Software Law: Software, SaaS and Cloud

Home › IT law › Software, SaaS and cloud

Software law covers the protection of programs, development, licence and maintenance contracts, and liability for defective software. We advise software vendors, agencies and users, from contract negotiation through to litigation over a failed project.

Copyright protection of software (sections 69a et seq. UrhG)

Computer programs are protected under section 69a of the German Copyright Act (UrhG) if they are the author’s own intellectual creation. The threshold is low; source code, object code and preparatory design material are covered. Ideas, algorithms as such, functionality, programming languages and file formats are not. The basis is the Software Directive 2009/24/EC.

Where employees write software in the course of their duties, the economic rights belong to the employer (section 69b UrhG). This does not apply to freelancers and agencies: without an express grant, the client only receives the rights that the purpose of the contract requires (section 31(5) UrhG). Missing provisions on source code, the right to modify and onward transfer are among the most common gaps in development contracts.

Users may do what is necessary for the intended use of the program, including error correction (section 69d UrhG). The CJEU has held that this can include decompilation to correct errors, unless the licence provides otherwise (judgment of 6 October 2021, C-13/20, Top System).

Software licences and licence audits

Disputes usually arise from under-licensing, virtualisation and cloud operation, or indirect access via interfaces. Vendors then use audits to demand additional licence fees, often at list price. Under the UsedSoft case law (CJEU, C-128/11), second-hand software may be resold if the licence was acquired permanently for a one-off fee and the seller makes its own copies unusable. This does not apply to subscriptions and SaaS.

• Review of the audit clause: scope, notice period, costs, confidentiality
• Your own licence position before any data goes to the auditor
• Negotiating additional licences rather than damages at list price
• Defending copyright claims under section 97 UrhG

Development contracts, acceptance and defects

Custom software is usually assessed under the German rules on contracts for work (sections 631 et seq. of the Civil Code, BGB), with acceptance under section 640 BGB and warranty rights under section 634 BGB. Where standard software is merely customised, sales law may apply. In agile development without a fixed deliverable, the contract moves closer to a contract for services. This decides who bears the risk of an unfinished result.

Deemed acceptance under section 640(2) BGB matters in practice: if the supplier sets a reasonable deadline after completion and the client does not refuse acceptance by stating at least one defect, the work is treated as accepted. Warranty claims for software are generally time-barred two years after acceptance (section 634a(1) no. 1 BGB).

Software for consumers: sections 327 et seq. BGB

Since 1 January 2022, the trader must provide updates to consumers, in particular security updates, for the period they can reasonably expect (section 327f BGB). Missing updates are a defect, the burden of proof is shifted in the consumer’s favour (section 327k BGB), and deviating standard terms are ineffective.

SaaS, cloud, maintenance and SLAs

German case law mostly treats software used as a service as a lease (Federal Court of Justice, judgment of 15 November 2006, XII ZR 120/04, on an ASP contract). The provider then owes availability for the whole term. How availability is measured, which response and recovery times apply and what happens if they are missed belongs in a service level agreement.

Liability: new product liability law and the CRA

The German act implementing Directive (EU) 2024/2853 applies to products placed on the market from 9 December 2026. Software will then expressly be a product, whether installed locally or provided via the cloud. Free and open-source software supplied outside a commercial activity remains exempt. Claimants benefit from easier rules on proof, and missing security updates can trigger liability.

Under the Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers of products with digital elements have had to report actively exploited vulnerabilities since 11 September 2026; the remaining requirements apply from 11 December 2027. Between businesses, liability can still be limited within sections 307 et seq. BGB, but not for intent, gross negligence or personal injury (section 309 no. 7 BGB).

Typical matters

• Development, licence, maintenance and support contracts
• Disputes over acceptance, defects, delay and payment for custom software
• Licence audits and vendor claims
• Clearing rights with agencies and freelancers, source code escrow
• Copyright claims, including interim proceedings

FAQs on software law

Does the client own the source code?

Only if this has been agreed. Without a provision, the prevailing view is that the developer need not hand it over unless the purpose of the contract, such as further development by the client, requires it.

May I buy second-hand software licences?

Yes, for licences acquired permanently and where exhaustion can be shown. Ask for documentation of the licence chain and of deletion by the previous owner.

Related topics

• IT projects in crisis
• Data Act and cloud switching
• SaaS contracts (in German)
• Open source (in German)
• Cyber Resilience Act (in German)