Free resource · 35 checks · No email required
Outsourcing to Kosovo: The Due-Diligence Checklist
What to actually verify before contracting a developer in Kosovo: IP assignment, GDPR transfer mechanism (Kosovo has no adequacy decision), reverse-charge VAT, payment rails, and how to tell senior from confident.
01 · 5 checks
Verify who you are actually hiring
The cheapest fraud in offshore contracting is seniority fraud, and it is not usually a fake identity. It is a real person whose portfolio belongs partly to someone else.
You have had a live technical conversation, on video, about a decision they made and regretted.
Anyone can narrate a success. The shape of a regret is very hard to fake and tells you where their judgement actually sits.
You have seen code they wrote, not only products they were involved in.
Involvement is elastic. A repository, a pull request, or a walkthrough of their own commit history is not.
You know whether you are contracting an individual or an agency that will subcontract.
Both can be fine. Discovering it after signing is what is not fine, because the person you assessed may never touch the work.
You have a named legal entity or registered individual, and an address.
You need this for the contract and the invoice regardless. Reluctance to provide it early is itself information.
You have asked directly what they will not take on.
A senior contractor has a clear answer. An unwillingness to decline anything usually means an unwillingness to tell you bad news later.
02 · 5 checks
Contract and governing law
Kosovo is outside the EU, so none of this is automatic. It is all routine, but it has to be written down.
Governing law and jurisdiction are named explicitly.
Left blank, this becomes an argument at exactly the moment you cannot afford one. Most Kosovo contractors will accept your jurisdiction.
The contract is business-to-business, with no language implying employment.
Misclassification risk sits with you, not with them, and the tests differ by your country rather than theirs.
Deliverables, acceptance criteria and revision scope are defined.
The most common dispute in contract development is not quality, it is whether something was in scope.
Notice period and termination rights are symmetrical and short.
A short mutual notice period protects both sides and is a good sign that neither is planning to rely on lock-in.
Confidentiality survives termination, with a defined duration.
An NDA that lapses with the contract protects you during the period you least need protecting.
03 · 4 checks
Intellectual property
The item most often skipped and most expensive to fix. In many jurisdictions, absent an assignment, the author retains rights in what they wrote for you.
The contract assigns IP in the deliverables to you, on creation or on payment.
A licence is not an assignment. If your investors or an acquirer diligence this later, the difference is material.
Assignment is not conditional on anything vague.
Assignment on full payment is normal and fine. Assignment on unspecified satisfaction is a hostage clause.
Third-party and open-source components are disclosed with their licences.
You cannot assign what they did not own. A copyleft dependency in a proprietary product is discovered at the worst possible time.
Any pre-existing tooling they reuse is identified, and you have a licence to keep using it.
Good contractors bring their own scaffolding. That is a benefit, provided you are not left unable to run your own system without them.
04 · 6 checks
Data protection and GDPR transfers
The section most buyers get wrong, and the one where the facts are specific. Kosovo has a GDPR-transposing law but does not have an EU adequacy decision, so a transfer mechanism is required.
You know whether the contractor will process personal data at all.
Often they will not, and this section collapses to one line. Assuming they will when they do not creates paperwork for nothing.
If they will, there is a written data processing agreement.
Article 28 requires it of you as controller. It is not optional and it is not satisfied by an NDA.
The transfer relies on Standard Contractual Clauses or another Article 46 safeguard.
Kosovo is not on the EU adequacy list, so there is no free-transfer route. SCCs are the standard mechanism and are routine to sign.
You have noted that Kosovo's Law No. 06/L-082 transposes the GDPR, with the Information and Privacy Agency as supervisory authority.
This strengthens your transfer impact assessment considerably. Local law being GDPR-aligned is a genuine safeguard, it just is not a substitute for the mechanism.
Access is least-privilege, and you can revoke it in minutes.
The strongest practical control regardless of paperwork. Production access for a contractor who only needs staging is a self-inflicted risk.
Sub-processors, including any AI tools they use on your data, are disclosed and approved.
A contractor pasting your customer data into a consumer AI tool is a transfer you never authorised and cannot see.
05 · 4 checks
Tax and invoicing
Boring, mechanical, and the thing that delays a first payment by three weeks if nobody checked. Your accountant has done all of this before.
You know how the invoice will be treated for VAT in your country.
For EU businesses buying services from a third-country supplier, the reverse charge is the normal route and your accountant handles it routinely.
Your own VAT number is on the contract if you have one.
It determines the treatment. Supplying it after the first invoice means reissuing the first invoice.
Withholding tax has been checked for your jurisdiction, not assumed.
Some countries require withholding on payments to non-treaty jurisdictions. It is usually nil, and finding out is a single question.
For US payers, the appropriate tax form is on file before the first payment.
A non-US contractor generally provides a W-8BEN or W-8BEN-E. Requesting it after payday delays payday.
06 · 3 checks
Payment mechanics
Kosovo uses the euro. Payment is straightforward, and there are two things worth agreeing in advance.
Currency and who bears conversion and transfer fees are agreed.
Unstated, this surfaces as a contractor being underpaid by a small amount every month and being annoyed about it.
Payment terms and an invoicing cadence are written down.
Net-30 against a monthly invoice is normal. Ambiguity here is the most common cause of friction in an otherwise good relationship.
For a first engagement, the commercial structure limits your downside.
A small paid pilot, or milestones rather than a single terminal payment, is how both sides de-risk a relationship neither has tested.
07 · 4 checks
Working practices
Kosovo is on Central European Time, which removes most of what makes offshore contracting painful. These four cover the rest.
Working hours and expected response time are explicit.
CET gives a full overlap with Western Europe and near-full with the UK, but overlap available is not overlap agreed.
Code lives in your repository, and infrastructure in your accounts, from day one.
The single best protection against a bad ending. If it is all in their accounts, the handover is a negotiation.
Language for meetings, documentation and code comments is agreed.
English is standard in Kosovo's tech sector. Agreeing that code and docs are English keeps the codebase maintainable by whoever comes next.
There is one recurring checkpoint, not only asynchronous updates.
Written updates hide drift well. Thirty minutes a week surfaces it early, which is when it is cheap.
08 · 4 checks
Continuity and exit
Plan the ending while everyone is still pleased with each other. It is the only time you will get good terms.
You can deploy the system without the contractor present.
The most useful test of whether you actually own what you paid for. Try it before you need it.
Documentation is a named deliverable, not an implied courtesy.
Unbilled documentation does not get written. A day of it in scope is worth weeks of archaeology later.
There is an agreed handover scope if the engagement ends.
Cheap to agree at the start, contentious at the end, and the difference is measured in weeks of continuity.
You have accepted the concentration risk of a single contractor, or mitigated it.
One senior person is often better value than a team. It is also one person, and being honest about that is better than being surprised by it.
Smaller than a call
Stuck on one of these?
Reply to one item rather than booking a call. Tell me which check you are least sure about and I will tell you what I would do, in writing, at no cost. I answer these myself.
Opens your mail client with the subject filled in. Nothing is stored on this site.
If it would be faster to have this built than checked: Hire a Software Engineer in Kosovo · all resources