1. Map the assets and their authors
A working application is not a single uniform legal asset. It contains original code, libraries, documentation, graphics, an interface, databases and external services. Each may have a different author and contractual basis. Begin by identifying the product version, repositories, contribution history, creators and entity that intends to develop, distribute or sell it. Access to a repository does not itself prove acquisition of copyright. [1] [2]
A useful audit unit is a module linked to its author, creation date, engagement terms and assignment or licence document. An invoice for application development records payment but does not automatically settle exploitation rights, modification or onward licensing. Separate documented rights from oral assurances and missing links. Include founders’ contributions created before incorporation: later use by the company does not by itself establish how the rights reached it.
2. Employees and business contractors have different starting points
Article 74(3) of the Polish Copyright Act generally places economic rights in a program created by an employee in the execution of employment duties with the employer, unless the agreement provides otherwise. Establish both employment and the connection with those duties. This specific rule should not be extended indiscriminately to every graphic work or private project produced by someone employed by the business. [1]
For a business contractor, examine the contract, the contractor’s rights received from subcontractors and the required form. An assignment of economic copyright requires written form on pain of invalidity; an exclusive licence also requires written form. The agreement should expressly cover the agreed fields of exploitation. A scanned signature, an email and a qualified electronic signature are not identical legal categories; check how the particular contract was concluded. [1]
3. Test the contract against the business model
For software, relevant acts include reproduction, translation, adaptation, other alterations and distribution. Check whether the customer may maintain the system, commission another developer, share it within a corporate group and offer it to downstream users. Separately examine operational access: source code, build instructions, configuration, domain, accounts and keys. A legal entitlement has limited practical value when the current version cannot be built or deployed. [1] [2]
Consider a hypothetical company buying an application whose key module was written by a subcontractor omitted from the contracts. The main supplier’s assurance of full rights does not itself repair the missing chain. Identify the author and permission, obtain the appropriate rights or replace the module. The issue can matter during investment or a product sale even if the application has operated for years without a complaint.
4. SAS Institute: functionality is different from protected expression
In SAS Institute, C-406/10, the Court held that functionality, programming language and data-file formats used to exploit a program’s functions are not, as such, forms of expression protected under the software directive. The distinction separates ideas and operating principles from the particular expression of code. It does not create a general permission to copy another developer’s materials. [3]
Elements expressing the author’s own intellectual creation may still be protected, including relevant documentation. A lawful user may observe, study and test functioning within statutory limits; decompilation for interoperability has separate, strict conditions. A compatible-tool project should document lawful information sources and its working method. Confidentiality, contracts, data and other rights may require their own assessment. [2] [3]
5. UsedSoft: resale depends on the transaction and evidence
UsedSoft, C-128/11, concerned exhaustion for downloaded software under a particular transaction model: an unlimited-period right, payment reflecting the copy’s economic value, and first marketing in the EU with the right holder’s consent. The Court considered downloading and licensing together. The label attached to the contract alone does not determine the legal outcome. [4]
On resale, the first buyer must render their own copy unusable; the judgment also restricts splitting licence packages. It does not automatically make every subscription, cloud service or digital work freely transferable. A second-hand software audit therefore needs the initial purchase documents, licence scope, transfer history and evidence that the previous holder stopped using the copy. Missing provenance is a specific evidential risk, not something a generic resale certificate necessarily resolves. [4]
6. Open source: examine the version and distribution route
A dependency inventory should identify name, version, origin, licence, modifications and distribution model. SPDX supports exchanging component and licensing information; a tool-generated report is not itself a legal conclusion that every condition has been met. Check licence files, exceptions, dual licensing and transitive dependencies. Record internal use, transfer of copies and network access separately because their consequences depend on the particular licence. [5]
GPLv3, for example, sets conditions for conveying object code, including corresponding source and licensing information. Open-source libraries do not all follow the same model, and every use does not automatically require publication of an entire product. Assess the actual combination and distribution. An audit should end with assigned actions: correct notices, supply source, replace a dependency or obtain another licence, with an owner and deadline. [6]
Sources and further reading
- 1Polish Copyright Act ↗
Dz. U. 2025 poz. 24 ze zm.; art. 41,53,67,74–77
Official entry linking to consolidated text; employee software and contract form.
- 2Computer Programs Directive ↗
Dyrektywa 2009/24/WE; art. 1–6,9
Scope of protection, lawful acquirers and interoperability conditions.
- 3CJEU: SAS Institute v World Programming ↗
C-406/10, 2.05.2012, ECLI:EU:C:2012:259, pkt 39–46,54–61,66–70
Functionality, language, file formats and manuals require distinct assessments.
- 4CJEU: UsedSoft v Oracle ↗
C-128/11, 3.07.2012, ECLI:EU:C:2012:407, pkt 42–49,69–71,78–88
Conditions for exhaustion and limits on resale of software copies.
- 5SPDX — specifications ↗
SPDX: Software Package Data Exchange; specyfikacje projektu Linux Foundation
Component and licensing documentation does not replace legal analysis.
- 6GNU GPLv3 — official text in GCC documentation ↗
GNU General Public License, version 3, 29.06.2007; sekcje 4–6
Licence terms, rather than legislation; a specific licensing-model example.
Rekel Patent — an intellectual-property information website. Publisher: Vadym Rekel.