Every custom automation project starts with a supplier confidentiality agreement for assembly machines export-control obligations 1. Yet buyers often send our engineers full drawings before the NDA covers them. That gap leaks designs.
A supplier confidentiality agreement for assembly machines should define the confidential information scope precisely, assign intellectual property ownership, limit use to one permitted purpose, bind employees and third-party contractors, set confidentiality duration with return or destruction rules, and state breach remedies and compensation so the terms are enforceable.
Those five areas are the backbone. Below, I walk through each one from the supplier side of the table. I will show you what we accept, what we push back on, and why.
A procurement manager in Germany once sent me a two-page NDA for a bowl feeder assembly line. It never defined what "confidential" meant. We rewrote it together.
Core clauses should include a precise definition of confidential information, a permitted purpose limit, non-use and non-disclosure duties, intellectual property ownership split between background and project IP, a narrow non-circumvention clause, need-to-know access, flow-down to subcontractors, and a stated confidentiality term.
In my experience, the definition clause is the single most important part of the agreement. If the scope is vague, nothing else works. A buyer cannot enforce a duty on information that was never clearly covered.
For an assembly machine, the scope should name the real items. Think about what actually changes hands on a project like a terminal crimping cell or a chamfering station. It includes 2D engineering drawings 2, 3D CAD models, and tolerance data. It includes bills of materials, approved-vendor lists, and component pricing. It includes PLC, HMI, robot, and vision-system code. It includes process parameters such as torque settings, force profiles, and recipes. It includes cycle-time targets, factory layouts, production forecasts, and the identity of the end customer.
The clause should also cover oral, visual, and observed information. Our engineers learn a lot during a factory tour or a screen-share session. A clause that only covers stamped documents leaves that knowledge unprotected.
Not all proprietary information flows one way. I always ask buyers to think in three groups:
This matters when you decide between a unilateral and a mutual agreement. If you only send us technical specifications and we send nothing back, unilateral works. But when we share our proprietary feeder tooling designs or PLC function blocks, a mutual agreement is safer for both sides.
A promise to "keep information confidential" is weak on its own. Misuse can happen without any disclosure. A supplier could reuse your fixtures on another customer's line and never tell anyone. So the stronger clause is a purpose limitation. We accept language like "use only to perform obligations under this agreement." That covers quoting, design, manufacturing, installation, commissioning, and service. It excludes everything else.
Here is where many buyers overreach. A clause that says "do not use the customer's drawings, parameters, or source code for another customer" is fair and enforceable. A clause that says "do not design any similar assembly machine" is a disguised non-compete. We will not sign it, and in many jurisdictions it would not hold up anyway. Precise non-use language protects your project without blocking legitimate competition.
| Core clause | What it does | Drafting tip |
|---|---|---|
| Definition of confidential information | Sets the enforceable scope | List drawings, BOMs, code, recipes, layouts, observations |
| Permitted purpose | Limits use to the project | Name the project and the activities covered |
| Non-use and non-disclosure | Prevents competitive reuse and leaks | Keep it narrow to your data, not the whole market |
| IP ownership | Separates background IP from project IP | Add an assignment clause for custom deliverables |
| Non-circumvention clause | Stops the supplier bypassing a distributor to reach its end customer | Limit to named customers and a fixed period |
| Flow-down | Binds subcontractors to equal terms | Supplier stays liable for their acts |
| Term and survival | Defines how long duties last | Use longer periods for trade secrets 3 |
For distributors and private-label resellers, the non-circumvention clause deserves a mention. Several of our U.S. partners resell under their own brand. They need assurance we will not approach their end users directly. We agree to this when it is tied to named accounts and a defined period.
Years ago our team learned that a drawing marked "confidential" still travels. It gets emailed to a machine shop, opened on a phone, and copied to a laptop.
Ensure confidentiality by protecting marked, orally disclosed, and observed information, keeping disclosure records with file names and revisions, restricting access to named personnel, requiring written consent and equivalent terms for subcontractors, banning uploads to public AI or cloud tools, and adding cybersecurity and export-control obligations.
Many agreements say only documents stamped "confidential" are protected. That is too narrow. The better rule protects information that is marked, identified as confidential when disclosed, or reasonably understood to be confidential from its nature. Source code and nonpublic production data fall in that last group even without a label.
A fair compromise for oral disclosures is a written confirmation window. The disclosing party confirms the oral disclosure in writing within 15 or 30 days. We accept this. It gives both sides a record without making every meeting a legal event.
The buyer's best evidence is a log of what was sent, when, and to whom. I recommend this to every customer before the first CAD file leaves their server.
| Record item | Why it matters |
|---|---|
| File names and revision numbers | Proves which version the supplier received |
| Dates and recipients | Links each disclosure to a person and time |
| Data-room access logs | Shows who opened what |
| Drawing and software version histories | Tracks changes during engineering |
| Meeting, demo, and site-visit notes | Captures observed and oral information |
| Authorized supplier personnel list | Defines the need-to-know perimeter |
With these records, you can show exactly what the supplier knew. Without them, a dispute becomes one memory against another.
Access should be limited to employees, officers, advisers, and approved subcontractors who need the information for the job. On sensitive projects we name the project team. When someone leaves or changes roles, access is removed. Printed drawings, USB drives, and laptops get the same treatment. Photographing or recording a facility without permission is prohibited.
Here is a reality from our side. We sometimes outsource machining, electrical-panel fabrication, or specialist testing. Your confidentiality perimeter therefore includes those third-party contractors. The agreement should require prior written consent before disclosure to any subcontractor, or at least restrict disclosure to approved categories. Each subcontractor must sign equivalent terms. We remain fully liable for their acts and omissions. Their data must be segregated by customer and returned or destroyed when their work ends.
A paper NDA no longer covers the whole risk. Our newer machines run smart PLC control with remote diagnostics. That means credentials, telemetry, and software repositories are all part of the confidential perimeter. Ask for encryption in transit and at rest, multi-factor authentication 4 for remote access, individual accounts instead of shared passwords, and logging of downloads and remote sessions. Expressly prohibit uploading CAD files, troubleshooting logs, or source code to public generative AI tools. This is a new and real risk.
Finally, address export controls. A supplier can breach confidentiality or regulatory duties simply by letting overseas staff open a shared folder. The agreement should assign responsibility for classification, licensing, and screening of foreign personnel and cloud locations.
There is a real tension in every OEM project we quote. The buyer wants to own everything the machine contains. We need to keep our standard PLC libraries.
Before sharing OEM specifications, request written intellectual property assignment for project-specific designs, a license split for background IP, ownership and non-replication terms for custom tooling, trade-secret protection without a fixed expiry, narrow legal exceptions, a limited residuals clause, proportionate audit rights, and governing-law alignment.
This surprises some buyers. An NDA tells the supplier not to disclose or misuse. It does not say who owns the new fixture, the robot program, or the inspection recipe we create during engineering. You need a separate ownership structure for intellectual property rights 5. Depending on jurisdiction, that may mean an invention-assignment or work-made-for-hire clause.
The structure we find workable splits IP into three layers:
| IP layer | Examples | Typical owner |
|---|---|---|
| Customer background IP | Product designs, process parameters, specifications | Customer |
| Supplier background IP | Standard modules, feeder designs, PLC function libraries, general engineering know-how | Supplier, with a license to the customer for use with the machine |
| Project-specific IP | Custom fixtures, machine-specific code, recipes, editable engineering files, manuals | Customer, by assignment or broad license |
The agreement should also prohibit the supplier from claiming ownership just because your information was incorporated into a machine or modified during engineering. That is a common grab, and you should close it.
Tooling is both a physical asset and a store of confidential information. Bowl feeder tooling, nests, grippers, gauges, and test fixtures encode your manufacturing processes. The agreement should state who owns them, require asset marking, separate storage from other customers' tooling, and prohibit alteration or use for others without approval. Add a non-replication clause so unique jigs and fixtures cannot be copied for a competing line. Set return deadlines and require written authorization before any destruction.
One flat term does not fit an automation project. Bid pricing loses value after award. Machine designs stay sensitive through the equipment's useful life. Source code and process know-how may need protection for as long as they stay secret.
| Information type | Suggested approach |
|---|---|
| Quotations and commercial terms | Fixed period of a few years |
| General manufacturing information | Several years, depending on governing law |
| Machine designs and drawings | Through the useful life of the equipment |
| Trade secrets, source code, process recipes | Indefinite, while the information remains nonpublic and reasonably protected |
Trade secrets should never expire automatically after three or five years. That is a drafting mistake we see often.
Standard exceptions are fine: information already known, publicly available without breach, independently developed, lawfully received from a third party, or required by law. For legally compelled disclosure, require prompt notice where permitted and disclosure of only the required portion. For independent development, require contemporaneous records. A supplier should not be able to wave a vague "we already had that" defense.
Some suppliers, including us on occasion, ask for a residuals clause. It lets engineers use what stays in unaided memory. From the buyer side, treat it with caution. If you accept it, exclude deliberately memorized information, engineering drawings, source code, trade secrets, and customer-specific parameters. We can live with that. Our engineers keep their general skill, and you keep your distinctive know-how.
Buyers often ask for broad audit rights. The honest supplier objection is that unrestricted audits are expensive, disruptive, and can expose other customers' data. The compromise we accept is risk-based: written security questionnaires, compliance certificates, access-log reviews, and onsite audits on reasonable notice or after a suspected breach. Limit the audit to relevant records and bind the auditors to confidentiality. That gives you verification without turning every visit into an inspection of our whole shop.
During a commissioning visit for a terminal crimping line, a technician's laptop went missing overnight. Nothing leaked, but it showed us how fast a breach response must start.
Handle breaches with a clause requiring prompt written notice, containment, evidence preservation, root-cause investigation, and cooperation; then set remedies including injunctive relief, damages, indemnification, termination, and cost recovery, with liability caps carved out for willful misuse, all aligned with the master supply agreement.
A breach clause should not stop at "notify the customer." It should set a sequence. Here is the order we follow, and the order I recommend buyers write into the agreement:
For a lost laptop, this sequence took us hours, not days. Remote wipe, password resets, and a short report to the customer closed the issue. Without a written procedure, those hours stretch into arguments.
| Remedy | When it fits |
|---|---|
| Injunctive relief 6 | Stopping ongoing misuse before damages can be measured |
| Damages | Compensating measurable loss from the breach |
| Indemnification | Covering third-party claims caused by the supplier's breach |
| Termination rights | Ending the relationship after serious or repeated breaches |
| Replacement of personnel | Removing a specific individual from the project |
| Recovery of investigation and remediation costs | Where legally enforceable in the governing jurisdiction |
Injunctive relief is the one buyers most often forget. Money arrives late. A court order to stop using your drawings arrives fast. State clearly that a breach causes irreparable harm and that the disclosing party may seek injunctive relief without posting a bond where the law allows.
Here is the honest negotiation. Buyers want confidentiality breaches excluded from any liability cap. Suppliers worry that unlimited liability is out of proportion to a modest machine order. The compromise we accept is layered: a capped liability for ordinary negligent breaches, and uncapped liability for intentional misuse, fraud, willful misconduct, or reckless disregard. This keeps the consequences real without exposing a ten-person engineering team to unlimited risk on every order.
A supplier confidentiality agreement for assembly machines rarely stands alone. The master supply or OEM agreement also has caps, notice periods, governing law, and indemnities. If the two documents disagree, you get uncertainty instead of protection. State which document controls on conflict, and use the same governing law in both.
Breach handling also covers the end of the project. Require return or secure destruction of documents, drawings, credentials, software, and customer-owned tooling. Require a certificate of destruction that names the categories destroyed, the date, the responsible officer, and the systems covered. Be realistic on backups. Immediate deletion from backup media is often impossible, so allow inaccessible backup copies to remain until overwritten under normal retention cycles, subject to continuing confidentiality duties.
Unclear NDAs leave assembly machine designs exposed. From our side of the table, the fix is precise scope, clear IP ownership, controlled access, realistic duration, and enforceable remedies.
Interested in sourcing the products mentioned in this article? See details and request a quote here:
1. Primary government authority for regulations governing the cross-border transfer of sensitive technical data. ↩︎
2. International standards body providing the framework for technical product documentation and engineering drawings. ↩︎
3. Official government resource explaining the legal requirements for maintaining and enforcing trade secret protection. ↩︎
4. Official cybersecurity agency guidance on implementing essential access controls for sensitive digital information. ↩︎
5. Global authority defining the legal standards for protecting inventions and proprietary technical information. ↩︎
6. Authoritative legal encyclopedia defining the court-ordered remedies used to stop immediate confidentiality breaches. ↩︎
