COMPLIANCE & RIGHT · TREATY
Software companies work with short development cycles, changing components and different delivery models. Legal audits must therefore take place where architecture, functions and distribution channels are defined. We advise providers and development companies on usage rights, data, security requirements and contractual obligations.
The business model makes a difference
A locally installed application, a SaaS offering and software embedded in a device raise different questions. The same applies to pure development on behalf and sales under own brand. It should therefore be established before the contract is reviewed which services the company itself provides, which components of third parties are used and who acts as a provider towards the customer.
A change in the delivery model also deserves a new test. To date, a suitable license cannot cover the use in hosting or integration into a customer product. A technical change sometimes also changes data protection roles and security commitments.
Clear rights and components before release
Development contracts must secure the rights of use that are actually needed. In addition, there are source code, documentation, editing rights and the handling of third party components. For free software a comprehensible release process, which takes license version and usage form into account, is recommended. A scan provides clues; unclear licenses and dependencies require a professional evaluation.
Page Software and open source compliance deals with these issues in detail. In the case of a sale of the company, rights chains and licence proofs should be arranged at an early stage in order not to start testing in the data room.
Security and data access
Whether or not the Cyber Resilience Act depends on the specific product and its provision. The requirements must be distinguished from the organizational IT security of the company. For cloud and other data processing services, the change-over arrangements of the Data Act be relevant.
In the case of personal data, responsibility, order processing, subcontractors and international transfers must be clarified. A contract should reflect the actual data flows. Promises about storage locations, encryption or deletion must be kept technically.
AI functions and customer communication
In the integration of AI, the purpose is to capture the customer's own role and possible changes. Not every application is a high-risk system. Transparency, data protection, copyright and contractual commitments can also become relevant outside this category. Approvals should document which function has been checked and the modification in which the test is to be renewed.
Performance descriptions should explain clearly the limits, prerequisites and responsibilities. General promises such as "completely legally compliant" are unreliable without a specific reference basis. Warranty, support and update obligations must fit the offered service.
Cooperation with the firm
An order may concern a single license model, a customer contract or a release process for new functions. We clarify the legal issues with the responsible persons and keep the results so that product management and development can work with them. In the case of technical tests, responsibilities are agreed separately.
For a Request for a mandate First, product description, delivery model, target customers and the concrete question are sufficient. Confidential source code is requested only if this is necessary for the coordinated order.
Legal basis and decisions: Copyright law, in particular §§ 69a et seq.; European Commission: CRA; European Commission: Data Act.
Situation as at 2 November 2026.
Further reading: Software, licences and open source · AI compliance · Data protection and IT security
Four practical examples
The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.
01 · SaaS with customer data
A provider processes data from different customers. Roles, contract, security and subcontractors are determined for the specific performance model.
02 · New AI function
An existing product receives automatic reviews. Role and risk assessment are updated; the old release does not automatically cover new functions.
03 · Foreign library
A release contains an unchecked component. Licenses, security and evidence will be clarified before publication.
04 · Termination of a major customer
The customer requires a complete data export. Contractual and legal change obligations are coordinated with the technically available export.
Your next step
Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.