named four, or a dated certificate plus the sub’s legal name. Do not sign the sub.

CCS 26.7.4 colour: a copy within ten (10) Working Days. Ned’s ask can be narrower — extract or certificate, not their rates. Law Insider samples give a review right without becoming a party. Verbal “we flowed it down” is a fail. Refusal is a fail. Do: see the flow-down. Don’t: sign their sub.

How do you consent, flow-down, or walk?

Consent only if the log shows prior written consent for core work, named four in writing before disclosure, prime liable as if its own, and a right to see the extract. Flow-down means redline those four. Walk — do not start Friday — if “without consent” plus unnamed four plus “we used a sub” plus refusal-to-show remain.

Success bar: a one-page checklist plus one Friday pause sentence. Workflow: consent (core work) → named flow-down (confidentiality / IP / security / ABC) → prime stays liable → not B06 → see the extract → consent / flow-down / walk. Verify clause 12 before you sign. Escalate that package to counsel — a qualified lawyer, not the chatbot. Optional: upload the same PDF to document analysis for a first-pass — first machine pass that extracts clauses before a human reads every page — and a human still opens clause 12. Verify every High flag — a severity-high finding a named human still opens.