Services.
Artificial Intelligence
AI projects seldom stall on a single legal issue. They stall because requirements, licensing constraints and liability exposure are identified after the design decisions that determine them have been made. We establish which obligations genuinely bind you, and translate them into controls your product or teams can actually operate.
AI Act compliance. Everything follows from two determinations: your role in the value chain and the risk class of the system. Organisations that fine-tune or rebrand a third-party model often assume provider obligations without realising it. I deliver the classification, the gap analysis and the documentation that closes it.
Audits of AI models, systems and tools. Reviews of your own products before release, third-party tools before procurement, and AI assets in due diligence - evidence-based, with findings rated by severity and a remediation plan you can work from.
AI governance. Policy, inventory, intake and approval, decision rights and incident handling, scaled to the organisation that has to run them.
AI model release. For organisations publishing weights: choice of terms against commercial strategy, the restrictions worth imposing and their enforceability, documentation of data provenance, model documentation, and what the release commits you to supporting.
FOSS AI model release. A model release has to be assessed in three separate layers - weights, inference and training code, and the data - because each may carry different terms. Widely adopted community licences restrict fields of use, require naming and attribution, and in some cases impose additional conditions once a user threshold is crossed. Responsible-use terms go further and propagate their restrictions to anything derived from the model. The practical question is whether the terms support your commercial use, and whether they continue to do so as the product scales.
Derivative models. Fine-tuning, distillation, quantisation and model merging all raise the same issue: whether the result is governed by the original terms, what has to be passed downstream, and what you may permit your own customers to do.
AI governance in the SDLC. Compliance documentation reconstructed after the fact is expensive and fragile. We place controls inside the development lifecycle, so that governance fits existing DevSecOps practice and documentation emerges as a by-product of the work.
Standardisation. The more regulatory obligations we have the more standarization we need. Implementation of ISO or EU-harmonised standards is an area we may help.
Licensing. Open-weight does not mean unrestricted. We review whether the licences in your stack support your intended commercial use - fine-tuning, redistribution, resale - together with training data provenance, ownership of outputs and vendor indemnities.
Deployment and marketing. Procurement, data protection, human oversight and sector overlays on the deployment side. On the marketing side: labelling of synthetic content, and the marketing of AI itself, where overstated capability claims have become an enforcement focus.
Audit and inventory. The same discipline applied to software dependencies, applied to models: what is in use, under what terms, with what data provenance, obtained from which source, and whether it was adopted through any approval process at all. In transactions and procurement this is now a standard enquiry, and it is usually the part of the technology stack with the weakest documentation.
Cybersecurity
Cybersecurity obligations now arrive from several directions at once - sectoral regulation, product regulation and contractual requirements imposed by customers. We advise on establishing which of them apply to your organisation, and on building one set of controls that satisfies all of them rather than three overlapping ones.
Information Security Management System. Design and implementation of an ISMS that fits how the organisation actually works. The legal documentation layer matters as much as the technical one: policies, roles, supplier requirements and records are what regulators and auditors examine first.
ISO 27000 family. Advisory on ISO/IEC 27001 and the supporting standards, including preparation for certification and surveillance audits.
NIS2 and the Polish National Cybersecurity System Act (uKSC). Proper assessment and classification as an essential or an important entity determines your obligations, your supervisory regime and your exposure to penalties. We carry out the assessment, document the reasoning behind it, and then help you to build relevant ISMS documentation and procedures.
Incident response & assistance. Your organization faced an security incident. We are there to support you from legal perspective, either at post- or during incident assessment phase.
Cyber Resilience Act. For manufacturers, importers and distributors of products with digital elements, security becomes a condition of market access. We advise on classification, conformity obligations, FOSS, vulnerability handling and reporting duties, and on the lifecycle support commitments that have to be reflected in contracts and product documentation.
BCP and DRP. Business continuity and disaster recovery plans that meet regulatory expectations and survive contact with an actual incident. This includes the contractual side - continuity obligations imposed on suppliers, and continuity obligations you have accepted towards customers, which are frequently inconsistent with each other.
Legal audit. A review of the organisation’s security position from the legal and regulatory perspective: scope and status determinations, documentation, contractual obligations and the gaps between them. Delivered as findings rated by severity with a remediation plan, and usable as evidence of due diligence.
Data
Data obligations no longer divide neatly into “personal” and “everything else”. The same dataset can be subject to data protection law, the Data Act, contractual access rights and intellectual property claims at once, and the practical questions are usually about which of those actually constrains what you want to do with it.
GDPR. Advisory across the full compliance cycle: lawful basis, roles and allocation of responsibility between controllers, joint controllers and processors, data subject rights, retention, DPIA and risk assessment, TIA, and the documentation that has to exist before a supervisory authority asks for it.
Data Act. New rights of access to data generated by connected products, obligations on data holders, mandatory contractual terms in data sharing arrangements, and the cloud switching and interoperability requirements.
Datasets for AI training. The legal position of a training dataset depends on its provenance, and provenance is usually poorly documented. We advise on the basis for collection and use, including scraping and text and data mining exceptions, on handling personal and special category data in training sets, on the limits of anonymisation and pseudonymisation, on data governance requirements for high-risk AI systems, and on licensing in and licensing out — whether datasets you acquire permit your intended use, and what you may permit when you share your own.
Non-personal and mixed datasets. Where a dataset is mixed, the controlling constraint is often contractual or proprietary rather than regulatory. I advise on ownership and control, database and trade secret protection, data licensing and monetisation, and the terms on which data moves between group entities, suppliers and customers.
IT & Cloud
Most disputes over IT projects are not about technology. They arise from acceptance criteria that were never defined, a scope that moved without a change procedure, or a rights transfer that does not actually cover what the customer now wants to do. We draft and negotiate these contracts so that those questions are settled before they become expensive. Provider and its client should focus on business, not on formalities. Leave it to us.
Implementation contracts. Drafting and negotiation – either in agile or waterfall methodologies – for both suppliers and customers: scope and deliverables, acceptance procedures and criteria, change control, milestones and payment linkage, liability and its limits, and exit and transition arrangements.
SaaS legal framework and documentation. For SaaS providers we build the complete contractual stack rather than individual documents: subscription terms and order forms, acceptable use policy, SLA, support policy, data processing agreement and subprocessor disclosure, privacy and cookie notices, trial and API terms, and partner or reseller terms where relevant. The usual failure mode is not a missing document but a set of documents that contradict each other - different liability caps, inconsistent termination rights, an SLA that promises more than the main agreement allows. We draft the stack as one coherent instrument, structured so that it supports self-service sign-up and scales with the product instead of requiring renegotiation with every new customer segment.
Software development. Development, co-development and outsourcing arrangements, including subcontracting chains, team-based and dedicated-team models, open source compliance, and the allocation of rights in results. Also the contractual treatment of AI coding assistants, which has made the provenance of delivered code a question customers now ask.
Licensing. Licence structures and metrics, scope of permitted use, affiliate and group use, territorial and term limits, assignment on corporate change, and compliance with the model actually in force. On the supplier side: licence terms that remain enforceable and commercially coherent as the product evolves.
Licence audit. Representation in supplier-initiated licence audits, including scope and procedure of the audit itself, assessment of exposure before any admission is made, and negotiation of the settlement or renewal that typically follows.
SLA and maintenance agreements. Service levels defined so that they are measurable and actually measured: availability definitions, exclusions, measurement windows, response and resolution distinguished, and service credits calibrated to real operational impact rather than nominal severity. Maintenance and support agreements cover versioning, end-of-support, security patching obligations and the point at which maintenance becomes development.
Vendor and cloud solution audit. Pre-contract assessment of cloud and IT suppliers covering contractual terms, subprocessing and supply chain, security commitments, data location and transfers, continuity, audit and inspection rights, exit and data retrieval, and change-of-terms mechanisms. Where the deployment sits in a regulated sector, the assessment also covers the outsourcing and concentration requirements applicable to it.
FOSS licensing & audit
Open source is in every codebase, and the obligations it carries are enforceable as copyright. The risk is rarely a deliberate decision - it is a transitive dependency pulled in years ago, under a licence nobody reviewed, in a product that is now being sold, audited or acquired.
Licence compliance and compatibility. Review of the licences actually present in your code and dependency tree, the obligations each one imposes, and whether they are compatible with each other and with how you distribute the product.
Audit and due diligence. Structured FOSS audits for your own products, for suppliers, and for transactions. We work from composition analysis output and SBOM data, verify what it actually shows, and deliver findings rated by severity with a remediation path.
Remediation and notice obligations. Implementation of what compliance requires in practice: attribution and notice files, provision of corresponding source where owed, modification records, and the internal process that keeps the position accurate as dependencies change.
Outbound licensing and policy. For organisations releasing their own code: choice of licence against commercial strategy, dual licensing, contributor agreements and contribution policy, trademark handling, and an open source policy that development teams can follow without a legal review for every dependency.
FinTech & DORA
Financial sector technology work is constrained twice over: by the contract and by the supervisor. A cloud or software arrangement that is commercially sound can still be unacceptable because of how it allocates audit rights, where data sits, or what happens on exit - and those terms are examined after the deal, not before.
DORA. Advisory across the regulation for financial entities and for the ICT providers serving them: ICT risk management arrangements, incident classification and reporting, resilience testing, the register of information, and the third-party risk framework. In practice most of the work is contractual – DORA prescribes terms that must appear in ICT service agreements, and bringing an existing supplier portfolio into line with them is a renegotiation exercise rather than a drafting one.
Outsourcing. Classification of arrangements, assessment of criticality, pre-contract due diligence, and the contractual package that supervisory expectations require: audit and inspection rights, subcontracting control, data location, continuity, termination and exit.
EBA & Polish Financial Supervisory Authority (KNF) guidelines and supervisory expectations. Advisory on the applicable European and Polish guidelines on outsourcing and ICT and security risk management, including their interaction with DORA and which obligations now derive from which instrument. For many institutions the difficulty is not identifying the requirement but demonstrating compliance with it in documentation.
Corporate
& Company law
Corporate work is only visible when something goes wrong with it - a resolution adopted in the wrong form, a capital change recorded incompletely, a registry file that no longer matches reality. Most of our work here is making sure that the corporate record of a company will withstand examination by a counterparty, a bank or an acquirer.
Incorporation and structuring. Formation of Polish commercial companies, choice of form against the actual purpose of the business, drafting of articles of association and shareholders’ arrangements, and registration. The decisions worth spending time on at this stage are governance and exit: who decides what, and what happens when the shareholders no longer agree.
Ongoing corporate servicing. Day-to-day corporate support for companies and their governing bodies: shareholder and management board resolutions, meetings and their documentation, appointments and changes in composition, registry filings, and the internal rules governing how corporate bodies operate.
Transformations and capital changes. Transformations, mergers and divisions, increases and reductions of share capital, contributions in cash and in kind, share transfers and redemptions, and liquidation. These procedures are formal and sequence-dependent, and defects are usually not correctable retrospectively - we run them as documented processes with the resolutions, valuations and filings prepared in the required order.
Family foundations. Establishment and operation of family foundations under Polish law, covering the statute, the composition and powers of the governing bodies, the position of beneficiaries, and the contribution of assets, including shares in operating companies. This is succession and asset-holding work rather than an operational structure, and we conduct it in coordination with the client’s tax advisers, since the tax treatment drives much of the design.
Contracts
A contract is where everything else in a project is either resolved or deferred. We draft and negotiate commercial contracts, in Polish and English, for transactions ranging from standard supply arrangements to bespoke cross-border deals.
Drafting. Commercial contracts prepared to fit the transaction rather than adapted from a template that was written for a different one. We work in both directions: drafting the first version, which sets the terms of the discussion, and reviewing and marking up what has been put in front of you, where the task is to identify quickly what matters, what is negotiable and what is not worth the cost of contesting.
Cross-border and international trade. Contracts governed by foreign law and contracts between parties in different jurisdictions, including choice of law and forum, arbitration and enforcement, delivery and payment terms, security, and the application or exclusion of international conventions.