Technology contracts and outsourcing: the decisions this practice answers
This hub maps each technology contract question to the page that answers it, from software licensing terms to outsourcing risk and liability caps. Where a dispute turns into a digital-asset question, Tokenised rights and digital objects overview in practice takes over. Below, each row states the deciding page, the applicable deadline, and the source we rely on.
Which question goes where
Use this table before opening a specific page. It saves you from reading a page that only sounds relevant.
| Decision | What decides it | Where it is answered |
|---|---|---|
| Customer demands an uncapped liability clause | Clause type, and whether a cap already exists in the master agreement | Practice: liability cap situations |
| Due diligence on a vendor or customer before signature | Which registers exist for that party and what they show | Reports: counterparty file |
| Retention and change history for a contract or its schedules | What a document register can confirm and what it cannot | Reports: document file |
| Personal data terms inside an outsourcing schedule | Which notice applies to the processing described there | Legal: privacy notice |
| Rights over a tokenised or blockchain-recorded deliverable | Whether the token carries the right or only records it | Digital assets: tokenised rights hub |
What this practice covers
Software licensing terms — assignment, source-code escrow, permitted use — sit under Directive 2009/24/EC. Outsourcing an ICT function to a third party brings in the security duties of Directive (EU) 2022/2555 (NIS2) once the customer or the provider falls within its scope. A contract that procures or embeds an AI system also engages Regulation (EU) 2024/1689 (AI Act), whose remaining obligations take effect from 2 August 2026 (current as at this review). None of these three acts sets a price or a fee; each sets a duty, and the duty changes who drafts what into the contract.
What this changes in practice
A contract that once needed only commercial terms now needs a security schedule if NIS2 applies to either party, and an AI-use schedule if the deliverable includes a model or a component trained on one. Escrow and source-code terms under Directive 2009/24/EC still follow ordinary contract negotiation — the directive protects the software, it does not dictate the commercial split. The practical effect is procedural: more schedules, more sign-off steps, and an earlier point at which legal review needs to start.
What to do
- Identify which page below matches your question before drafting anything.
- Ask your counterparty to confirm which processing activities the outsourcing schedule covers, then check the data terms against the Privacy notice overview explained before signature.
- Run due diligence on the other party before the contract is executed, not after.
- Flag any AI component in the deliverable at the term-sheet stage, not at the review stage.
- Route liability-cap disputes to the specific situation page rather than negotiating from a general template.
Who decides
Inside the contract, the parties decide by negotiation, within the limits their governing-law clause allows. Outside the contract, disputes go to the forum named in the dispute-resolution clause — court or arbitration, as agreed. This hub does not replace that clause; it tells you which internal question to resolve before the clause becomes relevant.
If your situation is different
If you are the customer facing a demand for unlimited liability, the relevant page walks through the first response, not this one. If you need to verify a counterparty before signature, the counterparty file answers what a register can and cannot confirm. If your outsourcing schedule names sub-processors, resolve the privacy question before the security question, since the privacy notice usually defines the processing scope that the security schedule then covers.
What this page does not decide
This hub does not draft a clause, does not set a fee, and does not confirm which national statute applies to a specific dispute. It only allocates your question to the page built to answer it. National-level statutory detail lives on the pages it points to, not here.
Sources and limit
For evidence questions about the parties named in the contract, open the Counterparty in Lithuania and its limits in detail file before you rely on any representation the other side makes about itself.
For evidence questions about the contract document itself — signature dates, amendments, version history — open the Document in Lithuania step by step file rather than assuming the file you hold is the final one.
Related publications
See also: When a customer demands unlimited liability and its limits.
FAQ
What does this change in practice?
It adds schedules that did not exist before: a security schedule where NIS2 applies, and an AI-use schedule where the deliverable includes a model. Licensing terms under Directive 2009/24/EC stay a matter of negotiation, not statutory dictation.
Which deadline applies?
There is no single deadline across this practice — it depends on which page answers your specific question. The liability-cap situation has its own timing; the AI Act's remaining obligations run from 2 August 2026 for contracts that fall within its scope.
What do you need from us to start?
The draft contract or schedule in question, the identity of the other party, and a note on whether an AI component or a sub-processor is involved. That is enough to route your question to the right page and, from there, to a first response.
Verified
Verified: 1 April 2025. Sources: Directive 2009/24/EC; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2024/1689 (AI Act), effective from 2 August 2026 (as at this review).