A company commissions development from a freelancer or a studio, pays against acceptance certificates and assumes the code is its own. The law does not always agree. In many countries the rights in a contractor’s software must be assigned in a written contract, or they stay with the author. We go through how this works in the US, the UK, the EU and Russia according to primary sources, and what to write about AI-generated code, personal data and access.
Checked on 22 October 2026. Rules and sources are current as of this date.
Who owns the code by default
The answer depends on the law of the country and on who the author is: an employee or a contractor. That difference drives everything else.
United States
US law treats as a “work made for hire” a work prepared by an employee within the scope of employment. A commissioned work qualifies only if it falls within a closed list of categories and the parties sign a written agreement to that effect (17 U.S.C. § 101). A stand-alone program by a contractor does not usually fit the list, so the rights have to be assigned. An assignment is valid only in a writing signed by the owner of the rights (§ 204).
United Kingdom
Where a literary work, which includes software, is made by an employee in the course of employment, the employer is the first owner of the copyright, subject to any agreement to the contrary (CDPA, s. 11(2)). There is no such rule for a contractor. An assignment is not effective unless it is in writing signed by or on behalf of the assignor (s. 90(3)).
European Union
Directive 2009/24 on the legal protection of computer programs speaks directly only about an employee. Where a program is created by an employee in the execution of his duties or following the employer’s instructions, the employer exclusively is entitled to exercise all economic rights, unless otherwise provided by contract (Article 2(3)). The directive has no rule for a contractor, so national law and the contract decide.
Russia
The exclusive right to a computer program created under a contract whose subject was its creation belongs to the customer, unless the contract provides otherwise (Article 1296 of the Civil Code). The contractor may use the program for its own needs under a free non-exclusive licence unless the contract says otherwise.
Do not rely on the default rules. If the contract has no express assignment of rights in the code, the customer at best holds a licence and at worst holds nothing.
Four jurisdictions side by side
A summary of what follows directly from the texts of the laws.
| Country | What the law says | What to do |
|---|---|---|
| United States | A contractor’s work rarely qualifies as a work made for hire, and rights do not pass without a signed writing | A written assignment signed by the contractor |
| United Kingdom | The employer is first owner only for an employee | A written assignment signed by the assignor |
| European Union | The directive covers only the employee, national laws decide the rest | An assignment in the contract under the law of the contractor’s country |
| Russia | Rights in a commissioned program belong to the customer unless the contract says otherwise | State the assignment, its scope and the contractor’s lack of reuse rights |
What the contract must contain
A good development contract answers five questions. Who owns the code, to what extent, for how long, what the contractor may keep and who answers for third-party rights inside the code.
Assignment
Use direct assignment wording, not “the right to use”. State the scope, territory and term, or that it is perpetual. In the US and the UK the contractor’s signature is required.
Existing code and tools
Separate what is created for you from the contractor’s general tools. General components need a licence, and what is created for you needs an assignment.
Reuse
In Russia a contractor may by default use the program it created for its own needs. If that does not suit you, prohibit it expressly.
Warranties
The contractor confirms that the code does not infringe third-party rights and that the licences of third-party components allow commercial use.
Code produced with AI
Contractors increasingly write code with generative models, and that affects what exactly you receive.
The US Copyright Office position
In its report of 29 January 2025 the Office concluded that outputs of generative AI can be protected by copyright only where a human author has determined sufficient expressive elements. Prompts alone are not enough. Using AI as an assistant does not bar protection of the work as a whole.
What to put in the contract
Whether the contractor may use AI tools, which ones, how it discloses their use and who is responsible if generated code infringes third-party rights or the tool’s licence terms.
If you pay for original code but receive mostly generated code, the protectable part may be smaller than you think. Require disclosure of AI use.
We will review your situation and propose a solution for your project.
Personal data and confidentiality
If a contractor gets access to user databases, logs or test data with real people, it becomes a data processor.
Article 28 GDPR
Processing may be entrusted only to those providing sufficient guarantees. It is governed by a contract setting out the subject matter and duration, the nature and purpose of the processing, the type of personal data and the categories of data subjects. The processor acts only on documented instructions and engages another processor only with the controller’s authorisation.
Confidentiality and security
The processor ensures that authorised persons are bound by confidentiality and takes the measures required by Article 32. At the controller’s choice it deletes or returns the data after the work ends.
Do not hand over live data
Use anonymised or test data for development. If real data cannot be avoided, sign the processing agreement before access is granted.
Accounts, keys and repositories
Rights in the code mean little if the contractor holds the keys to everything else.
Everything in the company’s name
Register the repository, cloud accounts, domains, app store accounts and signing keys to the customer from day one.
Handover and acceptance
The contract should provide for delivery of the source code, documentation and access on acceptance and on termination. Tie payment under the final certificate to actual handover.
Subcontractors
Require written consent for subcontractors and for the passing of rights down the chain. Otherwise rights assigned to you may never have reached you.
The Apple and Google rules are covered in detail in our article on publishing an app on the App Store and Google Play. If the developer account is registered to the contractor, the platform sees the contractor as the seller.
Liability, acceptance and support
These terms are discussed least and cause the most disputes.
Acceptance
A review period, completion criteria and a procedure for fixing defects. Without them a dispute over whether the work was accepted is often not decided in your favour.
Liability
Define what the contractor answers for towards you: infringement of third-party rights, data leaks, hidden features. A limit on liability should reflect the real risks of the project.
Support and source code
Terms for fixing bugs after launch and for delivery of current source code if the contractor stops work.
Case law
The best-known decision on this question comes from the US Supreme Court, so it shows US law logic, and in another jurisdiction local rules must be checked. The problem itself is similar everywhere: paying for work does not transfer the rights.
CCNV v. Reid, 5 June 1989
A non-profit organisation commissioned a work from a sculptor, and there was no written agreement on rights. The Court unanimously held that “employee” in the work-made-for-hire provisions is determined by the general common law of agency, and that the sculptor was an independent contractor. The commissioned sculpture was outside the closed list of commissioned-work categories and was not covered by a signed written agreement, so it was not a work made for hire. The question of possible joint authorship was left to the lower court.
If the developer is not an employee, rights in the code do not pass to the customer automatically just because the customer paid. A written assignment or a licence with clear terms is needed.
A startup hires a freelancer to build an app and pays the invoices, but the contract has no clause on rights. Two years later an investor runs due diligence and asks for confirmation of title to the code. The freelancer replies that nothing was ever transferred. A sensible order of action is to sign a written assignment with the contractor that also confirms the transfer for code already written, provide consideration for it, check whether the contractor used other people, and list the open-source libraries used.
What to do now
Reviewing existing contracts takes a few hours, and losing rights costs far more.
Find the development contracts
Collect every contract under which product code was written, including old freelancer contracts.
Start hereCheck the assignment of rights
Is there a direct written assignment signed by the contractor, and what does it cover.
Close gaps with an addendum
If there is no assignment, obtain one retroactively in a separate signed document.
Ask for a component list
A list of third-party libraries and licences, and information about AI use.
Move access to the company
Repositories, cloud, domains, store accounts and keys.
Update your template
Include assignment of rights, a reuse ban, data terms and subcontractor terms.
A missing assignment is easier to obtain while the relationship with the contractor is working. After a dispute it can become a bargaining chip.
Paying for code does not yet give you the rights in it.The LegalBit team
Frequently asked questions
Is paying for the work enough for the rights to pass to the customer?
No. In the US and the UK an assignment of copyright is valid only in writing signed by the assignor. In Russia the rights default to the customer, but the contract may provide otherwise.
Does “work made for hire” apply to a contractor’s code?
As a rule, no. For commissioned works US law has a closed list of categories and requires a written agreement, and a stand-alone program does not usually fit. That is why a direct assignment is used.
May the contractor reuse the code it wrote for other clients?
In Russia it may by default for its own needs unless the contract says otherwise. Elsewhere it depends on the contract. It is best to settle the rule expressly.
Is AI-generated code protected by copyright?
According to the US Copyright Office, protection arises only where a human has determined sufficient expressive elements, and prompts alone do not create it.
Do we need a separate agreement if the contractor sees personal data?
Yes. If the contractor processes data on your behalf, Article 28 GDPR requires a contract with mandatory terms, including acting only on instructions and returning or deleting data.
What to do about signed contracts with no assignment of rights?
Sign an addendum with an assignment of rights and the contractor’s signature, then update your contract template.
See also: Publishing an app on the App Store and Google Play; Terms of Service and Privacy Policy for your project; EU AI Act checklist for IT companies and SaaS. Services: lawyers for IT companies and SaaS, contracts and documents.
- U.S. Copyright Office: Copyright Law of the United States, Chapter 1, § 101 (work made for hire)
- U.S. Copyright Office: Copyright Law of the United States, Chapter 2, §§ 201, 204
- legislation.gov.uk: Copyright, Designs and Patents Act 1988, section 11
- legislation.gov.uk: Copyright, Designs and Patents Act 1988, section 90
- EUR-Lex: Directive 2009/24/EC on the legal protection of computer programs
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), Article 28
- President of Russia: Civil Code of the Russian Federation, Part Four, Articles 1295, 1296 (in Russian)
- U.S. Copyright Office: Part 2 of the Artificial Intelligence Report (29.01.2025)
- U.S. Copyright Office: Copyright and Artificial Intelligence, Part 2: Copyrightability
- Supreme Court of the United States: Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989), U.S. Reports
This is what we do
How we help IT companies and developers:
