In webinar, Natalia Lener Bobek (legal counsel at Sawaryn & Partners) discusses key AI legal risks for technology companies: defective IT contracts, data leaks, classification of roles under the AI Act, and liability for generative AI output.
5 key takeaways from the webinar
- Works generated entirely by AI are not protected by copyright. If you guarantee in a B2B agreement that you will transfer copyright in such output, you are making a representation you cannot perform.
- Free AI tools train on your data. An employee who uploads source code, contracts, or client data risks exposing the company to GDPR violations and breaches of NDAs with business partners.
- Integrating an AI model through an API may make you a Provider under the AI Act. This entails regulatory duties that may block product sales in the EU if they are not mapped in advance.
- Big Tech copyright shields contain many exclusions. Your company, not the tool provider, bears responsibility when AI output infringes third-party rights.
- An internal AI policy with an approved-tools list and a data-anonymization rule is the operational minimum. Banning AI does not work. Clear rules do.
Risks and recommendations: what to change in your contracts, processes, and organization
Natalia Lener Bobek guided webinar participants through five areas where technology companies most often make mistakes. Each can have concrete financial, operational, and reputational consequences.
Copyright in code and materials generated with AI: defective representations in B2B agreements
If you run a software house, marketing agency, or company that develops software to order, check one thing: do your IT agreements contain a representation that copyright is transferred in materials your team generates using AI?
The problem is that copyright in works generated entirely by artificial intelligence simply does not arise. Under the law, only a human can be an author. If output comes from an AI tool and has not been modified sufficiently by a human, it is not protected by copyright. And if no rights exist, they cannot be transferred.
“If we create software, graphics, or a marketing campaign entirely with an AI tool and state in a contract that we are transferring all copyright to our client, that statement may be untrue because, most often, we will not own those copyrights and therefore cannot transfer them to anyone.”
Natalia Lener Bobek
This is not a remote scenario. It is part of everyday business for companies that have not updated their B2B agreement templates. The problem usually surfaces during due diligence before an investment or M&A transaction. An investor sees defective representations, identifies the risk of client claims, and lowers the company valuation or withdraws from the transaction.
The webinar identified three ways to classify works created with AI:
- Works assisted by AI (for example, text editing or photo enhancement). You own the copyright because you created the work. AI was only an assisting tool.
- Works generated entirely by AI (a simple prompt, with no modifications). Copyright does not arise. The output belongs to no one. Anyone may copy and use it.
- Works created in collaboration with AI (repeated prompting and a detailed concept). This is disputed. The U.S. Copyright Office has found that prompting alone, even repeated prompting, does not create copyright protection. A court in Beijing reached the opposite position. In Europe, so far, one Czech court judgment has declined to recognize copyright.
What to do:
- Map projects in which your team uses AI to generate code, graphics, or content.
- Update your B2B agreement templates. Instead of an empty representation that rights are transferred, add provisions describing how AI is used and setting out responsibility for that part of the work.
- Treat AI as an assisting tool. Modify output manually and document how the work was created.
- Agree with the client whether they accept materials without full copyright protection.
Confidential-data leaks and GDPR violations caused by free AI tools
The second area of risk concerns what your team uploads to AI tools. Every prompt is input: every document, code fragment, client data, business strategy, and contract with a business partner. If your employees use free versions of AI tools, this data is used to train public models. It may appear in responses to other users, including your competitors.
Natalia Lener Bobek cited two real situations. In Germany, lawyers uploaded a court pleading to an AI tool, and after a suitable prompt the text appeared to the opposing party before the document had been filed in court. In the European fuel sector, a company’s marketing and business strategy was entered into a chat and, after prompting, became available to a competitor.
“Do not use free tools. If you want to use these tools in your organization and business, I strongly recommend paid tools, because the vast majority, if not all, of these free tools train on what we upload.”
Natalia Lener Bobek
The consequences include GDPR violations (if the prompt contained personal data), breaches of NDAs with clients and partners, and disclosure of trade secrets. Your company, not the employee who uploaded the data, is responsible for these violations.
What to do:
- Move to paid enterprise versions of AI tools. They provide data isolation and prevent prompts from being used to train the model.
- Adopt an internal AI policy with an approved-tools list.
- Set a strict rule requiring data to be anonymized before anything is entered into a prompt.
- Review the terms of the tools your team uses: do they train on data, can this function be disabled, and can you enter into a data-processing agreement (DPA)?
- Train the team. No policy will work without awareness of the risks.
Classifying roles under the AI Act: the “Provider” trap for SaaS companies and AI model integrators
The webinar’s third topic was the AI Act and how to determine whether it applies to your company. Many myths have grown around the AI Act. The most common is: “I do not create a language model, so the AI Act does not apply to me.”
The AI Act divides organizations into two main roles: Provider and Deployer. A Provider is not only a company that builds an AI model from scratch. A Provider may be any entity that:
- Creates AI-based software and sells it to external customers.
- Commissions someone else to create an AI system and places it on the market under its own brand.
- Creates an AI solution for internal use within its organization.
- Integrates an AI model (for example, through an API) with its own product and launches it on the market.
The last point is especially important for SaaS companies. If you build an application, connect it through an API to a language model (for example, ChatGPT), and offer it to clients as your own product, you may fall within the definition of a Provider. This means regulatory duties: risk assessment, technical documentation, and post-deployment system monitoring.
The scope of duties depends on the system’s risk category:
- Prohibited systems (for example, subliminal manipulation and social scoring). A complete ban. The rules have applied since 2 February 2025.
- High-risk systems (for example, employment, education, and the administration of justice). The most extensive set of duties under the AI Act. They take effect from August 2026 and 2027.
- Limited-risk systems (for example, chatbots). Users must be told that they are interacting with AI.
- Minimal-risk systems. No additional duties.
The AI Act also applies to companies outside the EU if their system is available on the European market. That is why OpenAI, Microsoft, and Google must comply with the rules.
What to do:
- Determine whether your product meets the definition of an AI system under the AI Act.
- Check which role you perform: Provider or Deployer.
- Identify the system’s risk category.
- If you fall within the definition of a Provider of a high-risk system, plan to implement the regulatory requirements before the product’s official launch.
- Include AI Act requirements in your product roadmap. Without preparation, you may be unable to sell legally in the EU.
How to put these takeaways into practice
The webinar identified practical steps you can take whether you run a software house, SaaS company, marketing agency, or e-commerce store that uses AI.
Step 1: Audit AI use in projects
Map the projects in which your team uses AI tools. This includes code, graphics, marketing content, analysis, and customer-service automation. Identify which projects are covered by client agreements containing representations that copyright is transferred.
Step 2: Update B2B agreements and subcontractor contracts
Review your IT agreement templates for three things:
- Do they contain representations transferring copyright in materials that may have been generated by AI?
- Do they regulate how the contractor or subcontractor may use AI tools?
- Do they include clauses limiting liability for legal defects in AI output and for generative-model hallucinations?
If you work with B2B subcontractors, add three provisions: a duty to disclose AI use, a ban on free tools that train on data, and the subcontractor’s financial liability for infringement of third-party rights.
Step 3: Adopt an internal AI policy
Create an operational document (not a 20-page set of rules nobody will read) that includes:
- An approved list of AI tools allowed in the organization.
- An anonymization rule: no personal data, financial data, or confidential information may be entered in prompts. No exceptions.
- A duty to label output: tell the supervisor and client that an element was created with AI assistance.
- A human-in-the-loop process for checking results.
Step 4: Research and verify tools
Review the terms of the AI tools your team uses. Determine:
- Whether the tool trains on your data, both input and output.
- Whether training can be disabled.
- Whether you can enter into a data-processing agreement (DPA).
- Whether the license permits commercial use of the output. Some licenses prohibit this, and breaching their terms may entitle the provider to claim damages.
Step 5: Classify under the AI Act
If you create, integrate, or sell AI-based solutions, conduct a classification audit:
- Role: Provider or Deployer.
- Risk category: prohibited, high, limited, or minimal.
- Timeline: rules for high-risk systems take effect from August 2026. The time to prepare is now.
Next steps: organize your company’s legal support before a dispute or investor audit arises
AI regulation in Europe is still taking shape. The AI Act establishes an initial framework but does not resolve every issue, such as copyright in AI output, liability for model hallucinations, or how creators whose works were used to train language models should be remunerated. The European Union withdrew the AI Liability Directive, which means these questions will be regulated differently in each country under national law.
For technology companies, this means one thing: do not wait for the rules to be finalized. Protect yourself now through contracts, processes, and internal rules for working with AI. Update IT and B2B agreements. Adopt an AI policy. Map AI Act risks. Organize intellectual-property ownership before an investor’s auditors find the gaps themselves.
Our IT law firm has experience advising technology companies, including on AI implementation, tool reviews, IT agreements, and IP audits before M&A transactions. We work with founders, boards, and managers, bringing corporate law, investment agreements, data protection, and digital law together in a coherent model of legal support for companies.
If your company uses AI in client projects and your agreement templates have not been updated for copyright and liability for AI output, contact us.
Watch the webinar
Watch the recording:
