When a proof of concept becomes production: what it costs to be wrong
A proof of concept is scoped for testing: limited data, limited users, limited licence. Once real customers use it, three contracts activate at the same time — the software licence, the data processing terms, and, if the system uses AI or touches essential services, regulatory duties. Treat the switch as a contract event, not a technical footnote.
The three contracts that switch on
Three areas of EU law typically become relevant once a pilot goes live. Software protection follows Directive 2009/24/EC, which treats the source code and its adaptations as the author's work, regardless of the deployment stage. A production build usually needs adaptation and reproduction rights that a proof-of-concept licence never granted; testing rights and production rights are not the same thing, even under the same vendor.
Cybersecurity duties may follow Directive (EU) 2022/2555 (NIS2). It applies once a service qualifies as essential or important. A closed test environment usually does not qualify; a live production environment carrying real customer traffic often does.
Where the system itself performs an AI function, Regulation (EU) 2024/1689 (AI Act) becomes relevant. Its main obligations apply from 2 August 2026. The classification of the use case can shift once real data and real outcomes replace test data, and that shift is worth checking again at go-live, not only at design stage.
What changes once real users touch it
Test data protects nobody real; production data does. The first consequence is a data-protection gap: a proper data processing agreement needs to exist before the first live customer record is written, not after go-live has already happened.
Control over the production environment often moves to whichever platform actually hosts it. See When custody is held by a platform step by for the same control question applied to a different asset class.
A third consequence sits with cybersecurity. If the service now qualifies as essential or important under Directive (EU) 2022/2555, registration and incident-reporting duties can start running from the go-live date. That date rarely matches any renewal date already written into the original proof-of-concept agreement.
What to do, in order
- Contract owner freezes the current scope in writing and dates the freeze.
- Contracting parties amend the licence to cover production use, referencing rights held under Directive 2009/24/EC.
- Data protection lead puts a proper data processing agreement in place before any real personal data is processed; see Data processing agreement overview and what to prepare.
- Security lead checks whether the live service now falls within Directive (EU) 2022/2555 and, if so, starts the registration clock rather than waiting for a reminder.
- Compliance lead reassesses the AI system's classification under Regulation (EU) 2024/1689 against the actual production use case, not the original pilot design.
- Legal counsel records the transition decision, the date it was made, and who approved it.
Who decides, and by when
Four questions tend to arrive together at the moment of go-live. Each has a different decision-maker and a different clock, and confusing one clock for another is the usual source of avoidable cost.
| Question | Decided by | Trigger |
|---|---|---|
| Production licence scope | Both parties, by written amendment | Before go-live, not after |
| NIS2 registration duty | National competent cybersecurity authority | Once the essential or important threshold is met, under Directive (EU) 2022/2555 |
| AI system classification | Provider's own assessment, checked by the market surveillance authority | Main duties apply from 2 August 2026, under Regulation (EU) 2024/1689 |
| Lawful basis for real data | Controller, together with the processor | Before any live personal data is processed |
Where the answer forks
- If the proof of concept used only synthetic data, then the data processing agreement is the first document to update, not the last.
- If the system performs a function the AI Act treats as high-risk, then conformity work should start well before 2 August 2026, not on that date.
- If the underlying code was written by an outside contractor, then confirm the production licence under Directive 2009/24/EC covers adaptation and deployment, not merely internal testing.
What this page does not settle
This page does not classify your specific system as high-risk, essential or important. That needs the actual contract and the actual data flows in front of someone qualified to read them.
It does not replace a review of the vendor's current standing before you extend the relationship. See Counterparty report before renewing a contract in practice.
It also does not resolve a dispute over what a translated version of the licence actually says. See Document report when a translation is disputed and who.
Cost factors and response times
The cost of getting this wrong depends on how many jurisdictions the contract touches, whether a regulator's clock has already started, and whether the other side disputes the scope. None of that is quoted here as a price; it depends on your file. A partner's first response arrives within minutes during business hours. A written fee estimate follows within one business day.
Related reading
A related pattern appears when a services engagement quietly grows past its original brief. See When professional services drift out of scope in detail.
Verified
Checked against the sources below on 12 May 2025. Directive 2009/24/EC on the legal protection of computer programs, consolidated version. Directive (EU) 2022/2555 (NIS2), in force since 18 October 2024. Regulation (EU) 2024/1689 (AI Act), with main obligations applying from 2 August 2026.
FAQ
What is the first step when a proof of concept becomes production?
Freeze the current scope in writing, dated, before anything else changes. The freeze becomes the reference point for the licence amendment and the data processing agreement that follow it.
Which deadline is already running?
If real personal data is already flowing, the deadline to have a data processing agreement in place has already passed, not started. If the AI Act applies to the system, classification work should already be underway ahead of the 2 August 2026 obligations date.
Who decides, and on what evidence?
The licence scope is decided by the parties through a written amendment. Regulatory questions such as NIS2 registration or AI Act classification are decided first by self-assessment, then checked by the competent authority against the system actually in production, not against the original proof of concept.