Sawaryn & Partners
At this webinar, attorney-at-law Natalia Lener Bobek of Sawaryn & Partners discusses key AI Act mechanisms: risk classification for AI systems, the role-change trap in the supply chain, and practical duties for providers and deployers.
Five key takeaways from the webinar
- The AI Act does not scale obligations by company size. A startup deploying a high-risk system is subject to the same requirements as a global corporation. There is no relief for SMEs.
- White-labeling changes your regulatory role. Branding a ready-made AI system as your own reclassifies you from deployer to provider, with the full package of compliance duties.
- The AI Act does not regulate copyright or liability for damage. AI-generated content may not be protected by IP rights, which complicates IT agreements, investment rounds, and M&A transactions.
- AI literacy has applied since February 2025 and concerns every organization. Even a company using only minimal-risk systems must implement procedures for informed AI use.
- Transitional provisions give you time, but less than you may think. Inventorying AI tools, classifying risk, and preparing documentation in a medium-sized organization takes months, not one meeting.
Key mechanisms and good practices
The webinar highlights several areas that require immediate attention from boards and compliance leads at technology companies. Below are the main takeaways, grouped by topic.
Classifying AI systems and what it means for your product
The AI Act divides AI systems into four risk levels: prohibited systems, such as social scoring and subliminal manipulation; high-risk systems, such as recruitment, credit scoring, and medical diagnosis; limited-risk systems, such as chatbots and content generators; and minimal-risk systems.
The decision rule is simple. If your product involves recruitment, creditworthiness assessment, biometrics, insurance, or education, it falls into the high-risk category. This means you must keep technical documentation, implement a risk-management system, ensure auditability, and provide human oversight.
Importantly, the European Commission may amend Annex III to the Regulation, expanding or narrowing the list of high-risk systems. A system you classify as limited risk today could be classified as high risk tomorrow. Legal support for technology companies in this area requires ongoing monitoring of regulatory changes.
The most common mistake we see in practice is classifying risk only when a product is ready for deployment at an enterprise client. That client may ask about AI Act compliance at the request-for-proposal stage.
Add an AI Act risk assessment to the planning process for every new product module. Before the first line of code, not after the fact. Early classification takes a few hours. Rebuilding the architecture for compliance takes weeks and delays releases.
The role-change trap in the software supply chain
This is one of the most overlooked AI Act mechanisms and directly affects companies using SaaS, white-label, and systems-integration models.
A role change occurs when a deployer becomes a provider, with all the resulting duties. Meeting any one of three conditions is enough for reclassification:
- Placing your own trade name or trademark on an AI system already on the market. This is the simplest and most common scenario. You buy a ready-made system, brand it, and offer it to clients under your name. From a business perspective, this is white-labeling. Under the AI Act, it is a change of role.
- Making a substantial modification to a high-risk system already on the market. “Substantial modification” is defined broadly: any change not foreseen by the original provider.
- Changing the intended purpose of a general-purpose AI model so that it becomes a high-risk system. For example, using a public language model to build a credit-scoring tool.
“The point is that we are deployers and suddenly become providers, with all the resulting duties. All it takes is placing your trade name or trademark on a system already on the market and branding it.”
Natalia Lener Bobek, at a webinar by Sawaryn & Partners
For software houses and SaaS companies building offers around other companies’ AI models, this is a key risk. The margin comes from distribution and integration, not building the model. But regulatory responsibility does not follow the margin. It follows the brand.
What to do: Review your IT agreements with AI technology providers. Map your role in the supply chain separately for each product. One product may make you a deployer while another makes you a provider. Plan the compliance budget before launching the product.
Legal gaps: copyright and liability for harm caused by AI
The AI Act is not a complete regulation. It is product legislation that governs AI system safety and risk classification. It does not address two key areas: intellectual property and liability for harm.
First issue: who owns the output? If your development team generates code with Copilot and an agency creates a marketing campaign in ChatGPT, the legal status of this material is uncertain at best. The dominant legal doctrine, which developed in the United States, suggests that AI-generated content may not be protected by copyright. This means a clause transferring copyright in a client agreement may be ineffective.
We see this in practice in M&A transactions and investment rounds. An investor asks: “Does the company own all the rights to its product?” If a substantial part of the code was created with generative tools and the developer agreements say nothing about AI, the answer is: “We do not know.” And “we do not know” in due diligence blocks a transaction. A well-prepared investment agreement requires the IP structure to be organized in advance.
Second issue: whose rights are you infringing? Large language models were trained on data collected from the internet without the creators’ permission. The output you receive from an AI tool may infringe a third party’s copyright. The AI model has no legal personality. The person who publishes the material is responsible.
“The AI Act is a regulation that concerns AI systems and general-purpose AI systems. But the AI Act does not address many important issues. It does not regulate copyright.”
Natalia Lener Bobek, at a webinar by Sawaryn & Partners
Third issue: liability for damage. A separate EU regulation that was intended to govern liability for harm caused by AI was put on hold. For now, liability is regulated separately in each Member State. For legal support to companies operating across borders, this adds another layer of uncertainty.
How to put these takeaways into practice
Below are concrete steps you can take in your organization. The order matters: each step builds on the previous one.
Step 1: Inventory AI systems
List every AI tool used in your organization. Include not only tools purchased officially but also those teams use independently as shadow IT. For each tool, record who uses it, for what purpose, what data it processes, and who provides it. This is your starting map. Without it, every later compliance step is based on assumptions.
Step 2: Classify the risk of each system
For every system you identify, assess whether it is a prohibited practice, a high-risk system, a limited-risk system, or a minimal-risk system. Remember that the line between prohibited practices and high-risk systems can be narrow and debatable.
Step 3: Map your role in the supply chain
For each product with an AI component, determine whether your company is a provider or a deployer. Pay special attention to role-change scenarios: white-labeling, substantial modifications, and changes in intended purpose. If you are an IT law firm serving technology clients or develop AI products yourself, run this analysis for each part of your offer separately.
Step 4: Update your agreements
Review your IT agreement templates, including MSAs, SLAs, and implementation agreements, for AI clauses. Define the limits of responsibility for how the model operates. Separate liability for integration from liability for the base model’s output. Update agreements with developers, both B2B contractors and employees, to address coding assistants and rights to generated output.
Step 5: Implement AI literacy, in force since February 2025
Instead of a 50-page policy, implement three elements:
- A short prompting guide: identify data that must never be entered into public AI tools, including personal data, commercial terms, source code, financial data, and trade secrets.
- A list of approved tools and the tasks they may be used for. Review the providers’ terms and privacy policies. If a DPA can be signed, sign it.
- One 60-minute training session for the whole team. Focus on practical scenarios, not AI Act theory: what happens if you paste a draft agreement into a public chat? Real examples, such as a lawsuit leak in Germany or a brand strategy leak, work better than slides full of legal sections.
Step 6: Plan compliance for high-risk systems
If your classification identifies high-risk systems, prepare for the duties that apply from August 2026: a risk-management system, technical documentation, an event-logging system, an information duty, human oversight, protection against cyberattacks, and a conformity-assessment procedure. Budget for compliance from the first sprint, not after the first customer complaint.
Compliance as part of product strategy
The AI Act is taking effect in stages, but the transition period is not as comfortable as it may seem. Inventorying systems, classifying risk, and preparing documentation in an organization with 200 or more people takes months of work. Enterprise clients are already adding AI Act compliance to implementation agreements, changing the dynamics of every IT contract negotiation involving AI.
The key perspective is this: well-designed compliance does not slow innovation. It increases a product’s credibility with clients and investors. Legal support for technology companies in the AI Act era is not only about reacting to regulations; it is about designing a compliance model that supports growth.
If you are unsure what role your company has in the AI supply chain, want to classify product risks, or need to organize IP before an investment round, an initial analysis usually takes a few hours and can save weeks of corrections later.
Watch and listen
Watch the webinar:
This video is currently unavailable.
