# Outsourcing to Kosovo: The Due-Diligence Checklist What to actually verify before contracting a developer in Kosovo: IP assignment, GDPR transfer mechanism (Kosovo has no adequacy decision), reverse-charge VAT, payment rails, and how to tell senior from confident. 35 checks across 8 sections. By Ergini, senior software and AI developer. https://ergini.com Full version, kept up to date: https://ergini.com/resources/kosovo-outsourcing-due-diligence Questions about any item are welcome at ergin@ergini.com. --- ## 1. Verify who you are actually hiring The cheapest fraud in offshore contracting is seniority fraud, and it is not usually a fake identity. It is a real person whose portfolio belongs partly to someone else. - [ ] You have had a live technical conversation, on video, about a decision they made and regretted. Why: Anyone can narrate a success. The shape of a regret is very hard to fake and tells you where their judgement actually sits. - [ ] You have seen code they wrote, not only products they were involved in. Why: Involvement is elastic. A repository, a pull request, or a walkthrough of their own commit history is not. - [ ] You know whether you are contracting an individual or an agency that will subcontract. Why: Both can be fine. Discovering it after signing is what is not fine, because the person you assessed may never touch the work. - [ ] You have a named legal entity or registered individual, and an address. Why: You need this for the contract and the invoice regardless. Reluctance to provide it early is itself information. - [ ] You have asked directly what they will not take on. Why: A senior contractor has a clear answer. An unwillingness to decline anything usually means an unwillingness to tell you bad news later. ## 2. Contract and governing law Kosovo is outside the EU, so none of this is automatic. It is all routine, but it has to be written down. - [ ] Governing law and jurisdiction are named explicitly. Why: Left blank, this becomes an argument at exactly the moment you cannot afford one. Most Kosovo contractors will accept your jurisdiction. - [ ] The contract is business-to-business, with no language implying employment. Why: Misclassification risk sits with you, not with them, and the tests differ by your country rather than theirs. - [ ] Deliverables, acceptance criteria and revision scope are defined. Why: The most common dispute in contract development is not quality, it is whether something was in scope. - [ ] Notice period and termination rights are symmetrical and short. Why: A short mutual notice period protects both sides and is a good sign that neither is planning to rely on lock-in. - [ ] Confidentiality survives termination, with a defined duration. Why: An NDA that lapses with the contract protects you during the period you least need protecting. ## 3. Intellectual property The item most often skipped and most expensive to fix. In many jurisdictions, absent an assignment, the author retains rights in what they wrote for you. - [ ] The contract assigns IP in the deliverables to you, on creation or on payment. Why: A licence is not an assignment. If your investors or an acquirer diligence this later, the difference is material. - [ ] Assignment is not conditional on anything vague. Why: Assignment on full payment is normal and fine. Assignment on unspecified satisfaction is a hostage clause. - [ ] Third-party and open-source components are disclosed with their licences. Why: You cannot assign what they did not own. A copyleft dependency in a proprietary product is discovered at the worst possible time. - [ ] Any pre-existing tooling they reuse is identified, and you have a licence to keep using it. Why: Good contractors bring their own scaffolding. That is a benefit, provided you are not left unable to run your own system without them. ## 4. Data protection and GDPR transfers The section most buyers get wrong, and the one where the facts are specific. Kosovo has a GDPR-transposing law but does not have an EU adequacy decision, so a transfer mechanism is required. - [ ] You know whether the contractor will process personal data at all. Why: Often they will not, and this section collapses to one line. Assuming they will when they do not creates paperwork for nothing. - [ ] If they will, there is a written data processing agreement. Why: Article 28 requires it of you as controller. It is not optional and it is not satisfied by an NDA. - [ ] The transfer relies on Standard Contractual Clauses or another Article 46 safeguard. Why: Kosovo is not on the EU adequacy list, so there is no free-transfer route. SCCs are the standard mechanism and are routine to sign. - [ ] You have noted that Kosovo's Law No. 06/L-082 transposes the GDPR, with the Information and Privacy Agency as supervisory authority. Why: This strengthens your transfer impact assessment considerably. Local law being GDPR-aligned is a genuine safeguard, it just is not a substitute for the mechanism. - [ ] Access is least-privilege, and you can revoke it in minutes. Why: The strongest practical control regardless of paperwork. Production access for a contractor who only needs staging is a self-inflicted risk. - [ ] Sub-processors, including any AI tools they use on your data, are disclosed and approved. Why: A contractor pasting your customer data into a consumer AI tool is a transfer you never authorised and cannot see. ## 5. Tax and invoicing Boring, mechanical, and the thing that delays a first payment by three weeks if nobody checked. Your accountant has done all of this before. - [ ] You know how the invoice will be treated for VAT in your country. Why: For EU businesses buying services from a third-country supplier, the reverse charge is the normal route and your accountant handles it routinely. - [ ] Your own VAT number is on the contract if you have one. Why: It determines the treatment. Supplying it after the first invoice means reissuing the first invoice. - [ ] Withholding tax has been checked for your jurisdiction, not assumed. Why: Some countries require withholding on payments to non-treaty jurisdictions. It is usually nil, and finding out is a single question. - [ ] For US payers, the appropriate tax form is on file before the first payment. Why: A non-US contractor generally provides a W-8BEN or W-8BEN-E. Requesting it after payday delays payday. ## 6. Payment mechanics Kosovo uses the euro. Payment is straightforward, and there are two things worth agreeing in advance. - [ ] Currency and who bears conversion and transfer fees are agreed. Why: Unstated, this surfaces as a contractor being underpaid by a small amount every month and being annoyed about it. - [ ] Payment terms and an invoicing cadence are written down. Why: Net-30 against a monthly invoice is normal. Ambiguity here is the most common cause of friction in an otherwise good relationship. - [ ] For a first engagement, the commercial structure limits your downside. Why: A small paid pilot, or milestones rather than a single terminal payment, is how both sides de-risk a relationship neither has tested. ## 7. Working practices Kosovo is on Central European Time, which removes most of what makes offshore contracting painful. These four cover the rest. - [ ] Working hours and expected response time are explicit. Why: CET gives a full overlap with Western Europe and near-full with the UK, but overlap available is not overlap agreed. - [ ] Code lives in your repository, and infrastructure in your accounts, from day one. Why: The single best protection against a bad ending. If it is all in their accounts, the handover is a negotiation. - [ ] Language for meetings, documentation and code comments is agreed. Why: English is standard in Kosovo's tech sector. Agreeing that code and docs are English keeps the codebase maintainable by whoever comes next. - [ ] There is one recurring checkpoint, not only asynchronous updates. Why: Written updates hide drift well. Thirty minutes a week surfaces it early, which is when it is cheap. ## 8. Continuity and exit Plan the ending while everyone is still pleased with each other. It is the only time you will get good terms. - [ ] You can deploy the system without the contractor present. Why: The most useful test of whether you actually own what you paid for. Try it before you need it. - [ ] Documentation is a named deliverable, not an implied courtesy. Why: Unbilled documentation does not get written. A day of it in scope is worth weeks of archaeology later. - [ ] There is an agreed handover scope if the engagement ends. Why: Cheap to agree at the start, contentious at the end, and the difference is measured in weeks of continuity. - [ ] You have accepted the concentration risk of a single contractor, or mitigated it. Why: One senior person is often better value than a team. It is also one person, and being honest about that is better than being surprised by it. --- Written by Ergini. Free to use, share, and adapt inside your own team. If it would be faster to have this built rather than checked: https://ergini.com/hire/software-engineer-kosovo