Scope Creep Examples — Web design
Legal review requested, outside the agency's actual expertise
The client asks the design team to confirm the new site's cookie banner and privacy language are legally compliant with GDPR — a legal judgment, not a design task.
The design engagement includes implementing a cookie consent banner and privacy policy page, using copy the client is expected to supply. Before launch, the client asks the design team to confirm the implementation is "fully GDPR compliant" — a legal determination about consent mechanisms, data processing disclosures, and jurisdiction-specific requirements that a design team isn't qualified to make, and that implementing a banner correctly doesn't by itself guarantee.
Clause typically implicated
Clause typically implicated
Liability limitation clause→ — Usually excludes legal or regulatory compliance opinions from what the agency is responsible for — worth confirming this agreement includes that exclusion before responding to a compliance question directly.
Suggested change-order wording
Suggested change-order wording (illustrative, not legal advice)
We can implement whatever consent mechanism and copy you provide exactly as specified, but confirming actual GDPR compliance is a legal determination outside our expertise — we're not positioned to make that call responsibly. I'd strongly recommend having your legal counsel or a privacy compliance consultant review the implementation before launch. Happy to make any adjustments they recommend.
How this usually resolves
It's worth declining this one clearly rather than trying to be reassuring — giving an informal "looks fine to me" on a legal compliance question creates real liability exposure for the agency if it turns out to be wrong, in a way that a simple redirect to actual legal counsel doesn't.
Related reading