Legal risks of AI-driven code generation

The AI Act and compliance It's no longer enough for code to "work". Under the EU AI Regulation, applications must be categorized based on risk. If your AI-generated software is used for critical decision-making (e.g. recruitment or credit checks), it is classified as 'high risk'. This entails strict requirements for logging, transparency and human oversight. There are also requirements to inform users that content is AI-generated in certain contexts.

GDPR and personal data AI-generated applications may inadvertently handle personal data in a way that violates the GDPR. Always analyze what data is used and how it is processed, and document this in your impact assessment.

Cybersecurity Act (NIS2 Directive) The new Cybersecurity Act aims to increase resilience in the EU. Compared to previous rules, there are now stricter requirements for risk analysis and security measures in the supply chain. The law will enter into force in Sweden on 15 January 2026 and covers significantly more organizations than before.

Intellectual Property Law and "license taint" Many AI tools are trained on copyrighted code. Your solution may therefore contain elements that you do not own and infringe the rights of others. At CLX Legal, we also see a risk of "license contamination", where the AI downloads code from Open Source projects with strict Copyleft terms (e.g. GPLv3 or AGPL). In the worst case, this could force you to open up your own source code.

The issue of liability in case of incidents Who is responsible when software that no human wrote causes a data breach? Traditional license agreements often absolve the AI vendor. The onus is on the company implementing the code to prove that they validated the product. Many also forget that so-called "vibe-coding" (where code is created from simple instructions without deeper technical scrutiny) can involve feeding sensitive data and unique business logic into a public AI model, jeopardizing trade secrets.