When a proof of concept becomes production: what to do first
A proof of concept moves fast because its licence, its data, and its liability cap are all deliberately narrow. Production removes that narrowness. Before the first real user touches the system, confirm that the licence actually permits production use, classify any AI component the system contains, and check whether security-incident duties already apply to this deployment.
What already governs the switch
The starting point is the licence text of the pilot agreement itself. Directive 2009/24/EC treats a computer program as a protected work regardless of the setting it was tested in. Whatever the pilot agreement granted — often only an internal evaluation right — stays the boundary of what production may do with the same code, unless the parties amend it in writing.
If your organisation counts as an essential or important entity, Directive (EU) 2022/2555 (NIS2) attaches security and incident-reporting duties to services actually in operation, not to services still under evaluation. Go-live is the point at which those duties start running for this particular deployment.
Where the system includes an AI component intended to stay in production, Regulation (EU) 2024/1689 (AI Act) — in force from 2 August 2026 — sets classification and conformity duties that must be resolved before deployment, not after users already depend on the output.
A pilot codebase often carries third-party components brought in without a full rights check. The audit questions are the same wherever the underlying asset originated: When a collection uses third-party artwork step by step.
What changes when the pilot goes live
| Aspect | Typical pilot position | Position once live |
|---|---|---|
| Licence scope | Internal evaluation only | Must cover the actual production use, or be renegotiated |
| Data processed | Synthetic or limited test data | Real personal or business data at full volume |
| Liability cap | Nominal, or capped at the pilot fee | Sized to the production exposure |
| Security duties | Not yet operational for NIS2 purposes | Running from go-live, if the entity is in scope |
| AI classification | Often deferred as "testing" | Must be settled before deployment |
What to do, in order
- Legal team: pull the pilot agreement and read the licence grant clause before the SLA — check whether it excludes production use in as many words.
- Product owner: map the data that will actually flow once live. Synthetic data during the pilot is not a proxy for what production will process.
- Compliance: screen the system against Regulation (EU) 2024/1689 to establish whether it qualifies as an AI system and, if so, in which risk tier.
- Security officer: check whether the organisation is an essential or important entity under Directive (EU) 2022/2555; if so, add the service to the incident-reporting scope before go-live.
- Legal team: replace the pilot agreement with a production agreement — a new liability cap, an SLA, and, where the codebase changed hands, an explicit licence or assignment referencing Directive 2009/24/EC.
- Whoever owns the go-live decision: fix a single date and treat it as the trigger for every deadline above. A phased or "soft" launch without a fixed date leaves each of these duties undated.
Where production means real personal data for the first time, the applicable roles and bases need re-checking rather than assumed: Privacy notice: two roles, two bases explained.
Who decides
Inside the organisation, the go-live decision usually sits with whoever owns the budget — a CTO or a head of product. Legal sign-off on the production agreement sits with whoever holds contract authority, and that is rarely the same person. A supervisory authority only enters the picture after an incident is reported under NIS2; before that, no regulator decides anything about this specific deployment.
Two situations that split the answer
If the pilot processed only synthetic data and production will process real personal data, the data-protection basis has to be revisited before go-live, not after the first live query touches a real record.
If the AI Act applies because the deployed component is genuinely an AI system, the classification exercise has to close before deployment. The 2 August 2026 date is the outer limit for the relevant duties, not the internal target.
If the vendor kept the pilot's intellectual property under a short-term evaluation licence, the production agreement needs a separate rights grant. Silence on this point is not an extension of the pilot terms.
What this page does not cover
This page does not size the cost of the production agreement, and it does not draft the licence amendment itself — both are engagement-specific. It does not cover sector rules layered on top of NIS2 for regulated industries such as finance or health. It does not replace a line-by-line review of the specific pilot contract in front of you.
Sources and limits
For due diligence on the counterparty taking the system into production, the report scope for that jurisdiction sets out what can actually be established: Counterparty in Switzerland and its limits in detail.
Where the open question concerns a specific document rather than the counterparty as a whole, the equivalent scope sits here: Document in Switzerland step by step.
Checked: 4 June 2025. Sources: Regulation (EU) 2024/1689 (AI Act); Directive (EU) 2022/2555 (NIS2); Directive 2009/24/EC.
Related situations
A related friction point in technology contracts sits on the services side rather than the code: When professional services drift out of scope and its.
FAQ
What is the first step when a proof of concept becomes production?
Read the licence grant clause in the pilot agreement before anything else. Most pilot licences are written for internal evaluation only, and production use falls outside that grant unless the parties amend it.
Which deadline is already running?
If the deployed component is an AI system, the duties under Regulation (EU) 2024/1689 attach from 2 August 2026 regardless of your internal launch calendar. If the organisation is in scope of Directive (EU) 2022/2555, security and incident-reporting duties start the moment the service actually goes live, not when the pilot began.
Who decides, and on what evidence?
Internally, the person with contract authority decides based on the licence text and the data-flow map, not on the pilot's technical success. Externally, a supervisory authority only makes a decision once an incident has been reported under NIS2; before that stage, this deployment is not on any regulator's desk.