Technology law has become one of the most relevant legal fields for companies, professionals and organisations operating in an increasingly digitalised environment. Artificial intelligence (AI), data protection, e-commerce, digital platforms, digital assets and cybersecurity give rise to obligations and risks that require specialised legal advice.
At A&M, we advise companies, startups, international clients and professionals on risk prevention, technology contracting, regulatory compliance, and representation in proceedings and litigation relating to their digital activities.
We advise on the application of the AI Act, the classification of artificial intelligence systems and the identification of the obligations applicable to providers, deployers, importers and distributors. We also provide advice on generative AI, contracts, the use of data and liability arising from the use of automated systems.
We assist companies in bringing their activities into compliance with the GDPR, including privacy policies, legal bases for processing, consent, international data transfers, and relationships between controllers and processors. We also represent clients in complaints and proceedings before national and international data protection authorities.
We advise on security obligations, data breaches, cyberattacks and incidents, as well as on the application of NIS2 rules where relevant. We also review technology contracts to ensure that responsibilities between companies and service providers are properly allocated in relation to security.
Technology companies often grow rapidly from an early stage. Particular attention should therefore be paid to software development, contracting, the admission of investors, licensing, data processing and the provision of digital services. Appropriate legal advice from the outset helps manage potential liabilities and supports investment rounds or the subsequent sale of the company.
In a startup, one of the first matters to address is the regulation of relationships between founders and shareholders, optimisation of the corporate structure, the admission of investors, confidentiality, intellectual property and the hiring of employees. This facilitates subsequent financing rounds, due diligence processes, investor participation, international expansion or the sale of the company at the appropriate time.
Standard terms and conditions are not sufficient where technical matters may affect the liability of the parties.
In SaaS, cloud computing, licensing, outsourcing or maintenance agreements, it is necessary to define the scope of the services, availability and support levels, liability in the event of service disruption or data loss, intellectual property, confidentiality and security, data protection, duration, renewal and termination, as well as the migration or recovery of information upon termination of the relationship. Depending on the project, it may also be appropriate to establish penalties, warranties or limitations of liability.
Software-related disputes often arise from an inadequate contractual definition of the rights and obligations of each party. Where a company commissions the development of software or an application, it should be clear who owns the code, what rights are granted to the client and what the developer may reuse.
Matters such as the delivery of and access to source code, the use of third-party or open-source components, maintenance and updates, and continuity of service upon termination of the relationship with the developer should also be regulated. These issues may subsequently affect the exploitation of the business or the admission of investors.
Setting up an online store requires the sales process to be legally compliant. Appropriate terms and conditions must be in place, pre-contractual information must be provided, and the rules governing electronic contracting must be observed. Payment methods, deliveries, returns, withdrawal rights and statutory consumer guarantees must also be properly regulated. In addition, every online store must comply with data protection and cookie rules, including privacy policies, the processing of customer data and the use of tracking or advertising tools.
Marketplaces and digital platforms are subject to specific obligations where they connect sellers, service providers and users. Appropriate terms of use must be established, the platform’s liability must be defined, and matters such as account creation and suspension, payments, complaints and the removal of content or products must be regulated. Platforms acting as intermediaries between third parties are also subject to transparency obligations, professional seller identification requirements and content moderation rules.
The Digital Services Act (DSA) imposes obligations on digital services operating within the European Union. It applies, among others, to intermediary services, hosting providers, marketplaces, online platforms, social networks and search engines. The applicable obligations vary according to the nature, function and size of the service.
The DSA regulates matters such as the handling of illegal content, transparency, online advertising and the identification of professional sellers. It is therefore important to analyse the business model and the role performed by the platform in order to determine which obligations apply.
Companies offering products, subscriptions, digital content or digital services to consumers must take consumer protection requirements into account. European rules on distance contracts impose specific information obligations and regulate, among other matters, the consumer’s right of withdrawal. In subscription and automatic renewal models, companies must provide transparent information regarding price, duration, renewal terms and cancellation, without making termination of the service unnecessarily difficult.
Digital content and services —such as software, applications, platforms, cloud services, audiovisual content or certain subscription-based services— are also subject to conformity requirements. Consumers must be able to exercise the applicable remedies where the content or service does not provide the characteristics, functionality or performance required under the contract. Commercial practices used to attract and retain customers must also be reviewed. Promotions and free trial periods must not be misleading.
E-commerce and digital platforms are subject to numerous legal obligations. We advise companies selling products or services online, as well as marketplaces and other digital operators conducting business within the European Union.
Intellectual property determines who may exploit, modify, license or transfer the digital assets of a company or individual. It is particularly important where the value of the business depends on software, databases, digital content or artificial intelligence (AI) solutions.
Software may constitute one of a company’s most valuable assets, but this does not necessarily mean that the company owns all rights in the software. Where external developers, freelancers, employees or partners are involved, it is important to determine who owns the code, which rights have been assigned and the scope of any such assignment.
Databases, catalogues, photographs, videos, interfaces and other digital content may represent a significant part of a company’s value. However, having possession of such content does not necessarily entail the right to use, modify, transfer or commercialise it.
A database may incorporate elements protected by copyright, image rights, trademarks or other third-party rights. It is also necessary to verify whether the relevant rights have been acquired from collaborators, agencies or external service providers. These issues become particularly important where a company intends to monetise its data, share it with third parties or use it to develop analytical tools.
Artificial intelligence raises new questions concerning the use of content and the rights that may subsist in AI-generated outputs. It is necessary to analyse what information is processed by the AI system, what happens to that data and under what conditions the resulting outputs may subsequently be used.
An AI-generated output should not automatically be assumed to be free of third-party rights or capable of protection by the person using it. The origin of the information and datasets, applicable software licences, and the rights in the outputs to be granted to clients and users should therefore be reviewed. Intellectual property is consequently a fundamental aspect of any project based on artificial intelligence.
A significant part of the legal framework governing new technologies is now developed at European Union level. Most obligations no longer depend solely on national law, but form part of a common European regulatory framework. EU law is therefore fundamental for companies operating in several Member States, providing digital services on a cross-border basis or developing products for the European market.
In recent years, the European Union has developed a specific regulatory framework for the digital economy. Rules such as the GDPR, the Digital Services Act, the Digital Markets Act, the AI Act, the MiCA regime, NIS2 and the eIDAS framework may apply simultaneously.
A company may provide services in several European Union countries without necessarily maintaining a physical establishment in each of them. This does not, however, remove the application of rules relating to consumer protection, data protection, contracting, taxation or sector-specific regulation.
Before expanding a service into other markets, it is advisable to assess whether specific registration requirements or contractual adaptations are required, as well as to determine which law applies and which authorities may have jurisdiction. Companies should make use of the opportunities offered by the European single market while taking applicable national requirements into account.
The regulation of the technology sector has resulted in increased intervention by administrative authorities and supervisory bodies. Companies may be required to respond to inspections, complaints or administrative proceedings. We advise companies and technology operators on litigation and European Union law issues relating to new technologies, including regulatory compliance and national and international administrative and regulatory proceedings.
Digital advertising enables businesses to reach a wider audience, but it also entails legal obligations. Social media campaigns, collaborations with influencers and advertising strategies are subject to rules on commercial practices, consumer protection and data protection.
Advertising through websites, social media, search engines or digital platforms must be clearly identifiable as advertising and must not mislead consumers as to the characteristics, price or conditions of the products or services being promoted.
The fact that a campaign adopts a creative or informal format, or is naturally integrated into content, videos, social media posts or recommendations, does not remove its advertising nature or the applicable transparency obligations.
Claims concerning a product’s characteristics, price, advantages over competitors or qualities must be capable of substantiation. Both the communication channel and the content of the advertising must therefore be assessed.
Collaborations with influencers and content creators may give rise to liability both for the creator and for the company promoting its products or services. Where remuneration, a free product, commission, discount or any other benefit is provided in exchange for a publication, its commercial nature must be clear and easily identifiable to the user.
Such collaborations should therefore be contractually regulated. The agreement should define the messages the creator may use, how advertising must be identified, what rights the company has over photographs and videos, how long those materials may be reused and what happens if a publication breaches advertising rules.
A good campaign should preserve the influencer’s authenticity without losing control over statements made on behalf of the brand.
Digital advertising increasingly relies on the analysis of user behaviour. Cookies, advertising identifiers and other technologies make it possible to measure campaigns, create profiles and display personalised advertising, but their use involves the processing of personal data and is subject to the GDPR. In general, a distinction is made between necessary cookies and cookies used for other purposes, which may be subject to additional consent requirements.
As regards direct marketing by email, SMS or other electronic channels, prior consent is generally required, subject to the applicable exceptions. In addition, where personal data is processed for direct marketing purposes, the data subject has the right to object at any time, after which the data may no longer be used for that purpose.
The legal complexity increases where advertising relies on profiling and advanced segmentation. In such cases, the Digital Services Act introduces additional restrictions concerning advertising based on sensitive categories of personal data and advertising targeted at minors.
Blockchain technology enables new financing models and new forms of digital representation of assets. However, the applicable obligations may vary depending on the nature of the token, the rights attached to it and the services provided in connection with it.
Smart contracts make it possible to automate certain transactions or agreements through code. It is important to define the obligations assumed by the parties, what happens in the event of an error in the code or in the information used to execute the agreement, and how disputes are to be resolved.
As regards asset tokenisation, the digital representation of a right or asset through a token does not in itself determine the applicable legal regime or governing law. It is necessary to analyse what the token represents, what rights it confers on its holder and whether its issuance or commercialisation may be subject to financial or crypto-asset regulation. The technological architecture of the project must therefore be developed in conjunction with its legal structure, particularly where blockchain is used to automate contractual relationships, transfer rights or structure investments.
Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) establishes a European framework governing the issuance and public offering of crypto-assets. MiCA applies to companies issuing or commercialising crypto-assets and to those providing services such as custody, exchange, execution of orders, advice or management in relation to those assets. Crypto-asset service providers —known as CASPs— are subject to authorisation, organisational and operational requirements. An authorisation granted under MiCA in one Member State allows services to be provided on a cross-border basis throughout the European Union.
The digitalisation of financial services has given rise to new business models involving electronic payments, fintech platforms, financing, wallets and other digital financial services. It is important to determine whether the activity constitutes a regulated financial activity, as this may entail authorisation, registration and supervisory requirements.
A technology company may become subject to financial regulation where, for example, it receives or transfers funds, provides payment services or manages client assets. The relationships between the technology company, financial institutions or payment service providers and end users must therefore be analysed. The allocation of responsibilities, protection of client funds and data, outsourcing of technology services and applicable obligations should be clearly defined. We advise companies and technology projects on identifying the applicable regulatory framework, structuring their activities and assessing the resulting obligations.
Electronic contracting and document management require the identity of the parties and the authenticity and legal value of the documents used to be properly established. The eIDAS Regulation provides a common European framework designed to facilitate secure electronic transactions between citizens, companies and public authorities throughout the European Union.
A simple electronic signature enables a document to be accepted electronically or certain data to be incorporated in order to identify the signatory. An advanced electronic signature provides greater safeguards by allowing the signatory to be identified and subsequent alterations to the document to be detected. A qualified electronic signature is subject to additional requirements, including the use of a qualified certificate and a qualified signature creation device. Under the eIDAS Regulation, it has the same legal effect as a handwritten signature and must be recognised in the other Member States.
The eIDAS Regulation governs electronic signatures and electronic identification. It covers electronic certificates, electronic delivery services and other mechanisms designed to ensure the authenticity of digital transactions. This framework has been expanded by Regulation (EU) 2024/1183, which establishes the new European digital identity framework and develops the future EU Digital Identity Wallet. Its purpose is to enable citizens and companies to identify and authenticate themselves securely when accessing public and private services in different Member States. For companies and institutions, this is relevant to administrative proceedings, cross-border contracting, client identification, document signing and the provision of digital services within the European Union.
Professional and commercial decisions begin with an Internet search, and online reputation is essential for entrepreneurs and professionals. The information
Appearing in Google search results with negative, outdated, or irrelevant information can have a significant impact on your personal and
In recent years, European authorities have imposed fines worth billions of euros on companies of all sizes and sectors for
Advertising in regulated sectors is an activity that combines creativity with compliance with the legal framework governing advertising. In particular,
Cryptocurrencies in the European Union have emerged as one of the most transformative phenomena of the 21st century. They are
Filing a patent for an invention is a process aimed at protecting a technical innovation. It grants the patent holder
Specialised legal advice makes it possible to assess risks, adapt business activities to European regulation, draft contracts suited to the relevant technology model and act promptly in the event of a dispute. At Arthur & Marin, we assist companies, institutions, startups, individuals and international clients with software, platform, AI and other technology projects, combining expertise in national law with European Union law.
If you require advice on Tech Law and Digital Law, contact our firm
info@arthurmarin.com
+32 465 34 53 45
