AI in software development
The legal questions do not arise while coding but on shipping. Anyone building generated code into a product answers for it as if it were their own.
Assistance systems have arrived in development. The questions that follow rarely concern a single line of code. They concern the product that ships and the contract standing behind it.
Four fields that meet
- LicensingAdopted passages may carry third party licence terms. With copyleft licences that reaches the whole product, not just the file.
- Trade secretsStatutory protection of source code depends on reasonable steps to keep it secret. Unregulated input into third party systems can remove that precondition.
- Product securityThe Cyber Resilience Act requires traceability of the components used. Generated code of unknown provenance makes exactly that harder.
- Role under the AI ActEmbedding a model into your own product and distributing it can bring provider duties, even without having trained a model yourself.
Two mistaken assumptions
Worth correcting
- The provider indemnity covers everything
- Whatever the assistant suggests is legally neutral
- A note in the developer documentation counts as a rule
- The client will never learn how the code came about
Closer to the truth
- Indemnities apply on conditions that have to be met
- Responsibility sits with whoever ships, not with whoever suggests
- Binding rules need a basis that holds in employment law too
- Tenders and audits now ask about this expressly
Practical safeguards
- Define approved tools, on company accounts rather than private sign-ups
- Check the terms for whether inputs are used for training, and switch that off
- Keep a record of components that also captures generated parts
- Put automated checks for known code matches into the release pipeline
- Review client contracts for warranties that can no longer be kept
- Rule which project material and source code must not reach third party systems
What you can promise your clients is set out under passing on rights in AI output.
Assistance systems in your pipeline?
We sort out licence, secrecy and product questions and put the rules into a workable form.
Review the processFrequently asked questions
Can generated code infringe third party licences?
It is possible. In individual cases models reproduce passages recognisably drawn from a particular source. For short, technically obvious fragments that is legally unproblematic. For longer, distinctive passages it is different. What helps in practice is scanning the code base for known provenance, not relying on provider assurances.
May we put our own source code into a model?
That depends on the terms of the tool and on what you have promised your clients. Source code is regularly a trade secret, and the protection presupposes reasonable steps to keep it secret. Putting code into a third party system without a rule risks not only a breach of contract but the protection itself.
Do we become a provider under the AI Act?
Anyone placing an AI system on the market under their own name, or substantially modifying or repurposing an existing system, may slip into the provider role. For development firms embedding models into their own products this is the decisive turn, because a whole programme of duties hangs on it.