When professional services drift out of scope: what to do first
Treat scope drift as a live billing and liability event, not a communication problem. Stop assigning new tasks outside the signed statement of work, log every item added since the last change order, and put the mismatch in writing to the vendor before the next invoice arrives. A response clock under the contract's own escalation clause is usually already running, whether or not either side has noticed.
Foundation
The first document to open is the contract, not general law. Most technology-services agreements define scope through a statement of work, a change-order procedure and an acceptance step. Drift is what happens when delivery outruns that paperwork.
Where the drift adds a right to modify software rather than simply run it, that right sits under Directive 2009/24/EC — a licence to use a program is not the same grant as a licence to adapt it. A related question, addressed separately, is what happens when the underlying licence ends while something built on top of it survives: When a licence terminates but the token remains.
Where drift moves integration work into systems already within scope of network and information security duties, obligations may attach under Directive (EU) 2022/2555 (NIS2), depending on whether the entity itself is in scope. Where drift adds an AI component absent from the original specification, the risk classification under Regulation (EU) 2024/1689 (AI Act) becomes relevant to who carries which duty going forward.
What changes in practice
Unmanaged drift changes three things at once: the fee basis, the risk allocation, and the limitation clock. Work performed outside a change order commonly falls outside the fee cap and outside the liability cap the original scope negotiated. If the drifted work touches a system with security or data obligations, notification duties can start running before anyone has framed the change as a scope issue at all.
What to do, in order
- Freeze new tasks. The project manager stops assigning deliverables outside the signed statement of work until scope is confirmed in writing.
- Reconstruct the timeline. Whoever holds the project file lists every task performed since the last signed change order, with dates and the requester.
- Match tasks to the contract. In-house counsel or the commercial lead checks each item against the scope clause and the change-management procedure.
- Send a scope notice. The contract owner on the client side puts the mismatch in writing to the vendor's account lead, before the next invoice is issued.
- Decide the treatment. Commercial leads on both sides agree whether the extra work is billed under a retrospective change order, absorbed, or removed from the deliverable.
- Escalate only if the notice gets no answer within the contractual response window, and escalate to the level the governance clause names — not straight to litigation.
Who decides
Well-drafted technology contracts route disagreement through a two-tier structure before anyone reaches a court or a tribunal.
| Stage | Who decides | Typical basis |
|---|---|---|
| Operational | Project managers on both sides | Statement of work, task log |
| Commercial | Steering committee or named account leads | Change-order clause |
| Contested | Escalation contact or expert named in the contract | Governance or dispute clause |
| Unresolved | Court or arbitral tribunal named in the contract | Governing law clause |
If your situation differs
- If the drift added software functionality your organisation now depends on, settle the licence question under Directive 2009/24/EC before paying for it. Otherwise you may be paying for a right you were never actually granted.
- If the drifted work touches a system already within scope of security duties, treat the notification clock as running from the moment the system changed, not from the moment someone noticed.
- If the counterparty is a reseller acting under terms your organisation never signed, the scope problem sits one contractual layer higher: When a reseller signs terms you never saw.
What this page does not decide
This page does not decide whether drift amounts to a breach entitling termination. That turns on the materiality test written into the specific contract, and on facts this page cannot see. It does not set a rate for extra work — the contract, not general law, fixes that. It does not replace the governance and escalation clause already in your agreement; read that clause before applying any step above.
Verified
Checked on 4 February 2025. Sources consulted: Directive 2009/24/EC on the legal protection of computer programs; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2024/1689 (AI Act).
This analysis does not track you beyond what our Cookies and what is switched off by default and notice describes.
Where the underlying question is what can be established about a counterparty already involved in the dispute, our automated report maps that separately: Counterparty in Germany and its limits explained.
Where the underlying question is what a document already in hand can actually support, a second report covers that ground: Document in Germany step by step. Both sit outside the scope of this page.
Related situations
The reseller variant above is the closest neighbour to this one. Both start with the same instinct: stop, log, and write it down before the next invoice makes the argument for you.
Before you contact us
Bring the last signed statement of work and the task log described in step two. That is what lets a first read of the file be useful rather than speculative.
Frequently asked questions
What is the first step when professional services drift out of scope?
Stop assigning further tasks outside the signed statement of work and build a dated log of everything performed since the last change order. Do this before responding to the vendor.
Which deadline is already running?
Usually the response window written into the contract's own escalation or governance clause, and, where a system with security duties was affected, any notification clock tied to that system. Neither waits for agreement on who is right.
Who decides, and on what evidence?
Most contracts route the question first to project managers, then to a steering committee or named account leads, then to an escalation contact or expert named in the contract. The evidence is the statement of work, the change-order log, and the dated record of who asked for what.