How do I sell into Legal / Compliance without losing momentum?

Front-load Legal/Compliance in week 2, not week 8. Give them a risk register and contract template 10 days before they need to sign. They become part of the solution, not a surprise objection at close.

Selling Through Legal

Why Legal stalls deals:

• They're reactive gatekeepers asked to approve terms they didn't help shape
• They see risk everywhere (it's their job)
• They have no visibility into business value, so risk feels unbalanced

Early engagement (week 2):

1. Ask your champion: "Who owns vendor compliance and contract review?"
2. Schedule a 30-min "risk walkthrough" call (not a demo, not a pitch)
3. Agenda:

• What are your non-negotiables? (SOC 2, data residency, HIPAA, GDPR)
• Data handling: where it lives, who can access, retention policy
• Contract terms: liability caps, indemnification, termination clause

What you bring to Legal:

1. Risk register (your template):

• "Your data is encrypted in transit and at rest (AES 256)"
• "We're SOC 2 Type II certified as of [date]"
• "GDPR DPA is attached; CCPA addendum available"

1. Comparison table (if relevant):

• Competitor A: SOC 2, HIPAA, US-only data centers
• Competitor B: SOC 2, no HIPAA, EU data center option
• Your company: SOC 2, HIPAA, GDPR, multi-region

1. Contract terms (standard template):

• Liability caps (2x ACV / 12 months, your standard)
• Indemnification (your counsel already reviewed)
• Data handling addendum (DPA)

Conversation framing:

• "We know Legal has critical requirements. We've built this to pass compliance review fast. Can we walk through the risk register so there are no surprises at signing?"
• Don't say "Can you approve this?"
• Say "What gaps should we address before contract review?"

Common Legal objections (handling):

1. "We've never heard of you"

• Response: "We're SOC 2 Type II, GDPR-compliant, and have [X] enterprise customers. Here's our security overview."

1. "We need your insurance certificate"

• Have it ready day 1 (cyber liability, E&O, standard coverage amounts)

1. "Your liability cap is too low"

• Negotiate in the legal phase, not at close (e.g., 2x ACV instead of 1x)

1. "We can't use your DPA"

• Offer to co-sign their DPA if it meets GDPR minimum (you probably can)

Timeline expectation-setting:

• "Legal review typically takes 10–14 days. If we loop them in now [week 2], they can review in parallel with your technical team. That puts us at close by [date]."
• Build 2 extra weeks into your close date; Legal always uses them

Post-contract, protect momentum:

• Signing authority: Make sure whoever owns Legal actually has signing rights (don't discover on day 45 that the CFO must co-sign)
• One final review round: "Any final changes before signature?"
• Turnaround time: 24–48 hours, not "next week"

TAGS: legal-compliance, contract-negotiation, deal-structure, risk-management, buying-process