At the “Zakazać AI” webinar, Natalia Lener Bobek, attorney-at-law at Sawaryn and Partners, discusses practical implications of the AI Act for technology companies: system classification, the risk of a change in roles, the copyright gap affecting AI-generated content, and obligations relating to HR tools.
Five key takeaways from the webinar
- The AI Act does not provide exemptions for startups or SMEs. The rules cover every entity that places an AI system on the EU market, regardless of the scale of its operations or revenue.
- Adding your own logo to an external AI model may change your role from deployer to provider. This means duties to prepare technical documentation, establish a risk-management system, and follow a conformity-assessment procedure.
- Copyright does not arise in AI-generated content. A standard B2B clause transferring rights may be ineffective, creating a risk of disputes over ownership of technology.
- AI tools used in recruitment, employee evaluation, and task assignment fall within the high-risk systems regime. This applies to people on employment contracts and B2B contractors. The rules will apply from August 2026.
- The first step is to inventory and classify the AI systems in your organization. Without that, you do not know which duties apply or how much time implementation will take.
How the AI Act changes the rules: practical takeaways from the webinar
Changing roles in the supply chain: how to become a provider without planning to
The AI Act clearly distinguishes the roles in the technology supply chain. A deployer is a company that buys a ready-made AI system and uses it for its intended purpose. A provider is an entity that developed the system, or commissioned its development, and placed it on the market under its own brand. The duties attached to these roles are very different.
Problems arise when the boundary between the roles becomes blurred. The AI Act provides for a mechanism called a “change of roles” that applies in three situations:
- You place your trade name or trademark on an AI system that has already been placed on the market.
- You make a substantial change to an existing high-risk system.
- You change the intended purpose of a general-purpose AI model so that it becomes a high-risk system.
In practice, a company that integrates an external AI model, for example through an API from OpenAI or Anthropic, wraps it in its own interface, and sells it as its own functionality may be classified as the provider of the AI system. Not the integrator. Not the reseller. The provider. With the full set of duties: technical documentation, a risk-management system, and a conformity-assessment procedure.
“The point is that we are deployers and suddenly become providers, with all the resulting obligations. It is very easy for us to be reclassified from deployers to providers. And why is it so easy? Because all it takes is placing your trade name or trademark on a system that is already on the market and branding it.”
Natalia Lener Bobek
If you are building a SaaS product with an AI component, check how your platform presents the technology to end users. Do they see the model provider’s brand or yours? The answer determines your regulatory role and the scope of your duties.
Any IT law firm advising technology companies should take this mechanism into account when reviewing API-provider agreements. The division of responsibility between the model provider and the integrating company must be clearly allocated in the contract before the product reaches the market.
The copyright gap: what it means when AI-generated content has no IP rights
The AI Act does not regulate copyright. This is one of the major gaps in the current legal framework, with a direct impact on B2B agreements, company valuations, and M&A transactions.
The issue is this: Polish copyright law protects works that result from human creative activity. If a piece of code, graphic, marketing text, or campaign concept was generated by AI, it is not a work within the meaning of the law. Copyright does not arise in it. And if no rights arise, they cannot be transferred to a client.
A standard clause in a B2B agreement, such as “The Contractor transfers to the Client all economic copyrights to works created in the course of performing the agreement,” is ineffective to that extent.
“Most often, we will not have these copyrights. If we created anything using an AI tool, no matter how extensively we modified it later, those copyrights do not arise. If our contract says that we transfer copyrights to our client, that clause may simply be invalid or ineffective.”
Natalia Lener Bobek
For software houses and agencies, this means their contract templates need to be rebuilt. Instead of transferring all rights in the same way, consider a mixed model:
- Transfer of rights to elements created by people, such as concepts, selection, editing, and manually written code.
- A license to use elements generated by AI.
- An obligation to identify which parts of the product were created in which way.
Without this distinction, every investment agreement and due-diligence process carries risk. If an investor or buyer cannot establish which parts of a product the company has rights to, they do not know what they are buying. This directly affects valuation, transaction terms, and the protections required from the founder.
Legal support for startups that use AI tools in development should include an AI-use policy for technical teams and updated agreements with developers, both employees and B2B contractors, covering AI-generated output.
HR and team-management systems: high risk that also affects B2B contractors
The AI Act classifies AI tools used in employment as high-risk systems. This includes systems used in recruitment, CV screening, promotion or dismissal decisions, task assignment based on individual personality traits, and performance evaluation.
The rules do not refer to “employees” or “people employed under an employment contract.” They refer to people affected by the system. This means compliance duties cover both employees and B2B contractors.
In practice, many technology companies use the same tools to manage the whole team, regardless of the form of cooperation: Jira with an AI plugin for estimation, time-tracking software with a scoring feature, or tools that automatically evaluate pull requests. Each of these tools may be subject to AI Act requirements if it influences decisions about people.
A company using such a tool, even one purchased from an external provider, must:
- Conduct a risk assessment before deployment.
- Ensure human oversight of system decisions.
- Document how the algorithm works and its impact on the people being assessed.
- Inform candidates and people working with the company that AI is involved in the process.
The rules for high-risk systems in HR will apply from August 2026. Implementing the necessary procedures takes months of work by product and legal teams. An employment law firm supporting fast-growing organizations should already be initiating a review of AI tools used in HR processes.
How to put these takeaways into practice
Below are concrete steps you can take in your organization. The order matters: each step builds on the results of the previous one.
Step 1: Inventory the AI systems in your organization
List every tool and feature in your product and internal processes that uses AI algorithms. Do not limit the list to obvious cases such as chatbots and content generators. Also check team-management, analytics, scoring, and automated-decision tools.
Step 2: Classify the risk
For every system you identify, determine its risk category under the AI Act: prohibited practice, high-risk system, limited-risk system, or minimal-risk system. Remember that the European Commission may expand Annex III, which defines high-risk systems. Check it regularly.
Step 3: Assess your role in the supply chain
For each AI system your company offers on the market, determine whether you are the provider or the deployer. Check whether your product presents external AI technology under your brand. If it does, prepare for provider obligations.
Step 4: Audit IP agreements and documentation
Review your B2B agreements for clauses transferring copyright. If your team uses AI tools to create deliverables, update the legal arrangements by separating elements created by people from elements generated by AI. Update agreements with developers and subcontractors.
Step 5: Review AI tools used in HR
Identify which recruitment, performance-evaluation, and team-management tools use AI algorithms. The review must cover everyone working with the company, not only employees. Plan oversight, information, and documentation procedures.
Step 6: Review AI tool providers
Before implementing any AI tool, read the provider’s terms and privacy policy. Check what the provider does with input data. If the provider offers a GDPR-compliant DPA, sign it. Establish a contingency plan in case the provider changes its terms.
Step 7: Train the team in AI literacy
The AI literacy obligation has applied since February 2025. It covers all companies, regardless of the risk category of their systems. Train the team in responsible AI use, the risks of entering data into AI tools, and security procedures.
What comes next: timeline and next steps
The AI Act is taking effect in stages. The ban on prohibited practices and the AI literacy obligation have applied since February 2025. The rules for general-purpose AI models will apply from August 2025. The full rules for high-risk systems will apply from August 2026.
For technology companies, software houses, and organizations using AI in their operations, this means the time to prepare is shrinking each month. Implementing procedures for a high-risk system involves technical documentation, a risk-management system, human-oversight mechanisms, testing, and logs. It is not a one-week task.
Legal support for companies in the technology sector now requires treating the AI Act as part of the product roadmap, not as a separate compliance project launched at the last minute.
If your company integrates AI into a product, uses AI tools in HR, or transfers copyright in content created with AI, it is worth reviewing your agreements and processes before the rules apply in full.
Contact us. We can help you determine what needs to change and in what order.
Watch and listen
Watch the webinar:
This video is currently unavailable.
