KG Legal KIELTYKA GLADKOWSKI is pleased to announce that one of the firm’s partners has contributed, as a legal practitioner from Poland, to the forthcoming 2026 edition of the World Justice Project Rule of Law Index®.

The World Justice Project is an independent, non-partisan and multidisciplinary organisation dedicated to advancing the rule of law worldwide. Its Rule of Law Index is one of the leading global sources of independent data on how the rule of law is experienced and perceived in practice. Drawing on surveys of the general public and of qualified legal practitioners and experts across numerous jurisdictions, the Index examines not merely the laws formally in force, but — crucially — how legal institutions actually operate.

The assessment encompasses eight fundamental dimensions: constraints on government powers, absence of corruption, open government, protection of fundamental rights, order and security, regulatory enforcement, civil justice and criminal justice. These areas are evaluated through detailed questions concerning, among other matters, judicial independence, access to justice, the effectiveness and timeliness of court proceedings, due process, the practical enforcement of judgments and regulations, the operation of public authorities, and the protection of individuals against arbitrary or improper exercises of power.

Contributing to this project from the perspective of the Polish jurisdiction was both a privilege and a significant professional responsibility for our partner. Meaningful assessment of the rule of law requires more than an analysis of legislation or institutional structures. It also requires practical knowledge of how courts, prosecutors, law-enforcement bodies and administrative authorities function in real cases — and how legal safeguards are experienced by individuals and businesses navigating the system.

Together with the team at KG Legal KIELTYKA GLADKOWSKI, our partner works primarily on complex cross-border matters and remains actively involved in civil, commercial, administrative and criminal proceedings. This experience provides a close view of the practical operation of the Polish justice system, including cases involving international businesses, foreign investors and individuals from other jurisdictions seeking the protection of their rights or the resolution of disputes before Polish courts and authorities.

Poland’s position as a major European Union jurisdiction makes this perspective particularly important. Polish courts and public authorities are increasingly called upon to address cases with international, regulatory and cross-border dimensions. As the movement of people, capital, technology and business activities across borders continues to intensify, the predictability, independence, accessibility and effectiveness of the justice system become matters of significance not only domestically, but also for parties and institutions throughout Europe and beyond.

The rule of law is therefore not an abstract constitutional principle. It directly influences the security of individuals, the protection of fundamental rights, confidence in public institutions, the enforceability of contracts, the stability of investment and the ability of businesses and citizens to obtain effective remedies. Reliable, comparative research such as the World Justice Project Rule of Law Index helps transform professional experience and public perceptions into data that can support informed debate, institutional reflection and meaningful reform.

Our partner’s involvement in this initiative also reflects a broader professional commitment pursued as an active member of the American Bar Association, particularly its International Law Section: promoting the cross-border exchange of legal knowledge, practical experience and perspectives among colleagues from different jurisdictions. Such dialogue is indispensable. No legal system operates in isolation, and many of the challenges affecting justice today — technological transformation, international commerce, migration, regulatory enforcement and the protection of fundamental rights — require cooperation extending beyond national boundaries.

KG Legal KIELTYKA GLADKOWSKI is sincerely grateful to the World Justice Project for the opportunity afforded to our partner to contribute to this important endeavour. It has been a great honour to share practical insights from Poland and to support a project that strengthens knowledge and awareness of the rule of law worldwide.

#WorldJusticeProject #RuleOfLaw #RuleOfLawIndex #Poland #Justice #Judiciary #InternationalLaw #CrossBorderLaw #AmericanBarAssociation #ABAILS #LegalProfession #KGLegal #KieltykaGladkowski #Litigation

Artykuł Partner of KG Legal KIELTYKA GLADKOWSKI contributes to the 2026 edition of the World Justice Project Rule of Law Index® pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Legal Environment and Practical Aspects of Dual-Use Technology – the Ukrainian Conflict as a Lens on the Development of EU Regulation and the Polish Jurisdiction – Expanded Edition – Legal status as at 25 August 2026

Authors: attorney-at-law (radca prawny) K. Jakub Gładkowski (corporate practice, court and regulatory representation), attorney-at-law (radca prawny) Małgorzata Kiełtyka (M&A, high-technology and highly regulated sectors) – KG Legal Kiełtyka Gładkowski Spółka Partnerska Kancelaria Radców Prawnych; iSTART1 programme.

This material is of a popular-science and informational nature. It does not constitute legal advice or a binding opinion. Before citing any specific provision, the current consolidated version in EUR-Lex and the current entry in the Polish Journal of Laws (Dziennik Ustaw) should be verified in each case.

Abstract

The Russo-Ukrainian conflict has become a lens in which the future of dual-use unmanned technology is brought into focus – and, at the same time, a barometer of the direction its regulation will take. Within two to three years, technological progress has occurred which, in peacetime conditions, would have taken decades. This article combines two perspectives: a technological taxonomy of drone warfare and a map of the legal environment of the European Union and Poland, encompassing nine mutually interpenetrating regulatory pillars – from product certification and airspace management, through artificial intelligence, export control, defence financing, satellite communications, cybersecurity and personal data protection, to international law and the national regime.

The thesis to be verified is that the legal regime of the UAV sector is structurally dual-track: on the civil track, law operates as a consequence of need and as a risk-dampening factor, whereas on the defence track it operates as a driver of development. The mechanism separating the two tracks is the military exclusion in Article 2(3) of the Artificial Intelligence Act and the analogous defence exclusions in successive instruments, while the line of dispute is the increasingly blurred dual-use boundary. We analyse seven concrete points of friction between the tracks and formulate a practical qualification map and a 2026–2028 compliance calendar for manufacturers, operators and investors in this sector.

Keywords: unmanned aircraft, dual use, Artificial Intelligence Act, high-risk systems, autonomous weapon systems, export control, U-space, NIS2, CER, personal data protection, European Drone Defence Initiative.

1 Introduction

1.1 Nineteen objects over Poland – the moment when law caught up with reality

The impulse to look at the drone problem not merely as a tactical phenomenon but as a growing strategic threat to Europe comes from reports circulating in the analytical and milblogger space – based on statements of Ukrainian military intelligence (HUR) – that Russia is already producing more jet-powered variants of the Geran-4 and Geran-5 than piston-engined Geran-2s, with figures in the order of approximately 3,000 jet platforms per month against approximately 2,800 piston variants. Assessments of this kind, even if they call for source-related caution, are of significant analytical importance: they show that the scale of Russian production of unmanned means of aerial attack may exceed the framework of a war of attrition against Ukraine and may be perceived as a capability able to support a broader campaign of pressure or threat directed at European states. In this sense, the drone problem is no longer an exclusively military issue, but also a stimulus for a fresh reading of the legal environment of unmanned technologies in Europe – from aviation law, through export control and AI, to cybersecurity, the protection of critical infrastructure and state security.[1]

On the night of 9/10 September 2025, a dozen or so unmanned aircraft flew into Polish airspace; some of them were shot down by NATO aircraft. This was not an isolated incident – the Romanian government had reported violations as early as January 2025, and in August of the same year a Russian Geran-2-type platform came down near Osiny in eastern Poland. The September event, however, carried a different weight: it triggered consultations under Article 4 of the Washington Treaty, led to the launch of NATO’s operation _Eastern Sentry_, and, in the EU dimension, to the announcement of a “drone wall”, subsequently transformed into the European Drone Defence Initiative (EDDI) and Eastern Flank Watch.

The current phase of the Russo-Ukrainian conflict makes it plain that both sides are developing unmanned technologies according to different operational logics and economics of use. The Russian side has to a greater extent expanded the segment of drones performing a function complementary to classic means of aerial attack: decoys, platforms imitating the actual strike assets, and cheap carriers used to saturate air defence and force the expenditure of effectors on the Ukrainian side. The Ukrainian side, conversely, is developing more broadly the segment of long-range drones with a real strike function, whose principal purpose is to strike rear-area infrastructure, including refineries, logistics and other objects of high operational value. This difference matters not only militarily but also in legal-regulatory terms, because it translates into different risk profiles as regards the qualification of dual-use technology, liability for the use of means of aerial attack, the protection of critical infrastructure, and the economics of air defence. In practice, the Russian model relies to a considerable degree on forcing a costly defensive reaction on the adversary’s side, whereas the Ukrainian model aims at the asymmetric striking of rear-area targets using relatively cheap platforms, which further deepens the problem of cost disproportionality between a cheap drone and an expensive defensive effector, such as the missiles of the S-300, S-400, Tor or Pantsir systems. In this sense, the conflict is a lens not only of the development of technology, but also of the transformation of the regulatory logic itself: law must now contend not with a single device, but with entire models of the operational use of unmanned technologies.[2]

For the lawyer, however, something else is most important. The facts give rise to questions about an asymmetry which is the crux of the entire regulatory problem: against platforms with a unit cost counted in thousands of dollars, systems were used whose single effector should cost hundreds of thousands. This cost asymmetry is not merely a budgetary problem. It forces the burden of defence to be shifted onto solutions that are cheap, mass-produced and increasingly autonomous – and therefore precisely onto that class of technology which European Union law regulates most cautiously on the civil side and almost not at all on the military side.

The new regulatory architecture of drone security: from EU strategy to the obligations of critical infrastructure operators and AI systems

Over the following months, the legislative tempo concerning unmanned systems accelerated in a manner unprecedented for this sector. The existing drone regulations had concentrated primarily on aviation safety, the rules for conducting operations, and technical requirements for operators and manufacturers. In 2026, however, a significant shift of regulatory emphasis took place: the drone began to be treated not only as an aviation device, but also as a potential tool of threat to critical infrastructure and as a system that may be subject to the requirements of artificial intelligence regulation.

The first element of this new architecture was the Action Plan on Drone and Counter Drone Security (COM(2026) 81 final) presented by the European Commission on 11 February 2026.[3] This document does not constitute a legally binding act within the meaning of Article 288 of the Treaty on the Functioning of the European Union,[4] but has the character of a European Commission communication – a political and programmatic instrument belonging to the category of so-called soft law. It does not establish direct obligations for Member States, undertakings or critical infrastructure operators, but it sets the direction of the European Union’s future legislative and organisational actions.

The significance of this document lies above all in a change in the way threats connected with unmanned aircraft are perceived. The Commission indicated that the rapid development of drone technologies, their commercial availability and the possibility of their use by entities conducting hostile activities make it necessary to build a European security system encompassing both protection against unauthorised drone operations (counter-drone) and the strengthening of the resilience of Member States’ infrastructure.

The Action Plan provides for the development of Member States’ capabilities in detecting, identifying and neutralising threats caused by drones, better information exchange between security authorities, and the development of counter-drone technologies. Particular importance was attached to the protection of critical infrastructure, military facilities, the external borders of the European Union, and places particularly exposed to the unlawful use of drones.

The European Commission’s Action Plan should accordingly be treated as the first level of the new regulation – the strategic level. It does not yet impose specific legal obligations, but it creates the political justification for subsequent legislative changes at national and EU level.

The second level was the intervention of the Polish legislator. The Act of 29 May 2026 amending the Act on Crisis Management and certain other acts introduced solutions enabling the use of jamming devices in the protection of critical infrastructure.[5]

This amendment[6] is of particular importance because, for the first time in the Polish legal system, an express basis was created for the application of measures interfering with the communications or control of unmanned aircraft by entities connected with the protection of critical infrastructure. It must, however, be precisely noted that the legislator did not grant critical infrastructure operators an independent right to use jamming devices.[7] The legal construction was shaped at two levels.

First, Article 16c,[8] added to the Act on Crisis Management, grants the critical infrastructure operator the competence to take a decision on the admissibility of the use of specified devices.

That provision reads:

“In order to ensure the protection of critical infrastructure, the critical infrastructure operator (…) may take a decision on the admissibility of the use of the devices referred to in paragraph 1, for the time necessary for the performance of activities by security staff of specialist armed security formations (…)”.

Second, the technical scope of those measures follows from the provisions of the Aviation Law, in particular Article 156ze(1), which sets out the possibility of using devices serving to counter unmanned aircraft.

Under that provision, such devices may be used for the purpose of:

“interfering with or taking over control of an unmanned aircraft, interfering with the flight control signal or the navigation signal enabling the flight of that aircraft”.[9]

In practice, this means that the critical infrastructure operator has obtained a new power of a decision-making character, whereas the physical use of the devices remains tied to the activities of the staff of specialist armed security formations (SUFO). This solution is a compromise between the need for effective protection of strategic facilities and the necessity of limiting the risk of uncontrolled use of devices capable of interfering with communications or navigation systems.

The explanatory memorandum to the bill[10] stated that the purpose of the regulation is to increase the resilience of critical infrastructure and to provide operators with tools corresponding to contemporary threats, in particular threats making use of unmanned systems.

The third level of regulation was the modification of the timetable for the application of the provisions of the EU Artificial Intelligence Act.

On 29 June 2026, the Council of the European Union approved an amendment to Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (the AI Act).[11] This amendment did not change the AI Act’s basic risk-based regulatory model, but postponed the dates on which part of the obligations concerning high-risk systems begin to apply.

The most significant change was the extension of the preparatory period for providers of high-risk AI systems. The regulation was intended to enable undertakings, supervisory authorities and standardisation institutions to prepare the appropriate technical and organisational mechanisms, including conformity standards, risk assessment procedures and quality management systems.

This change is also relevant for the drone sector. Contemporary unmanned systems increasingly use artificial intelligence algorithms for autonomous navigation, object identification, image analysis or operational decision-making. In consequence, particular applications of drones may simultaneously be subject to aviation law regulations, provisions concerning the security of critical infrastructure, and the requirements of the AI Act.

By way of example, Article 113 of Regulation (EU) 2024/1689, which sets out the timetable for the application of the AI Act’s provisions, was amended as regards the dates of applicability of the rules concerning high-risk systems, postponing the full application of part of the obligations to later dates.[12]

As a result, in 2026 a multi-level regulatory architecture concerning a single device came into being. At European Union level, the European Commission set the strategic direction of the development of drone security policy through the non-binding Action Plan. At national level, Poland created a mechanism for the protection of critical infrastructure enabling the use of counter-drone measures. At the technological level, the AI Act laid down the principles of the responsible use of artificial intelligence systems employed in autonomous devices.

Three different regimes. Three different regulatory logics. And all of them concern the same device.

1.2 The paradox of acceleration

The history of military technology knows few moments in which the development curve breaks as abruptly as in Ukraine after 2022. Commentators[13] estimate that the technological leap[14] in the field of unmanned aircraft accomplished during two to three years of war would, in the absence of an arms race, have taken 20–30 years.[15] As to the period, it must be assessed that the thesis itself is fundamentally true, but the formulation “20–30 years” is not a scientific claim easily attributable to a single source. It is rather a metaphor used by military analysts, representatives of the defence industry and commentators, who describe a step-change acceleration of the innovation cycle under the influence of the war. In the space of only two to three years, drones travelled the road from specialised reconnaissance tools to mass-deployed combat systems, encompassing cheap single-use platforms, unmanned swarms, systems resistant to electronic jamming, and solutions using artificial intelligence. In the view of many military analysts, this conflict has shortened the development cycles of unmanned technologies in a way that, in peacetime conditions, would correspond to a multi-year or even multi-decade process of evolution.[16]

This paradox of acceleration has its source not in success but in failure.[17] The original plan of a lightning resolution – seizing the capital within a week and taking control of the south of the country – collapsed already in the cyber phase, when the operation intended to paralyse the digital administration, banking and state budget did not translate into the country’s military collapse. The result was a positional stalemate in the east – trench warfare reminiscent of the fronts of a hundred years ago.

And it was precisely this stalemate, not manoeuvre, that became the incubator of innovation. Tactical pressure in an environment in which neither side can gain a conventional advantage forced a cascade of technological solutions: from commercial observation drones, through mass-scale FPV drones, to satellite-controlled long-range platforms with elements of autonomy.

It is worth emphasising that this mechanism was to a considerable extent civilian in its genesis. The drone revolution did not come out of the laboratories of the great arms concerns, but out of the model-making market, out of commercial consumer electronics and out of open-source software. A manufacturer which in 2021 was selling a platform for power-line inspection was in 2023 delivering the same design with a different payload configuration. The law, which for two decades had been building separate regimes for civil aviation and for armaments, found itself confronted with a product that crosses that boundary without any design modification.

1.3 Thesis, research question and structure of the argument

For a lawyer serving entities in the high-technology sector, the paradox of acceleration has a practical dimension. It gives rise to the question that is the axis of this text: does law in this area merely react to a technology which the conflict has outpaced, or has it itself become an instrument of acceleration – and perhaps, in some segments, an instrument of its extinguishment.

The answer, which we substantiate in the remainder of this text, is: law performs three different roles simultaneously in this sector, and which of them is activated is decided not by the technology but by the qualification of the purpose of use. And that qualification is, in the case of dual-use products, inherently unstable.

The structure of the argument is as follows. Part 2 presents the technological taxonomy of drone warfare – without it, legal analysis operates in a vacuum, because each of the regulatory regimes attaches legal consequences to specific technical features (mass, range, presence of sensors, degree of autonomy, type of link). Part 3 maps the legal environment of the European Union and Poland, divided into nine pillars.

Part 4 analyses seven points of friction at which these pillars collide with one another – it is there that the undertaking’s real legal risk is concentrated. Part 5 formulates the thesis of the dual-track nature of the regime. Part 6 translates the analysis into transactional and compliance practice, together with a compliance calendar up to 2028.

2 · The Anatomy of Drone Warfare – a Technological Taxonomy

The point of departure for any legal analysis must be the differentiation of categories. It is a fundamental error – also in the regulatory debate – to treat the “drone” as a single class of devices. A more apt analogy here is to optics and photography: there is no single universal lens for every photograph, because each type of shot – macro, portrait, telephoto, wide-angle landscape – requires a different optical construction, a different focal length and a different compromise between reach and field of view. It is exactly the same with drones and counter-drone systems: there is no single “anti-drone system”; there are systems countering specific categories of platforms, matched to their signature, range and mode of communication. This differentiation is not merely descriptive but legal in character – it determines product qualification, the export regime and the scope of compliance obligations.

This differentiation has directly normative consequences. At the level of product qualification, the mass, construction and intended purpose of the platform determine its place in the EU UAV regime, in particular in Delegated Regulation (EU) 2019/945 and Implementing Regulation (EU) 2019/947, which treat product classes and the “open”, “specific” and “certified” categories of operations differently; in practice this means that the same aircraft may, as a product, remain in lawful civil circulation while at the same time, with a different mode of use or retrofitting, pass into the area of heightened regulatory risk. At the level of the export regime, the identical differentiation decides whether a component, software, sensor, communications module or navigation system falls within the scope of Regulation (EU) 2021/821 as a dual-use product, which may trigger an authorisation requirement, an end-user assessment and a proliferation risk analysis. At the level of compliance obligations, in turn, what matters are not only the physical features of the drone but also its data and autonomy functions: the presence of cameras, sensors or AI modules may in parallel trigger the requirements of the GDPR, cybersecurity, information security and – outside the scope of the military exclusion – the obligations arising from the AI Act. As a result, in the UAV sector it is not enough to ask “what is the product”; the key question becomes in what chain of use, circulation and liability the product operates.

The importance of this differentiation lies in the fact that, in the UAV sector, technical categories translate into different normative consequences in several overlapping legal regimes at once. First, at the level of product and operational qualification, features such as take-off mass, communications architecture, scope of autonomy or type of payload affect the classification of the platform in the light of Delegated Regulation (EU) 2019/945 and Implementing Regulation (EU) 2019/947, and thus the admissibility of its placing on the market and the mode of its lawful operation. Second, at the level of export control, the same features may determine whether specific components, sensors, navigation modules, software or technical documentation are covered by the regime of Regulation (EU) 2021/821, which triggers licensing obligations, end-user assessment and proliferation risk assessment. Third, at the level of functional compliance, what matters is no longer only the material features of the platform itself, but also its data-processing, observation and decision-support functions: the use of optical sensors, thermal-imaging sensors, remote identification systems or image-analysis algorithms may in parallel trigger requirements arising from the GDPR, cybersecurity regulation and – outside the scope of the military exclusion – the obligations laid down in the AI Act. In this sense, the legal qualification of a drone is not a one-off act but a multi-layered process, dependent on construction, function, context of use and the architecture of circulation.[18]

A separate phenomenon, irreducible to any of the above categories, is the drone swarm. Whereas the existing taxonomy ordered drones according to the features of a single platform – mass, range, mode of communication, degree of autonomy – the swarm is an emergent phenomenon at the level of many platforms operating as one system. Three elements are key here: iteration and coordination between units (drones exchange data on position, target and status in real time, often via a mesh network, with no single point of failure), distributed processing of sensor data (imagery and telemetry from many platforms are aggregated and classified jointly, which increases target-detection effectiveness beyond the sum of individual sensors), and collective control by a single operator or a supervisory algorithm which allocates tasks among the units of the swarm. Ukrainian deployments of this technology – including autonomous swarming systems used since 2025 for mine-laying and target engagement, and large-scale operations combining several dozen to several hundred platforms in a single strike – show that the swarm is no longer an experiment but an operational reality. This has serious legal consequences which remain unresolved to date: whether the swarm should be qualified as a single system subject to a single conformity assessment or as a collection of separate products; who bears responsibility for a decision taken at swarm level when no single platform takes it independently; and how the data protection and radio spectrum management regime is to treat a network whose nodes come into being and disappear in flight.[19]

This differentiation is not merely terminological or descriptive in character, but produces direct legal effects. The individual technical properties of an unmanned aircraft constitute the triggering conditions for different regulatory regimes of European Union law and national law. In practice, this means that a change in one technical parameter of a drone may lead to a fundamentally different legal qualification of the same device.

The first such parameter is the Maximum Take-Off Mass (MTOM). Commission Delegated Regulation (EU) 2019/945 establishes classes of unmanned aircraft systems (C0–C6), whose assignment takes place, among other things, with regard to technical parameters, in particular mass, speed and system equipment. This classification is not purely technical in character – it determines the possibility of conducting operations in the appropriate subcategories of the “open” category provided for in Commission Implementing Regulation (EU) 2019/947 and affects the manufacturer’s obligations connected with conformity assessment and product class marking.[20]

The significance of mass is also revealed at the level of the operator’s obligations. Under Article 14 of Implementing Regulation (EU) 2019/947, the operator of an unmanned aircraft system is subject to a registration obligation, inter alia, where it operates an aircraft with a maximum take-off mass of at least 250 g or – regardless of mass – an aircraft equipped with a sensor capable of capturing personal data, unless the device meets the conditions provided for toys within the meaning of Directive 2009/48/EC. The 250 g mass thus constitutes one of the fundamental legal thresholds in the European drone regulatory system.[21]

The second parameter of fundamental importance is the drone’s equipment with sensors enabling the capture of personal data, above all optical cameras, thermal-imaging cameras, LiDAR scanners or other devices allowing the identification of natural persons. In such a case, the General Data Protection Regulation (GDPR) applies. Data recorded by a drone may constitute personal data within the meaning of Article 4(1) GDPR, which entails the necessity of ensuring a legal basis for processing in accordance with Article 6 GDPR, complying with the principles set out in Article 5 GDPR and – in the case of operations creating a high risk to the rights and freedoms of natural persons – carrying out a data protection impact assessment in accordance with Article 35 GDPR. These obligations arise regardless of the mass of the aircraft, and therefore also in relation to the smallest drones weighing under 250 g, if they are equipped with devices enabling the capture of personal data.[22]

This approach is confirmed in the case law of the Court of Justice of the European Union. In its judgment of 11 December 2014 in Case C-212/13, Ryneš, the Court held that the recording of images enabling the identification of natural persons constitutes the processing of personal data, even if it takes place with the use of devices monitoring the surroundings of private property. Although the case concerned video surveillance, the conclusions flowing from that judgment apply mutatis mutandis also to unmanned systems equipped with cameras or other observation sensors.[23]

A further feature determining the legal regime is the character of the equipment and payload. Regulation (EU) 2021/821 of the European Parliament and of the Council establishes the Union’s system for the control of exports of dual-use items. The qualification of a drone or its components for the list of dual-use items is decided not only by flight parameters but also by the technical capabilities of the device, such as range, autonomy, navigation systems, observation equipment, high-resolution cameras, data transmission systems or specialised sensors. In consequence, two seemingly similar drones may be subject to entirely different export obligations solely on account of differences in their equipment or technical capabilities.[24]

Even more complex is the legal qualification of systems using artificial intelligence. The degree of flight autonomy alone does not automatically determine the applicability of the AI Act. It must first be established whether the given solution constitutes an “AI system” within the meaning of Article 3 of Regulation (EU) 2024/1689. Only at the next stage is it necessary to assess whether the system belongs to the high-risk category in accordance with Article 6 of that regulation and Annexes I and III. This means that two drones with identical flight parameters may be subject to different regulatory obligations solely on account of differences in the software responsible for autonomous navigation, object identification, image analysis or operational decision-making.[25]

In consequence, the legal qualification of an unmanned aircraft does not follow from a single technical feature, but from the configuration of its constructional, functional and operational properties. The same drone may simultaneously be subject to aviation law regulations, personal data protection provisions, the dual-use item control regime, provisions concerning the protection of critical infrastructure and – in specific cases – Regulation (EU) 2024/1689 (the AI Act). This signifies a transition from the classic model of sectoral regulation to a model of functional regulation, in which different branches of law simultaneously apply to the same device, protecting different legal goods: aviation safety, privacy, state security, control of trade in technologies and the safety of artificial intelligence systems.

2.1 · Observation drones – the foundation of situational awareness

The lowest tier consists of commercial multirotor drones (the Chinese DJI Mavic,[26] Ukrainian equivalents of the Zoom class). Their role is to provide situational awareness – the category that decides the success of every assault and every defence. A contemporary soldier with an overhead picture operates in an entirely different reality from one who scans the field with his eyes.

In the Ukrainian trade and military-technology discourse,[27] the designation ZOOM refers to a specific reconnaissance platform developed by the Ukrainian company Frontline / Frontline Robotics, presented as an alternative to the Chinese DJI Mavic drones. It is a light multirotor observation drone intended for reconnaissance tasks, fire correction and building situational awareness at the tactical level, and therefore for the same operational niche which for a long time was dominantly occupied at the front by Mavic platforms. In this sense, the “Ukrainian equivalent of the Mavic of the ZOOM class” should be understood not as a formal technical category but as the proper name of a domestic platform positioned in the segment of light reconnaissance drones with a substitutive function vis-à-vis DJI. The available sources[28] also indicate that ZOOM forms part of a broader Ukrainian trend of building domestic Mavic analogues in order to reduce dependence on foreign civilian commercial systems.

Importantly, despite rapid development these platforms have not disappeared – on both sides of the front, civilian Mavics are still used, whose sole task is to “hang in the air and watch”. This is an observation of primary legal importance: the most numerous category of platforms used in the conflict consists of mass-produced consumer products, placed on the market under the civil regime, with CE marking, in classes C0–C2. The same unit which yesterday was subject to Implementing Regulation (EU) 2019/947 as an operation in the open category is today carrying out a reconnaissance task outside any EU regime.

The DJI Mavic constitutes a model example of the detachment of the product from the purpose of use. As a commercial product, it was designed and placed on the market for the needs of the civil market: photography, inspection, surveying, recreation and light professional applications. In that order, its legal status is determined by the classic instruments of EU aviation law and product law – in particular the requirements of CE marking, the product classes under Delegated Regulation (EU) 2019/945, the operating rules under Implementing Regulation (EU) 2019/947, the operator’s obligations, remote identification, geographical zones, registration and – depending on the sensor configuration – data protection requirements. However, the moment that same unit is used on contested territory to build situational awareness, correct fire or conduct military reconnaissance, the logic for which the EU civil aviation regime was built ceases to operate. The product itself as a thing does not change, but its operational function changes, and with it the normative order changes: from the area of product safety and lawful civil operation we pass into the area of military operations, military logistics, the law of armed conflict, export control and state security. It is precisely for this reason that, in the UAV sector, the legal nature of a platform is increasingly determined not by its construction but by the chain of use into which it is incorporated.

A good counterpoint to this transformation is the example of the Ukrainian Mavic equivalents, such as the ZOOM developed by the above-mentioned Frontline Robotics. Where the manufacturer communicates[29] that a given complex has been entered in the NATO Codification System (NCS) and has received a NATO Stock Number (NSN), this means not so much the obtaining of civil certification as the product’s entry into the common language of NATO defence logistics: the item is unambiguously identified, classified and prepared to function within the system of supply, storage and military interoperability. The NSN is therefore a catalogue-logistics designation, not a mark of quality or an authorisation for marketing in the sense of consumer law or civil aviation law. The juxtaposition of the Mavic with a platform codified in the NATO system well illustrates the institutional shift: the first product begins its life in the regime of civil commercialisation, while the second is from the outset positioned as an element of the defence architecture and the military supply chain. This difference does not consist solely in technology, but in normative embedding – that is, in whether the product is designed for the civil market or for the order of military logistics and allied interoperability.[30]

2.2 · FPV drones – a squad weapon and the cost revolution

The current combat standard in the front-line zone is the FPV (first person view) drone – single-use platforms controlled from a first-person perspective through goggles. This is not, however, a weapon of the individual soldier: the operation of a single drone requires a team of 3–4 persons (pilot, relay operator, sapper, frequently a navigator). The FPV is a squad weapon, like a mortar or a heavy machine gun. One team is able to carry out 25–30 sorties a day, consuming a corresponding number of single-use platforms.[31]

The scale of this revolution has above all an economic and institutional dimension. It is no accident that industry analyses describe FPV as the “$1,000 revolution”: the essence of the breakthrough lies not solely in the platform itself, but in the relationship between the low unit cost of the means of attack and the high cost of countering it, as well as in the possibility of rapidly scaling production on the basis of a dispersed component market, a simple assembly architecture and short iteration cycles. In this sense, FPV is not merely a new category of drone but a new model of the economics of war – a model in which a relatively cheap, partly standardised and rapidly modifiable platform can generate tactical and operational effects disproportionate to its price. That is precisely why the weight of the analysis shifts from the question of the individual product to the question of the production ecosystem, the capacity for its continuous reproduction, and the institutional conditions that enable the transition from field improvisation to mass production.[32]

In the case of Ukraine, this capacity is no longer solely the effect of spontaneous industrial mobilisation, but results from the construction of an organised, state-supported defence tech ecosystem, centred on the Brave1 platform.[33] Brave1 was launched on 26 April 2023 as a governmental defence tech cluster, co-created by the Ministry of Digital Transformation of Ukraine, the Ministry of Defence, the General Staff of the Armed Forces of Ukraine, the National Security and Defence Council and the Ministry of Strategic Industries,[34] with the implementation layer carried out by the Innovation Development Fund. From a legal perspective, this is not a classic commercial-law company nor a single procurement procedure, but rather a public coordination platform combining grant, testing, matchmaking and acceleration functions. Officially, Brave1 describes its role as supporting the development of defence technologies through organisational, informational and financial support for projects, and the platform’s successive initiatives – including grant programmes, a defence innovation marketplace and projects carried out with international partners – show that it operates as an intermediate layer between the technological idea, the prototype, military testing, IP protection and further implementation into procurement or operational use. It is therefore an institutional mechanism for mobilising defence innovation, not a separate, homogeneous statutory regime.

The significance of Brave1 for the FPV market lies in the fact that this platform aggregates dispersed manufacturers and lowers the threshold of entry into the defence sector, shortening the road from design to implementation. Analytical sources indicate that around 1,500 defence tech companies and start-ups are gathered around Brave1, with some more recent analyses speaking of an even greater number of entities functioning within this ecosystem.[35] From the point of view of this report, however, more important than the number itself is that Brave1 produces an architecture of scale: new entities can enter the sector via a grant, testing, validation, contact with the military user, intellectual property protection and entry into the procurement circuit, without having to pass immediately through the classic, heavy model of the armaments industry. It is precisely this institutional model that explains why Ukraine was able to move from the early phase of improvisation and purchases from the commercial market to a phase in which drone production began to be treated as a mass state capability.[36]

The volumes of this production are unprecedented. Industry analyses and statements by representatives of the Ukrainian authorities cite figures of the order of about 800 thousand drones in 2023, about 2 million in 2024, production capacities reaching 4 million annually, and subsequently procurement plans covering about 4.5 million FPV drones in 2025. In parallel, declared targets for 2026 have also appeared in public circulation, according to which Ukraine would aim for a level of 7 million drones annually, presented as a volume many times exceeding American production. Even if the individual figures must be treated with caution and a distinction must be drawn between actual production, production capacity, procurement plan and political-industrial target, the direction itself is unambiguous: Ukraine has transformed drones – especially FPV – from an auxiliary technology into an industrial strategic resource, whose development depends no longer solely on the technical capability of an individual manufacturer, but on state-supported organisational, grant, testing and procurement infrastructure. In this sense, Brave1 operates as a multiplier of production sovereignty: it not only supports a specific project, but builds the conditions in which the entire sector can reproduce itself, scale and become independent of imports of ready-made platforms.[37]

In the legal and economic layer, it is particularly significant that Brave1 is not limited to the distribution of public funds from the Ukrainian budget. Over time, this platform has also been opened to international grants, partnerships with Western states and institutions, and channels of cooperation with the NATO procurement and interoperability environment. This means that the Ukrainian FPV market is today developing at the intersection of national law, mechanisms of public support for innovation, defence cooperation with foreign partners, and the wartime logic of rapid testing and deployment. From this perspective, the success of Ukrainian unmanned production should not be described solely as an industrial success, but also as a success in the design of institutional instruments which have made it possible to combine thousands of smaller entities into one functional ecosystem capable of delivering effects at the scale of millions of units annually.

The mass character of FPV production and the dispersal of suppliers in Ukraine are not solely a spontaneous effect of wartime mobilisation, but the result of the institutional ordering of the defence tech ecosystem. The importance of Brave1 lies precisely in the fact that this platform does not replace the individual manufacturer or the classic armaments industry, but creates an organisational framework within which hundreds – and, according to the available sources, around one and a half thousand – entities can function as elements of a single innovation-production system. From a legal and economic perspective, Brave1 is therefore not merely a sectoral cluster, but an instrument of the state ordering of defence innovation: it shortens the road from idea to test, from test to grant, from grant to implementation, and in the longer perspective – to an order or operational use. This architecture can be described most cleanly at three levels: institutional, project and operational.

1. The institutional level

At the institutional level, Brave1 functions as a governmental initiative / defence tech cluster of Ukraine, launched on 26 April 2023 and co-created by the key state organs responsible for security, defence and technology policy, in particular the Ministry of Digital Transformation of Ukraine, the Ministry of Defence, the General Staff of the Armed Forces of Ukraine, the National Security and Defence Council and the Ministry of Strategic Industries. The official description further indicates that the initiative is implemented by the Innovation Development Fund, which allows Brave1 to be treated as an instrument embedded at the interface of public administration, the security sector and state innovation policy. It does not follow from the publicly available materials that Brave1 is a self-standing entity established by a single separate statute or a single specific normative act; it is more accurate to conceive of it as a state coordination platform whose status results from the combination of the competences of public institutions and the implementation mechanisms of the innovation development fund. It is precisely this institutional embedding that explains why Brave1 was able to become a focal point for a broad ecosystem of drone manufacturers, including FPV platforms, instead of remaining merely a grant programme or a sectoral initiative of limited reach.

2. The project level

At the project level, the Brave1 cluster has been linked with the European Union-financed undertaking EU4UA Defence Tech, functioning publicly under the title “Strengthening the Innovation Capacities of the Ukrainian Defence Technological Industrial Base”. It follows from the available sources that this is not a self-standing act of secondary Union law of the kind of a regulation or directive, but an implementation and grant project, officially announced by the Delegation of the European Union to Ukraine within the EEAS structure, financed by the European Union and implemented by BRDO in cooperation with Brave1. In this architecture, Brave1 plays the role of the Ukrainian cluster and access point to the defence tech ecosystem, while the project layer gives this ecosystem an additional dimension of internationalisation, grant support and linkage with the policy of strengthening the Ukrainian defence technological and industrial base. The formal specification of this layer does not, however, take place through a single “founding act” of statutory or Union rank, but through a set of project and operational documents: the EEAS institutional communication, the BRDO project description and the regulations of the grant programme.

Particularly significant from the point of view of a legal report is that the project layer finds its concrete expression in the draft grant agreement concluded between the Innovation Development Fund and the beneficiary being the developer of a specific technology.[38] This means that entry into the Brave1 / EU4UA Defence Tech system does not lead directly to a relationship with a Union institution in the typical model of a European Commission grant, but to a contractual relationship governed by Ukrainian law with a public entity on the Ukrainian side. From this perspective, the project level of Brave1 should be understood as a space in which the dispersed sector of manufacturers – including creators of FPV technology – is drawn into a structured model of public support, but at the price of entering a specific contractual regime. Of particular importance here are the clauses concerning ownership and intellectual property rights: the draft grant agreement provides that ownership rights and rights to IP created with the use of grant funds as a rule remain with the developer, which at first sight may suggest a model friendly to commercialisation and to the retention of private control over the result of the project. At the same time, however, the same draft agreement grants the fund a broad, free-of-charge entitlement to use – at its own discretion – all documents and information obtained in the course of the granting of the grant, insofar as such use remains consistent with existing IP rights. This construction therefore does not lead to a simple takeover of IP by the state, but creates a hybrid model of control in which formal ownership remains with the developer, while the fund secures for itself a strong position of access and use in relation to the documentation and information connected with the project. In legal practice, this means that the key question is no longer only who owns the result, but also how broadly the scope of “documents and information” will be interpreted, what technical material is transferred to the fund, and where the boundary runs between the authorised use of documentation and indirect interference with the developer’s economic exclusivity (in accordance with Article 5(1) and (2) of the grant form: “Ownership rights and property rights to intellectual property created as a result of the use of Grant funds belong to the Developer, unless otherwise specified by the Developer.”; ”The Developer grants the Fund the right to use, free of charge and at its own discretion, all documents and information obtained in the process of providing the Grant, if such use complies with existing intellectual property rights”) (see footnote 38).

This tension is further reinforced by the clause on governing law and disputes, according to which the agreement is to be interpreted under the law of Ukraine, and any disputes are to be resolved first by way of negotiations and then in accordance with the procedure provided for by Ukrainian law and/or before a court. In the functional sense, Brave1 / EU4UA Defence Tech therefore remains an undertaking co-financed and politically legitimised by the European Union, but its contractual core – at least at the level of the relationship with the developer – has a clearly Ukrainian jurisdictional embedding. It is precisely this element that should close the analysis of the project level: Brave1 is not solely a mechanism for stimulating innovation, but also a system in which the Ukrainian state, through the innovation development fund and the contractual template, shapes the rules of access to technology, documentation and the results of R&D work. Thanks to this, the cluster can perform the function of a multiplier of mass and scale of production, but it does so in a formula which combines the retention of private intellectual property with a public safeguarding of informational and operational access. It is precisely this combination – and not the mere number of manufacturers – that explains why the dispersed market of FPV suppliers can be integrated into a single functional ecosystem of state-supported defence capability.[39]

3. The operational level

At the operational level, the basic source document is not a general political communication but the regulations of the grant programme, i.e. the Regulations for the Brave1 EU4UA Defence Tech Grant Program, made available in the Legal Terms section of the programme. It is precisely this document that constitutes the most useful source for practical analysis: it determines the framework of participation, the conditions of application, the function of grant support and the operational rules of the call within the initiative linked with EU4UA Defence Tech. In combination with the EEAS communication and the BRDO project description, this document creates the actual operational basis of the programme: the institutional communication legitimises the project and its financing by the EU, the project description indicates its purpose and place in the architecture of cooperation, while the grant regulations order the manner in which undertakings and technology teams can enter the support system. From the perspective of a legal report, it is precisely this operational layer that is key to understanding how dispersed manufacturers of FPV and other defence technologies have been gathered around a single cluster: not through an abstract political declaration, but through a set of specific procedures, grants, tests, validations and pathways to implementation. As a result, Brave1 operates as an institutional multiplier of production capability – it not only finances innovation but organises its transition into a mass state capability.[40]

The regulatory consequence of this scale is under-appreciated. Product certification regimes – both aviation and armaments – were built around the assumption of small-series production of goods with a long life cycle and high unit value. A model in which a platform comes into being within a week, is consumed within hours and undergoes continuous design modification in reaction to the adversary’s countermeasures is structurally incompatible with that assumption. No European conformity regime was designed for a product whose iteration cycle is shorter than the conformity assessment cycle.

That is precisely why the Ukrainian mass production of FPV should not be described solely as the result of wartime improvisation or of the cost advantage of a cheap platform over an expensive defensive effector, but also as the result of a consciously built institutional architecture in which Brave1 performs the function of a common node for the state, the military, grant-givers and the dispersed defence tech industry.[41]

2.3 · Communications, the radio horizon and relays

The effectiveness of FPV depends on communications to a degree perhaps greater than on the quality of the platform itself, and the absolutely fundamental category here is the radio horizon. The radio horizon is not a separate normative concept of EU law or of Polish aviation law, but a technical-operational category describing the limit of effective propagation of a radio signal in communications requiring a line of sight between transmitter and receiver. In practice, this means that the range of control and data transmission depends not only on the power of the devices, but also on antenna height, terrain obstacles, built-up areas, forestation and the shape of the terrain. The legal significance of this category is therefore indirect in character: the concept itself is not regulated as a statutory definition, but the phenomena it describes enter legal analysis through the regime of radio equipment, spectrum management, electronic communications, and the safety and reliability requirements for unmanned operations, especially BVLOS and within U-space.[42]

• BVLOS – flight beyond visual line of sight, i.e. beyond the operator’s visual range.
  In practice, it is precisely this category of operations that most needs stable, trusted and legally permissible relay infrastructure.
• U-space – simplifying, this is the digital drone traffic management environment, created so that a larger number of drones can fly safely, predictably and in an automated manner, especially in more difficult operations and denser airspace.

The control signal and image transmission in classic FPV systems require as clean a line of sight as possible, which is why their propagation is attenuated not only by buildings, forest walls or dense development, but also by the relief of the terrain itself: depressions, escarpments, embankments, forested ridges, rural development and all obstacles that “break” the connection between the operator and the platform. In the realities of the Russo-Ukrainian war, this means that the advantage does not follow solely from the flight parameters of the drone, but from the ability to raise the communications point above terrain obstacles and to maintain a stable transmission channel despite jamming, masking and target movement. Hence the great importance acquired by relays – signal repeaters mounted on masts, on ground vehicles, and most often on separate drones hovering higher than the combat platform. In the simplest variant, such a relay is a separate item of equipment, a kind of “communications superstructure” added to the system; in more advanced solutions, the relay function becomes part of a larger architecture, in which one drone carries the payload, a second observes, a third provides retransmission, and further nodes take over part of the traffic in a network model. This means that the relay need not be understood solely as a single device purchased separately – increasingly it is a separate technological layer, which may take the form of a radio module, an additional aerial platform, a ground set, or a node in a mesh network. It is precisely here that one of the most interesting trends appears: the transition from a single repeater to a layered architecture, and then to dynamic mesh networks, in which every modem or selected platforms can simultaneously transmit and repeat the signal, creating a self-repairing chain of communications. In such an arrangement, the radio horizon problem is no longer solved by a single device, but by a system of systems, functionally approaching a swarm with a division of roles. This in turn means that the most valuable IP in this segment may not reside in the airframe at all, but in the signal-routing algorithms, node switching, jamming resistance, bandwidth management and the integration of the relay function with the combat or reconnaissance role. Competitive advantage may here be protected as a patent, software, a trade secret or systemic know-how; in practice, value increasingly shifts from “the drone itself” to the communications and control architecture which allows the platform to operate effectively outside the classic line of sight. In this sense, the fight for advantage in the air simultaneously becomes a fight over who will build a higher-elevated, more resilient and more intelligently managed transmission network than the adversary.

This architecture has legal significance extending beyond the battlefield. Retransmission is in essence the construction of an ad hoc, mobile radio communications network – and thus an activity which, in the civil regime, is subject to electronic communications law, spectrum management and the requirements of Directive 2014/53/EU on radio equipment. The civil equivalent of this architecture – relay networks for BVLOS operations – is one of the fundamental implementation challenges of the U-space framework.

RED 2014/53/EU – this is the radio equipment regime, i.e. not only “does the drone work”, but whether its communications modules:

• lawfully use the spectrum,
• do not interfere with other systems,
• are safe and electromagnetically compatible.

The retransmission architecture has legal significance extending far beyond the battlefield, because from the civil perspective it in essence means the construction of an ad hoc, mobile electronic communications network for unmanned operations. What in wartime conditions takes the form of an improvised or semi-improvised radio bridge between operator and drone becomes, in the civil environment, a multi-layered issue: it concerns not only the aircraft itself, but also radio equipment, frequencies, electromagnetic compatibility, data integrity, network resilience and liability for the continuity of the communications service. For this reason, at least three legal orders enter here in parallel.[43] First, the law of electronic communications and spectrum management, because the relay is no longer merely “part of the drone”, but an element of transmission infrastructure affecting the radio spectrum and requiring conformity with the rules on the use of bands. Second, Directive 2014/53/EU (RED), i.e. the radio equipment regime, whose essence is to ensure that equipment uses the spectrum efficiently, does not interfere with the operation of other systems and satisfies safety and compatibility requirements. Third, the U-space framework, which is not “a single drone system” but a regulatory model of highly digitalised and partly automated management of a large number of unmanned operations, in particular also BVLOS (beyond visual line of sight) flights. Relay networks for BVLOS operations therefore in practice mean a model in which the continuity of the flight does not depend on a simple, linear operator-drone connection, but on an entire chain of communications services, identification, data transmission and coordination with the digital airspace. That is precisely why one of the main implementation challenges of U-space is not the mere fact that the drone flies beyond visual range, but who is responsible, and on what terms, for the communications layer sustaining such a flight: for the reliability of the channel, the interoperability of the equipment, information security, jamming resistance, cybersecurity and the technical conformity of the entire transmission chain. In civil conditions, the problem which at the front is solved by an improvised relay or a mesh network therefore becomes a regulatory problem of the highest rank: the question is no longer only whether the drone may fly, but whether there exists a lawful and secure communications infrastructure allowing it to fly outside the simple logic of direct contact.[44]

If, however, the relay and the mesh network[45] are an attempt to solve the radio horizon problem within the logic of radio emission, then fibre-optic drones represent an attempt to step outside that logic altogether. Whereas the relay architecture endeavours to elevate, stabilise and disperse the signal, the optical fibre eliminates the need for its emission in radio space, and thereby undermines a considerable part of the existing assumptions of both counter-drone technologies and regulation based on the detectability and jammability of the signal.

Mesh network, Shahed/Geran and the shift from loitering munition to a networked strike system

One of the most interesting and at the same time most disturbing phenomena of the current phase of the drone war is the transition from a simple point-to-point control model to a mesh network architecture, that is a lattice or grid network. Unlike the classic arrangement in which the operator communicates directly with a single platform or via a single relay, the mesh network consists of many nodes capable of simultaneously receiving, forwarding and amplifying the signal. Each such node can be part of a larger transmission system: a ground modem, an intermediate station, an observation platform or the drone itself. In practice, this means that communications do not depend on one channel and one transmission route, but can be dynamically reconfigured depending on which elements of the network remain active, where the platforms are located and what the jamming environment looks like. That is precisely why the mesh network is an architecture more resilient, flexible and difficult to disable than a classic linear connection. It is no longer a “link to the drone”, but a dispersed operational network.

In relation to heavy platforms of the Shahed/Geran type, such an architecture has breakthrough significance, because it blurs the boundary between a loitering munition and a network-controlled or network-supervised drone. Traditionally, loitering munitions are perceived as an essentially single-use means flying along a route programmed in advance or corrected to a limited extent. Meanwhile, equipping heavy drones with mesh modems, retransmission nodes and external relay points means that the system ceases to be merely a “blind carrier” executing a sequence of commands recorded once. It enters a more flexible model: it can maintain communications deeper over the adversary’s territory, benefit from mutual signal amplification, and in some configurations also from more up-to-date mission supervision. It is precisely for this reason that analysts speak of the blurring of the boundary between the classic loitering munition and the one-way attack UAV with elements of networked command. In other words: if the “Shahed” begins to function as part of a communications system, it ceases to be solely a single-use kinetic effect and begins to resemble a networked means of aerial attack, whose effectiveness depends not only on the airframe and warhead, but on the data transmission architecture.

This is very well illustrated by the Belarusian case from the beginning of 2026, when reports appeared in the analytical space of Russia’s use of relay stations and other network nodes supporting the flights of Shaheds operating from that direction, and subsequently of their elimination by the Ukrainian side.[46] Even if part of the details of those events remains based on front-line, technical and media sources rather than on full, open official material, the operational sense of such a solution is itself logical and coherent: if the platform is to fly deep, maintain communications and benefit from the effect of mutual retransmission, then the network cannot end at the drone itself. It must have external nodes sustaining the communications architecture, whether in the form of border stations, relay towers, ground amplification points or other supporting elements. The destruction of such nodes does not mean the destruction of a single drone, but a strike at the network layer which makes the entire system more dangerous. In this sense, Ukraine is not merely destroying the carrier of a warhead, but degrading the communications infrastructure of the attack.

Technologically, the most dangerous aspect is that the mesh network changes the logic of defence. In the classic model, it was enough to cut the connection, destroy the platform or jam a single channel. In the grid model, the adversary can attempt to:

• redirect traffic along another route,
• use other drones as relays,
• dynamically change the structure of communications,
• combine strike, reconnaissance and retransmission platforms into a single arrangement.

This in turn naturally brings such a system closer to a swarm with a division of roles. Not all platforms have to attack. Some may perform the role of:

• communications nodes,
• observers,
• decoys,
• retransmission carriers,
• elements building the resilience of the network.

This means that advantage increasingly depends not on a “better drone” but on a better systemic architecture. It is precisely here that IP of the highest value is born: not in the airframe itself, but in the modems, transmission protocols, routing algorithms, jamming resistance, throughput management, node authorisation and the integration of the relay role with the combat role. Solutions of this kind may be protected as a patent, software, a trade secret or systemic know-how. In practice, market and military value therefore shifts from the individual product to the network architecture, which may be more difficult to copy than the drone itself.

This shift also has very significant legal consequences. First, the mesh network is not directly a legal category of aviation law or EU drone law; it is above all a technical concept. However, its legal significance is indirectly enormous, because it describes the structure of communications on which the operation of unmanned platforms depends. The moment such a network is analysed outside the theatre of hostilities, we immediately enter the area of electronic communications law, spectrum management and the radio equipment regime. For if the effectiveness of the drone depends on a dispersed arrangement of transmitters, modems and relay nodes, then we are no longer dealing solely with an aircraft, but with regulated communications infrastructure. Here, Directive 2014/53/EU (RED) gains significance, because all radio transmission modules – especially when they form a system of mutual relays – must be analysed from the perspective of the efficient use of the spectrum, electromagnetic compatibility and equipment safety. In such a framing, the mesh network is not only a technical feature but a question of whether the radio network being built conforms to the rules on the use of bands and does not generate new risks for other communications systems.

Second, the mesh network has a cybersecurity and information security dimension. Every additional node means not only greater flexibility of the communications architecture, but also a greater attack surface: more points vulnerable to takeover, impersonation of an authorised element of the system, spoofing, jamming or the injection of false data. The injection of false data should here be understood as the introduction into the network of signals, messages or parameters which appear authentic but are intended to mislead the other nodes, cause an erroneous reconfiguration of connections, direct the platforms along another route or distort the picture of the operational situation. The more the system passes from a simple point-to-point connection to a dispersed lattice network, the more crucial becomes not the mere transmission of the signal, but trust in its source, integrity and authenticity. That is precisely why mesh technology shifts the analysis from the level of simple drone control towards the issues of node authorisation, data integrity and the resilience of the communications architecture to manipulation.

The legal dimension of this phenomenon is multi-layered. First, the more the effectiveness of the system depends on a multi-node transmission architecture, the less sufficient it is to treat it solely as an aircraft, and the more necessary it becomes to conceive of it as an element of regulated radiocommunications infrastructure – and thus also through the prism of the radio equipment regime, spectrum use and electromagnetic compatibility, with which the significance of Directive 2014/53/EU (RED) is indirectly connected. Second, the strategic value of the system shifts from the airframe itself to the modems, antennas, amplifiers, jamming-resistance systems and routing software, which reinforces their significance as dual-use components. Third, the mesh architecture creates the conditions for dispersed functional autonomy: it enables the redirection of the flight during the mission, the use of other platforms as relays, the dynamic alteration of the communications structure and the combination of strike, reconnaissance and retransmission platforms into a single arrangement. In the case of heavy Shahed/Geran drones, this leads to the blurring of the boundary between the classic loitering munition and a network-supported means of aerial attack. The reports of the use of external relay stations on the Belarusian direction and of their elimination by the Ukrainian side show well that the object of the fight is now not only the drone itself, but also the communications layer which sustains its operation. In this sense, the drone war simultaneously becomes a war for control over dispersed data transmission infrastructure.

In a dispersed communications system, security no longer depends on a single link, but on the integrity of the entire arrangement of mutual trust between nodes. This makes the legal analysis of such systems naturally shift also towards questions of:

• signal integrity,
• device authorisation,
• resistance to manipulation,
• the security of data transmitted between nodes,
• and, in the civil equivalent, also towards regimes functionally approximating the requirements imposed on high-risk digital infrastructure.

Third, mesh technology has an obvious significance for dual-use export control. While the airframe itself may be relatively simple, the true value and strategic sensitivity is concentrated in the communications components: modems, amplifiers, antennas, jamming-resistance systems, routing and network management software. It is precisely these elements that most easily move from the civil market to the military one and vice versa. In consequence, the components building mesh networks may be analysed not only as part of the end product, but as self-standing dual-use components, whose export, technical transfer and integration may be subject to a separate licensing and security assessment.

Fourth, the mesh network leads us to the boundary of the issues of AI and functional autonomy. The lattice network itself is not yet artificial intelligence, but when it begins to support:

• automatic selection of the signal route,
• adaptive node switching,
• coordination of multiple platforms,
• sharing of observations and targeting data,
• maintenance of the mission despite the loss of part of the system’s elements,

then in practice we approach an architecture in which operational decisions no longer flow solely from a direct human command, but from the dispersed operation of the system. This gives rise to the classic questions of responsibility, predictability and the qualification of such a network as an element of a more autonomous means of warfare. In the European context, this tension is particularly interesting, because civil applications of AI and communications are subject to ever greater regulation, while military applications of networked autonomy remain to a large extent outside the scope of the classic civil conformity regimes.

Finally, from the perspective of the law of armed conflict, the mesh network changes the very object of what is regarded as a significant component of combat capability. If the effectiveness of the system depends on a dispersed layer of relays, modems and relay stations, then the target of military significance becomes not only the drone itself, but also the communications infrastructure sustaining its operation. This shifts the analysis from the level of the individual effector to the level of the entire network architecture. One might say that, in such a model, the drone war is becoming to an ever greater degree a war for control over the aerial and border-zone tactical internet.

2.4 · Fibre-optic drones – the end of the jamming era

The breakthrough proved to be drones controlled by optical fibre – a spool of thin glass fibre unwound in flight. The solution has its costs (the mass of the fibre limits range, payload and manoeuvrability), but it eliminates two problems at once: the radio horizon ceases to matter, and the drone cannot be jammed, because it emits no radio signal. It is an electronically “mute” platform – practically undetectable by RF detectors and resistant to electronic warfare.

Fibre-optic drones appeared en masse in August 2024 in the Kursk area,[47] where Russian platforms of this type – with a range of over 30 km and a “crystal-clear” image – paralysed Ukrainian logistics along the sole supply route. As one Ukrainian medic put it, logistics simply collapsed, because fibre-optic drones were monitoring all the routes. By January 2026, fibre-optic variants accounted in some sectors for 30–50% of Russian FPV operations and around 15% of Ukrainian ones. In 2025, countering fibre-optic drones became the central theme of the NATO Innovation Challenge.[48]

The regulatory significance of this category is difficult to overestimate and remains unnoticed in the public debate. The entire European acquis on countering unauthorised unmanned operations – both technical and normative – rests on the assumption that the drone emits a radio signal.[49] On this assumption were built the remote identification requirement, RF detection systems, the jamming powers granted to the services and, from June 2026, to critical infrastructure operators. The fibre-optic platform invalidates each of those mechanisms simultaneously. Regulation aimed at a specific relay technology ages faster than the legislative process in which it comes into being.

2.5 · Electronic warfare and spoofing

Classic jamming consists in generating noise on radio frequencies so that the drone cannot distinguish the operator’s signal from the interference and loses control. For platforms flying to preset coordinates (deep strike), spoofing is used instead – the substitution of the satellite navigation signal, as a result of which the drone “thinks” it is somewhere else and corrects its flight in the wrong direction.

This distinction translates directly into the choice of defensive means – but also into legal qualification. Jamming is an interference with the radio spectrum, and thus with a good administered by the state and protected by electronic communications provisions; spoofing is an interference with the integrity of the signal of a satellite navigation system,[50] and thus with infrastructure of a global character, the disruption of which has effects far beyond the target. The side effects of both measures – loss of the GNSS signal by civil aviation, maritime transport, power grids synchronised by satellite time – are a classic example of damage in which establishing the causal link and the responsible entity is exceptionally difficult. We return to this issue in section 4.3.

2.6 · Heavy platforms – bombers, wings, loitering munitions

• Heavy bombers (Ukr. Vampire,[51] colloquially “Baba Yaga”[52]) – multirotors carrying anti-tank mines and performing logistics tasks (transport of ammunition, water, medicines). They require heavier means of engagement – 12.7/14.5 mm machine guns with thermal imaging.
• Light wings (Rus. Molniya[53]) – cheap long-range airframes, of low precision but mass-produced; they are sometimes armed with incendiary charges.
• Loitering munitions (Rus. Lancet,[54] Ukr. Bulava,[55] Pol. Warmate[56]) – advanced platforms for the elimination of artillery and anti-aircraft systems; difficult to shoot down owing to low-detectability materials and their flight profile.

The category of loitering munitions deserves separate legal attention. It is a construction at the boundary between an unmanned aircraft and a missile: a platform which remains in the task area for an extended time, searching for a target, and then carries out the strike. The blurring of the boundary between “aircraft” and “munition” has consequences in each of the regimes analysed – from classification on the control list of dual-use items, through the intra-EU transfer regime, to the question of the character of human control over the use of force.

2.7 · Deep strike and autonomy – Fire Point as a case study

The highest tier consists of heavy long-range platforms. The model example is the Ukrainian FP-1. The Ukrainian FP-1,[57] developed by Fire Point, is a one-way strike drone of light construction,[58] including fuselage elements made of plywood, powered by a two-cylinder engine; industry and media sources estimate its unit cost at approximately USD 55,000–58,000, i.e. significantly below the level of comparable systems. In mid-2025, a rapid increase in the scale of production was reported, already counted in hundreds of units weekly and over 100 units daily, and in July 2026 drones attributed to the FP-1 family were linked to the strike on the refinery in Omsk, one of the deepest Ukrainian long-range attacks.[59]

This case study is instructive for three reasons. First, it shows the inversion of the classic cost curve of the defence industry: a construction made of commercially available materials achieves an operational effect comparable to systems of many times higher cost. Second, it demonstrates the scalability of production outside the traditional armaments chain – growth from 30 to over 100 units daily within a few months is difficult under the regime of classic military certification. Third, this problem illustrates that range is not solely a technical parameter, but also a regulatory category. This follows from the logic of the Missile Technology Control Regime (MTCR), which – although it is not a classic international agreement in treaty form, but an informal export control regime based on common guidelines and a control annex – has long covered not only classic missiles but also unmanned aerial systems capable of carrying a payload over considerable distances. The most restrictive layer, i.e. Category I, encompasses complete rocket systems and unmanned aerial systems capable of delivering a payload of at least 500 kg to a range of at least 300 km, together with specified subsystems and technologies. This means that a platform with a range exceeding 2,500 km – even if it does not always satisfy every historical parameter of a classic missile system – enters the same type of strategic regulatory sensitivity which for decades has triggered the sharpest logic of proliferation control. In European practice, this logic was subsequently absorbed into the dual-use regime, in which references to the MTCR remain an element of the system of control of exports of technology and means of delivery (in EU law, the logic of the Missile Technology Control Regime (MTCR) was taken over into the system of control of exports of dual-use items primarily by Regulation (EU) 2021/821, which in recital 3 refers to the multilateral export control regimes, including expressly the MTCR, and then develops this logic operationally in Annex I, containing the EU dual-use control list). In this sense, great range is not merely an engineering feature, but a legally relevant feature, because from a specified threshold it triggers a normative order closer to proliferation control, export control and strategic security than to the ordinary regulation of a civil UAV.[60]

The boundary between control and autonomy is blurring. Placing a satellite communications terminal on a drone allows it to be controlled from enormous distances; the use of machine vision algorithms enables autonomous terminal guidance onto the target after loss of communications.[61] It is precisely this last feature – terminal autonomy, i.e. the capability to complete the task without a human in the decision loop – that is the heart of the legal problem to which we now turn.

Conceptual precision, usually lacking in the public debate, is worth preserving here. Autonomy is not a binary feature but a spectrum encompassing at least: (i) flight stabilisation and route keeping, (ii) navigation without a satellite signal using terrain image correlation, (iii) automatic detection and classification of objects, (iv) automatic tracking of a target designated by the operator in the terminal phase, (v) independent selection of a target within a designated area. Legal regimes – both the EU Artificial Intelligence Act and the discussion of autonomous weapon systems within the framework of the CCW Convention – react differently to each of these levels, and the distinction between (iv) and (v) is in practice the most difficult to prove in evidentiary proceedings and at the same time the most legally momentous.[62]

2.8 · The countermeasure layer – a C-UAS taxonomy

Symmetrically to the strike layer, the countermeasure layer (_counter-UAS_, C-UAS) has developed, which for the European civil market today has greater economic significance than the strike layer itself. Its taxonomy comprises two segments.

Detection and identification: radio sensors (monitoring of control and image-transmission bands), low-power radars, acoustic sensors, optoelectronic systems with a thermal channel, and – increasingly – fusion of data from multiple sensors with machine-learning-based classification. It is precisely in this segment that artificial intelligence performs a critical role, and it is precisely this segment that is fully civil, and therefore covered by the EU regime without exclusions.

Neutralisation: jamming of the control link and image transmission, spoofing of satellite navigation, taking over control of the platform, mechanical means (nets, including those launched from interceptor platforms), kinetic means (from smoothbore weapons to artillery systems with programmable ammunition), directed energy (lasers, high-power pulse) and interceptor drones.

This distinction is legally significant, because each of the effectors is subject to a different regime: jamming and spoofing fall under electronic communications law and spectrum management; kinetic means fall under the law on weapons and ammunition and liability for damage caused by falling debris; taking over control is an interference with an ICT system, and thus potentially an act criminalised under criminal law if it does not have an express statutory basis. A separate problem is that effective detection requires data processing – on which see section 3.7.

2.9 The kill chain and the place of the human in the loop

For the legal analysis of autonomy, it is indispensable to break the process down into links. Adopting a simplified model of the kill chain: a) detection b) identification and classification c) prioritisation d) engagement decision e) terminal guidance f) effects assessment. The debate on “meaningful human control” in essence concerns the question in which of these links the human takes the constitutive decision and whether at that moment he has information and time sufficient for that decision to be real rather than formal in character.

In the practice of contemporary drone operations: the first and second links are increasingly automated (image classifiers), the fourth link remains on the human side, and the fifth link is sometimes autonomous out of technical necessity – after loss of the link. Legally, this means that the “human in the loop” construction rests on a link of which the adversary consistently tries to deprive it. The argument that loss of communications is a technical circumstance and not a design decision loses its force at the moment when the manufacturer designs the platform on the assumption of operation in a heavily jammed environment.

An analogous structure – with different consequences – occurs on the civil side. Article 14 of the Artificial Intelligence Act requires that a high-risk system be designed so that natural persons can effectively oversee it, including understanding its limitations, correctly interpreting its output and deciding not to use it or to interrupt its operation. This requirement is technically identical to the postulate of meaningful human control – with the difference that on the civil track it is a legal norm backed by a sanction, while on the military track it remains the subject of unfinished international negotiations.

2.10 · The data layer – the drone as a sensory platform

The last layer, systematically omitted in technical analyses, is the data layer. Each of the platforms described is above all a sensor generating a stream of data: visual and thermal imagery, telemetry, position, radio spectrum parameters. The operational value of an unmanned system today lies to a lesser degree in the platform and to a greater degree in the chain of processing of those data – from transmission, through storage and annotation, to use in training image-recognition models.

From this arises a chain which crosses the civil-military boundary in both directions. Collections of recordings from combat operations constitute training material of a value impossible to obtain in laboratory conditions – and they are used to perfect classifiers, which subsequently find their way into civil systems (infrastructure monitoring, border protection, crisis management). In the other direction: models trained on civil collections of aerial imagery constitute the base for target-recognition systems.

This bidirectional flow is – as we demonstrate in section 4.5 – the area in which the EU data protection and artificial intelligence regimes come into contact with the defence exclusions in the manner that is legally most unclear and practically most momentous.

2.11 · The innovation spiral as a law of development

Drone warfare is a spiral process: each innovation provokes a countermeasure, and that forces the next innovation: the observation Mavic; drops; FPV; jamming; the relay; the optical fibre; satellite communications; satellite jamming; AI autonomy; interceptor drones.

For the regulator, this means that every norm aimed at a specific technology ages at the pace of that spiral. This is an argument in favour of regulation based on effects and on the level of risk, rather than on a catalogue of technical solutions – and at the same time an explanation of why acts based on risk classification (the Artificial Intelligence Act) have a greater chance of remaining current than acts based on product catalogues (dual-use control lists, classes C0–C6).

The legal environment of the UAV sector is not one act or one branch. It is a lattice of regimes, which it is worth ordering into nine pillars. Below, we furnish each of them both with its legal basis and with a practical “flavour” relevant to the servicing of entities in the sector.

The original version of this taxonomy comprised seven pillars. The extension by two further ones – personal data protection and data governance, and public international law – is not a tidying-up exercise. It follows from the observation made in section 2.10: since the value of the unmanned system has shifted from the platform to the data, the data regime has ceased to be a side issue and has become one of the two or three pillars determining the business model. International law, in turn, is the only regime which covers the space left by the defence exclusions of EU law – and therefore precisely the space in which the revolution described above is playing out.

3.1 · Pillar I – UAV categories and airspace

The core of the civil regime is formed by three related acts founded on the basic Regulation (EU) 2018/1139 (EASA): Delegated Regulation (EU) 2019/945 (product requirements, classes C0–C6, CE marking) and Implementing Regulation (EU) 2019/947 (operations in the open, specific and certified categories). The spatial layer is completed by the U-space package: Implementing Regulation (EU) 2021/664 together with 2021/665 and 2021/666.

The architecture of this pillar rests on two independent axes of qualification, the confusion of which is the most frequent error in the practice of the industry. The first axis – the product axis – concerns what the device is: classes C0–C6 lay down construction requirements, including the obligation to be equipped with a remote identification system and a geo-awareness function for the higher classes. The second axis – the operational axis – concerns what is done with it: the open category covers low-risk operations within visual range, the specific category requires an authorisation based on a risk assessment (the SORA methodology) or a declaration of conformity with a standard scenario, and the certified category brings the regime close to classic manned aviation.

The U-space layer, in turn, introduces mandatory services in designated airspaces: network identification, geo-awareness, traffic information and flight authorisation, provided by certified service providers.

The practical dimension is therefore that the regime is not static. Regulation 2019/947 has applied in its consolidated version since 1 May 2025, and the U-space framework was reinforced by Regulation (EU) 2023/203, which added information security requirements – risk assessment, management and incident response. Of key interpretative importance is therefore the revision of the Easy Access Rules for UAS of June 2026, consolidating the AMC/GM to Regulation 2019/947 (ED Decision 2025/018/R). From 1 January 2026, flights in standard scenarios require platforms holding a class C5 or C6 certificate. In a broader perspective, this confirms that in the UAV sector law does not end with the text of the regulation itself, but also functions in the executive, interpretative and operational layer. It is precisely at this level – through the AMC, GM and their consolidation in the Easy Access Rules – that general norms are translated into compliance practice, risk assessment, operational documentation and the everyday application of the law by operators, manufacturers, advisers and supervisory authorities. As a result, an analysis of the legal environment of drones requires account to be taken not only of the formally binding provisions, but also of how they are operationalised in executive and interpretative materials, because it is only there that the real regulatory weight of the sector is revealed. AMC (Acceptable Means of Compliance) and GM (Guidance Material) do not have the character of independently binding provisions of the rank of a regulation, but they perform a fundamental interpretative and practical function: they show how entities can demonstrate conformity with the requirements arising from Regulation (EU) 2019/947 and how authorities and operators should understand the individual obligations in operational practice. That is precisely why the Easy Access Rules for Unmanned Aircraft Systems are of such great importance for the UAV sector – they do not create new law, but order, consolidate and operationalise the normative material and its interpretation, becoming in practice the basic working tool for operators, manufacturers, advisers and supervisory authorities.[63]

A systemic remark: this entire pillar concerns civil aviation exclusively. Article 2(3)(a) of Regulation 2018/1139 excludes from its scope of application aircraft carrying out military, customs, police, search and rescue, firefighting, border control and coastguard operations. The first and most far-reaching defence exclusion therefore appears already at the level of the foundation, and not only in the Artificial Intelligence Act. This means that the boundary between the civil and the defence order is drawn already in the EASA basic regulation itself: it is that regulation which determines that the development, certification and operation of military unmanned systems are not subject to the EU regime of common civil aviation rules, but remain within the domain of the competence of the Member States, their defence policies and the relevant national security regimes. From the perspective of an analysis of the UAV sector, this is of fundamental importance, because it shows that the dual-track nature of the regime does not begin at the stage of AI, autonomy or export control, but already at the level of the most basic question of whether a given aircraft is subject to common European aviation law at all. In practice, this means that identical or nearly identical technology may be covered by the full civil conformity regime if it functions on the commercial market, while at the same time remaining outside that regime if it is incorporated into a military operation or one directly connected with it.

3.2 · Pillar II – Artificial intelligence and decision-making autonomy

Regulation (EU) 2024/1689 (the Artificial Intelligence Act, “AI Act”) introduces a risk-based classification: prohibited practices (Article 5), high-risk systems (Article 6 in conjunction with Annexes I and III), systems subject to transparency obligations (Article 50), general-purpose models (Articles 51–55) and the remainder, not covered by substantive obligations.

For the UAV sector, however, what is decisive is not what the act regulates, but what it does not regulate. Article 2(3) provides:

“This Regulation does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes.” – Article 2(3) of Regulation (EU) 2024/1689.

The consequence is paradoxical: a civil drone with AI is subject to the full high-risk regime, while a technologically identical platform used “exclusively” for military purposes remains outside the scope. The criterion is not the technology, but the purpose of use. Lethal autonomous weapon systems (LAWS) therefore remain outside the EU regime; the matter is the subject of international law and NATO doctrines, and the European Parliament has repeatedly warned against the Union’s regulatory backwardness in this area. The European Parliament was one of the earliest institutional actors to take up the subject of autonomous weapon systems and military AI, adopting already in 2018 a resolution on LAWS, and then in 2021 a resolution relating to artificial intelligence in the military and civil context.[64]

Key, however, is the word “exclusively”. Recital 24 of the preamble specifies that if the system is also used for purposes other than military, defence or national security – even temporarily and even by another entity – the exclusion does not apply to that extent. For a dual-use manufacturer, this means that the exclusion is not a feature of the product, but a feature of the specific placing on the market or putting into service. The same product series sold simultaneously to a military purchaser and to a critical infrastructure operator is, in the second case, subject to the full regime – and the manufacturer must be able to document this duality, separate the product lines and demonstrate it in the event of an inspection.

Qualification of a drone system as a high-risk system

In practice, the classification proceeds along two independent tracks:

• Article 6(1) (Annex I) – an AI system is high-risk if it constitutes a safety component of a product covered by the Union harmonisation legislation listed in Annex I, and that product is subject to third-party conformity assessment. Section B of Annex I expressly lists Regulation (EU) 2018/1139. This means that control software performing a safety function in a certified unmanned system may be a high-risk system on precisely this basis – a circumstance still under-appreciated in market practice, because the discussion concentrates almost exclusively on Annex III.
• Article 6(2) (Annex III) – covers, inter alia, the management of critical infrastructure, law enforcement, and migration management and border control. Drone systems used by border services or critical infrastructure operators fall here directly.

The consequence of qualification is the set of obligations under Articles 8–15: a risk management system, data and data quality governance (Article 10), technical documentation (Article 11), automatic recording of events (Article 12), transparency and information for the user (Article 13), human oversight (Article 14) and accuracy, robustness and cybersecurity (Article 15) – and, on the procedural side: conformity assessment, the EU declaration, CE marking and registration in the EU database.

The calendar – amended in June 2026

Market practice planned compliance for over a year around the date of 2 August 2026. That date has changed. On 19 November 2025, the Commission presented a simplification package (the Digital Omnibus), whose part concerning artificial intelligence – after the unsuccessful trilogue of 28 April 2026 and the political agreement of 6–7 May 2026 – was finally approved by the Council on 29 June 2026 (Parliament: 16 June 2026). The result is a postponement:

• obligations for standalone high-risk systems under Annex III – 2 December 2027;
• obligations for AI embedded in regulated products under Annex I (and thus, inter alia, unmanned systems) – 2 August 2028;
• transparency obligations under Article 50 – unchanged, 2 August 2026;
• Article 50(2) (marking of generated content) in relation to systems already present on the market, and the new prohibitions – 2 December 2026.

The postponement is conditional in character and is linked to a readiness mechanism: the registration of systems in the EU database and the availability of harmonised standards. The following, by contrast, apply unchanged: the prohibitions under Article 5 (from 2 February 2025), the AI literacy obligation under Article 4 (from 2 February 2025) and the general-purpose model regime (from 2 August 2025).[65]

In practice, the postponement is not a relief but a shift. The task which cannot be omitted or accelerated is the inventory of AI systems in the organisation and the assignment of each of them to the appropriate category – work independent of the state of the harmonised standards. In addition, the grandfathering principle applies: systems placed on the market before the date of application are not subject to the obligations until they are substantially modified – which, in a sector with an iteration cycle counted in weeks, is a guarantee of limited value.

3.3 · Pillar III – Dual-use products and export control

Regulation (EU) 2021/821 establishes the Union’s system for the control of exports of dual-use items; it entered into force on 9 September 2021, replacing Regulation (EC) No 428/2009, and has applied in its consolidated version since 15 November 2025. On 8 September 2025,[66] the Commission updated Annex I (the control list), covering emerging technologies – which directly affects drone components, electronics and AI software.

Four mechanisms of this regime are significant for the unmanned sector:

1. The control list (Annex I) – drone components are dispersed across several categories: electronics (cat. 3), sensors and lasers (cat. 6), navigation and avionics (cat. 7) and aerospace and propulsion (cat. 9). Qualification rarely concerns the platform as a whole – most often a single subassembly is decisive.

2. Catch-all clauses (Article 4) – the obligation to obtain an authorisation arises also for items not included in the list, if the exporter has been informed or is aware of an intended use connected with weapons of mass destruction, military purposes in a state subject to an embargo, or parts for armaments exported without authorisation. This is the instrument which in practice covers the largest number of drone transactions, because it operates independently of the list.

3. Control of intangible technology transfer (ITT) – the regime covers not only things, but also software and technology, including making them available by electronic means. In practice, this means that granting remote access to a code repository, transferring model weights[67] or placing technical documentation in a cloud outside the customs territory of the Union may constitute an export requiring an authorisation.

4. Cyber-surveillance items (Article 5) – a control mechanism covering items not included in the list, intended for surveillance, where there is a risk of use for human rights violations; it applies directly to advanced observation systems and image analytics.

The complementary layer is formed by: Directive 2009/43/EC on intra-EU transfers of defence-related products (simplified within the framework of the Defence Readiness Omnibus), the international regimes (the Wassenaar Arrangement, the MTCR – whose Category I traditionally covers unmanned systems with specified range and payload parameters) and, at national level, the Act of 29 November 2000 on foreign trade in goods, technologies and services of strategic importance.

IMPORTANT for M&A practice: in the due diligence of an entity in the drone sector, the qualification of components as dual use determines the export authorisation regime, the end-user and re-export prohibition clauses and – in real terms – the feasibility of the cross-border transaction. The disappearance of the commercial/combat boundary (a mass-produced observation drone converted into a combat platform without design changes) makes this qualification ever broader, and the regulatory risk ever more difficult to price. Particular attention is required in the situation where the purchaser is an entity from outside the Union: the mere transfer of technical documentation in the company examination process may require an authorisation before the agreement is even concluded.

3.4 Pillar IV – Defence financing and procurement (the driver)

This is the pillar in which law performs the function of a driver. The EU instruments do not react to technology – they create demand, direct the stream of public funds and establish the framework for joint production and procurement:

•      The European Defence Fund (EDF)[68] – co-financing of joint defence research and development projects, lowering the industry’s investment risk.

• EDIRPA (Regulation (EU) 2023/2418) – support for common defence procurement.[69]
• ASAP[70] – the regulation on supporting ammunition production: increasing the production capacities of industry; a logic fully transferable to the mass production of loitering munitions and drones.
• SAFE (Security Action for Europe, 2025)[71] – a loan instrument with procurement to be carried out by the end of 2030.
• EDIP – the European Defence Industry Programme, together with the construction of SEAP (Structure for European Armament Programme) as a voluntary legal framework for the long-term cooperation of Member States across the entire life cycle of a defence product.[72]

The superstructure of these instruments is the Defence Readiness Omnibus[73] of 17 June 2025 – a legislative and non-legislative package intended to remove administrative barriers to defence investment estimated at EUR 800 billion over a four-year perspective. It includes, inter alia, accelerated authorisation procedures for defence projects with a single point of contact, extension of the maximum duration of framework agreements to ten years, simplification of intra-EU transfers of defence products (where delays reached a year), clarification of the defence exclusions in chemicals legislation (REACH, CLP, biocidal products) and – which is particularly significant for financing – a communication clarifying the application of the sustainable finance framework to the defence sector. In June 2026, the co-legislators reached a preliminary agreement on the procurement part of the package, extending the increased EDF financing to actions carried out within the framework of SEAP and permitting the eligibility of the costs of tests conducted in Ukraine.

A separate, younger layer is formed by the four flagship projects[74] of the Readiness Roadmap 2030: the European Drone Defence Initiative, Eastern Flank Watch, the European Air Shield and the European Space Shield. EDDI – originally communicated as the “drone wall” – is to create a multi-layered network capable of detecting, tracking and neutralising hostile platforms, while preserving a dual-use dimension allowing civil applications (border protection, disaster response). The assumed timetable: launch in Q1 2026, initial capability by the end of 2026, full functionality by the end of 2027 (Eastern Flank Watch – by the end of 2028). They are complemented by the Action Plan on drone and counter-drone security of 11 February 2026 and the Drone Alliance with Ukraine, together with the announcement of the allocation of EUR 6 billion from the interest on immobilised Russian assets to support Ukrainian drone production.

The market confirms the direction: over a twelve-month horizon, autonomous drones attracted around USD 6.2 billion in 169 transactions, driving a 139-per-cent increase in defence robotics financing. Analysts at the same time point to the gap between the “battle-tested” Ukrainian ecosystem and the capital actually flowing in – a field in which legal advice and transaction structuring become critical.

The practical dimension: participation in the driver instruments has a legal price which must be factored in at the stage of structuring the consortium. The EDF and EDIP regimes contain extensive provisions on rights to the results of the project, access to existing knowledge (background) and generated knowledge (foreground), export restrictions on results and requirements of control over the entity (registered office in the Union, absence of third-country control or effective mechanisms for its limitation). For a company with capital from outside the Union, eligibility can be illusory if the ownership structure is not appropriately arranged in advance.

3.5 · Pillar V – Satellite communications (IRIS²)

Regulation (EU) 2023/588 establishes the Union’s secure connectivity programme for 2023–2027 and the IRIS² constellation (Infrastructure for Resilience, Interconnectivity and Security by Satellite). It is the sovereign European answer to dependence on commercial satellite systems, whose role in the control of long-range drones was revealed by the conflict.[75]

Law here builds the physical layer on which the future generation of satellite-controlled platforms will rest – a classic infrastructural driver. The significance of this pillar is, however, deeper than technical: the experience of recent years has shown that a private satellite operator’s decision on coverage or on refusal to provide the service in a given area may have operational effects comparable to a decision of a state. The construction of a public capability is the answer to a problem which should be called the privatisation of communications sovereignty.

3.6 · Pillar VI – Critical infrastructure, cybersecurity and product resilience

Since the first phase of the conflict was cyber warfare, the pillar of digital and physical resilience has systemic significance. It is formed by three acts of differing logic:

• Directive (EU) 2022/2555 (NIS2)[76] – raises the common level of cybersecurity, extending the circle of essential and important entities and the obligations of risk management, incident reporting and the responsibility of management bodies. It covers, inter alia, air transport, energy, digital infrastructure and – which is significant for the sector under discussion – the manufacture of products, including electronic devices. NIS2 shifts the weight from “IT security” itself to risk management at the level of the entire organisation, including the responsibility of management, incident reporting obligations and the requirement of operational resilience for entities operating in critical and technologically sensitive sectors.
• Directive (EU) 2022/2557 (CER)[77] – regulates the resilience of critical entities in the physical and organisational dimension: the identification of critical entities, risk assessment, resilience plans, personnel security vetting. The key significance of CER lies in the fact that it concentrates not on cyberspace, but on the physical and organisational resilience of critical entities, and thus on the capability to maintain continuity of operation despite an attack, sabotage, disruption or infrastructural crisis.
• Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA)[78] – the youngest act and, in practice, the most burdensome for manufacturers. It establishes horizontal cybersecurity requirements for products with digital elements, and thus for drones, ground controllers, detection systems and software. It imposes obligations of secure design, vulnerability management throughout the support period, provision of a software bill of materials (SBOM) and reporting of actively exploited vulnerabilities and serious incidents. The reporting obligations apply from September 2026, and the entirety – from December 2027. The most momentous element of the CRA is that, for the first time, it imposes on manufacturers of products with digital elements a continuous cybersecurity obligation throughout the product’s entire life cycle, encompassing secure design, vulnerability management and response obligations also after the product’s placing on the market.

Both directive-form acts (NIS2, CER) require national transposition – which shifts the weight to the Polish level, discussed in Pillar IX.

The practical dimension: the convergence of the three regimes means that a manufacturer of a drone system for a critical infrastructure operator may simultaneously: (i) be subject to the CRA as a manufacturer of a product with digital elements, (ii) be an important entity within the meaning of NIS2 by virtue of its own manufacturing activity, and (iii) be covered by requirements arising from the obligations of its client under CER and NIS2, passed down contractually within the framework of supply chain risk management. Three regimes, three separate calendars, three separate sets of reporting obligations – while the event that triggers them is one.

3.7 · Pillar VII – Personal data and data governance

This is a pillar systematically omitted in analyses of the defence sector, and at the same time the one which in practice most often blocks civil deployments. This follows from the observation made in section 2.10: the drone is above all a sensor, and a sensor turned towards the surface of the earth in an urbanised environment almost always records personal data.

Regulation (EU) 2016/679 (GDPR) applies to the processing of imagery from an unmanned platform on general principles, whereby in practice four issues are decisive:

• Scope of application. Article 2(2)(a) and (b) excludes processing in the course of an activity which falls outside the scope of Union law and within the framework of the common foreign and security policy. National security remains the competence of the Member States (Article 4(2) TEU). There thus arises – symmetrically to Article 2(3) of the Artificial Intelligence Act – a second defence exclusion, with differently drawn boundaries.
• Legal basis and transparency. The information obligation under Articles 13–14 is difficult to perform in a real manner in aerial operations; practice relies on area-based information, signage and the publication of flight plans, which the European Data Protection Board analysed in Guidelines 3/2019 on the processing of personal data through video devices.
• Data protection impact assessment (Article 35). Systematic monitoring of public space on a large scale with the use of new technologies falls within the typical criteria of a mandatory impact assessment; in Polish practice, the list of operations requiring a DPIA maintained by the supervisory authority includes monitoring with the use of drones.
• Special categories (Article 9). The processing of facial imagery for the purpose of the unique identification of a natural person constitutes the processing of biometric data; in combination with Article 5 of the Artificial Intelligence Act (the prohibition of real-time remote biometric identification in public space for law enforcement purposes, subject to exceptions), this creates a double barrier for observation systems with facial recognition.

For operations conducted by the services, the appropriate regime is Directive (EU) 2016/680 (the so-called Police Directive), transposed in Poland by the Act of 14 December 2018 on the protection of personal data processed in connection with the prevention and combating of crime.

A separate, younger layer is constituted by the governance of non-personal data. Regulation (EU) 2023/2854 (the Data Act), applicable from 12 September 2025, covers “connected products” – that is, devices generating data on their use and environment, to which unmanned systems belong directly. It imposes obligations to make data available to the user and to third parties designated by the user, and limits the freedom to shape contracts in this respect. Regulation (EU) 2022/868 (the Data Governance Act), in turn, creates the framework for the re-use of public sector data and data intermediation.

Finally, Article 10 of the Artificial Intelligence Act introduces quality requirements for the training, validation and testing data sets of high-risk systems – representativeness, relevance, examination for systematic errors. These requirements overlap with the GDPR regime in a manner which is sometimes a source of practical contradictions: the obligation to examine bias sometimes requires the processing of special-category data, the processing of which the GDPR as a rule prohibits. This issue is the subject of work on the data part of the Digital Omnibus.

Legislative status: in contrast to the part concerning artificial intelligence, the part of the simplification package covering the GDPR, the ePrivacy Directive, NIS2, the Data Act and DORA remains at the negotiation stage. At the end of June 2026, the Cypriot Presidency withdrew the compromise text from the approval procedure in COREPER II in the absence of a qualified majority; the file was taken over by the Irish Presidency. The European Data Protection Board and the European Data Protection Supervisor expressed, in Joint Opinion 2/2026 of 11 February 2026, decided opposition to the proposed narrowing of the definition of personal data. Until formal adoption, the existing state of the law applies – the contrary assumption is at this moment the most frequent error in compliance planning (The legislative status remains unclosed: in contrast to the part of the simplification package concerning artificial intelligence, the component covering the GDPR, privacy and electronic communications, NIS2, the Data Act and DORA still remains at the negotiation stage. It is officially known that the EDPB and the EDPS, in Joint Opinion 2/2026 of 11 February 2026, expressed substantial reservations about the proposed changes, including the narrowing of the definition of personal data. Expert sources further indicate that at the end of June 2026 the Cypriot Presidency withdrew the compromise text from the approval procedure in COREPER II in the absence of a qualified majority, which means that until formal adoption the existing state of the law continues to apply.[79]).

3.8 · Pillar VIII – Public international law and autonomous weapon systems

The space left by the defence exclusions of EU law is not a lawless space. It is filled – with varying effectiveness – by three regimes of international law.

International aviation law. The Chicago Convention of 1944 excludes state aircraft from its scope (Article 3), requires special authorisation for flights of pilotless aircraft over the territory of another state (Article 8) and – in Article 3 bis, added in 1984 – confirms the obligation to refrain from resorting to the use of weapons against civil aircraft in flight. This construction arose in a world in which the distinction “civil/state aircraft” was possible visually and procedurally. Applying it to an object with a wingspan of two metres, without markings, crossing the border unannounced, is a task for which the treaty was not designed.

International humanitarian law. The principles of distinction, proportionality and precautions in attack apply regardless of whether the decision on the use of force is taken by a human or assisted by an algorithm. Article 36 of Additional Protocol I of 1977 imposes on the parties the obligation to review new weapons, means and methods of warfare for their compatibility with international law – this provision is today the only universally binding instrument that covers autonomy in armaments, although it does so indirectly.[80]

The CCW process and the UN forum. The Group of Governmental Experts on lethal autonomous weapon systems (GGE on LAWS), operating since 2016 within the framework of the Convention on Prohibitions or Restrictions on the Use of Certain Conventional Weapons, has been working since 2024 on the so-called rolling text, encompassing elements of a potential instrument based on a two-tier approach of prohibitions and regulation. At the September 2025 session, a group of 42 states – one third of the parties to the Convention – declared readiness to move to negotiations on the basis of that text. On 6 November 2025, the UN General Assembly adopted, for the third time in succession, a resolution on autonomous weapon systems, supported by 156 states. The UN Secretary-General and the President of the International Committee of the Red Cross jointly called for the conclusion of negotiations on a legally binding instrument by the end of 2026. The Seventh CCW Review Conference, planned for November 2026, is the moment at which it will be decided whether a negotiating mandate will come into being – whereby the consensus rule applicable in that forum makes this outcome uncertain.[81]

The NATO layer comprises the principles of the responsible use of artificial intelligence in defence adopted in 2021 (lawfulness, accountability, explainability and traceability, reliability, governability, bias mitigation) and the revised AI strategy. These are not legally binding norms, but they constitute a point of reference for contractual requirements in allied procurement – and in this sense they affect industry more strongly than many a legal act.[82]

3.9 · Pillar IX – The Polish level

The Polish regime combines directly applicable EU regulations with national statutes and operational provisions. The Regulations (2019/945, 2019/947, 2021/664, 2021/821, 2023/588, 2024/1689, 2024/2847) apply directly; the directives (NIS2, CER) require transposition.

The aviation layer. The national basis is formed by the Act of 3 July 2002 – Aviation Law, substantially amended by the Act of 24 January 2025, which entered into force on 27 February 2025. The amendment adapted national law to the EU regime and introduced, inter alia: a register of operators of unmanned systems (a registration obligation for platforms of at least 250 g and – regardless of mass – those equipped with sensors capable of collecting personal data), the statutory empowerment of the Polish Air Navigation Services Agency to designate geographical zones, the extension of the catalogue of services entitled to check pilots, the lowering of the minimum age of a pilot in the open category from 16 to 14 under supervision, and a chapter devoted to the prevention of the unlawful performance of operations with the use of unmanned systems. Notification of the intention to perform an operation takes place through the DroneTower application, integrated with the PANSA UTM system and the National Drone Information System (KSID). The legal basis for the neutralisation of a platform remains Article 156ze of the Aviation Law (destruction, immobilisation or taking over control of the flight), supplemented by the provisions of the chapter on the prevention of unlawful operations.

Institutionally, this layer is completed by the Act of 8 December 2006 on the Polish Air Navigation Services Agency (Journal of Laws of 2025, item 1267), extended by the Agency’s competences in the area of unmanned systems, including the possibility of providing services to operators, supporting the testing of new solutions and creating special-purpose companies. Supervision is exercised by the President of the Civil Aviation Authority.

The resilience and countermeasure layer. The breakthrough is the Act of 29 May 2026 amending the Act on Crisis Management and certain other acts (Journal of Laws of 2026, item 815), implementing the CER Directive. Its significance for the sector under discussion extends far beyond its declared purpose:

• Critical infrastructure operators have obtained the right to apply countermeasures against unmanned platforms, including jamming devices. Until now, a private entity managing a strategic facility could only await the intervention of the services; it can now itself interrupt communications with the intruder. The power entered into force on 26 June 2026.
• The catalogue of authorised formations (the Police, the Border Guard, the State Protection Service, the Military Gendarmerie) obtained competences to destroy, immobilise or take over control of unmanned surface/floating objects and robots and autonomous vehicles moving on land, where they create a threat to critical infrastructure. The new Chapter 6a of the Act, modelled constructionally on the provisions of the Aviation Law concerning aircraft, extends the counter-drone regime to the maritime and land domains.
• The Act further introduces an obligation of security audits, mechanisms for the protection of supply chains, and establishes the Maritime Security Centre.

The defence layer. It is formed by the Act of 11 March 2022 on the Defence of the Homeland – the national framework for the acquisition and operation of unmanned and counter-drone systems, together with the procurement regime in the fields of defence and security.

The direction of change. This area is evolving intensively in the years 2024–2026 and requires ongoing verification of the entries in the Journal of Laws and of legislative drafts. After a period of tightening of administrative sanctions, assessed by the operator community as disproportionate, the Civil Aviation Authority transmitted to the Ministry of Infrastructure on 5 May 2026 a draft amendment of a deregulatory and ordering character, covering the system of penalties, insurance, mandatory notifications, the securing of critical infrastructure and counter-drone systems. Entry into force is announced for the turn of 2026 and 2027. In parallel, work is under way on the full transposition of NIS2 within the framework of the amendment of the Act on the National Cybersecurity System.[83]

4 · Seven Points of Friction

The pillars described in Part 3 do not form a coherent system. They come into contact with one another at points where their assumptions are mutually contradictory, and the resolution of the collision does not follow from any of them. It is precisely at these points that the undertaking’s real legal risk is concentrated – and it is they, not the content of the individual acts, that should set the agenda of legal advice.

4.1 · The “exclusivity” test – the military exclusion in relation to a dual-use product

The exclusion in Article 2(3) of the Artificial Intelligence Act operates on the condition of the exclusivity of the military, defence or national security purpose. This construction assumes that the purpose can be unambiguously assigned to the placing on the market or the putting into service. In the dual-use sector, this assumption is empirically false: the same machine vision module may be sold to the manufacturer of a power plant perimeter protection system and at the same time integrated into a military platform.

The practical consequences are three. First, the burden of demonstrating exclusivity rests on the entity that invokes it – and demonstrating a negative fact (the absence of civil application) requires documented control of the distribution channel and end-user clauses. Second, the exclusion relates to the system, not to the undertaking: a company may simultaneously be a provider of a high-risk system and a provider of an excluded system. Third, modification of the intended purpose after placing on the market changes the regime – and in a sector in which the end user routinely modifies the platform, this is a real risk, not a hypothetical one.

The practical recommendation is unambiguous: the separation of product lines at the documentary, contractual and – as far as possible – technical level, before the first mixed contract comes into being. Untangling this situation later is costly, and in the course of a company examination it is sometimes impracticable.

4.2 · Human oversight: two regimes, one technical requirement

Article 14 of the Artificial Intelligence Act and the postulate of meaningful human control in humanitarian law[84] describe the same property of a system – the human’s capability to understand, verify and interrupt the operation of the automaton – but have an entirely different normative status. On the civil side, it is a legal obligation with an administrative sanction and a documentation requirement. On the military side – the subject of unfinished negotiations.

From this arises an asymmetry with industrial effects: a manufacturer that builds one technical platform for both tracks must design to the stricter requirement, because it cannot foresee in advance in which track a given unit will end up. Consequently, the civil requirement becomes the de facto design standard also for excluded applications – a mechanism worth calling the standard-transfer effect. This is one of the few situations in which the defence exclusion operates to the benefit, rather than to the detriment, of the coherence of the system.

The converse mechanism is, however, equally real: operational pressure to shorten the decision chain in a heavily jammed environment leads to constructions in which human oversight is formally preserved but in fact illusory – the operator approves a decision which he had neither the time nor the data to assess. Demonstrating such a situation in evidentiary proceedings requires access to event logs, which Article 12 of the Artificial Intelligence Act requires only on the civil side.

4.3 · Jamming as a legally regulated activity

The jamming power, granted in Poland to critical infrastructure operators from June 2026, is an example of a norm which solves one problem and opens three further ones.[85]

Jamming devices are, as a rule, inadmissible for marketing and use: they do not satisfy the essential requirements of Directive 2014/53/EU on radio equipment (harmful interference), and their use violates the spectrum management regime. The grant of a statutory power removes the unlawfulness of the act itself, but does not settle liability for side effects. Interference in the bands used by satellite navigation systems affects civil aviation, transport, telecommunications networks and – which is sometimes overlooked – energy infrastructure synchronised by satellite time. Questions therefore arise as to: (i) the compensation liability regime of the facility operator towards third parties, (ii) the delimitation of liability between the operator and the manufacturer of the device, (iii) the documentation obligations allowing the course of the event to be reconstructed.

To this is added a third problem, described in section 2.4: the legal measure was granted at the moment when the technology against which it is effective is in retreat. The fibre-optic platform is resistant to jamming by definition. The norm responds to the state of the art of two years ago.

4.4 · Kinetic neutralisation and liability for damage

Shooting down or immobilising a platform does not end the event – it begins the fall of a mass with kinetic energy over terrain which is usually precisely what was to be protected. Polish law provides a basis for neutralisation (Article 156ze of the Aviation Law, the provisions of the chapter on the prevention of unlawful operations, the new powers under the Act of 29 May 2026), but the regime of liability for damage caused as a result of lawful neutralisation remains dispersed between the liability of the State Treasury for acts of public authority, the general rules of tortious liability and the special provisions on damage caused by the movement of aircraft.

A separate issue is the qualification of independent neutralisation by an unauthorised entity. The shooting down of a drone by the owner of the property over which it is flying is not the exercise of the right of ownership – it is the destruction of another’s thing and, depending on the circumstances, the creation of a danger. Judicial practice in this area is already taking shape.

4.5 · Battlefield data as training material

This is the most under-defined point of the entire map. Collections of recordings from combat operations – visual and thermal imagery from thousands of sorties – have a training value unattainable in laboratory conditions. They flow, formally and informally, in both directions across the civil-military boundary.

The legal issues arrange themselves in three layers. Data protection: material of this kind contains the images of natural persons; processing in the course of hostilities falls within the exclusion of Article 2(2) GDPR, but the use of the same collection by a commercial entity to train a model intended for the civil market no longer does – and determining the moment at which the data “enter” the scope of application of the regulation has no unambiguous normative answer. Data quality: Article 10 of the Artificial Intelligence Act requires that the training data sets of high-risk systems be representative and free of systematic errors; a collection originating from one theatre of operations, one season of the year and one type of terrain does not satisfy that requirement, which has a direct bearing on the reliability of classifiers in civil applications. Export control: the weights of a model trained on such a collection may constitute controlled technology, and making them available outside the customs territory of the Union – an export requiring authorisation (cf. section 3.3, point 3).

The practical recommendation: in every transaction concerning an entity possessing vision models, the provenance of the training data sets must be established and documented in a manner allowing the lawfulness of the chain to be demonstrated. This is today one of the most frequently omitted – and most difficult to repair after the fact – elements of a company examination.

4.6 Intangible technology transfer and the dispersed working model

The export control regime is not limited to the physical movement of goods across the border. Within the meaning of Regulation (EU) 2021/821, “export” also includes the transmission of software or technology by electronic means – inter alia electronic mail, telephone or other electronic means – to a destination outside the customs territory of the Union. Making such software or technology available in electronic form to natural or legal persons located outside the customs territory of the Union is also deemed to be an export. In consequence, granting a foreign engineer, consultant or potential investor the ability to download controlled files from a repository may constitute an export, even if the data at all times remain saved on the same server and the access was remote and short-lived.[86]

This does not, however, mean that every making available of source code outside the Union automatically requires an authorisation. It must first be established whether the software or technical information in question has been included in the list of dual-use items in Annex I to Regulation 2021/821, or whether the conditions for the control of unlisted items are met on account of their intended end use or end user. In the unmanned aircraft sector, this assessment may concern both the design of the drone itself, its subassemblies and equipment, and the dedicated software and the technology necessary for their development, production or use. Potentially significant will be, inter alia, design documentation, aerodynamic models and simulations, control system diagrams, autopilot code, solutions concerning autonomous navigation, sensor integration, encrypted communications or jamming resistance. The classification should, however, refer to the parameters and criteria of the specific control entry, and not solely to the fact that the given technology is connected with drones.

The risk of intangible technology transfer arises above all in three configurations: (i) in a geographically dispersed development team including persons working from third countries; (ii) in the due diligence process, if the advisers or technical experts of a potential purchaser from outside the Union receive access to the repository, the design documentation or the test environment; and (iii) in the use of cloud infrastructure, if the data are transmitted to servers located outside the Union or can be accessed from there. The mere decentralisation of infrastructure, the use of blockchain technology or the storage of data in the cloud do not yet determine the occurrence of a controlled export. What matters above all is the content of the data, their export classification, the location of the recipient and whether the entity from outside the Union has obtained a real possibility of acquainting itself with the controlled technology. In the case of dispersed data storage, an additional problem may be the impossibility of reliably establishing in which states the individual nodes or copies of the data are located.

For this reason, control of access to repositories containing drone technologies should be an element of the internal export compliance programme, and not solely a cybersecurity procedure. Such a system should encompass the classification of repositories and documentation, the establishment of the state from which the user actually obtains access, the verification of end users and of the purpose of use of the technology, the segmentation of projects, the principle of least privilege, restrictions on the downloading and copying of files, and the keeping of access logs. For the protection of data against unauthorised access does not itself replace the answer to a separate regulatory question: whether the access of a person who is authorised, but located outside the Union, constitutes an export requiring an authorisation.

4.7 Supply chain, components and investment control

The last point of friction is the tension between strategic autonomy and the structure of the component market. The ecosystem which made possible the cost revolution described in section 2.2 rests to a considerable extent on components of geographically concentrated origin – from cells and motors to integrated circuits and cameras. The policy of reducing dependence collides with the fact that alternative European chains do not exist at a scale corresponding to demand.

Legally, this tension materialises in three instruments: the eligibility mechanisms in the financing programmes (the requirement of component origin and of control over the contractor), Regulation (EU) 2019/452 on the screening of foreign direct investments together with the national Act of 24 July 2015 on the control of certain investments,[87] and the sanctions regime. For an investor, this means that a transaction in this sector requires a parallel analysis of three consent paths: merger control, investment control and – where the object comprises listed assets – export consents. The transaction timetable must take this into account from day one; the attempt to catch up on these consents after the signing of the preliminary agreement is a typical cause of the failure of the process.

5 · The Dual-Track Nature of the Regime – an Answer to the Practical Question in the Legal Environment

The juxtaposition of the nine pillars leads to the conclusion that law simultaneously performs three different roles – depending on the track in which we find ourselves – and leaves one area uncovered.

Law is neither exclusively a consequence nor exclusively a driver – it is dual-track. On the civil track it operates as a consequence of need and as a dampener; on the defence track as a driver. The mechanism separating the two tracks is the military exclusion in Article 2(3) of the Artificial Intelligence Act and the analogous defence exclusions in successive acts – whereby, as we demonstrated in section 3.1, the first of them appears already in the EASA basic regulation, and thus at the level of the foundation of the entire regime, not as a special exception.

The paradox lies in the fact that the same technology is simultaneously being accelerated on the defence side and dampened on the civil side – and the dual-use boundary along which this division runs is increasingly indistinct. What is more, in the years 2025–2026 we observe an additional phenomenon, which is worth noting as a fourth mechanism: simplification as a tool of industrial policy. Both the Defence Readiness Omnibus and the Digital Omnibus aim to lower regulatory burdens – the first on the defence track, the second on the civil one. The direction is convergent, the justifications different: in the first case defence readiness, in the second competitiveness. The effect is a convergence of the two tracks on the procedural side, while their substantive separateness is preserved.

6 · Practical Implications for Entities in the Sector

6.1 · The qualification map – questions which must be answered in this order

For a client from the UAV sector, one question is key: on which side of the boundary – dual use, military/civil – is its product or project located. This qualification determines the entire legal regime that covers it. In practice, it is worth conducting it sequentially:

1. Is the product intended exclusively for military, defence or national security purposes? If so – the basis of that assertion and the mechanisms of control over the distribution channel must be documented. If not, or not fully – the civil regime applies in its entirety.

2. Does the Artificial Intelligence Act apply, and if so, on which basis? Annex I (a safety component of a certified product) or Annex III (critical infrastructure, law enforcement, borders)? On this depends not only the scope of the obligations, but also the date of their application (2 December 2027 or 2 August 2028).

3. Which product class and operational category does the platform concern under the 2019/945 and 2019/947 regime – and do the operations require an authorisation in the specific category?

4. Is the product or any of its components subject to export control on the basis of Regulation (EU) 2021/821 and the current control list, including under the regime of the catch-all clauses and intangible technology transfer?

5. Does the device process personal data – and if so, has an impact assessment been carried out and is the legal basis of the processing documented? Is the platform a “connected product” within the meaning of the Data Act?

6. What cybersecurity obligations (the CRA as manufacturer, NIS2 by virtue of its own activity, CER indirectly through the client) cover the manufacturer and the operator?

7. Does the project qualify for driver financing (EDF, EDIRPA, ASAP, SAFE, EDIP/SEAP) – and does the ownership and consortium structure satisfy the eligibility and control requirements?

6.2 Due diligence of a drone entity

In M&A practice, this means that the examination of the company must cover not only the classic areas (legal title to intellectual property, contracts, obligations), but also regulatory positioning. The checklist covers at least:

• the dual-use classification of every component and product, together with the substantiating documentation and the history of authorisations issued;
• the status vis-à-vis the Artificial Intelligence Act: an inventory of systems, assignment to categories, assessment of the existence and effectiveness of the exclusion under Article 2(3);
• the provenance of the training data sets and the rights to use them – including the chain of title to data originating from third parties or from real operations;
• the history of security incidents and compliance with the reporting regimes;
• operator registration, operational authorisations, the history of proceedings before the aviation supervisory authority and of administrative sanctions;
• exposure to investment control (Regulation 2019/452, the Act of 24 July 2015) and the eligibility requirements in the financing programmes of which the company is a beneficiary;
• compliance with the intangible technology transfer regime in the dispersed working model, including a list of the jurisdictions from which access to the repositories was granted;
• rights to the results of projects financed from public funds, including export restrictions and access rights allocated to Member States.

A procedural remark of significant practical importance: the mere conduct of the company examination may trigger export obligations if access to the technical documentation is obtained by advisers from third countries. The sequence of steps in the transaction process is therefore not a matter of convenience – it is an element of compliance.

6.3 · Compliance calendar 2026–2028

The dates concerning the part of the simplification package relating to the GDPR, privacy in electronic communications, NIS2 and the Data Act remain unsettled – the file is in negotiations in the Council, and adoption before the end of 2026 is uncertain.

6.4 What cannot be postponed

The postponement of the obligations for high-risk systems is sometimes read as consent to suspend work. This is an error with a measurable cost. Three tasks have no temporal alternative:

• Inventory and classification. The most difficult element of compliance with the Artificial Intelligence Act is not the completion of documentation, but the identification of all systems in the organisation and the maintenance of that register as successive versions of the product are introduced. This work does not depend on the state of the harmonised standards.
• AI literacy (Article 4). The obligation to ensure an appropriate level of knowledge of the personnel operating AI systems has applied since 2 February 2025 and has not been postponed.
• Data architecture and event logs. The requirements of Articles 10 and 12 are of a design character – satisfying them after the completion of construction work is many times more costly than taking them into account from the outset.

It is precisely here – at the interface of technology and the ever-denser lattice of regimes – that the added value of legal advice specialised in highly regulated sectors lies.

7 Conclusion – the Conflict as Lens and Barometer

The Ukrainian conflict is a lens in which the future of dual-use technology can be seen, and a barometer of the direction of its regulation. It refutes the popular thesis that law by its nature restrains technological development: on the defence track, the legal layer of public financing has proved to be a vector of abrupt acceleration – and the instruments adopted in the years 2025–2026, from the Defence Readiness Omnibus to the flagship projects of the Readiness Roadmap 2030, are proof of this on a scale hitherto unknown in Europe. At the same time, it shows that as drones become widespread, civil law assumes a dampening function – controlling export, autonomy, data processing and access to airspace.

Three observations seem most significant for the further discussion.

First, the defence exclusions are not an exception to the rule, but a systemic construction repeated at every level of regulation – from the EASA basic regulation, through the GDPR, to the Artificial Intelligence Act. Each time, however, they have differently drawn boundaries, which means that the same platform may simultaneously be excluded from one regime and covered by another. The ordering of those boundaries is a task which the EU legislator has not yet undertaken.

Second, with the shift of value from the platform to the data and models, the regulatory weight is shifting from aviation law towards data and artificial intelligence law. A manufacturer that in 2019 needed mainly a certificate needs, in 2026, a documented chain of provenance of the training data sets, a vulnerability management system and jurisdiction-based access control.

Third, the innovation spiral will not slow down – and with it, the pace of the layering of the law will not slow down either. A norm responding to the state of the art of two years ago, adopted in reaction to an incident of a year ago, entering into force in a year’s time, will at the moment of its application relate to a world that no longer exists. This is an argument not against regulation, but for regulation based on effects and on the level of risk, resistant to a change of technical solution.

For lawyers serving this sector, the conclusion is one: an effective legal strategy begins with the conscious positioning of the product on the right side of each of the boundaries of the regime – and there are today nine of those boundaries, not one. The ability to move simultaneously in the technological and regulatory layer ceases to be an advantage and becomes a condition of presence on this market.

Annex A: Glossary of Technical Terms

About the Authors and the Firm

KG Legal Kiełtyka Gładkowski. Partnership – Attorneys law firm advises entities from the high-technology sectors and highly regulated industries.

Attorney-at-law (radca prawny) Kazimierz Jakub Gładkowski specialises in corporate matters.

Attorney-at-law (radca prawny) Małgorzata Kiełtyka, entitled to appear before all courts, specialises in M&A transactions for entities from the high-technology and highly regulated sectors.

This article is of an informational and popular-science nature; it does not constitute legal advice. In individual matters, we recommend contacting the firm.

Additional Footnotes and Sources

1. Violations of Polish airspace on 9/10 September 2025 and earlier incidents (Romania – January 2025; Osiny – August 2025); launch of NATO’s operation Eastern Sentry; compare: T. Withington, “Europe’s Drone Wall – Ready, EDDI, Go!”, European Security & Defence, 13 March 2026, pp. 38–41; https://euro-sd.com/2026/03/articles/exclusive/49854/europes-drone-wall-ready-eddi-go/

2. Expert estimate concerning the pace of development of unmanned technologies in wartime conditions; cf. the analysis systematising drone warfare technology – M. Strzyżewski, “Anti-drone defense – shotguns, nets, EW, interceptor drones”, Marcin Strzyżewski YouTube channel, 2026 (video material).

3. The analogy and taxonomy of drone categories and the role of situational awareness; the persistence of commercial observation platforms on the battlefield after: M. Strzyżewski, op. cit.

4. “FPV Drone Warfare: The $1,000 Revolution Reshaping Modern Combat”, drone-warfare.com, 2026. https://drone-warfare.com/research/fpv-drone-warfare

5. V. Sutea, “Fiber-optic drones have emerged as critical kit for both Russia and Ukraine”, Atlantic Council – UkraineAlert, 24 February 2026 (the appearance of fibre-optic drones in August 2024 in the Kursk area; range of over 30 km, no susceptibility to jamming); https://www.atlanticcouncil.org/blogs/ukrainealert/fiber-optics-drones-have-emerged-as-critical-kit-for-both-russia-and-ukraine

6. NATO Allied Command Transformation, Innovation Challenge devoted to countering fibre-optic drones, 2025 – cf. Atlantic Council, op. cit.

7. “Fire Point FP-1”, Wikipedia (as at 21 July 2026); cf. “FP-1 vs Shahed: Ukraine Ramps Up Production…”, United24 Media, 20 August 2025 (unit cost approx. USD 55 thousand; plywood fuselage, two-cylinder engine).

8. “Russian largest oil refinery hit for first time by Ukrainian drones”, Politico Europe, 6 July 2026; cf. Tom’s Hardware, 17 July 2026 (strike on the Omsk refinery after a flight of over 2,500 km). https://www.tomshardware.com/tech-industry/drones/ukraines-55000-plywood-drone-flew-2500-km-and-shut-down-russias-largest-oil-refinery

9. Regulation (EU) 2018/1139 (EASA), including Article 2(3)(a) (exclusion of military, customs, police and related operations); Delegated Regulation (EU) 2019/945; Implementing Regulation (EU) 2019/947 (open / specific / certified categories). Source: EUR-Lex.

10. Implementing Regulation (EU) 2021/664 (the U-space framework) together with 2021/665 and 2021/666. Source: EUR-Lex; EASA.

11. Regulation (EU) 2023/203 (information security requirements in U-space); the consolidated version of 2019/947 applicable from 1 May 2025. Source: EUR-Lex; SKYbrary.

12. EASA, Easy Access Rules for Unmanned Aircraft Systems – revision of June 2026 (consolidation of the AMC/GM to 2019/947, ED Decision 2025/018/R).

13. Regulation (EU) 2024/1689 (the Artificial Intelligence Act), Article 2(3) and recital 24; Articles 4, 5, 6, 8–15, 50, 51–55; Annexes I and III. Source: EUR-Lex; artificialintelligenceact.eu (Article 2: Scope).

14. European Parliament, EPRS, “Defence and artificial intelligence”, 2025 (LAWS outside the scope of the AI Act by virtue of Article 2(3); calls for international regulation).

15. Digital Omnibus on AI: Commission proposal of 19 November 2025; unsuccessful trilogue of 28 April 2026; preliminary political agreement of 6–7 May 2026; confirmation by Member State representatives on 13 May 2026; approval by the Parliament on 16 June 2026 and by the Council on 29 June 2026. New dates: 2 December 2027 (Annex III), 2 August 2028 (Annex I), 2 December 2026 (Article 50(2) in relation to existing systems and the new prohibitions). Cf. analyses: Gibson Dunn, May 2026; Travers Smith, May 2026.

16. Regulation (EU) 2021/821 (dual-use export control); entry into force on 9 September 2021; consolidated version from 15 November 2025; Article 4 (catch-all clauses), Article 5 (cyber-surveillance items), the intangible technology transfer regime. Source: EUR-Lex.

17. European Commission, update of Annex I to Regulation (EU) 2021/821 of 8 September 2025 (emerging technologies). Cf. Akin, “EU Updates Dual-Use Export Control List”, 16 September 2025.

18. Directive 2009/43/EC on intra-EU transfers of defence-related products; the Act of 29 November 2000 on foreign trade in goods, technologies and services of strategic importance.

19. Regulation (EU) 2023/2418 (EDIRPA – common defence procurement). Source: EUR-Lex; European Commission (DG DEFIS).

20. The SAFE instrument (Security Action for Europe), 2025; procurement to be carried out by the end of 2030. Cf. European Parliament, EPRS, “EU joint defence procurement”, 2026.

21. Defence Readiness Omnibus, European Commission, 17 June 2025 (accelerated authorisations, framework agreements up to 10 years, simplification of intra-EU transfers, exclusions in REACH/CLP, communication on sustainable finance); preliminary agreement of the co-legislators on the procurement part, June 2026. Source: European Commission (DG DEFIS); Staff Working Document to the proposal of 17 June 2025.

22. Readiness Roadmap 2030 and the four flagship projects: European Drone Defence Initiative, Eastern Flank Watch, European Air Shield, European Space Shield; timetable: launch Q1 2026, initial capability end of 2026, full functionality of EDDI end of 2027, Eastern Flank Watch end of 2028. Source: European Commission (DG DEFIS); European Parliament, EPRS, “Eastern Flank Watch and European Drone Wall”, October 2025.

23. European Commission, Action Plan on drone and counter-drone security, 11 February 2026 (IP/26/364); Drone Alliance with Ukraine; announcement of the allocation of EUR 6 billion from the interest on immobilised Russian assets.

24. “Drone deals fueled VC’s 139% surge into defense robotics”, PitchBook, 19 March 2026 (approx. USD 6.2 billion in 169 transactions; a 139% increase).

25. “Ukraine 2025 defence tech investment topped $57.2M, but the ‘funded market’ is $6.8B, says PitchBook”, Resilience Media, 9 July 2026.

26. Regulation (EU) 2023/588 (the secure connectivity programme 2023–2027; the IRIS constellation). Source: EUR-Lex; European Commission (DG DEFIS).

27. Directive (EU) 2022/2555 (NIS2), repealing Directive 2016/1148. Source: EUR-Lex; European Commission (DG CNECT).

28. Directive (EU) 2022/2557 (CER – resilience of critical entities). Source: EUR-Lex.

29. Regulation (EU) 2024/2847 (the Cyber Resilience Act) – reporting obligations from September 2026, full application from December 2027. Source: EUR-Lex.

30. Regulation (EU) 2016/679 (GDPR), Article 2(2)(a) and (b), Articles 5, 6, 9, 13–14, 35; Article 4(2) TEU. European Data Protection Board, Guidelines 3/2019 on the processing of personal data through video devices. Directive (EU) 2016/680 and the Act of 14 December 2018 on the protection of personal data processed in connection with the prevention and combating of crime.

31. Regulation (EU) 2023/2854 (the Data Act), applicable from 12 September 2025; Regulation (EU) 2022/868 (the Data Governance Act).

32. The Digital Omnibus – the data part (GDPR, privacy in electronic communications, NIS2, the Data Act, DORA): negotiating status as at July 2026; withdrawal of the Cypriot Presidency’s compromise text from the COREPER II procedure at the end of June 2026. EDPB and EDPS, Joint Opinion 2/2026 of 11 February 2026 (opposition to the narrowing of the definition of personal data); Joint Opinion 1/2026 of 20 January 2026 on the amendments to the Artificial Intelligence Act.

33. The Convention on International Civil Aviation (Chicago, 1944), Articles 3, 3 bis and 8; Additional Protocol I to the Geneva Conventions (1977), Article 36.

34. The Group of Governmental Experts on LAWS within the framework of the CCW Convention: rolling text since 2024; joint statement of 42 states, September 2025; resolution of the First Committee of the UN General Assembly of 6 November 2025 (156 states); joint call of the UN Secretary-General and the President of the ICRC for the conclusion of negotiations by the end of 2026; Seventh CCW Review Conference – November 2026. Source: UNODA; Lieber Institute West Point, May 2026.

35. NATO, principles of the responsible use of artificial intelligence in defence (2021) and the revised AI strategy.

36. The Act of 8 December 2006 on the Polish Air Navigation Services Agency (Journal of Laws of 2025, item 1267), including the Agency’s extended competences in the area of unmanned systems.

37. The Act of 29 May 2026 amending the Act on Crisis Management and certain other acts (Journal of Laws of 2026, item 815) – implementation of the CER Directive; the powers of critical infrastructure operators to use jamming devices (from 26 June 2026); the new Chapter 6a concerning unmanned floating objects; the extension of the powers of the Police, the Border Guard, the State Protection Service and the Military Gendarmerie; security audits; the Maritime Security Centre.

38. The Act of 11 March 2022 on the Defence of the Homeland.

39. The draft deregulatory amendment of the Aviation Law, transmitted by the Civil Aviation Authority to the Ministry of Infrastructure on 5 May 2026 (the system of penalties, insurance, notifications, protection of critical infrastructure, counter-drone systems) (at present no publication of the source text – see the footnotes referring to press information sources).

40. Directive 2014/53/EU on radio equipment (essential requirements, harmful interference).

41. Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments; the Act of 24 July 2015 on the control of certain investments.

[1] https://www.youtube.com/watch?v=GCOeO35PQh8 Cf. the analytical material of a Polish commentator on the war and new technologies, based on accounts attributed to Ukrainian military intelligence (HUR), where it was indicated that Russia is producing “more Shaheds of the Geran 4 and 5 model, i.e. the jet variants, than Geran 2 drones, i.e. the piston ones – 3,000 jet-powered per month and 2,800 piston-powered.”

[2] Paweł Jeżowski, Rosja 2026: Koniec snu Putina o Imperium [Russia 2026: The End of Putin’s Dream of Empire] – Paweł Jeżowski https://www.youtube.com/watch?v=JSA9sh44Qj4&t=27s

[3] European Commission, Communication from the Commission to the European Parliament and the Council – Action Plan on Drone and Counter Drone Security, COM(2026) 81 final, 11 February 2026.

[4] Treaty on the Functioning of the European Union, Article 288 – the legal character of regulations, directives and other instruments of EU law.

[5] The Act of 29 May 2026 amending the Act on Crisis Management and certain other acts, Journal of Laws of 2026, item 815.

[6] The governmental bill amending the Act on Crisis Management and certain other acts, Sejm print no. 2355, the explanatory memorandum to the bill.

[7] The Act of 29 May 2026 amending the Act on Crisis Management and certain other acts, Journal of Laws of 2026, item 815, introducing, inter alia, Article 16c into the Act of 26 April 2007 on Crisis Management. Text of the act: https://eli.gov.pl/eli/DU/2026/815/ogl/pol

[8] The Act of 26 April 2007 on Crisis Management, Article 16c, added by the Act of 29 May 2026.

[9] The Act of 3 July 2002 – Aviation Law, Article 156ze(1).

[10] The governmental bill amending the Act on Crisis Management and certain other acts, Sejm print no. 2355, together with the explanatory memorandum, Sejm of the Republic of Poland, 10th term: https://www.sejm.gov.pl/Sejm10.nsf/druk.xsp?nr=2355

[11] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the AI Act), Article 6 and Article 113.

[12] The regulation amending Regulation (EU) 2024/1689 as regards the dates of application of the obligations concerning high-risk AI systems.

[13] Council on Foreign Relations (CFR) The CFR indicates that the war in Ukraine has led to a hitherto unseen pace of innovation in unmanned systems: “the Russia-Ukraine war is driving innovations in autonomous warfare not seen on other battlefields.” Kristen Thompson, How the Drone War in Ukraine Is Transforming Conflict, Council on Foreign Relations, 16 January 2024.

[14] The Carnegie Endowment for International Peace describes the conflict as a “living laboratory” for new doctrines of warfare: “both sides are now engaged in a sustained effort to gain advantage through rapid innovation and adaptation, introducing new types of unmanned systems, countermeasures, and operating methods at unprecedented speed.” Andriy Zagorodnyuk, The New Revolution in Military Affairs, Carnegie Endowment for International Peace, 2026.

[15] CSIS – Center for Strategic and International Studies The CSIS report describes how, after the start of the full-scale invasion, Ukraine created within about three years an entirely new defence technology ecosystem based on drones, shortening development cycles from multi-year military programmes to months. Kateryna Bondar, Unleashing U.S. Military Drone Dominance: What the United States Can Learn from Ukraine, Center for Strategic and International Studies (CSIS), 18 July 2025.

[16] K. Bondar, Unleashing U.S. Military Drone Dominance: What the United States Can Learn from Ukraine, Center for Strategic and International Studies (CSIS), 2025. The author indicates that the war in Ukraine has radically shortened the cycles of development and deployment of drone technologies: solutions whose development in classic military programmes took many years are now designed, tested and deployed in periods counted in months. Link: https://www.csis.org/analysis/unleashing-us-military-drone-dominance-what-united-states-can-learn-ukraine , Michael Kofman, Rob Lee, Not Built for Purpose: The Russian Military’s Ill-Fated Force Design, Center for a New American Security / Carnegie Endowment for International Peace, an analysis of the technological adaptation of both sides of the conflict and the role of the rapid iteration of unmanned systems.

Link: https://carnegieendowment.org International Institute for Strategic Studies (IISS), The Military Balance 2025, chapters on the Russo-Ukrainian war and the development of unmanned systems. The IISS indicates that the conflict in Ukraine has led to the mass use of drones as a basic element of combat operations and has accelerated the development of technologies for countering unmanned systems. Link: https://www.iiss.org/publications/the-military-balance/

Samuel Bendett, Russia’s War in Ukraine: The Role of Unmanned Systems and the Future of Warfare, Center for Naval Analyses (CNA). Bendett’s analyses frequently indicate that the war in Ukraine has become a “laboratory” for the rapid evolution of unmanned systems, in which the innovation cycle has been shortened from years to months.

Link: https://www.cna.org/

[17] https://www.youtube.com/watch?v=vI1W4bYCuNA&t=181s; thus General Skrzypczak in the press service: “the 7th day of the offensive operation conducted by the Russians is ending. The Russians have not achieved their main objectives, the objectives of the operation, that is they have not captured and have not managed to carry out the encirclement of Kyiv and have not come out on the Mykolaiv axis towards Odesa in order to encircle it jointly with a naval landing. On the auxiliary axes they achieved limited success; they approached Kharkiv and Mariupol; they took Zaporizhzhia. The problem is that the Russians have lost their momentum; the offensive has been halted essentially along the entire front line; the Russians are preparing, trying to bring up reserves, to reconstitute the forces that are prepared, in order to prepare them for combat, but at this moment they do not have such capabilities.”

[18] In practice, it is precisely at this point that the real value of legal advice for companies from the UAV and dual-use sector begins. For the same product may simultaneously be subject to the rules of aviation law, export law, data protection, cybersecurity, AI compliance and contractual restrictions connected with its further use by the client or integrator. Effective advice therefore does not consist in the analysis of a single provision in isolation from the rest, but in building a coherent risk map: from the classification of the product and the market entry model, through the assessment of compliance obligations and export restrictions, to the structure of contracts, responsibility for implementation and the security of project financing. In the drone sector, the advantage today is gained not only by those who develop better technology, but also by those who are able to order its legal and transactional status earlier in many jurisdictions simultaneously.

[19] Lieber Institute at West Point, Whose Decision Was It? Drone Swarms and the Accountability Gap in Ukraine, 25 July 2026.

[20] Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems, OJ EU L 152 of 11.06.2019, p. 1.

[21] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft, in particular Article 14 (the operator registration obligation). The character of the operator registration obligation, including for drones equipped with sensors capable of capturing personal data, is also explained by EASA.

[22] Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in particular Article 4(1), Article 5, Article 6 and Article 35.

[23] Judgment of the Court of Justice of 11 December 2014, František Ryneš v Úřad pro ochranu osobních údajů, C-212/13, EU:C:2014:2428.

[24] Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items.

[25] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the AI Act), in particular Article 3, Article 6 and Annexes I and III.

[26] DJI (full name: SZ DJI Technology Co., Ltd., also referred to as Shenzhen DJI Sciences and Technologies Ltd.) is a private technology company with its registered office in Shenzhen in the People’s Republic of China, founded in 2006 by Frank Wang. The company specialises in the production of commercial and professional unmanned systems, image stabilisers, cameras, aerial imaging devices and solutions for consumer, industrial and agricultural applications. Its most recognisable product lines include, inter alia, Mavic, Mini, Air, Avata, Matrice, Agras and the Osmo line of handheld devices. In the trade literature and media coverage, DJI is commonly described as the largest manufacturer of consumer drones in the world, whereby, owing to the private character of the company, data on its precise revenues and sales volumes are not fully public; publicly available sources point, however, to the global scale of its activity, employment counted in the thousands, and a dominant position in the segment of civil camera drones; https://www.reuters.com/article/technology/game-of-drones-chinese-giant-dji-hit-by-us-tensions-staff-defections-idUSKBN2AZ0PV/

[27] https://odessa-journal.com/the-ukrainian-company-has-unveiled-the-zoom-drone-as-an-alternative-to-the-chinese-dji-mavic

[28] https://rubryka.com/ru/2024/10/21/ukrayinska-kompaniya-rozrobyla-dron-rozvidnyk-zoom-u-nishi-dji-mavic/

[29] https://www.frontline-robotics.tech/en#product

[30] The NATO Codification System (NCS) does not derive from a single statute or regulation, but from NATO’s allied standardisation-logistics system, managed by Allied Committee 135 (AC/135). The basic system document is ACodP-1 (NATO Manual on Codification / AC/135 Codification Manual), which sets out the principles, responsibilities and procedures of codification. The system further rests on a series of NATO standardisation agreements (STANAG), in particular STANAG 3150, STANAG 3151, STANAG 4199 and STANAG 4438.

https://www.dla.mil/Working-With-DLA/Federal-and-International-Cataloging/NATO

[31] https://www.atlanticcouncil.org/blogs/ukrainealert/fpv-drones-in-ukraine-are-changing-modern-warfare/

[32] https://vgi.com.ua/en/the-race-for-drone-independence-ukraines-fpv-component-ecosystem/

[33] https://brave1.gov.ua/en

[34] https://www.kmu.gov.ua/en/news/v-ukraini-zapustyly-defense-tech-cluster-brave1-iakyi-stymuliuvatyme-rozvytok-viiskovykh-innovatsii-ta-oboronnykh-tekhnolohii

https://egrants.com.ua/en/programs/grant-for-the-development-of-components-for-unmanned-systems

[35] https://www.aspistrategist.org.au/the-underexploited-potential-of-ukrainian-defence-tech/

[36] https://digitalstate.gov.ua/news/tech/brave1-market-ukrayina-zapuskaye-marketpleys-viyskovykh-innovatsiy

[37] https://www.nationaldefensemagazine.org/articles/2025/5/28/as-russia-ukraine-war-continues-so-does-drone-innovation

https://www.reuters.com/business/aerospace-defense/ukraine-sharply-raise-purchases-home-produced-fpv-drones-2025-2025-03-10

https://www.reuters.com/world/europe/ukraine-ramps-up-arms-production-can-produce-4-million-drones-year-zelenskiy-2024-10-02

https://euromaidanpress.com/2026/01/26/ukraine-aims-to-build-7-million-drones-in-2026-70-times-more-than-the-us

[38] https://cms.egrants.com.ua/assets/4621da83-b816-4967-8328-b9223a6c0d1c

[39] https://usf.com.ua/en/about-usf

[40] https://www.eeas.europa.eu/delegations/ukraine/eu4ua-defence-tech-eu-and-ukraine-launch-new-%E2%82%AC33-million-brave1-grant-programme_en

[41] See Cabinet of Ministers of Ukraine, Ukraine launches BRAVE1 defence tech cluster to stimulate development of military innovations and defence technologies; cf. also Brave1, About Brave1, where it is indicated that Brave1 is a governmental initiative directed at the development of defence technologies, implemented by the Innovation Development Fund and initiated by the competent state organs and the components of Ukraine’s security and defence sector.

https://www.kmu.gov.ua/en/news/v-ukraini-zapustyly-defense-tech-cluster-brave1-iakyi-stymuliuvatyme-rozvytok-viiskovykh-innovatsii-ta-oboronnykh-tekhnolohii

See EEAS / Delegation of the European Union to Ukraine, EU4UA Defence Tech: EU and Ukraine launch new EUR 3.3 million BRAVE1 grant programme, indicating that the project is financed by the European Union and implemented by BRDO in cooperation with Brave1; cf. also BRDO, Strengthening the Innovation Capacities of the Ukrainian Defence Technological Industrial Base, where the title of the implementation project linked with the EU4UA Defence Tech initiative was disclosed.

https://www.eeas.europa.eu/delegations/ukraine/eu4ua-defence-tech-eu-and-ukraine-launch-new-%E2%82%AC33-million-brave1-grant-programme_en

See Regulations for the Brave1 EU4UA Defence Tech Grant Program, available in the Legal Terms section of the programme Grant for the development of components for unmanned systems on the eGrants platform; cf. also the Digital State communication, indicating that EU4UA Defence Tech is financed by the European Union and implemented by BRDO in cooperation with Brave1.

https://egrants.com.ua/en/programs/grant-for-the-development-of-components-for-unmanned-systems

[42] The concept of the radio horizon should be treated as a technical, not a normative, term. It does not function as a legal definition in the EASA regime, in U-space or in the classic acts of electronic communications law. Its legal significance is, however, obvious, because it describes a material limitation of communications on which the possibility of conducting unmanned operations beyond the direct line of sight depends, and thus it indirectly affects the assessment of the conformity of radio equipment, the safety of operations, the design of BVLOS architecture and liability for the continuity and reliability of transmission.

[43] https://interoperable-europe.ec.europa.eu/collection/rolling-plan-ict-standardisation/u-space-0

[44] https://militaeraktuell.at/en/ukraine-opens-next-round-in-drone-frequency-war/;

[45] Mesh modems turn Shaheds into FPV drones: how enemy technology works:

https://dev.ua/en/news/mesh-modemy-u-shakhedakh-peretvoriuiut-ikh-na-fpv-drony-1762344495

[46] https://dronexl.co/2026/02/28/ukraine-shahed-drone-relay-stations-belarus/

[47] https://www.atlanticcouncil.org/blogs/ukrainealert/fiber-optics-drones-have-emerged-as-critical-kit-for-both-russia-and-ukraine/, https://www.washingtonpost.com/world/2025/05/23/ukraine-russia-drones-fiberoptic-jamming/

[48] https://www.act.nato.int/article/innovation-challenge-fibre-optic-drones/

[49] European Commission, Joint Research Centre, C-UAS detection, tracking and identification technology.

https://publications.jrc.ec.europa.eu/repository/bitstream/JRC140692/JRC140692_01.pdf

Alex Braszko, Center for Army Lessons Learned, August 12, 2025; Fiber Optic Drones: Posing a Significant C-UAS Challenge – https://www.army.mil/article/287737/fiber_optic_drones_posing_a_significant_c_uas_challenge

[50] https://csrc.nist.gov/glossary/term/spoofing, https://www.faa.gov/about/office_org/headquarters_offices/avs/offices/afx/afs/afs400/afs410/GNSS/GPS_GNSS_Interference_Resource_Guide.pdf

[51] https://www.armyrecognition.com/archives/archives-defense-exhibitions/2026-archives-news-defense-exhibitions/bedex-2026/ukraine-to-export-combat-proven-vampire-heavy-drone-for-night-strikes-and-mine-laying

[52] https://united24media.com/latest-news/russia-forms-units-of-agricultural-drones-to-mirror-ukrainian-tactics-7371

[53] https://www.pravda.com.ua/eng/articles/2026/01/15/8016293/ ; https://united24media.com/defense-tech/a-russian-drone-that-takes-off-every-minute-along-ukraines-front-how-do-you-stop-molniya-19647

[54] https://github.com/cognis-digital/awesome-drone-warfare-osint/blob/main/docs/drones/lancet.md

[55] https://defence-blog.com/ukraine-fields-new-recon-strike-drone/

[56] https://www.wbgroup.pl/en/produkt/warmate-loitering-munnitions/, https://en.wikipedia.org/wiki/WB_Electronics_Warmate

[57] https://english.nv.ua/nation/ukraine-fields-the-low-cost-fp-1-long-range-drone-nv-discloses-the-uav-specs-50559428.html;

[58] https://bavovna.ai/uav/fp-1/;

[59] See NV, How Ukraine-made FP-1 drone reshapes long-range strikes; Militarnyi, Ukrainian Fire Point Establishes In-House Production of Engines for Long-Range Drones; Reuters, Ukrainian drones hit Russia’s largest refinery, in one of deepest strikes yet; cf. also UNN and RBC-Ukraine in relation to the attack on Omsk and the scale of FP-1 production NV Militarnyi Reuters UNN RBC-Ukraine.

[60] See the MTCR Guidelines, the official MTCR website, indicating the division of the control annex into Category I and Category II; cf. also U.S. Department of State, Missile Technology Control Regime (MTCR) Frequently Asked Questions, where it is indicated that Category I covers complete rocket systems and unmanned aerial vehicle systems capable of delivering a payload of at least 500 kg to a range of at least 300 km; as regards the absorption of this logic into EU law, see Regulation (EU) 2021/821 setting up a Union regime for the control of exports of dual-use items. MTCR U.S. Department of State EUR-Lex; https://www.state.gov/bureau-of-international-security-and-nonproliferation/releases/2025/01/missile-technology-control-regime-mtcr-frequently-asked-questions

[61] On the significance of long-range communications for modern drone operations, see Atlantic Council, The coming compute war in Ukraine; on terminal guidance / machine vision enabling autonomous terminal-phase homing, see Modern War Institute, Battlefield Drones and the Accelerating Autonomous Arms Race in Ukraine and Defense Express, How Ukrainian FPV Drones With Automated Terminal Guidance Work; https://mwi.westpoint.edu/battlefield-drones-and-the-accelerating-autonomous-arms-race-in-ukraine/

[62] See Article 2(3) and recital 24 of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the AI Act), which exclude from the regulation’s scope AI systems used exclusively for military, defence or national security purposes; cf. also the discussions on autonomous weapon systems (LAWS) conducted within the framework of the Convention on Certain Conventional Weapons (CCW), in particular the work of the Group of Governmental Experts on Lethal Autonomous Weapons Systems (GGE on LAWS).

[63] See EASA, Easy Access Rules for Unmanned Aircraft Systems, revision from June 2026, indicating that this revision incorporates the AMC and GM to Regulation (EU) 2019/947 stemming from ED Decision 2025/018/R; cf. also the online version of the publication of 30 June 2026. EASA EASA online publication.

[64] See European Parliamentary Research Service, Defence and artificial intelligence (2025), indicating that the European Parliament adopted two main resolutions concerning LAWS and military AI – in 2018 and 2021; cf. also EEAS, Autonomous weapons must remain under human control, Mogherini says at European Parliament. EPRS PDF EEAS

[65] See European Parliament Legislative Train, Digital Omnibus on AI, indicating that the proposal formed part of the package published on 19 November 2025; cf. also EPRS, Digital Omnibus on AI, where it is indicated that the co-legislators reached agreement in the trilogue on 7 May 2026, and the Parliament approved it on 16 June 2026; on the final adoption by the Council, see Consilium, Artificial Intelligence: Council gives final green light to simplify and streamline rules, 29 June 2026; the final act: Regulation (EU) 2026/1744. Legislative Train EPRS PDF Consilium EUR-Lex;

[66] Regulation (EU) 2021/821 entered into force on 9 September 2021 as the new basic act of the Union’s system for the control of exports of dual-use items, replacing the earlier Regulation (EC) No 428/2009. The reference to 15 November 2025 does not mean that the act “ends” in 2025, but that from that day the cited consolidated version applies, taking account of the amendments to the text so far. The date of 8 September 2025, in turn, refers to one of the updates of the control lists / annexes. In August 2026, the regulation still remains an act in force.

[67] The transfer of model weights means the transfer of the trained parameters of the AI model themselves – that is, the numbers which the model “carries within itself” after training and on the basis of which it operates.

[68] See Regulation (EU) 2021/697 of the European Parliament and of the Council of 29 April 2021 establishing the European Defence Fund; cf. also the European Defence Fund (2021–2027) on EUR-Lex and the European Commission’s official website concerning the EDF. EUR-Lex EUR-Lex summary European Commission;

[69] See Regulation (EU) 2023/2418 of the European Parliament and of the Council of 18 October 2023 establishing an instrument for the reinforcement of the European defence industry through common procurement (EDIRPA); cf. also the EUR-Lex summary and the European Commission’s official website concerning EDIRPA. EUR-Lex EUR-Lex summary European Commission;

[70] ASAP was established by Regulation (EU) 2023/1525 of the European Parliament and of the Council of 20 July 2023 as an instrument supporting the increase of the production capacities of European industry in the field of ammunition and missiles; the logic of this act – consisting in the public strengthening of the production capabilities of the defence industry – is functionally transferable also to the mass production of loitering munitions and drones. EUR-Lex European Commission;

[71] SAFE (Security Action for Europe) was established by Council Regulation (EU) 2025/1106 of 27 May 2025 as a new instrument strengthening European defence capabilities and the defence industry through financial mechanisms and the support of coordinated actions of the Member States; it remains a current element of the EU defence architecture also in 2026. EUR-Lex Consilium;

[72] See Regulation (EU) 2025/2643 of the European Parliament and of the Council of 16 December 2025 establishing the European Defence Industry Programme (EDIP); cf. also the European Commission’s official website concerning EDIP. EUR-Lex European Commission;

[73] This is a broader European Commission package, adopted on 17 June 2025, intended to create a “defence-readiness mindset” and to simplify the regulatory environment for defence investment. The Commission itself describes it as a comprehensive package and a simplification proposal, and the Parliament in the Legislative Train speaks outright of a Communication on the Defence Readiness Omnibus. It is therefore not simply “the same as EDIP”, but rather a deregulatory-simplification package and the political-legislative environment for faster action by the defence sector. European Commission Legislative Train

[74] See European Commission, Readiness Roadmap 2030 and White Paper for European Defence – Readiness 2030, indicating the four flagship projects: Eastern Flank Watch, the European Drone Defence Initiative, the European Air Shield and the European Space Shield. European Commission White Paper.

[75] Regulation (EU) 2023/588 of the European Parliament and of the Council of 15 March 2023 establishing the Union Secure Connectivity Programme for the period 2023–2027. eur-lex.europa.eu.

[76] Directive (EU) 2022/2555 (NIS2) of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union. eur-lex.europa.eu.

[77] Directive (EU) 2022/2557 (CER) of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities. eur-lex.europa.eu.

[78] Regulation (EU) 2024/2847 (the Cyber Resilience Act, CRA) of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements. eur-lex.europa.eu.

[79] See EDPB/EDPS Joint Opinion 2/2026 of 11 February 2026 on the Digital Omnibus and the EDPB communication of the same day; as to the further negotiating stage and the withdrawal of the text from COREPER II at the end of June 2026, cf. the expert source: Privacy Next, Digital Omnibus Negotiations (GDPR) – July 2026 Update. EDPB Joint Opinion 2/2026 Privacy Next.

[80] See Article 36 of Additional Protocol I of 1977 to the Geneva Conventions; cf. also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare. ICRC art. 36 ICRC Guide.

[81] See CCW/MSP/2023/7, para. 20, in which the mandate of the Group of Governmental Experts (GGE) on emerging technologies in the area of lethal autonomous weapons systems (LAWS) was defined as the further consideration and formulation, “by consensus”, of a set of elements of an instrument, without prejudging its character; see also CCW/GGE.1/2026/WP.2, paras. 3–5, 76–78. The Seventh CCW Review Conference has been scheduled for 16–20 November 2026 in Geneva (CCW/MSP/2025/8, para. 19(g); see also UN Secretary-General, Letter convening the Seventh Review Conference of the CCW, April 2026).

[82] NATO, Summary of the NATO Artificial Intelligence Strategy, 22 October 2021, paras. 7–10, in particular para. 9, containing the six Principles of Responsible Use for AI in Defence: Lawfulness, Responsibility and Accountability, Explainability and Traceability, Reliability, Governability and Bias Mitigation; NATO, Summary of NATO’s revised Artificial Intelligence (AI) strategy, 10 July 2024, paras. 2, 5-10. The revised strategy of 2024 confirms the applicability of the six principles of the responsible use of AI and provides for their further operationalisation, inter alia through standards, assessment and testing procedures (TEV&V) and certification mechanisms.

[83] https://www.swiatdronow.pl/podsumowanie-posiedzenia-podkomisji-stalej-do-spraw-lotnictwa-cywilnego-10-06-2026-r; Record of the proceedings of the Standing Subcommittee on Civil Aviation (no. 10) of 10 June 2026, Sejm of the Republic of Poland, in particular the statement of the Director of the Unmanned Aircraft Department of the Civil Aviation Authority, Paweł Szymański, who indicated that the draft amendment concerning unmanned aircraft systems prepared by the Civil Aviation Authority was transmitted to the Ministry of Infrastructure on 5 May 2026, constituting a response to the postulates of civil society and the problems revealed in the practice of applying the new provisions; the draft was described as being of a deregulatory, clarifying and ordering character, covering, inter alia, a change of the regulations concerning mandatory third-party liability insurance and sanctions. https://www.sejm.gov.pl/sejm10.nsf/biuletyn.xsp?SessionID=55B1AE69A4EDC2996BDD70EE751F3A4A86C14EE1&documentId=2AEF7DEF0751F54BC1258E22003E5D23&utm

[84] The postulate of meaningful human control does not currently constitute a separate, binding norm of international law. It is a concept developed within the framework of the negotiations concerning autonomous weapon systems, whose purpose is to ensure that the human retains real control over the application of force. Its legal justification is connected above all with the obligation to comply with the existing norms of international humanitarian law, in particular the principles of distinction, proportionality and the taking of precautionary measures, and the obligation to review new means and methods of warfare on the basis of Article 36 of Additional Protocol I.

[85] Article 6zj(1)–(4) of the Act of 26 April 2007 on Crisis Management, in the wording given by the Act of 29 May 2026 amending the Act on Crisis Management and certain other acts, Journal of Laws of 2026, item 815, in conjunction with Article 156ze(1) of the Act of 3 July 2002 – Aviation Law, consolidated text: Journal of Laws of 2025, item 1431, as amended.

[86] Article 2(2)(d) and Article 2(3) of Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items, in the current consolidated text; see also Commission Recommendation (EU) 2021/1700 of 15 September 2021 on internal compliance programmes for controls of research involving dual-use items: Regulation 2021/821 and Recommendation 2021/1700.

[87] The Act of 24 July 2015 on the control of certain investments (consolidated text: Journal of Laws of 2026, item 47, as amended).

Artykuł Drone Warfare pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The development of the Polish investment support system began in the mid-1990s, when Special Economic Zones (hereinafter referred to as SEZs) were established under the Act of 20 October 1994. According to Article 2 of this Act, the system was limited solely to designated, uninhabited areas of the territory of the Republic of Poland, where business activity could be conducted on preferential terms. However, a real breakthrough in this approach occurred in 2018 with the entry into force of the Act on Supporting New Investments. This introduced a completely new model – the support system was no longer limited to closed sectors. The resulting Polish Investment Zone effectively recognized the entire territory of Poland as a single large area where entrepreneurs could apply for aid for new projects. The primary support tool in both regimes remained the income tax exemption. In this respect, the Acts refer directly to the Corporate Income Tax Act of 15 February 1992 (CIT Act) – and in particular to Article 17, paragraph 1, item 34 (regarding exemptions within SEZs) and Article 17, paragraph 1, item 34a (regarding new investments within PSIs). We are currently at a key, transitional moment in this evolution. The historical SEZ system has a strictly defined expiry date – it will expire irrevocably at the end of 2026, giving way only to new regulations. This study outlines the framework for this transformation, from the zones being phased out to the current challenges and simplifications in the investment support system.

Current regulations relating and changes pursuant to the regulation

The main tool stimulating development under the 2018 Act on Supporting New Investments (PSI) is the exemption from corporate income tax (CIT). This mechanism is based on the implementation of a historically proven solution known from Special Economic Zones (SEZs). This exemption is treated directly as regional public aid from the state. Although in both regimes – the old SEZ Act and the new WNI Act – the exemption mechanism itself is based on general provisions (lex generalis), namely the Corporate Income Tax Act, the scope of this aid is not unlimited. The fixed, maximum level of support an investor can expect is defined directly by the zone regulations and specified in the relevant implementing regulations of the Council of Ministers. In the case of SEZs, the amount of support granted cannot exceed the maximum permissible amount specified in these acts.

A crucial element of the current system is significantly facilitating access to support for large businesses. Under the new regulations, in the enumerated counties (located primarily in the eastern and northern regions, including Suwałki, Białystok, and Chełm counties), minimum investment costs have been reduced from PLN 60 million or PLN 40 million to just PLN 10 million. Furthermore, in accordance with the zone rules, if an investor decides to reinvest (e.g., expand an existing plant), this threshold is further reduced by half. As a result, a large business requires just PLN 5 million to enter the support system. This solution is intended to provide a powerful incentive for private capital to invest in less developed regions of Poland.

The aforementioned mechanisms are detailed in the Regulation of the Council of Ministers of December 27, 2022, which was amended on June 13, 2025. This Act precisely defines the list of excluded activities, i.e., those that cannot apply for support under the Act. According to the new wording of the regulations (§ 2, paragraph 1, point 2), ineligible activities include, among others, the production of tobacco products and the production, bottling, and processing of alcoholic beverages (with the exception of biocomponents). On the other hand, the amendment brought a significant opening for the defense sector – by repealing § 2, paragraph 1, point 1, the production of weapons, ammunition, and explosives was removed from the current list of exclusions. As a result, entities in the defense industry can now apply for tax relief under the terms of the Act.

Changes to the Act in WNI and the reasons for the change.

The culmination of changes to the new investment support system is an amendment scheduled for 2026 (Council of Ministers bill no. UD391). To compensate entrepreneurs for the new fiscal burden, the government proposes, among other things, relaxing the investment timeframe. A key element of the amendment is extending the validity of the Support Decision ( DoW ) for all areas to 20 years. It is important to note that the DoW is a key administrative act issued within the Polish Investment Zone, formally granting the right to corporate income tax exemption. While this change does not de jure affect the amount of public aid, it de facto increases the effectiveness of this mechanism. Investors will gain a stable, 20-year time buffer, allowing for more flexible management of the effective tax rate.

An analysis of the official assumptions for the UD391 project, available on government websites, allows us to clearly understand the legislator’s intentions. As indicated in the recitals, the main goal of the planned legislative change is to reverse the negative trend and ensure that support instruments in Poland remain attractive to large businesses (both domestic and foreign). This is a direct and necessary response to new international regulations that have drastically reduced the attractiveness of traditional tax exemptions for the largest capital groups.

The need to introduce these simplifications stems directly from the adoption in 2024 of the Act on Equalization Taxation of Component Entities of International and Domestic Groups. This Act implements EU Council Directive (EU) 2022/2523. It imposes a new obligation on component entities of international groups and large domestic groups whose consolidated revenues exceed the threshold of €750 million. The overarching goal of these regulations—the minimum tax rate set at 15%—introduces significant restrictions for entities benefiting from national regional support instruments. Pursuant to Article 1, Section 2 of the Polish Act, revenues from the new tax (comprising the global and domestic equalization tax) constitute state budget revenue.

To fully understand the reasons for introducing the top-up tax, it’s necessary to refer to the recitals of the EU directive. Recitals 1 and 2 clearly express concerns about tax avoidance by giant corporate groups (MNEs). The European Union aims to ensure that they pay fair tax where they actually generate profits. Recital 4, in turn, explains the need for coherent and coordinated action in the form of a directive – this is intended to prevent fragmentation of the internal market while giving Member States the freedom to integrate these mechanisms into their national systems.

However, when imposing the new tax, the legislator provided certain protective mechanisms, crucial for entities operating in SEZs and PSIs. As explicitly noted in recital 14 of the directive, in situations where an SEZ conducts genuine economic activity requiring a physical presence (investing in production facilities and employing workers), the risk of artificial profit transfer is minimal. This has a direct impact on Polish law (generally in force since 1 January 2025). Article 101 introduces the so-called “capital and personal income tax exemption,” which mitigates the effects of the new tax proportionally to the wage costs and value of tangible fixed assets incurred in the zones.

SSE what will happen after December 31, 2026

The draft amendment to the Act on Supporting New Investments (No. UD391) does not introduce provisions extending the validity of historical SEZ permits. This represents a final acceptance that, as of December 31, 2026, the Special Economic Zone system will irrevocably expire, and the SEZ Act itself will cease to apply. Consequently, entrepreneurs using the old permits will lose the right to continue to apply the CIT exemption after this date, and their unused public aid limits will simply be forfeited. It should be emphasized, however, that the tax exemption will apply to all income actually generated (obtained) by December 31, 2026, even if it is formally reported in the annual CIT return after the SEZs expire. The overarching goal of the proposed amendment is, therefore, to encourage investors to smoothly transition to the reformed Polish Investment Zone regulations.

Artykuł The evolution of the Polish investment support system: From SEZ to new changes in PSI pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The development of artificial intelligence in medicine is no longer just a futuristic vision. Algorithms now support diagnostics, test result analysis, and disease prevention, and Polish medical law is beginning to address the challenges involved. The 2025 amendment to the Code of Medical Ethics explicitly addresses the use of AI by physicians for the first time, imposing obligations regarding patient information, obtaining informed consent, and the use of certified systems. However, the question arises: where does the role of technology end and the physician’s responsibility begin?

Amendment to the Code of Medical Ethics from 2025

The 2025 amendment to the Code of Medical Ethics addressed the use of artificial intelligence in medical practice for the first time in the history of Polish medical law. Because AI systems are defined as high-risk systems in the EU regulation on artificial intelligence, necessary procedural steps are identified before their practical application. The Code of Medical Ethics stipulates that four criteria must be met: informing the patient about the use of AI in the therapeutic process or when making a diagnosis; obtaining the patient’s informed consent to the use of AI. According to the AI Act, algorithms approved for medical use and holding appropriate certificates should be used. It is recommended that AI systems support physicians in their work rather than replace them. Therefore, the final decision regarding the use of AI algorithms in medicine rests with the physician. This emphasizes the need for continuous improvement in medical knowledge and the ability to adapt to new technologies.

The obligation to inform the patient that artificial intelligence will be used in the diagnosis or therapeutic process

Properly informing a patient about the use of artificial intelligence is understood as providing accurate information about the fact and characteristics of the AI system being used. This obligation also involves obtaining the patient’s informed consent to the use of AI systems, which means informing the patient about the possible benefits and risks of the proposed actions and the possibility of using other actions, as well as ensuring the patient knows and understands how the AI system being used works. Physicians should consider the circumstances and personality traits of the individual patient, ensuring that information is provided in an appropriate manner that allows for understanding the content of the message being communicated. The essence of the need for information is that AI systems are not infallible, and although the physician makes the final decision, the patient is aware of the potential risks arising from the use of AI systems. It is fundamentally crucial to respect two important patient rights: the right to information and the right to consent to healthcare services.

The obligation to obtain informed consent from the patient to use artificial intelligence in the diagnostic or therapeutic process

A written declaration of intent is not necessary to obtain patient consent; an oral statement or conduct that leaves no doubt as to the expression of intent is sufficient, although this can pose numerous evidentiary challenges in the event of a lawsuit against the doctor. If patients have been informed of the use of artificial intelligence in the diagnostic or therapeutic process, their consent to the provision of healthcare services will also include consent to the use of AI to provide these services, without the need for separate consent for the initial use of AI. When using AI systems in clinical practice, a distinction must be made between situations where the algorithm is crucial to the service being provided, for example, influencing the patient’s subsequent decisions without the doctor’s consent or with minimal consent. In such cases, informing the patient and obtaining their consent is essential. However, when algorithms merely support the doctor’s work, patient consent is not strictly required, but it is recommended to inform them about the use of AI systems.

The obligation to use artificial intelligence algorithms that are approved for medical use and have appropriate certificates

According to the AI Act, algorithms approved for medical use and with appropriate certificates must be used, given that medical practice may impact the health or life of the patient. The European system for the safety and market approval of products meeting EU requirements requires testing products using AI systems for compliance with standards and obtaining a certificate of conformity with the CE marking. Most medical software produced in the European Union requires external auditing and certification. A medical device can be software whose manufacturer has intended for use in at least one of the specific medical applications specified in the Medical Devices Regulation. The use of scientifically unverified therapeutic methods is prohibited. Software can be used for various purposes, for example, to control other medical devices, provide information that supports further therapeutic or diagnostic decisions, or assist in the interpretation of results generated by other devices.

The final diagnostic and therapeutic decision is always made by the doctor

The fourth regulation, Article 12 of the Code of Medical Ethics, aims to emphasize that artificial intelligence supports physicians in their work, rather than replaces them. Because scientific considerations about artificial intelligence are relatively new, societies still harbor many doubts about increasing the use of artificial intelligence, especially in classified high-risk systems. Furthermore, it is currently impossible for artificial intelligence to replace certain traits that physicians are capable of exercising, such as empathy and intuition.

Prospects and forecasts for the use of artificial intelligence in the work of doctors

The use of artificial intelligence in preventive medicine offers broad prospects thanks to the rapid analysis of millions of data points, which aims to enable early detection of disease. In such cases, the same conditions specified in Article 12 of the Code of Medical Ethics must be met as for treatment and diagnostic procedures. Currently, AI algorithms are increasingly equal to or even superior to qualified physicians in their preventive care. However, the novelty of the technology and the suggestion that AI is solely intended to facilitate physicians’ work contribute to many people’s skepticism about the further development of AI in preventive medicine. According to researchers, AI is ideal for preventing cardiovascular disease through remote monitoring of hypertension, and the algorithms can analyze, in addition to individual parameters, medical history, genetic predisposition, and lifestyle factors.

Legal status of Code of Medical Ethics

The Code of Medical Ethics was adopted in 1991 during the Extraordinary Second National Congress of Physicians. It is adopted and amended by the Supreme Medical Chamber. Although it is an important act for the medical profession, it does not have the status of a statute and, within the meaning of the Constitution, is not a legal act; instead, it is based on the Act on Medical Chambers. Physicians, as a professional group, have professional self-government, which influences regulations related to professional ethics. Resolutions in the Polish legal system are internal acts, regulating, among other things, the ethical principles of individual professions. The resolution addresses general ethical standards, respect for human rights, and upholding the dignity of the medical profession, which is further defined as physician conduct that does not undermine trust in the profession.

Liability for diagnostic errors of artificial intelligence systems

The dynamic development of artificial intelligence systems in medicine raises significant questions regarding liability for erroneous diagnostic or therapeutic decisions made using AI algorithms. This issue remains one of the most challenging in contemporary medical law, as current regulations do not yet provide a uniform model for liability for damages caused by AI systems.

Generally, according to Article 12 of the Code of Medical Ethics, the final diagnostic and therapeutic decision rests with the physician. This means that even when using advanced AI algorithms, the physician is not released from the obligation to exercise due diligence and critically evaluate the obtained results. If a physician thoughtlessly bases a diagnosis solely on the AI system’s indications, they may be subject to civil, professional, and in certain cases criminal liability for harm caused to the patient.

However, liability may also apply to healthcare providers, especially when the damage results from improper organization of the treatment process, the use of an uncertified AI system, or a lack of appropriate oversight procedures for the software used. The hospital or clinic is responsible for ensuring the organizational security of the healthcare services provided and for using tools that meet legal requirements and safety standards.

In certain situations, the manufacturer or supplier of an AI system may also be liable. This applies primarily to software malfunctions, design errors, improper model training, or the product’s noncompliance with the requirements of the AI Act and medical device regulations. In such cases, product liability or contractual liability provisions may apply.

Particular difficulties arise, however, when an incorrect diagnosis results from the so-called autonomous learning process of an AI system. Artificial intelligence systems lack legal personality and therefore cannot be held accountable independently. This necessitates determining which of the participants in the process – the doctor, the medical facility, the manufacturer, or the technology provider – actually contributed to the damage.

The doctrine emphasizes that with the further development of artificial intelligence, it will be necessary to create clearer regulations regarding liability for damage caused by AI systems in healthcare. The current legal framework relies primarily on the application of provisions analogous to traditional medical liability and product liability.

Other legal acts supplementing the issues of artificial intelligence in medicine

Act on Patients’ Rights and the Patient Ombudsman

The 2008 Act on Patients’ Rights and the Patient Ombudsman contains regulations complementary to the Code of Medical Ethics, but without addressing the topic of artificial intelligence. Patients have the right to information regarding, among other things, diagnosis, proposed diagnostic and treatment methods, and the foreseeable consequences of their use or omission, as well as the right to information about the type and scope of healthcare services provided by the healthcare provider.

Act on the Professions of Physician and Dentist

The 1996 Act on the Profession of Physicians and Dentists regulates the obligation to practice the profession in accordance with current medical knowledge, available methods and means of preventing, diagnosing, and treating diseases, in accordance with the principles of professional ethics, and with due diligence. In the case of the use of artificial intelligence in medicine as a high-risk system, this means the obligation, stipulated in the KEL, to use certified and approved systems.

Other legal acts relating to the issue of artificial intelligence in medicine

Because the field of artificial intelligence is a relatively new field of study and few legal acts have been created to date to regulate its operation, the vast majority of clinic and hospital regulations still do not directly address the use of artificial intelligence systems in healthcare services. However, indirect references can be found, such as specifying the institution’s purpose as, among other things, teaching and research activities in connection with the provision of healthcare services and health promotion, including the implementation of new treatment methods and medical technologies, which include artificial intelligence systems.

Summary

The dynamic development of artificial intelligence in healthcare means that existing legal regulations may prove insufficient in the coming years. Developing clear rules of accountability for AI-supported decisions and maintaining a balance between innovation and patient safety will be crucial. Despite technological advances, humans – physicians – should continue to play a central role in the diagnostic and therapeutic process, bearing responsibility for the patient’s well-being.

Artykuł Can AI Diagnose Patients? Medical Law and the Artificial Intelligence Revolution pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The dynamic development of the computer games market has led to a significant change in the monetization models used by game producers and publishers. The traditional sales model, based on a one-time purchase of a product by the consumer, has been largely replaced by solutions based on long-term user engagement and generating revenue through micropayments (microtransactions). Mechanisms known as loot boxes, consisting in the paid purchase of virtual packages with random content.

Although initially perceived as a means of enhancing gameplay, this mechanism is currently the subject of intense legal, economic, and social debate. It is increasingly being pointed out that the design of loot boxes utilizes psychological mechanisms similar to those that have been present in traditional gambling games for many years. The random nature of the reward, the uncertainty of the outcome, the “near miss” effect, the limited availability of certain items, and the use of dynamic animations intended to enhance the user’s emotional engagement all contribute to the blurring of the line between entertainment and gambling mechanisms.

Additional controversy stems from the fact that the vast majority of modern games using loot boxes are also aimed at minors. Unlike traditional gambling games, participation in these mechanisms does not require a specific age or meeting specific formal requirements. In practice, this means that random monetization mechanisms are also used by children and adolescents, who, due to their stage of psychological development, are particularly susceptible to the influence of behavioral design techniques and so-called dark patterns).

In recent years, the issue of loot boxes has ceased to be analyzed solely through the prism of gambling law. Regulations concerning consumer protection, digital services, and child safety in the online environment are gaining increasing importance. Discussions at the European Union level indicate that the future legal framework may be based not only on classic definitions of games of chance but also on instruments to combat manipulative practices and ensure a high level of protection for consumers using digital services.

At the national level, the problem remains equally relevant. Polish lawmakers have not yet decided to introduce a separate definition of loot boxes into the Gambling Act of 19 November 2009. This does not mean, however, that these mechanisms remain entirely outside the scope of existing regulations. In practice, administrative bodies assess each specific business model on a case-by-case basis, analyzing whether its design meets the statutory definition of gambling. At the same time, the development of the secondary market for trading in virtual items, particularly so-called skin gambling , is creating new interpretative challenges that the legislature did not anticipate when enacting the current regulations.

The changes introduced by the PEGI rating system in 2026 provided an additional impetus for reassessing the current regulations. The revised rules for classifying games with paid random mechanisms confirm the growing awareness of the risks associated with the use of loot boxes, especially for underage users. Although the PEGI rating is not a source of generally applicable law, its practical importance for the European market remains significant and may influence both the distribution of games and the future direction of legislative changes.

The purpose of this article is to analyze the current legal status of loot boxes under Polish and European Union law, taking into account recent regulatory changes, the practices of administrative bodies, and the experiences of selected European countries. Particular attention will be paid to whether the current regulations effectively protect consumers from mechanisms based on randomness and whether the current regulatory model meets the challenges of the modern digital economy.

The essence of loot boxes and their functioning models

The concept of a lootbox has not yet been defined in either Polish or European Union law. However, in the literature and by public institutions, it is generally accepted that a lootbox is a mechanism whereby the user obtains, for a fee or free of charge, a virtual package containing items whose contents remain unknown until opened. A characteristic element of this solution is randomness – the user has no influence on the item they receive, and the probability of obtaining individual rewards is determined by the game developer or platform operator.

At the definitional level, however, it should be emphasized that the term “lootbox” encompasses a wide variety of business models, the legal assessment of which cannot be uniform. Public debate often equates all mechanisms based on randomness with gambling, while from a legal perspective, individual solutions differ in both their economic structure and the degree of risk to the consumer. It is precisely this diversity that means that assessing the compliance of lootboxes with applicable regulations requires an analysis of the specific operational model, not just the presence of a random element.

The most classic model occurs in games where lootbox content is limited solely to cosmetic items, such as skins , animations, character outfits, or visual effects. These items do not affect gameplay or increase the player’s chances of success. They are intended solely for aesthetic purposes, allowing the user to personalize the appearance of their character or equipment. Such solutions were long considered relatively safe from a consumer protection perspective, but the development of secondary markets for trading virtual items has significantly changed their economic significance.

A good example is the Counter-Strike series, where weapon skins initially served only a visual purpose. Over time, however, a robust secondary market developed around these items, allowing them to be sold for real money. Consequently, the value of some virtual items began to reach several thousand, or even several dozen thousand, and in exceptional cases, several hundred thousand euros. In practice, this means that a randomly acquired item can have a tangible financial value, even though the game developer itself does not officially allow for its sale. The existence of an external market is one of the main arguments raised in the discussion on the classification of such mechanisms as potentially akin to gambling.

Loot boxes used in sports games, such as EA SPORTS FC Ultimate Team, are of a different nature. In this model, users purchase virtual packs containing player cards, coaches, or other team items. Unlike skins in games like Counter-Strike, acquired items directly impact gameplay. Acquiring rare players can increase a team’s competitiveness and improve player performance. Although the developer publishes information regarding the probability of receiving rewards in a given category, the user still doesn’t know the contents of a specific pack at the time of purchase, and the decision to purchase is based on a random mechanism.

Yet another model is found in so-called gacha games, extremely popular, especially in Asian markets and in the mobile gaming segment. This mechanism is based on randomization of characters, equipment, or other items necessary for further progression in the game. A characteristic feature of gacha systems is their close connection to long-term user monetization. Players are encouraged to repeatedly make micropayments to obtain exceptionally rare characters or items, the probability of obtaining which can be extremely low. The literature indicates that these solutions most fully utilize the mechanisms of behavioral economics and the psychology of addiction.

However, the most controversial are third-party platforms that enable the trading of virtual items and participation in games of chance that use items from video games as a form of currency. These services operate independently of game developers, leveraging the existing market for skins or other digital goods to organize mechanisms reminiscent of classic casino games. Users deposit funds or use their virtual items to participate in lotteries, roulette, duels, or other games based on chance. Unlike traditional loot boxes offered by game producers, the participant’s goal is not only to obtain a specific item but often to achieve a tangible economic benefit resulting from the possibility of reselling it.

From a legal perspective, the differences between the presented models are crucial. Not every mechanism employing an element of randomness automatically leads to its classification as gambling. Factors that should be assessed include, first and foremost, the potential for financial gain, the existence of a secondary market, the method of financing participation, the possibility of withdrawing funds, and the actual impact of randomness on achieving a specific outcome. In practice, this means a case-by-case analysis of the specific business model, rather than adopting a uniform classification for all types of loot boxes .

This approach is also reflected in the practice of many European countries. Both administrative bodies and courts are increasingly moving away from abstract assessments of the lootbox mechanism itself, focusing instead on analyzing their actual operation and impact on consumer interests. Consequently, the current legal debate no longer revolves around the question of whether lootboxes as a category should be considered gambling, but rather which monetization models justify their inclusion in a specific regulatory regime.

Loot boxes and the definition of gambling in Polish law

Assessing the compliance of lootbox mechanisms with Polish law requires, above all, an analysis of the provisions of the Gambling Act of 19 November 2009. Although the legislature has not yet decided to introduce a separate definition of lootboxes, this does not mean that these mechanisms remain outside the scope of applicable regulations. On the contrary, in practice, their legal classification depends on whether the specific operating model meets the criteria for one of the games specified in the Act.

The basic premise of the Gambling Act is to subject activities in which the outcome depends on chance to a specific regime, and the participant gains the opportunity to obtain a specific financial or material benefit. The Act does not use the term “lootbox” because it was enacted at a time when modern computer game monetization models were practically nonexistent. This necessitates a functional interpretation, taking into account the economic nature of the mechanism in question, not just its name or the technical solutions adopted by the game developer.

A key element of most loot boxes is undoubtedly randomness. The user making the purchase neither knows the contents of the package nor has the ability to influence the outcome of the drawing. However, the mere presence of a random element is not sufficient to classify a given mechanism as gambling. In practice, the nature of the prize received by the participant and the ability to assign it a real economic value are equally important.

This is where a fundamental difference between classic loot boxes offered by game developers and the mechanisms used by third-party platforms for trading virtual items becomes apparent. If the item obtained through a draw has a purely aesthetic function and cannot be legally exchanged for cash or used outside of the game environment, the arguments for classifying such a mechanism as gambling are significantly weaker. The situation is different when the item is de facto a property that can be freely traded on the secondary market, yielding a real financial benefit.

In practice, the greatest controversy surrounds so-called skin gambling. In this model, users use items obtained in-game as a means of participating in subsequent games of chance organized by third parties. Skins, which were originally purely cosmetic, are beginning to function as a kind of digital currency with measurable economic value. This mechanism leads to a situation in which participants risk losing items of real-world value in exchange for the opportunity to win an even more valuable reward. This structure bears a much greater resemblance to classic gambling games than the traditional micropayment systems used by game developers.

At the same time, caution should be exercised before drawing too far-reaching conclusions. The mere existence of a secondary market does not automatically mean that every loot box should be classified as gambling. From a legal perspective, a case-by-case analysis of the entire business model is necessary, including, among other things, the method of acquiring virtual items, the possibility of their resale, the role of the game producer, the scope of control over the trade in digital assets, and the actual economic significance of the rewards. Consequently, two mechanisms utilizing an identical element of randomness may be subject to entirely different legal assessments.

This position is also reflected in the practice of Polish administrative bodies. To date, there has been no established practice of automatically classifying all loot boxes as gambling. Authorities focus instead on analyzing specific business models and assessing whether they meet the requirements of applicable regulations. This approach reflects the nature of the Gambling Act, which uses functional definitions, leaving authorities considerable scope for assessing individual factual circumstances.

In this context, the practice of entering certain online platforms into the Register of Domains Used to Offer Gambling Games in Contravention of the Act has become particularly significant. However, such an entry does not mean that all platforms utilizing the element of randomness conduct illegal activities. Each decision is preceded by an assessment of the specific operational model of the given service. Consequently, it cannot be assumed that the lootbox mechanism itself has been deemed illegal in Poland. It is not the abstract technical structure that is being assessed, but rather its practical application.

Under current law, it seems more appropriate to ask not whether loot boxes per se constitute gambling, but which of their numerous operating models demonstrate characteristics that justify the application of the provisions of the Gambling Act. This approach avoids oversimplification and better reflects the reality of the digital market, where solutions with widely varying levels of risk to consumers coexist.

At the same time, it should be noted that even if a given mechanism does not meet the criteria for gambling within the meaning of the Act, this does not mean there is a lack of legal oversight. Modern regulations increasingly refer to consumer protection instruments, counteracting manipulative practices, and ensuring the safety of children using digital services. Therefore, analysis of loot boxes cannot be limited solely to gambling law. Regulations regarding consumer protection, digital services, and designing interfaces in accordance with fair trading principles are gaining increasing importance, and in many cases, they may prove to be a more effective tool for protecting users than traditional gambling law instruments.

Loot boxes as a challenge to consumer protection law and the regulation of digital services

Although the debate surrounding loot boxes has for many years focused primarily on gambling law, a shift in regulatory direction is now becoming increasingly apparent, both at the national and European Union levels. Contemporary challenges related to random mechanisms in computer games concern not only the classification of specific models as gambling, but also the compliance of the practices employed with the principles of consumer protection, the protection of minors, and the fair design of digital services.

This change is primarily due to the development of the digital economy. The mechanisms used by game producers are increasingly based not on traditional product sales, but on long-term user engagement and gradual increase in spending through appropriately designed psychological solutions. This phenomenon is referred to in the literature as behavioral monetization, or monetization that leverages knowledge from cognitive psychology and behavioral economics. The goal of such mechanisms is not simply to facilitate a purchase, but to create an environment that encourages users to make subsequent purchasing decisions impulsively or emotionally.

Of particular importance in this regard are so-called dark patterns, referred to in Polish literature as manipulative or deceptive design patterns. These design solutions exploit the workings of human perception and decision-making processes to induce behaviors that are beneficial to the entrepreneur, but not necessarily aligned with the consumer’s true interests. In the case of loot boxes, these can take a variety of forms – from counters counting down the time until the end of a promotion, through messages about the limited availability of specific rewards, to elaborate animations that enhance the emotional experience of opening the packages.

These mechanisms are not coincidental. Psychological research indicates that a reward system based on a variable ratio reinforcement schedule is one of the most effective ways to maintain long-term user engagement. This same mechanism has been used for many years in classic gambling games, where the unpredictability of rewards maintains a high level of motivation for subsequent attempts. In the case of loot boxes, this mechanism is transferred to the computer gaming environment and combined with an attractive audiovisual setting and the ability to immediately make another purchase.

From the perspective of consumer protection law, a crucial question is whether the use of such solutions could lead to a violation of traders’ obligations arising from provisions on fair market practices. It should be noted that contemporary EU regulations increasingly place greater emphasis not only on the content of information provided to consumers, but also on the design of digital interfaces. Therefore, the subject of assessment is increasingly not the product or service itself, but rather the architecture of the purchasing process and the impact of the interface on the user’s freedom of decision-making.

Underage users are particularly important here. Both the European Commission and the European Parliament have repeatedly stated that children using digital services require a higher level of protection than the average consumer. This stems from their limited ability to assess economic risk and their greater susceptibility to persuasive techniques used by businesses. In practice, this means that solutions acceptable to adult users may be deemed disproportionate or unfair if they are primarily targeted at children and adolescents.

The importance of this issue has increased following the entry into force of Regulation (EU) 2022/2065 on the Digital Single Market (Digital Services Act – DSA). Although this act does not explicitly regulate lootbox mechanisms, it establishes a number of obligations regarding the design of digital services and the protection of users from practices that may negatively impact their decision-making autonomy. In particular, the DSA emphasizes the need to ensure a high level of protection for minors and limit the use of solutions that exploit the vulnerabilities of specific user groups. This trend indicates that future assessments of the legality of lootboxes will increasingly be conducted not only through the lens of gambling law but also taking into account consumer protection standards applicable in the digital environment.

In parallel, the European Commission is working on a legislative package known as Digital Fairness, which aims to adapt EU consumer protection regulations to the realities of the digital economy. Issues under review include manipulative design patterns, interface design that exploits user vulnerability, and mechanisms that exert excessive psychological pressure during purchasing decisions. Although the legislative work has not yet been completed, the direction of the proposed changes clearly indicates that future regulations may also cover monetization mechanisms used in video games.

The European Parliament also highlighted the need to enhance the protection of minors in its resolution of 26 November 2025 on the protection of children online. The document indicated that mechanisms such as loot boxes, in-game currencies, and other systems based on chance should be subject to special scrutiny from the perspective of protecting children from addictive and manipulative digital practices. While the resolution is non-binding, it provides an important political signal indicating the direction of future legislative action at the European Union level.

A separate but crucial element of the modern user protection system is the PEGI age rating. Starting in 2026, this system will adopt a more stringent approach to games featuring paid random mechanisms, recognizing them as solutions requiring a higher age rating. While the PEGI rating is not a source of law and does not in itself determine the legality of specific monetization models, it reflects a growing consensus on the need to provide greater protection for minors from mechanisms that utilize randomness and behavioral design techniques.

The above circumstances lead to the conclusion that the future of loot box regulation will likely be shaped primarily by regulations concerning consumer protection and digital services, rather than solely by traditional gambling law instruments. While the Gambling Act focuses on the qualification of specific business models, contemporary EU regulations increasingly assess the design of digital services and their impact on the autonomy of user decisions. Consequently, assessing the legality of loot boxes in the future will require comprehensive consideration of both gambling law and regulations concerning consumer protection, digital services, and children’s rights.

Approach of selected European countries to regulating loot boxes – a comparative analysis

The lack of a uniform definition of loot boxes in European Union law has led individual member states to develop different models for regulating this phenomenon. These differences concern not only the legal classification of random-based mechanisms but, above all, the assessment of the risks loot boxes pose to consumers, especially minors. As a result, the European Union currently boasts both countries adopting a very restrictive approach and jurisdictions that prefer to analyze individual business models rather than create separate statutory regulations.

Belgium has taken the most stringent stance for many years. The Belgian Gaming Commission has determined that certain lootbox mechanisms meet the criteria for gambling if the participant pays a fee, the outcome depends on chance, and the reward represents a specific economic value. Consequently, some game producers have decided to remove paid lootboxes from the Belgian market or significantly limit their functionality. This solution was primarily preventative in nature and aimed at limiting children and adolescents’ exposure to mechanisms that utilize randomness as a monetization tool .

The Dutch experience was different. For many years, the Dutch supervisory authority took a similar stance to the Belgian one, deeming certain lootbox models to be in violation of gambling regulations. The dispute concerned one of the most popular monetization models used by Electronic Arts became the subject of years of administrative and court proceedings. However, the final rulings demonstrated that the classification of loot boxes cannot be based solely on the presence of an element of randomness, but requires consideration of the overall economic structure of the game, the method of trading virtual goods, and the actual potential for financial gain for the user. The Dutch experience thus highlighted the difficulties associated with applying traditional definitions of gambling law to new business models operating in the digital economy.

At the opposite extreme is the approach adopted in Poland. To date, Polish lawmakers have not decided to create separate regulations regarding loot boxes or introduce a statutory definition. This means that the assessment of individual models is based on applicable gambling regulations and an analysis of the specific factual circumstances. This approach provides administrative bodies with significant interpretative flexibility, but also limits predictability for businesses operating in the digital market.

The practice of Polish authorities indicates that a functional assessment of the specific business model is crucial. In the case of platforms enabling the use of virtual items as a means of participating in games of chance, authorities may apply the instruments provided for in the Gambling Act, including entry into the Register of Domains Used to Offer Gambling Games Contrary to the Act. However, this does not automatically mean that all loot boxes used in computer games are illegal. The Polish model is therefore based on an analysis of the economic impact of a given solution, not on an abstract assessment of the randomness mechanism itself.

An analysis of the solutions adopted in individual countries leads to the conclusion that what is becoming increasingly important is not simply classifying loot boxes as gambling, but rather protecting consumers from the psychological mechanisms that lead to excessive spending or compulsive behavior. Therefore, many countries are beginning to perceive the loot box problem as an issue that goes beyond traditional gambling law and requires the use of instruments appropriate to consumer law and digital market regulation.

This approach also aligns with actions undertaken at the European Union level. The European Commission and the European Parliament increasingly point out that the fragmentation of national regulatory models can lead to uneven levels of user protection in the digital single market. The global nature of game producers’ operations means that businesses operate simultaneously in multiple markets, adapting their business models to the most stringent requirements in force in individual countries. In practice, this means that future legal solutions will likely aim for greater harmonization of consumer protection standards at the EU level.

However, this doesn’t mean a complete ban on loot boxes is necessary. A much more likely approach would be to introduce requirements regarding the transparency of random mechanisms, the publication of actual reward probabilities, more effective age verification of users, and restrictions on the use of solutions that exploit the vulnerability of children and adolescents to persuasive techniques. Such a regulatory model would preserve the possibility of using micropayments as a legal method of financing computer games while simultaneously strengthening consumer protection.

From the perspective of Polish law, the experiences of other European countries have significant interpretative significance. They demonstrate that mechanisms operating at the intersection of gambling and digital services cannot be assessed solely through the lens of classic legal constructs developed for traditional casinos or lotteries. The development of the digital economy requires a more comprehensive approach, taking into account both the economic significance of virtual goods and the impact of interface design on consumer decisions. Consequently, the future model for regulating loot boxes will likely be based on a combination of instruments from gambling law, consumer protection law, and regulations governing digital services, rather than the exclusive application of one of these legal regimes.

Conclusions de lege lata and postulates de lege ferenda

The analysis leads to the conclusion that current Polish law does not allow for a uniform legal classification of all lootbox mechanisms. Despite the growing number of voices calling for the recognition of lootboxes as a form of gambling, the current legal status does not provide a basis for automatically subjecting this entire product category to the provisions of the Gambling Act of 19 November 2009. Each assessment requires consideration of the actual operation of the specific business model, the nature of the prize, the potential for further turnover, and the economic impact of user participation in the random mechanism.

This doesn’t mean, however, that the current regulations remain entirely insufficient. With respect to some models operating on the market – particularly platforms that use virtual items as a means of participating in games of chance or enabling their exchange for cash – current regulations may be applicable. The practice of administrative bodies to date demonstrates that the Gambling Act remains an instrument that helps counteract the riskiest forms of activity, especially when virtual goods begin to function as an equivalent of money or property.

At the same time, it’s important to note that the vast majority of modern loot boxes don’t pose a classic gambling law problem. Their primary purpose isn’t to organize games of chance in the traditional sense, but to create a monetization model that leverages psychological mechanisms that increase user propensity to make subsequent purchases. For this reason, the current regulatory debate is increasingly shifting from gambling law toward consumer protection law and the regulation of digital services.

It seems that this is precisely the direction that Polish lawmakers should also adopt. Attempting to classify all loot boxes as gambling would oversimplify the extremely diverse digital market. A much more rational solution seems to be creating separate regulatory obligations for mechanisms that utilize randomness, without the need for automatic application of the entire gambling law regime.

First and foremost, it seems reasonable to introduce full transparency into random mechanisms. Before making a purchase, users should be able to familiarize themselves with the actual probability of winning individual prizes, how the randomization algorithm works, and whether this probability remains constant for all participants. Such solutions already exist in some computer games, but currently they are primarily driven by voluntary decisions by businesses or requirements in specific foreign markets.

The second direction of change should be to strengthen the protection of underage users. In light of current psychological knowledge and the positions of EU institutions, there is little doubt that children are particularly susceptible to the influence of mechanisms based on a variable reward system. Therefore, it seems reasonable to consider limiting the ability of people under a certain age to purchase paid loot boxes or introducing mandatory parental control mechanisms to effectively manage minors’ expenses.

Regardless of the above, legislators should consider introducing more detailed regulations regarding third-party platforms enabling the trading of virtual items. It is this market segment that currently raises the greatest concerns from the perspective of consumer protection and compliance with the Gambling Act. In particular, situations in which items obtained in-game become a means of participation in subsequent games of chance or can be directly converted into cash require analysis. In such cases, the line between a digital service and gambling activity becomes significantly blurred, justifying the application of more restrictive oversight measures.

Obligations regarding marketing activities should also be a crucial element of future regulations. In practice, loot boxes are primarily promoted through influencers and online creators, whose audiences often include minors. While advertising collaborations in and of themselves cannot be deemed unacceptable, situations in which marketing messages exclusively emphasize the possibility of winning exceptionally valuable prizes, disregarding the actual probability of winning them, or employing techniques that could create unreasonable expectations among recipients regarding potential benefits, require special consideration. In this regard, both consumer protection regulations and regulations regarding the integrity of advertising messages may apply.

The issues presented demonstrate that the issue of loot boxes is not limited to gambling law. In fact, it exemplifies a much broader phenomenon involving the use of advanced digital design techniques to influence users’ economic decisions. Technological advancements increasingly render traditional private and public law frameworks inadequate for assessing new business models based on user behavior analysis and interface design that maximizes consumer engagement and spending.

Consequently, the future of loot box regulation will likely depend less on further expansion of the definition of gambling than on the development of European consumer protection standards in the digital environment. Regulations on the transparency of digital services, countering manipulative design patterns, and ensuring a high level of protection for children using the internet are becoming increasingly important . These instruments may become the primary tool for mitigating the risks associated with loot box operations in the coming years.

It should therefore be assumed that effective regulation of this phenomenon requires a multifaceted approach, combining instruments of gambling law, consumer protection law, and digital market regulation. Only such a comprehensive solution will achieve the right balance between the freedom of game producers to conduct business and the need to ensure a high level of protection for users, particularly children and adolescents, who remain most vulnerable to the negative effects of random-based mechanisms.

Artykuł Lootboxes in Computer Games – Between Gambling Law and Consumer Protection. Regulatory Analysis Against the Background of Polish and European Union Law. pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

You see a video, a product catches your eye, and an “add to cart” button is already blinking in the corner of the screen. A few seconds later the order is placed, paid for, and on its way — all without leaving the app. That’s how TikTok Shop works: a closed-loop model in which the path from watching a piece of content to completing a purchase has been cut to the bare minimum. That very immediacy is its greatest strength and, at the same time, the source of its most serious concerns.

A platform that in 2017 drew around 72 million monthly users now attracts more than 1.5 billion — and between 11 and 15 million in Poland alone. TikTok has stopped being merely a place for entertainment and has turned into a powerful advertising and sales engine, combining influencer marketing, algorithmic personalization, and the emotional purchasing impulse. For businesses, it is a new and remarkably effective retail space. For consumers, it is an environment in which it grows ever harder to tell an authentic recommendation from an ad, or a fleeting enthusiasm from a considered decision.

That is precisely why TikTok Shop has landed at the center of lawmakers’ attention. While its model is not unlawful, the platform’s operation intersects with an entire web of regulation: from consumer law and the ban on “dark patterns,” through the EU’s DSA and DMA, data protection and safeguards for minors, all the way to advertising, media, and electronic communications law. This article shows where the convenience of one-tap shopping ends and the protection of the buyer’s free will begins.

What makes the TikTok Shop platform innovative?

Today, an effective marketing strategy is becoming an increasingly important priority for sellers. In Poland, monopolies in sales are relatively rare. Many competing companies operate in most industries. When purchasing products, consumers must choose from hundreds, or even thousands, of options offered by different brands. The scale of this phenomenon is evidenced by the fact that in the fourth quarter of 2025, over 2.9 million active businesses operated in Poland alone, the largest group of which were those associated with the retail sector. Meanwhile, buyers generally do not want to spend much time thoroughly analyzing goods available on the market. They are often guided by the opinions of other users, brand recognition, or media coverage. Therefore, in an information society based on the dynamic development of social media, tailoring advertising to current consumer needs and behaviors becomes crucial for running a business. Authentic and credible recommendations from trusted creators are becoming more important, and for many buyers, they are more persuasive than formulaic television commercials.

Considering the above arguments, many companies are making changes to their advertising strategies, for example, opting for influencer marketing. Online creators typically publish aesthetically and thematically consistent content that captures the interest of users with similar preferences and tastes. A business partnering with an influencer who shares similar values gains the opportunity to reach a large group of potential consumers, made up of the influencer’s followers. TikTok has become the dominant platform enabling the implementation of the marketing model described above. In 2017, the application had approximately 72 million monthly active users, and according to data from 2026, this number has increased to approximately 1.54 billion. In Europe alone, TikTok has already reached over 200 million users, and in Poland, the number ranged from 11 to 15 million. The average time spent on the platform is 70 minutes per day, which translates to approximately 35 hours per month. These statistics also indicate the continued growth of TikTok’s popularity, confirming the future of using social media for advertising and promotional purposes.

The development of influencer marketing significantly changed existing marketing practices, and its increasing prevalence led to the transformation of the TikTok app from a social media platform into an advertising system. The effective and profitable collaboration between media and advertising prompted the platform to take the next step in its development, combining these two sectors. Users were offered the opportunity to completely simplify the purchasing process. Previously, consumers only saw product advertisements, which attracted their attention and prompted them to search for sales offers. However, this pattern left them time to consider whether a purchase was truly necessary or necessary. It was also likely that, despite their interest in the product, they would eventually forget about the advertised product, and therefore their desire to purchase it.

The solution to the marketing strategy described above turned out to be a new feature presented by TikTok: TikTok Shop. The innovative nature of this tool is based on a closed-loop model, meaning the purchasing process takes place within a single app. Users first encounter content promoting a specific item. They then have the option to immediately purchase it by adding the advertised item to their shopping cart in the bottom corner of the app. TikTok acts as an intermediary for payment, shipping, and the entire order process. In this way, the app has evolved not only into a profitable advertising system but also an online store, becoming a marketplace platform that mediates payment, logistics, and order fulfillment.

The origins of TikTok Shop

Initially, the online shopping phenomenon developed through e-commerce. Its popularity contributed to the diversification of online sales into several business models: B2C, B2B, and C2C. The former involves a relationship between a business and an individual customer (examples include online stores such as Zalando, Zara, and IKEA). B2B refers to transactions between businesses, while C2C refers to sales between individuals, such as on platforms like Vinted, OLX, and Allegro.

These e-commerce models typically control the sales process independently. Their profits largely come from consumers who shop by searching for specific products they need. Entrepreneurs compete with each other through marketing activities aimed at convincing consumers of the quality of their products and building brand recognition.

In the next stage, the development of social media, and consequently influencer marketing, contributed to the emergence of a completely new type of buyer, one driven by impulse. Online creators present a specific lifestyle on their profiles in a significantly idealized form, which attracts the attention of their followers and becomes a role model. The desire to emulate the creator they follow can manifest itself both in their behavior and in the possessions they possess. The influencer thus becomes a person who inspires and encourages the purchase of a given product. Even if, from a rational perspective, the buyer doesn’t need the product, they often decide to purchase it under the influence of influencer marketing.

Additionally, a new branch of e-commerce has emerged, known as discovery commerce . This model relies on the discovery and purchase of new items while actively browsing social media. Highly advanced algorithms select content for users that aligns with their tastes or interests, in order to evoke certain emotions that then transform into a strong purchasing impulse. Social media platforms, recognizing this profitable sector, have contributed to the development of social commerce, including TikTok Shop. This solution capitalizes on users’ fleeting enthusiasm and allows them to complete their order without leaving the app. The entire process, from advertising content to payment and shipping, is handled by TikTok, which can limit the time available for rational purchase consideration.

What exactly does the purchasing process look like on TikTok Shop?

TikTok Shop is not a separate app, but a new feature added to the TikTok platform. There’s no need to create a new account or install a new app. This solution provides access to a wide group of potential consumers, as every existing TikTok user over the age of 18 can familiarize themselves with the new feature. This solution gives businesses multiple ways to reach consumers. The platform offers a separate tab, “Shop,” where users can search for specific products using filters and categories, or browse recommended items based on their activity on the platform.

Products offered by sellers using the TikTok Shop service can also be viewed on the “For You Page” tab. This is the subpage most frequently visited by users. This option is especially useful when a company decides to use influencer marketing. A creator posts a video promoting a selected product, and buyers are immediately presented with a purchase button at the bottom of the page. Consumers can also directly access the profiles of brands and creators to find the products they offer or promote.

The latest feature, TikTok Live, is gaining popularity. Before the live stream begins, the seller or influencer adds products available in the TikTok Shop. During the live stream, the host can showcase products, communicate with users, and answer their questions via chat. This can increase the credibility of the product and the seller, as well as encourage consumers to make a purchase, which they can do without interrupting the stream.

The very process of posting ads on TikTok Shop helps build consumer trust. Becoming a seller requires thorough verification, which the TikTok platform conducts to protect users from unreliable and fictitious businesses.

The first step to becoming a seller is to log in to your TikTok Seller Center account using your email address, phone number, or existing TikTok account. You’ll also need to fill out an application form with information that proves your seller credentials, such as your company name, address, and contact information.

After successful verification, the seller completes their store profile, adding a description, name, logo, seller details, addresses, customer service information, and tax information. It’s also necessary to configure payment and delivery methods, including the shipping address, available delivery methods, order processing time, and return policy. Connecting the store dashboard to a regular TikTok account is also crucial. This allows for tagging offered products in live videos, etc. The seller then has the option to publish their product, including the title, description, price, available models, and inventory. The platform also allows businesses to add listings by importing a product catalog from another sales platform.

After a consumer makes a purchase, the seller receives a sale notification in the TikTok Seller Center. The seller is then responsible for packaging and shipping the item to the user, which can be done manually or using external order processing systems.

Distance selling and consumer rights

The TikTok Shop platform offers the option of concluding a sale via a distance contract. This does not require the parties to be physically present at the same time, but rather requires at least one means of distance communication (Act of 30 May 2014 on consumer rights, Article 2). Therefore, when making a purchase through the TikTok Shop, consumer rights are governed by national and European Union law.

In Poland, the primary legal act regulating these activities is the Act of May 30, 2014, on Consumer Rights. Article 12 requires businesses to clearly inform consumers in distance contracts, including the method and deadline for contract execution, the total price including taxes, the right to withdraw from the contract, the complaint procedure, and the seller’s identifying information. The TikTok Shop platform is therefore obligated to provide the required information to the user before finalizing the order via the app. An important regulation is also included in Article 17 of the aforementioned Act and concerns the requirement to design the interface in a way that confirms the consumer’s awareness of the obligation to pay. In the case of platforms that allow order completion via a “button,” it must be clearly marked, e.g., “I buy with an obligation to pay” or “I buy and pay.” Otherwise, the contract is not concluded. The requirements described above are referred to as ” button ” solution ” and are intended to protect consumers from accidentally concluding paid contracts. Alternative obligations also arise from the Directive of the European Parliament and of the Council of 25 October 2011 on consumer rights.

The Consumer Rights Act also implements the EU Commodity Directive (2019/771), introducing uniform standards for the conformity of goods with the contract. A trader is liable for any lack of conformity of goods with the contract upon delivery and for two years from the date the discrepancy is discovered. The Act also governs basic consumer claims in the event of non-conformity, including repair or replacement of the goods, and if this is not possible, a price reduction or withdrawal from the contract.

Given that the sales strategy on the TikTok Shop platform relies on recommendation algorithms and influencer marketing, the Omnibus Directive (EU) 2019/2161 of November 27, 2019, plays a significant role in consumer empowerment. Its regulations introduce the obligation to provide information about the lowest price, disclose whether reviews were published by verified consumers, and indicate whether the seller is a business or an individual. The Omnibus Directive therefore increases consumer awareness and allows consumers to make more rational and manipulation-free purchasing decisions.

Digital Services Act Regulation

Due to their global nature, online platforms reach hundreds of millions of users. Content published through them can reach a very wide audience, thus influencing social, political, and economic relations. Massive social networking sites, therefore, go beyond simply providing entertainment or communication services and digital space, and are beginning to shape the reality around us.

The strong influence of individual platforms on current international relations has initiated more stringent oversight, including through the provisions of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act – DSA). Based on this regulation, TikTok was recognized by the European Commission as a Very Large Online Platform (VLOP). This status is granted to portals with monthly active users exceeding 10% of the EU population. TikTok exceeded the threshold and was classified as a VLOP in 2023.

Platforms deemed globally influential are not solely responsible for removing illegal content. They are also required to counteract the negative consequences that may arise from their operation. Among the most important responsibilities of very large online platforms (VLOPs) is the identification and assessment of systemic risks and the potential implementation of proportionate mitigation measures. Impacts on fundamental rights, democratic processes, the protection of minors, public safety, and the dissemination of illegal content are particularly scrutinized. Once a specific risk is identified, measures are planned to counteract its escalation, such as modifying the user interface or changing certain advertising practices. In emergency situations, the European Commission has the authority to require VLOP providers to assess the platform’s impact on the development of the crisis, implement specific mitigation measures, and submit periodic reports on the effectiveness of these actions. Very large online platforms are also required to undergo an annual independent audit of compliance with the Digital Services Act (DSA) and regularly publish comprehensive reports on their activities. The aim of this action is to ensure transparency of the platform’s operation towards users and supervisory authorities.

The DSA also regulates advertising by introducing the requirement to maintain a public ad repository. This repository should include, among other things, the ad’s content, advertiser, funding entity, broadcast time, and the number of recipients. This solution is intended to ensure transparency in advertising messages and enable social and scientific analysis of platforms’ promotional activities. Restrictions have also been imposed on recommendation systems. This means that VLOPs are required to provide users with at least one way to display content that is not based on profiling, meaning it does not use user activity history or data. To monitor platforms’ compliance with the EU regulation, it is also possible to impose a requirement to share data on, for example, the performance of recommendation algorithms with the European Commission, national digital service coordinators, or verified researchers.

TikTok, however, is not subject only to the obligations of very large online platforms. It is subject to all regulations provided for in the Digital Services Act. According to Article 26, each advertisement must be clearly identified as promotional material and indicate the advertiser, the funding entity, and the mechanism by which it was tailored to the user. This restriction is particularly useful for the TikTok Shop platform, where sponsored content is commonly created in the manner of regular content published by creators. Limiting the phenomenon of so-called hidden advertising through the provisions described above aims to increase user awareness.

One of the DSA’s key goals is also the protection of minors. When designing their services, platforms are required to consider a high level of protection for minors and their privacy. It is prohibited to display advertisements based on the profiling of minors when the platform has knowledge of the user’s minor status. The goal is to limit the use of children’s data for marketing purposes and reduce the risk of addictive use of the app.

The European Commission has also become concerned about potential negative consumer behavior resulting from the increasing transformation of large social media platforms into e-commerce portals. Complex profiling algorithms, influencer marketing, and instant purchases can encourage users to make impulsive decisions or even become dependent on purchasing processes. Articles 25 and 27 of the Consumer Protection Act (DSA) mitigate this risk. Designing web interfaces that manipulate or complicate consumer decision-making – so-called dark patterns – is prohibited. Examples of unacceptable solutions include hiding options that are less favorable to the business, making it difficult to unsubscribe from services, or designing buttons that encourage a specific choice. Users should also be fully aware of how the recommendation system works; therefore, platforms are required to clearly present its main parameters and the possibility of changing the content suggestion method.

Tamper protection and dark patterns

A key premise of the TikTok Shop platform is the immediacy of purchases. While this solution is very beneficial for businesses and, typically, consumers, it can lead to abuse. Sales without leaving the app, a simplified order completion process, and algorithmic personalization of recommended products seem to provide greater convenience when shopping online. However, some activities can be classified as ” dark patterns”, manipulations used to mislead users and influence their decisions. Because the practices described above can lead to impulsive behavior and distort consumer will, they may be treated as unfair market practices and subject to criminal penalties.

The Act of 23 August 2007 on Counteracting Unfair Market Practices defines an unfair market practice as a sale that is contrary to good practice and significantly distorts or may distort the market behavior of the average consumer before, during or after the conclusion of a product agreement , in particular a misleading market practice and an aggressive market practice (Act of 23 August 2007 on Counteracting Unfair Market Practices, Article 4). The main grounds for considering a market practice misleading include the dissemination of false information or truthful information in a potentially misleading manner. Such misleading information typically concerns the existence of a product, its type or availability, price, the method of price calculation, or the existence of a special price advantage.

To encourage immediate purchases, sellers pressure buyers with messages suggesting limited availability or a limited-time promotion for a specific product. Examples of such messages include phrases like “100 people are viewing the product,” “offer ends in 2 hours,” or “only 4 items left.” This practice is not illegal and is one of the most common marketing mechanisms. Problems arise when the website or portal is programmed to continually extend promotions, the offer doesn’t actually expire after the specified date, or the counter restarts upon page refresh.

Misleading practices, such as suggesting the limited nature of a permanently available offer, and aggressive practices, such as exerting time pressure, may result in legal consequences. In addition to the aforementioned Act of 23 August 2007 on Combating Unfair Commercial Practices, this issue is also regulated by Directive 2005/29/EC concerning unfair business-to-consumer commercial practices in the internal market. This directive distinguishes between misleading commercial practices and aggressive commercial practices. Together, they constitute unfair commercial practices, which include, in particular, actions that are contrary to the requirements of professional diligence and that significantly distort or are likely to significantly distort the economic behavior of the average consumer who reaches or is targeted by the practice, or the average member of a group of consumers if the commercial practice is targeted at a specific group of consumers (Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (“Unfair Commercial Practices Directive”), Chapter 2, Article 5, paragraph 2).

Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 (Omnibus Directive) is also intended to combat various manifestations of the “dark patterns” phenomenon. It requires sellers to disclose the lowest price for a product within the last 30 days. This is intended to prevent the practice of artificially inflating prices and then announcing sales. The practice of fake reviews has also been curbed by introducing an obligation to disclose whether and how reviews posted on sales websites are verified. The Omnibus Directive also introduced the requirement to indicate on marketplace platforms whether the seller is a private individual or a professional entrepreneur, so that consumers are aware of who they are buying from.

The European Union has also introduced restrictions related to the design of digital services, contained in Regulation 2022/2065 on the Digital Single Market (DSA). As a result, online platform providers cannot design, organize, or operate their online interfaces in a way that misleads, manipulates, or otherwise interferes with or limits the ability of service users to make free and informed decisions. The regulation therefore directly addresses the fight against “dark patterns,” i.e., website design practices that deliberately use deceptive techniques, such as pre-selected consents or difficult unsubscribes.

The President of the Office of Competition and Consumer Protection (UOKiK) has broad authority to protect consumers from the unfair commercial practices mentioned above. Under the Act of 16 February 2007 on Competition and Consumer Protection, one of his powers is to protect the collective interests of consumers, including through provisions counteracting unfair market practices. If necessary, the UOKiK President may initiate proceedings against a business, ordering it to cease the unfair practice, or requiring the seller to remedy the effects of the violation. Should a business fail to comply with the guidelines, he may impose a fine of up to 10% of the business’s turnover in the previous year.

The number of legal acts, including EU documents, regulating unfair commercial practices reflects the considerable interest in this issue among both legislators and consumer protection authorities. TikTok Shop, as a social commerce model, is not illegal. It utilizes mechanisms combining influencer marketing, personalization, and emotional impact on the recipient, but the design of the user interface is crucial for this platform. The popularity of mass sales portals has contributed to the increasing use of “dark patterns” by businesses over the past few years. For this reason, the European Union and the Office of Competition and Consumer Protection (UOKiK) are increasingly rigorously monitoring sales tactics and issuing new legal acts to protect consumers and their free will when making purchases.

Influencer Marketing and Advertising Law

The effectiveness of influencer marketing stems from combining advertising with the ability to make an immediate purchase. Affiliate links, product tags, or direct purchase buttons, such as those on the TikTok Shop platform, are displayed beneath posts, videos, or other promotional materials. This purchasing model has proven effective by significantly simplifying the ordering process, thus reducing the time consumers spend considering the rationale behind the transaction.

The popularity of the marketing strategy described above stems from its perception by users, who perceive it as authentic and credible. Influencers present promoted products in a natural way, integrating them into their daily routine. However, if the material does not solely reflect the creator’s personal opinion but is created after receiving a benefit in return, it is considered commercial communication. This means it is subject to legal regulations on advertising and consumer protection. In Poland, influencers should clearly label advertising content in accordance with the Recommendations of the President of the Office of Competition and Consumer Protection. These regulations are intended to prevent misleading users.

Only content regarding a product that the influencer purchased independently and for which they did not receive remuneration or other benefits can be marked as a private opinion. Such material contains genuine feelings and opinions and therefore does not constitute advertising under the law and is not subject to advertising law. This is the most credible and reliable form of review for potential consumers, as it was created by a person not under any obligation to the manufacturer.

A manufacturer may enter into an agreement with an influencer to promote a product in exchange for a free product, financial benefit, or other form of remuneration. This creates legally regulated advertising. It may take the form of a post, report, or live broadcast in which the creator demonstrates how they use the product and its positive properties. Due to the natural presentation of the product as an everyday element, the recipient may have difficulty distinguishing a genuine recommendation from commercial content. The Act of August 23, 2007, on Counteracting Unfair Market Practices, classifies the act of concealing a promotional message as a misleading omission. Failure to clearly indicate the commercial nature of the material may hinder consumers’ proper assessment of the message and directly influence their purchasing decisions.

Another common advertising strategy is to feature a product integrated into published content without directly promoting it, for example, by placing it in the background of the material. This phenomenon is called product placement. Activities covered by advertising and consumer protection law also include, among others, affiliate and partner links, ambassador programs, and partner competitions. In Poland, these practices must contain clear, understandable to the average recipient, and visible advertising labels from the very beginning, such as “advertisement,” “paid collaboration,” or “sponsored content.” The Office of Competition and Consumer Protection (UOKiK) also recommends the use of two-level labeling, meaning that, in addition to the information contained in the content, the platform’s functionality must also be used to announce the paid collaboration. Detailed guidelines can be found in the Recommendations of the President of the UOKiK regarding the labeling of advertising content by influencers. Material is considered advertising content not only when the influencer receives monetary compensation in exchange for its creation. The same obligation applies when promoting your own business, receiving a free product or service, or obtaining a sales commission via an affiliate link or discount code (Recommendations of the President of the Office of Competition and Consumer Protection regarding the marking of advertising content by influencers).

In the event of non-compliance with the Recommendations of the President of the Office of Competition and Consumer Protection regarding the labeling of advertising content by influencers, pursuant to the Act of 16 February 2007 on Competition and Consumer Protection, the Office of Competition and Consumer Protection (UOKiK) conducts proceedings against entrepreneurs using practices that violate the collective interests of consumers. Actions may be taken against advertisers, influencers, and marketing agencies. Therefore, responsibility for incorrect labeling of advertising content rests not only with the creator publishing the material but also with all entities participating in organizing the promotional campaign. One of the sanctions that the President of the UOKiK has the right to impose is a financial penalty. Incorrectly labeled promotional material can also be considered surreptitious advertising. Due to the dynamic development of influencer marketing, the proper creation of marketing content is currently widely subject to UOKiK scrutiny. Therefore, it is worth clearly and understandably labeling sponsored publications, among other things, to avoid significant financial penalties.

Personal data protection

TikTok Shop, as a hybrid social network and e-commerce platform, processes a significant amount of data related to both user activity and purchasing processes. The app’s operation is based on audience profiling and matching the most relevant content. Therefore, the platform’s operations are subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

In addition to user data such as name, surname, contact details, shipping addresses, and payment information, media platforms also collect information that allows for behavioral analysis. Time spent browsing specific products, interactions with ads, and the history of items added to carts or wish lists allow the TikTok Shop platform to create a personalized recommendation system based on past activity. This phenomenon creates so-called behavioral advertising, a marketing strategy based on user profiling using advanced algorithms to predict future purchasing decisions. The concept of profiling refers to the automated processing of personal data, particularly for the purpose of predicting a user’s economic situation, personal preferences, interests, health, and location.

According to the GDPR, profiling is permissible, but it also comes with a number of obligations. Platforms are obligated to transparently inform users about, among other things, the purposes of profiling, the legal basis for data processing, the consequences of the actions taken, and their rights, including the right to object to profiling. Data of minors is particularly protected. Due to the growing popularity of the TikTok app among young users, it was necessary to subject it to special regulations in this regard. In the area of information society services, the processing of data of children over 16 years of age is lawful. An exception is made for situations in which a person with parental authority or guardianship provides prior consent. However, EU member states may introduce a lower age limit in their laws, but it must be at least 13 years old, as is the case in Poland, for example. To ensure that platforms enforce their obligations related to the protection of minors, they should use appropriate age verification mechanisms. In practice, however, this solution requires further improvement due to the common practice of users providing false data during registration.

The President of the Office of Competition and Consumer Protection (UOKiK) plays a crucial role in protecting users, especially the collective interests of consumers. He is authorized to take action against entrepreneurs who engage in unfair market practices, design manipulative interfaces, and so on. Personal data protection, however, falls primarily within the remit of the Office for Personal Data Protection (UODO), which oversees compliance with the GDPR and the secure processing of information by companies and institutions. Due to its global influence, TikTok has attracted increasing attention from EU authorities in recent years and is becoming the subject of more frequent inspections. Due to the platform’s European headquarters being located in Ireland, the relevant supervisory authority is the Irish Data Protection Commission (DPC). For example, in 2025, this institution imposed a fine of €530 million on ByteDance, the app’s owner. The fine was imposed on the transfer of user data from the European Economic Area to China in violation of the GDPR and the failure to demonstrate data protection at the level guaranteed in the EU.

The GDPR is supplemented by Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), which regulates, in addition to the processing of personal data, the confidentiality of electronic communications, also known as ePrivacy. Due to the scope of its regulations, the provisions of this directive have particular relevance to the TikTok Shop application. The platform uses numerous tracking technologies, such as cookies and mobile device advertising identifiers, to monitor user activity. Information may be stored on a user’s device or accessed only after obtaining prior consent. Exceptions are made only for technologies strictly necessary to provide the service requested by the user, such as remembering a shopping cart. An additional ePrivacy regulation was also envisaged, the purpose of which was to replace the current directive and harmonize the personal data protection rules applicable in all EU Member States. The changes were to include, among other things, simplifying the rules regarding cookies. However, the project encountered legislative difficulties and was not adopted by decision of the European Commission.

Abuse of Market Power and the Digital Markets Plan

The dynamic expansion of the largest digital platforms’ influence has led to the need to adapt competition law to the new situation, particularly in the digital market. To this end, the European Union adopted Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act – DMA). The Act introduces the concept of a gatekeeper. This term refers to an entrepreneur with an influential position in the internal market, through which business users reach end users. A gatekeeper provides a core platform service and maintains an established market position.

The dominant position of a gatekeeper is also associated with a number of obligations. Among other things, the practice of self-preferencing, which involves favoring one’s own products or services over the offers of other businesses using the platform, is prohibited. In the case of TikTok Shop, this could involve using recommendation algorithms to increase the visibility of products promoted by individual sellers, without applying objective and fair advertising criteria. This type of favoritism and limiting the reach of individual entities could lead to a distortion of fair competition between businesses using TikTok Shop for sales purposes.

By decision of the European Commission, BytaDance Ltd. was granted gatekeeper status solely for the operation of the TikTok application as a social media platform. The DMA regulations governing the gatekeeper position do not apply directly to TikTok Shop, but they may impact the rules for recommending products and using entrepreneurs’ data.

Media law and audiovisual regulations

Audiovisual materials are the primary tool for promoting and selling products on the TikTok Shop marketplace. Therefore, the app’s operations are also subject to scrutiny for compliance with media law and regulations governing audiovisual media services. The dominant role in this regard is played by Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation, or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive – AVMSD) and the Broadcasting Act of 29 December 1992, which implements it into Polish law. As a result of the amendment to the Act of 11 August 2021, the regulations have been extended to video-sharing platforms, including the TikTok app.

Video-sharing platforms are primarily obligated to implement appropriate measures to protect minors from harmful content that could negatively impact their moral, mental, or physical development. These provisions have been implemented into Polish law through Article 47e of the Broadcasting Act, which mandates, among other things, the marking of potentially inappropriate content with special graphics for young viewers. These regulations are particularly important for the TikTok Shop platform due to the constantly growing number of underage users. Posting content that spreads hatred and discrimination is also prohibited.

TikTok Shop, a hybrid social media platform and e-commerce platform, is often used to publish so-called audiovisual commercial communications—images used to directly or indirectly promote goods, services, or individuals (Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services, Article 1). Article 9 of the AVMSD requires member states to ensure that such communications are easily recognizable, thus prohibiting hidden audiovisual commercial communications. The use of subliminal techniques or the inclusion of discriminatory content would also be illegal. The National Broadcasting Council (KRRiT) is responsible for ensuring compliance with audiovisual law. Its remit includes, among other things, overseeing the activities of video-sharing platform providers.

The sales method used by TikTok Shop may seem analogous to teleshopping, offerings directly to consumers to deliver goods or services in exchange for payment. This modern form of interactive audiovisual commerce (live shopping) bears numerous similarities to traditional teleshopping. The mechanisms of both aforementioned sales methods involve presenting the product, its specific features, available options, and generally encouraging the recipient to purchase. However, teleshopping is targeted at a general, anonymous audience who may only be interested in the recommended product. Meanwhile, TikTok Shop relies on advanced algorithms that target promotional content to users who, based on their previous activity, have shown interest in similar content.

Platform liability under e-commerce regulations

The original act regulating the legal liability of online platforms in the European Union was Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce). Its foundation was the so-called safe harbor principle, i.e., the principle of limited liability of online intermediaries. According to this principle, hosting service providers and online platforms were not liable for content or goods published by users, provided they had no actual knowledge of the illegal nature of the content or goods or services or, upon obtaining such knowledge, promptly removed any infringements. Furthermore, the directive did not impose a general obligation on platforms to monitor content published by users.

However, the ongoing development of digital platforms has made it necessary to amend the current liability model. Regulation (EU) 2022/2065 – Digital Services Act (DSA) – came into effect on February 17, 2024. This regulation does not eliminate the principle of limited liability but significantly expands monitoring obligations, especially for very large online platforms (VLOPs). One of the key obligations introduced under the new regulations is the Know Your Business Customer (KYBC) principle. This regulation aims to increase the safety of consumers shopping online by limiting sales conducted by dishonest or anonymous traders. Before enabling sales through its platform, an online platform must collect and verify basic data identifying the seller. The required information includes, among others, the trader’s name, registered office address, contact details, registration number in the relevant register of traders, and the trader’s payment account details. In the event of refusal to provide the specified data or providing it falsely, the platform should prevent the trader from conducting sales until the situation is resolved.

A problematic issue related to the TikTok Shop app is defining the platform’s responsibility for transactions conducted by sellers using it. Although TikTok Shop formally acts as an online intermediary, it can be argued that its operating mechanism goes beyond passive hosting. A recommendation system using algorithms, promoting offers, and providing marketing and analytical tools to sellers are the mechanisms TikTok Shop uses to shape consumer behavior and purchasing decisions. The platform’s influence on the visibility of offers and the order fulfillment process may support assigning it broader responsibilities in overseeing the online sales process.

Regulations on electronic communications, including the European Electronic Communications Code and the Polish Electronic Communications Law

The TikTok Shop platform does not constitute an electronic communications service under European Union law, but its operations provide for various forms of electronic communication. TikTok Shop’s use of push notifications, in-app messages, and marketing communications requires the platform to comply with regulations governing electronic marketing and the protection of user privacy in electronic communications. The primary legal acts regulating these aspects are Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (EECC) and the Act of 12 July 2024 – Electronic Communications Law.

The primary function of TikTok Shop is to enable entities to sell goods through the social media platform. Article 2 of the European Electronic Communications Code defines an electronic communications service as the transmission of signal transmissions or the provision of interpersonal communications services. The mere ability to exchange messages between users or with sellers does not automatically qualify the TikTok Shop platform as a provider of electronic communications services, as this is not its core competency and does not constitute its core business. However, because electronic communications are primarily used for marketing purposes, it is obligated to comply with regulations governing direct marketing and the protection of user privacy.

Push notifications, messages sent directly to users’ mobile devices, are an increasingly popular marketing solution. TikTok Shop uses them to provide information about order status, discounts, time-limited campaigns, or the launch of live shopping. Transactional notifications regarding order fulfillment, shipping, or payment status are typically part of the contract and do not require marketing consent. However, notifications encouraging potential consumers to make a purchase are classified as direct marketing and, in accordance with electronic communications law, require prior user consent.

The practice of using automated calling systems and electronic means of communication for advertising purposes without the user’s prior consent is also prohibited. Users should be clearly informed about the purpose of receiving marketing communications, the data controller, and the possibility of withdrawing consent, which should not result in any negative consequences. With respect to the TikTok Shop platform, the above position means that it is unlawful to send promotional content to users solely based on the fact that they have an account on the app.

TikTok Shop is the clearest example of how thin the line between entertainment, advertising, and commerce has become – a one-tap purchase woven into a stream of content is now as effortless as liking a video. Yet that convenience comes at a price: the closed-loop model and algorithmic personalization shrink the time left for rational reflection, while responsibility for protecting the consumer shifts increasingly away from the buyer and onto the platform and the legislator. EU and national regulations – from consumer law, through the DSA and DMA, data protection and safeguards for minors, all the way to media and electronic communications law – form a web meant to counterbalance the platform’s power and restore the buyer’s awareness of their own choices. TikTok Shop thus remains a dual phenomenon: on one hand a groundbreaking innovation in digital commerce, on the other a test of whether the law can keep pace with a technology that sells faster than we can think.

Artykuł A Store in Your Pocket, the Law in the Background: TikTok Shop Under the Regulators’ Lens pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are pleased to share that Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, one of Poland’s leading legal and financial publications, devoted to one of the most intriguing regulatory phenomena of the digital economy: loot boxes in video games.

“Loot boxes in video games: between gambling law and consumer protection – a regulatory analysis under Polish and European Union law”

The article goes far beyond the classic “are loot boxes gambling?” debate. By analysing the actual monetisation models used in modern games — particularly microtransactions involving paid acquisition of virtual packages with randomised content — we examine how these mechanisms interact with:

• Polish gambling law and the statutory definition of a game of chance,
• EU consumer protection rules,
• digital services regulation,
• taxation and compliance considerations,
• and emerging concerns related to behavioural design and dark patterns.

One of the key conclusions is that the regulatory importance of loot boxes stems not only from their possible resemblance to gambling mechanisms, but also from the fact that such systems are frequently used by inexperienced consumers, including minors, who may be especially susceptible to manipulative design techniques aimed at increasing engagement and spending.

This is precisely the type of cross-sector regulatory issue in which our team has extensive experience — combining expertise in technology law, highly regulated industries, digital services, compliance, consumer protection and EU regulatory frameworks. We are proud that this experience is reflected in publications appearing in professional journals such as Infor.

Read the article here: Infor – Loot boxes in video games: between gambling law and consumer protection

Artykuł Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, devoted to loot boxes in video games pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Analysis of key changes for business managers

We have analyzed the proposed changes to criminal procedure, which introduce a new structure for conducting proceedings, moving away from the current, restrictive model. The foundation of the amendment is the liberalization of regulations and the strengthening of procedural guarantees for suspects, which is a direct response to the need to implement EU directives and restore the adversarial standard.

Compared to the current state of affairs, the draft law shifts away from the inquisitorial model and instead provides real legal protection for economic participants. These changes are crucial for individuals serving on corporate boards, effectively increasing their legal security in the area of risks inherent in running a business.

Recent years in Polish criminal procedure have been characterized by the primacy of procedural efficiency over individual rights, leading to a systematic tightening of discipline. This has manifested itself, among other things, in the facilitation of the use of preventive measures and the admission of evidence obtained illegally. Project 1600 makes a systemic shift towards strengthening citizen guarantees, restoring the principle of full equality of the parties and fair litigation. For the business sector, this means a real opportunity to actively shape their defenses at the pre-trial stage, instead of adopting a solely reactive approach.

A key element of this reform is to address years of neglect related to the implementation of the so-called EU defense directives (Directive 2013/48/EU of the European Parliament and of the Council of 22 October 2013 on the right of access to a lawyer in criminal proceedings and in European arrest warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty (OJ L 294, 2013, p. 1)). The existing regulations failed to meet European standards, which became the basis for the European Commission to initiate proceedings for Poland’s violation of its treaty obligations. The most important change in this regard is Article 245 § 1 of the Code of Criminal Procedure, which requires that a detained person be immediately allowed to contact a defense attorney and have a direct conversation. As the bill’s justification indicates, detention is a criminal act aimed at prosecuting, and therefore a lawyer or legal advisor providing assistance at this stage has full defense status. Furthermore, the introduction of mandatory on-call duty for lawyers and legal advisors, as defined in Article 245 § 2 of the Code of Criminal Procedure, guarantees effective legal assistance from the very first minute of the proceedings.

This solution is important for management bodies, as the isolation of an organization’s leader creates the risk of paralyzing the entity’s decision-making. The guarantee of immediate legal assistance enables the implementation of crisis management procedures and significantly reduces the risk of submitting flawed procedural declarations with a high degree of economic complexity.

Project 1600 introduces systemic mechanisms to limit the arbitrariness of imposing preventive measures in isolation. A significant change is the increase in the threshold for a severe sentence from 8 to 10 years (Article 258 § 2 of the Code of Criminal Procedure) and the requirement to demonstrate a real risk of perversion in each case. This eliminates the automatic nature of detention in commercial cases, obliging the court to assess whether the severity of the impending sanction actually poses a threat to the course of proceedings in the specific factual circumstances.

The new wording of Article 248 §§ 2 and 3 of the Code of Criminal Procedure serves to discipline law enforcement agencies. It introduces an absolute obligation to release a detainee if, within twenty-four hours (reduced from the current forty-eight) of being brought to the attention of the court, they are not served with a detention order and justification. The legislature establishes an absolute prohibition on re-arrest based on the same facts and evidence. This solution curbs the practice of circumventing procedural deadlines by repeatedly detaining an individual under the same circumstances. For governing bodies, this regulation guarantees the stability of their procedural status and protects personal freedom through repeated isolation.

The reform is complemented by the expansion of evidence disclosure. The amendment to Article 156 § 5a of the Code of Criminal Procedure removes the previous restriction on the exclusion of witness statements from accessible files. The current wording requires the authority to immediately provide the suspect and defense attorney with evidence attached to the arrest request. Restoring full equality of arms allows the defense to substantively refute the prosecution’s entire case, rather than select fragments. For management, implementing these rigors provides fundamental protection against the use of isolation as a pressure tool, directly protecting the reputation and operational stability of the company.

The planned amendment introduces a fundamental change to the Polish criminal process, restoring the primacy of procedural fairness to establishing the material truth at all costs. A key element of the reform is the definitive rejection of the admissibility of so-called “fruits of the poisonous tree,” which directly implements the fair trial standard. Under the current legal framework, shaped by the controversial wording of Article 168a of the Code of Criminal Procedure, evidence cannot be deemed inadmissible solely on the basis that it was obtained in violation of procedural rules or through a prohibited act. Therefore, previous case law permitted the procedural validation of evidence from unlawful sources, provided it was not obtained as a result of the most serious crimes (such as murder or deprivation of liberty). The amendment replaces this model with an absolute prohibition on using materials obtained as a result of a prohibited act. This excludes the possibility of subsequently deeming evidence obtained in violation of the law admissible and prevents law enforcement agencies from remedying procedural deficiencies by invoking an overriding public interest.

In the area of operational control, the reform introduces adequacy rules, which significantly modifies the current procedure for handling incidental evidence. The previous regime of Article 168b of the Code of Criminal Procedure allowed for almost unlimited use of wiretapping materials in cases involving any crime, even if they did not fall within the list of acts justifying the use of operational control. This led to a phenomenon referred to in the doctrine as fishing expeditions, where surveillance ordered in high-stakes cases became a gateway to seeking marginal violations, such as fiscal violations, which would not, in themselves, legitimize such a profound interference with civil liberties. The amendment thus compels the prosecutor to exercise a higher level of investigative diligence, shifting the defense’s focus from substantive analysis of evidence to reviewing the legality of its acquisition.

For the business sector, the implementation of these solutions brings enormous guarantee benefits, primarily in the form of protecting the integrity of business communications and eliminating uncertainty as to the procedural status of managers.

The analysis is based on the standards developed by the European Court of Human Rights in the context of Article 6 of the ECHR, as well as the constitutional principle of proportionality and the right to privacy. The new wording reflects the desire to civilize criminal procedure, where the reliability of state authorities becomes paramount over the ad hoc effectiveness of the public prosecutor, which is the foundation of economic security in a state governed by the rule of law.

The overall proposed changes to criminal procedure should be viewed as a significant strengthening of the legal position of entrepreneurs and management. The shift from an inquisitorial model to a fully adversarial and transparent judicial process significantly minimizes the risk of procedural abuses, which could previously be used as a tool for extraneous pressure in commercial disputes. The reinstatement of strict evidentiary prohibitions and the shortening of procedural deadlines for deprivation of liberty compel law enforcement agencies to adhere to a higher standard of diligence, which directly translates into the operational stability of businesses. Under the new legal framework, the most crucial element of a defense strategy is not only the substantive refutation of allegations but, above all, rigorous oversight of the legality of the state’s operational actions.

Sources:

Directive 2010/64/EU of the European Parliament and of the Council of 20 October 2010 on the right to interpretation and translation in criminal proceedings (OJ L 280, 26.10.2010, p. 1);

Directive 2012/13/EU of the European Parliament and of the Council of 22 May 2012 on the right to information in criminal proceedings (OJ L 142, 1.6.2012, p. 1);

Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters (OJ EU L 130, 1.5.2014, p. 1, OJ EU L 201, 30.7.2019, p. 47, OJ EU L 39, 21.02.2022, p. 1 and OJ EU L 2023/2843, 27.12.2023);

Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings (OJ L 65, 11.03.2016, p. 1);

Artykuł Criminal Procedure Reform (Project 1600) – Polish Standards of Protection in Commercial Matters pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Biostimulants in aesthetic medicine – current regulatory challenges for manufacturers, distributors and clinics

The aesthetic medicine market is currently one of the fastest-growing healthcare segments in Europe. Particularly dynamic growth is observed in so-called tissue biostimulants, preparations used to stimulate the body’s natural regenerative processes. While traditional fillers dominated just a few years ago, today both manufacturers and physicians are increasingly turning to preparations containing poly-L-lactic acid (PLLA), calcium hydroxyapatite, polynucleotides, and collagen preparations, whose mechanism of action is based on the stimulation of tissue regeneration processes rather than solely on mechanical effects.

The growing popularity of these products, however, raises a number of legal questions. These concern not only their qualification as medical devices, but primarily the manner of communicating their properties and permissible forms of promotion. In practice, manufacturers, importers, distributors, and aesthetic medicine clinics increasingly face the dilemma of drawing the line between providing reliable product information and advertising, which is subject to stringent legal restrictions.

This issue has become particularly important following the entry into force of the Act of April 7, 2022, on Medical Devices and the issuance of the Regulation of the Minister of Health on the Advertising of Medical Devices. Polish legislators have decided to introduce some of the most detailed regulations regarding the advertising of medical devices in Europe. These restrictions directly impact the activities of manufacturers, distributors, importers, healthcare providers, and marketing agencies serving the aesthetic medicine industry.

At the same time, it’s important to remember that advertising medical devices does not operate in isolation from other legal regulations. Businesses must consider not only the provisions of Regulation (EU) 2017/745 on medical devices (MDR) and the Medical Devices Act, but also regulations on consumer protection, combating unfair market practices, combating unfair competition, personal data protection, and sometimes regulations governing the practice of medical professions and healthcare activities. Consequently, a single marketing campaign may be subject to simultaneous assessment under several different legal regimes.

Particular difficulties arise with products used exclusively by individuals with appropriate professional qualifications. In practice, most biostimulants are administered via injection by a physician or other qualified medical professional. This raises the question of whether products intended exclusively for professional use can be advertised at all, and if not, how can businesses legally present information about their offerings on websites, social media, or at industry conferences.

The purpose of this study is to present practical aspects of applying regulations regarding the advertising of medical devices, using tissue biostimulants as an example. Particular attention will be paid to the boundary between advertising and information, the obligations of manufacturers and distributors, the most common marketing errors, and compliance solutions that can reduce the risk of violating applicable regulations.

Biostimulants – why do they raise so much legal controversy?

From a legal perspective, biostimulants constitute one of the most interesting categories of medical devices. Their specificity lies in the fact that, although formally subject to regulations specific to medical devices, their method of use, risk profile, and patient perception often resemble medicinal products more than traditional medical devices.

In market practice, patients often fail to recognize the difference between a medicinal product and a biostimulant. Both types of products are administered in a doctor’s office, require medical qualifications, involve intervention in the body, and may cause adverse reactions. Therefore, for the average consumer, the difference between a medicinal product and a medical device remains almost invisible.

From the perspective of EU law, however, what matters most is not the method of administration or the site of use, but the mechanism by which the principal intended action is achieved. The MDR is based on a fundamental distinction between medicinal products and medical devices. If the principal action is achieved by pharmacological, immunological, or metabolic means, the product will generally be classified as a medicinal product. However, if the mechanism of action is based on other properties – for example, physical or mechanical – the product may be classified as a medical device, even if its use leads to long-term biological effects.

This very boundary has been the subject of numerous interpretational disputes for years. In the case of biostimulants, the preparation does not replace natural processes occurring in the body nor does it produce a therapeutic effect through a pharmacological mechanism. Its purpose is to create conditions enabling the activation of natural regenerative processes, such as stimulating fibroblasts to produce collagen or rebuilding the extracellular matrix. It is this mechanism that causes most currently available biostimulants to be classified as medical devices.

This does not mean, however, that all products marketed as “biostimulants” automatically fall into the same regulatory category. Legal classification is determined by a case-by-case analysis of the specific product, its intended use, and the mechanism of action specified by the manufacturer. In practice, there are also products that, despite similar aesthetic applications, may be subject to different legal regimes, including regulations concerning medicinal products, cosmetics, and medical devices.

This is fundamental for subsequent marketing communications. Already at the product qualification stage, the manufacturer should consider the target audience, the information that can be conveyed to recipients, and the advertising restrictions that will apply. Mistakes made at this stage often result in the need to redesign the entire marketing strategy after the product has been launched.

Can biostimulants be advertised? Limitations under the Medical Devices Act and the MDR Regulation

One of the most frequently asked questions by manufacturers, importers, and healthcare providers is whether biostimulants can be advertised to a broad audience. The answer to this question is ambiguous and requires consideration of both the provisions of the EU MDR Regulation, the Polish Medical Devices Act, and implementing regulations governing advertising.

In practice, a certain pattern can be observed. Many entrepreneurs equate the fact that a product has been legally introduced to the market with the ability to freely promote it. However, this assumption is incorrect. Approval of a medical device for marketing does not automatically mean that the manufacturer or distributor can use any marketing tools. On the contrary, the more specialized the product and the greater the risk associated with its use, the greater the restrictions on its communication.

In the case of biostimulants, it is particularly important that the vast majority of these products are intended for use only by individuals with appropriate professional qualifications. Treatments using them require medical qualification, maintaining appropriate aseptic conditions, and injections performed in accordance with medical knowledge. Therefore, the recipient of the product is not the patient, but a medical professional who then uses the product while providing healthcare services or aesthetic medicine treatments.

This circumstance is of fundamental importance from the perspective of advertising law.

Advertising of medical devices is not advertising of consumer products.

The Medical Devices Act adopts different assumptions than the regulations governing the advertising of ordinary consumer goods. The legislator’s goal was not to create freedom in marketing activities, but to ensure that decisions regarding the use of medical devices are made primarily based on medical knowledge, not advertising messages.

For this reason, the legislator decided to introduce numerous restrictions on both the content of advertising and its target audience. In practice, this means that, already at the design stage of a marketing campaign, entrepreneurs should answer three fundamental questions:

• who is the actual user of the product,
• to whom the message is addressed,
• whether the information provided is of a promotional nature or purely informational.

Only a combined analysis of these elements allows us to assess the compliance of the planned communication with applicable regulations.

The intended use of the product is crucial.

In practice, there’s a common misconception that advertising opportunities are determined solely by how a product is sold. This isn’t the correct approach.

The manufacturer’s intended use of the product and the user group specified in the technical documentation and instructions for use are of much greater importance. If the manufacturer has specified that the product should only be used by professionals, this also influences the assessment of the admissibility of directing marketing messages to individuals without medical qualifications.

This is precisely the situation with most biostimulants. These products are intended for procedures requiring appropriate professional training, knowledge of anatomy, aseptic techniques, and the ability to recognize contraindications. From a regulatory perspective, it would be difficult to justify extensive advertising campaigns aimed at the general public when the product itself cannot be used independently by the average consumer.

This doesn’t mean, however, that businesses cannot provide any information regarding such products. On the contrary, the law permits the provision of information about medical devices, but the line between information and advertising requires individual assessment.

Advertising and information – why is the distinction so important?

In practice, the vast majority of disputes concerning medical device advertising do not focus on obvious promotional campaigns. Much more often, the problem arises with materials that businesses define as “informational,” while from the perspective of regulatory authorities, they may be considered advertising.

Importantly, neither the MDR nor the Medical Devices Act provide a legal definition of medical device advertising. However, the lack of a statutory definition does not imply any freedom of interpretation. Case law and doctrine assume that the nature of a message is primarily determined by its actual purpose, not the name given to it by the trader.

If the primary purpose of the message is to increase interest in the product, build a positive image of the product or encourage its purchase or use, there is a high probability that the message will be classified as advertising, regardless of whether it contains a direct call to purchase.

In practice, this means that even seemingly neutral materials may be considered advertising if they are prepared in a way that highlights only the advantages of the product, ignores its limitations or uses characteristic marketing techniques.

Is the manufacturer’s website itself an advertisement?

This is one of the most frequently asked questions in the practice of law firms advising manufacturers of medical devices.

There is no single universal answer to this question.

The mere presence of product information on a website does not constitute advertising. A website can function as a product catalog, a database of technical documentation, or a platform for communicating with medical professionals. However, if the product’s presentation goes beyond providing objective information and begins to utilize typical marketing mechanisms, the risk of such communication being classified as advertising significantly increases.

For example, posting instructions for use, declarations of conformity, technical data, or information on how to use a product on a website will generally be informative. However, a situation in which the same website includes slogans such as “revolutionary rejuvenation method,” “the most effective biostimulator available on the market,” “instant lifting effect,” or “spectacular results guaranteed” should be assessed differently. In such cases, the message goes beyond neutral information and begins to serve a promotional purpose.

Therefore, designing websites for medical device manufacturers requires close collaboration between marketing departments and legal and regulatory affairs departments . In practice, even seemingly minor changes in product presentation can result in a different legal classification for the entire message.

The boundary between advertising and information – practical problems of producers and aesthetic medicine clinics

While the distinction between advertising and information seems intuitive, in practice it is one of the most problematic issues related to the functioning of the medical device market. This stems primarily from the fact that contemporary marketing communication rarely takes the form of classic television or print advertising. Businesses much more frequently utilize websites, social media, newsletters, podcasts, webinars , expert blogs, and educational materials. Each of these forms can—depending on how it is prepared—be considered both neutral information and advertising.

In practice, there is no single element that automatically determines the classification of a given message. Supervisory authorities and courts analyze all the circumstances, taking into account the content of the message, its form, presentation, audience, and the actual purpose of the publication. This means that even a message containing only truthful information may be considered advertising if its primary purpose is to encourage the purchase or use of a product.

For this reason, businesses should move away from the simple question: “Are we allowed to publish this information?” and instead ask themselves: “How will the average recipient perceive this message?” It is the recipient’s perspective, not the business’s intention, that will in many cases determine the legality of the message.

Website – an entrepreneur’s business card or an advertising tool?

The first place where doubts arise is almost always the manufacturer’s, distributor’s, or clinic’s website. For many businesses, it is their primary channel of communication with the market, yet it is also one of the most frequently scrutinized elements during inspections conducted by regulatory authorities.

The mere presence of information about a medical device on a website is not prohibited. Businesses have the right to present information about the products offered, their properties, methods of use, technical documentation, and instructions for use. However, problems arise when the presentation method goes beyond providing objective information.

A good example is comparing two descriptions of the same product.

The first one could be as follows:

“A preparation intended for the reconstruction of tissue volume in accordance with the instructions for use. The product is intended for use by qualified medical professionals.”

This description is for informational purposes only. It is limited to presenting the product’s intended use and user group.

The following message should be assessed differently:

“The most innovative biostimulator on the market. It instantly rejuvenates the skin and provides a spectacular lifting effect after just one treatment.”

Although both messages refer to the same product, the second employs typical marketing tactics. It uses evaluative terms (“the most innovative,” “spectacular effect”), promises of effectiveness, and suggests a competitive advantage. This type of message is difficult to consider as neutral technical information.

In practice, this means that entrepreneurs should analyze not only the content of the information, but also the way it is expressed. Often, it is individual marketing terms that determine the overall nature of the message.

Newsletters and mailings to customers

Another tool increasingly used by manufacturers and distributors is newsletters and emails directed to customers. Again, not every message can be considered advertising.

If a newsletter contains information about changes in regulations, new regulatory requirements, announcements from supervisory authorities, or changes to product instructions, it will generally serve an informative purpose. However, messages whose primary purpose is to increase sales of a specific product should be assessed differently.

For example, a message titled “Changes to MDR requirements for technical documentation” would be educational in nature. An email with the slogan “Discover the most effective biostimulant available on the market – order today” would undoubtedly serve an advertising function.

This does not, of course, prohibit commercial communication. However, entrepreneurs should remember that such communication is subject to all restrictions applicable to advertising medical devices.

Webinars and training – education or product promotion?

The significant increase in the popularity of webinars organized by medical device manufacturers has also led to this form of communication starting to attract the attention of supervisory authorities.

Organizing training for doctors and other medical professionals is nothing unusual. On the contrary, in many cases, proper user training is an essential element in ensuring the safe use of a device.

The problem arises, however, when a webinar described as a “scientific training” actually focuses almost exclusively on promoting one product, highlighting its advantages while omitting limitations, contraindications, and alternative methods of treatment.

In practice, it is worth adopting the principle that the more educational the material is, the greater the emphasis should be on presenting objective medical knowledge, and not only information beneficial to the manufacturer.

Scientific conferences

Similar problems apply to industry conferences. Sponsorship of scientific events by medical device manufacturers is common practice and raises no objections in itself. However, risks arise when the scientific component is subordinated to marketing objectives.

In practice, particular caution should be exercised when presenting research results for a specific product. Results should be presented honestly, taking into account methodological limitations and the full clinical context. Selectively presenting only favorable data may be viewed as misleading.

LinkedIn – professional communication can also be advertising

Many content creators assume that since LinkedIn is primarily a professional platform, the content published there is strictly business-related. However, this assumption is far-fetched.

If a LinkedIn entry is limited to information about participation in a conference, obtaining a certificate, a scientific publication or organizational changes in the company, it is generally difficult to attribute an advertising nature to it.

However, if a publication contains incentives to use a specific product, comparisons with competitive products, promises of specific clinical effects or highlights the advantages of a product in order to increase sales, it may be considered advertising, regardless of the fact that it was published on a professional website.

LinkedIn is increasingly being used as a marketing platform for the healthcare market. Therefore, communications conducted via this platform should also be subject to the company’s internal compliance procedures.

Social media – the biggest challenge for the biostimulant market

Social media has completely transformed the way patients make decisions. Just a dozen or so years ago, the primary source of information was a doctor’s consultation and manufacturer-provided materials. Today, many patients primarily seek information on Instagram, TikTok, Facebook, and YouTube, guided by the opinions of influencers , physicians with educational profiles, and other users’ testimonials.

For entrepreneurs, this represents a huge marketing opportunity, but also significant regulatory risk. Traditional regulations regarding medical device advertising were designed with press, radio, and television advertising in mind. Modern online communication is much more dynamic and often combines elements of education, personal branding, and product promotion. As a result, assessing the legality of a specific message requires a case-by-case analysis of its actual purpose and context.

Instagram – where does education end and advertising begin?

Instagram remains the most important communication channel used by aesthetic medicine clinics and physicians performing biostimulant treatments. This platform relies primarily on visual communication, which inherently has a stronger impact on audiences than traditional product descriptions.

From a legal perspective, however, it cannot be assumed that every post about a procedure constitutes advertising. Physicians have the right to conduct educational activities, explain the mechanisms of individual procedures, discuss indications and contraindications, and comment on scientific publications. Such activities contribute to increasing patient awareness and should not, in and of themselves, be equated with advertising.

The line is crossed when communication begins to focus on promoting a specific medical device or building its commercial appeal. This applies particularly to publications containing marketing slogans, incentives for procedures, information about price promotions, comparisons with competing products, or emphasizing the exceptional effectiveness of a specific product without providing the full medical context.

In practice, it is worth adopting the rule that the more a post resembles advertising material prepared by a marketing agency, the greater the risk of it being classified as an advertisement for a medical device.

TikTok – short form does not exempt from responsibility

Just a few years ago, few medical device manufacturers considered TikTok a business communication tool. Today, the situation is completely different. More and more clinics are publishing short videos demonstrating treatment procedures, patient reactions, and the aesthetic effects achieved after using specific products.

The specific nature of this platform, however, means that the message is necessarily simplified. A video lasting several dozen seconds rarely allows for the presentation of contraindications, possible side effects, or limitations of the product’s use. As a result, there is an increased risk of creating a one-sided image of the product, highlighting only its benefits.

From a compliance perspective , businesses should therefore exercise particular caution when preparing materials published on platforms based on short audiovisual forms. Merely shortening the message does not exempt them from ensuring its compliance with regulations on advertising medical devices.

Influencer Marketing – New Regulatory Risk

influencers remains one of the most dynamically developing areas of marketing. This phenomenon has also impacted the aesthetic medicine market. Increasingly, individuals with significant social media followings are publishing treatment reports, presenting their recovery processes, and describing their own experiences using specific products.

From a legal perspective, such collaboration requires special caution. Even if the influencer doesn’t mention a specific product, the way the treatment is presented can lead to increased interest in a specific technology or manufacturer. If the publication is created as part of a commercial collaboration, additional obligations arise under regulations regarding labeling advertising content and consumer protection.

In practice, the producer should remember that responsibility for the legality of the message is not always limited solely to the influencer. Depending on the cooperation model, the entrepreneur initiating the campaign may also be responsible for the manner in which marketing communications are conducted.

Doctor as a product ambassador

The use of physicians’ authority to promote medical products remains a particularly sensitive issue. Public trust in medical professionals means their statements have a much greater impact than traditional advertising messages.

This doesn’t mean, however, that doctors cannot publicly comment on the technologies they use. On the contrary, sharing medical knowledge, clinical experience, and research results is a crucial element in the development of medical science and practice. The problem arises only when a doctor’s statement ceases to be expert-based and begins to serve a marketing function.

The risk increases especially when a physician appears in manufacturer-produced materials, uses promotional language, or explicitly encourages consumers to choose a specific product. In such cases, the regulatory authority may determine that the use of the medical profession’s authority serves to increase the product’s commercial appeal, which requires assessment from the perspective of regulations governing the advertising of medical devices.

Before – after photos – an effective marketing tool or a source of risk?

One of the most distinctive elements of communication in aesthetic medicine is photographs depicting the patient’s appearance before and after the procedure. From a marketing perspective, this is an extremely effective tool for influencing potential clients. However, from a legal perspective, its use raises a number of concerns.

Firstly, such materials often lead the recipient to believe that the treatment will provide a guaranteed result. However, the results of medical procedures depend on numerous individual factors, such as the patient’s health, age, biological predispositions, and adherence to post-treatment recommendations . Presenting single, spectacular results can lead to unrealistic expectations.

Secondly, publishing patient photos requires compliance with regulations on personal data protection and the protection of personal rights. Consent to perform a procedure does not constitute consent to the dissemination of the image. The provider should obtain separate, informed, and voluntary consent covering the publication of photographs in specific communication channels.

Third, it’s important to remember that even properly obtained patient consent doesn’t eliminate the risk of a publication being considered an advertisement for a medical device. If a photo is used to promote a specific product or increase interest in a specific procedure, the entire message should be assessed in light of advertising regulations.

In practice, this means that the use of ” before – after ” photography requires simultaneous analysis from the perspective of medical device law, personal data protection, civil law, and consumer protection regulations. Failure to consider even one of these aspects can lead to significant legal risk.

Misleading advertising – why can a truthful message also violate the law?

One of the most common mistakes made by businesses operating in the medical device market is the belief that because all information contained in an advertisement is truthful, the message is automatically legal. However, this assumption is far-fetched and is not supported by either the EU MDR or national regulations regarding medical device advertising.

Assessing the legality of advertising is not limited to verifying the veracity of individual claims. Equally important are the manner in which they are presented, the context of the overall message, and the potential impact on the recipient’s decisions. Advertising can be misleading not only by providing false information, but also by selectively presenting facts, omitting important limitations, or emphasizing only the positive aspects of a product’s use.

This is why Article 7 of the MDR should be considered one of the key regulations governing the marketing communications of medical device manufacturers. This provision prohibits the use of texts, names, trademarks, images, symbols, or other markings that could mislead the user or patient regarding the intended purpose, safety, or performance of the device. This prohibition applies not only to labels and instructions for use but also to advertising materials and other forms of market communication.

In practice, this means that an entrepreneur should analyze each message not only in terms of compliance with the product’s technical documentation, but also from the perspective of how the average recipient might interpret the information presented.

Not only falsehood, but also silence

One of the most frequently underestimated aspects of advertising is the responsibility for omitting information that is important to the recipient. Businesses typically focus on avoiding false claims, much less on analyzing the consequences of omitting specific information.

Imagine an advertisement for a biostimulator in which the manufacturer presents excellent aesthetic results achieved after the treatment. All photographs are authentic, and the description of the effects reflects the actual experiences of selected patients. At the same time, the advertisement contains no information about the need for medical qualification, possible contraindications, the risk of side effects, or the body’s varied response to treatment.

Formally, none of the claims presented are false. Nevertheless, the recipient may be misled into thinking that achieving the presented effect is typical, predictable, and practically guaranteed. Consequently, the message may be considered misleading because it creates unrealistic expectations regarding the product’s performance.

A similar risk arises when using terms such as “safe,” “non-invasive,” “natural,” or “side-effect-free.” Even if a product has a high safety profile, using such phrases can imply an absence of risk, which is difficult to reconcile with clinical reality.

Can we use the terms “best”, “most effective” or “revolutionary”?

Marketing language often relies on the use of evaluative terms. Advertisements feature phrases such as “market leader,” “the most innovative product,” “the best rejuvenation technology,” or “a breakthrough in aesthetic medicine.” In the consumer goods sector, this type of communication is common. However, when it comes to medical devices, much greater caution is required.

First, an entrepreneur should have objective evidence to support any comparative or evaluative claim. Second, even the existence of scientific research does not always justify the use of terms suggesting absolute superiority over all competing solutions. In medical practice, the effectiveness of therapy depends on many factors, including the patient’s qualifications, the physician’s experience, and individual biological conditions.

From a compliance perspective, a much safer solution is to use a description based on clinical trial results and technical parameters of the product, instead of using general marketing slogans.

Practice of supervisory authorities – the growing importance of digital communication

Recent years have seen a significant increase in supervisory authorities’ interest in online communications. While previously, oversight activities focused primarily on traditional advertising materials, they now also analyze websites, social media profiles, newsletters, videos published on streaming platforms , and collaborations with influencers.

This trend is consistent with a broader trend observed at the EU level, where increasing emphasis is being placed on countering manipulative marketing practices and ensuring a high level of protection for consumers using healthcare services. Consequently, businesses should assume that online communications are subject to the same scrutiny as traditional forms of advertising.

The Polish Office of Competition and Consumer Protection and consumer protection – the second pillar of responsibility

Although the primary legislation regulating the advertising of medical devices remains the Medical Devices Act, businesses cannot limit their analysis solely to this legal regime. Consumer protection regulations also apply, in particular the Act on Combating Unfair Market Practices and the Act on Competition and Consumer Protection.

From the perspective of the President of the Office of Competition and Consumer Protection (UOKiK), the impact of a message on the average consumer is of particular importance. If a communication exploits emotions, raises unjustified expectations, or suggests characteristics that the recipient is unable to independently verify, it may be considered a practice that violates the collective interests of consumers.

In practice, this means that a single marketing campaign may be assessed simultaneously by different authorities under different legal frameworks. Manufacturers should therefore design their marketing activities to ensure compliance not only with medical device regulations but also with consumer protection and fair competition regulations.

Compliance instead of reaction after inspection

Experience in recent years shows that a significant number of violations are not the result of deliberate actions by businesses, but rather a lack of appropriate internal procedures. Marketing materials are often prepared by external advertising agencies that are intimately familiar with the mechanisms of selling consumer products but lack experience in the regulated sector.

compliance systems that encompass the entire marketing communications process is becoming increasingly important . Every piece of content – whether it’s an Instagram post, a product brochure, a webinar , or a YouTube video – should be reviewed not only by the marketing department but also by those responsible for regulatory and legal matters.

This approach allows for the identification of risks before the material is published, reducing the likelihood of initiating administrative proceedings, disputes with supervisory authorities and negative image consequences.

The most common mistakes of manufacturers, importers, distributors and clinics – what to avoid in practice?

Recent experience shows that most violations of regulations regarding medical device advertising do not result from deliberate disregard for applicable regulations. Quite the opposite – entrepreneurs operating in the aesthetic medicine market typically strive to conduct their business in compliance with the law, but they encounter difficulties resulting from ambiguous regulations and the dynamic development of modern communication channels. Marketing of medical products is increasingly conducted via social media, educational platforms, and industry events, whereas existing regulations were primarily designed with traditional forms of advertising in mind.

In practice, however, there are several recurring mistakes that occur regardless of the size of the company and which should be taken into account when designing a marketing strategy.

Mistake No. 1 – Equating commercial information with neutral information

One of the most common misconceptions is that material doesn’t constitute advertising solely because a business owner has designated it as “information.” This approach is unsupported by applicable law.

The nature of a message is assessed based on its actual function, not the name given by the author. If the material highlights the benefits of a specific product, builds its market appeal, or is intended to encourage the recipient to choose a specific product, there is a high probability that it will be classified as an advertisement, even if it does not contain a classic call to purchase.

An example would be an article published on the manufacturer’s website titled “Modern Skin Regeneration Possibilities.” If the majority of the text is devoted to a single product, highlights its advantages over the competition, and leads to a contact form allowing purchase of the product or registration for training, it’s difficult to consider such material solely educational.

In practice, entrepreneurs should remember that supervisory authorities analyze not only the content of the publication, but also its location, method of presentation and connection with the entrepreneur’s business activity.

Mistake #2 – Copying Cosmetic Product Marketing

The aesthetic medicine market is developing in parallel with the cosmetics market, resulting in many marketing activities being mutually inspired. However, from a regulatory perspective, this approach can lead to serious problems.

Cosmetics marketing relies primarily on building emotions, visual appeal, and creating a specific lifestyle. Meanwhile, communication regarding medical devices is subject to much more stringent requirements. Using identical marketing techniques for products covered by the MDR may lead to violations of advertising regulations, especially if the message ignores the limitations imposed by the product’s intended use or its method of use.

In practice, this means that the marketing department of a medical device manufacturer should not automatically use solutions used in cosmetic campaigns, even if they seem effective from a business point of view.

Mistake No. 3 – overexposing the effects of the treatment

Marketing materials for biostimulants often focus almost exclusively on aesthetic effects. Images depicting wrinkle smoothing, facial contour improvement, or increased skin firmness undoubtedly attract audiences and enhance the message’s appeal.

The problem, however, is that the results of aesthetic medicine treatments are individual. They depend on the patient’s age, health, skin condition, previous medical procedures, lifestyle, and the experience of the practitioner. Presenting individual, exceptionally positive results without proper context can lead to unrealistic expectations on the part of potential patients.

From a compliance perspective , it is much safer to present information about the mechanism of action of the product and its intended use than to focus all communication on spectacular visual effects.

Mistake No. 4 – Ignoring contraindications and limitations of use

Another common mistake is presenting a product solely through the lens of its benefits. Marketing materials often emphasize the product’s effectiveness, innovation, and safety, while failing to mention situations in which its use may be inadvisable.

Meanwhile, reliable communication regarding medical devices should also include information about contraindications, limitations of use, and the need for medical qualification. This doesn’t mean, of course, that every advertisement must include full instructions for use, but omitting all information regarding potential risks could lead to accusations of misleading consumers.

Mistake #5 – Lack of cooperation between marketing and legal departments

In many companies, marketing materials are prepared by external creative agencies or marketing departments that lack specialized knowledge of medical device regulations. Only then does the completed material reach the legal department, often just prior to publication.

affairs specialists and lawyers at the marketing campaign design stage. This avoids the need for later material withdrawal or costly modification.

Mistake #6 – Lack of social media procedures

Many companies have extensive procedures for approving product catalogs and printed materials, yet they don’t regulate the rules for publishing content on social media. Yet, it’s short posts on Instagram, Facebook, and LinkedIn that are currently published most frequently and have the greatest impact on a company’s image.

The lack of internal guidelines leads individual employees to publish content at their own discretion, often unaware of the legal consequences of using specific phrases or photographs. In practice, it’s worth developing separate policies for online communication, covering topics such as product presentation, use of photographic materials, publishing coverage of industry events, and collaborating with physicians and influencers.

Compliance practices – how to organize legal marketing communications?

Compliance system shouldn’t be limited to merely responding to emerging issues. Its primary goal is to prevent violations by establishing transparent rules for preparing and approving marketing materials.

In practice, a growing number of medical device manufacturers are implementing multi-stage approval procedures involving marketing departments, regulatory affairs specialists, quality control departments, and lawyers. This model allows for the assessment of a material not only in terms of its marketing appeal but also its compliance with the product’s technical documentation, instructions for use, and applicable regulations.

Maintaining documentation of the approval process is also particularly important. In the event of an audit, the company should be able to demonstrate that the materials were prepared in accordance with internal procedures and reviewed by appropriately qualified individuals. Archiving subsequent versions of materials, legal opinions, and publication decisions can be of significant evidentiary value.

In practice, a well-functioning compliance system shouldn’t be perceived as an obstacle to marketing activities. On the contrary, properly designed procedures enable legally secure communication, reducing the risk of administrative sanctions and disputes with supervisory authorities, while building trust with customers and business partners.

European perspective – why will the importance of compliance systematically grow?

Polish regulations on medical device advertising are currently among the most detailed in the European Union. However, this does not mean that businesses operating in the domestic market can limit themselves solely to knowledge of the provisions of the Medical Devices Act and the Regulation of the Minister of Health. The functioning of the medical devices market is increasingly determined by the practice of applying the MDR, the positions of EU bodies, and the actions of national regulatory authorities in individual member states.

The MDR does not contain comprehensive regulations on the advertising of medical devices. It focuses primarily on product safety, manufacturers’ obligations, conformity assessment, and the rules for placing devices on the market. At the same time, Article 7 of the MDR establishes the general principle that all communication about a device – regardless of its form – must not mislead users or patients about the product’s intended purpose, properties, safety, or efficacy.

In practice, this provision serves a much broader purpose than the classic ban on misleading advertising. It constitutes a specific interpretative principle that should be considered when assessing every form of communication conducted by a manufacturer or distributor. Increasingly, supervisory authorities are moving away from formalistic analysis of individual advertising slogans and focusing on the overall perception of the message by the average user.

At the same time, the activities of Medical Device Coordination Group (MDCG) highlights the growing importance of transparent information provided to users of medical devices. Although MDCG documents are not legally binding, in practice they guide the interpretation of MDR provisions by national authorities and notified bodies. Increasing emphasis is being placed on ensuring consistency between a device’s technical documentation, instructions for use, and market communications.

It can be predicted that in the coming years, marketing control will encompass not only traditional advertising but also recommendation algorithms of online platforms, message personalization, the use of artificial intelligence in marketing, and automated advertising profiles. The development of new technologies is blurring the lines between information, advertising, and educational content.

For manufacturers, this means moving away from a one-time approach to assessing marketing materials. Implementing ongoing compliance procedures that enable ongoing assessment of communications’ compliance with rapidly evolving regulatory requirements will be much more effective.

Practical checklist compliance before publishing marketing materials

In practice, most violations can be avoided by implementing simple verification procedures. Before publishing material regarding a medical device, it’s important to answer the following questions:

First, is the product intended for use by laypeople or exclusively by professionals? The answer to this question determines the acceptable scope of communication and the target audience.

Secondly, is the planned material truly informative, or is its primary purpose to increase interest in the product? When in doubt, it’s worth adopting a more cautious approach and evaluating the message according to advertising principles.

Third, are all claims regarding product properties supported by technical documentation, instructions for use, and conformity assessment results? Marketing departments should not independently make new claims regarding product effectiveness or safety.

Fourthly, does the material use evaluative terms such as “best”, “most effective”, “revolutionary” or “guaranteed effect”, the validity of which could be questioned by the supervisory authority?

Fifth, does the message include product use restrictions, the need for medical qualification, and other information relevant to user safety?

Sixth, does the publication contain photographs or recordings of patients? If so, it is necessary to verify not only compliance with regulations on advertising medical devices, but also the basis for processing personal data, the scope of consent granted, and the protection of personal rights.

Seventh, was the material reviewed by those responsible for regulatory and legal matters? In practice, even minor linguistic changes can significantly alter the legal assessment of the entire message.

Eighth, does the entrepreneur have documentation confirming the material approval process? In the event of an audit, the ability to demonstrate organizational diligence can be crucial to assessing the entrepreneur’s actions.

Summary

The development of the biostimulator market is one of the most dynamic areas in contemporary aesthetic medicine. These products respond to growing patient expectations for natural tissue regeneration methods, while simultaneously posing entirely new regulatory challenges for manufacturers, importers, distributors, and healthcare providers.

Contrary to popular belief, the biggest problem today isn’t the mere ability to advertise. The key challenge remains the ability to communicate effectively, while simultaneously providing accurate product information and complying with stringent legal requirements. The line between information and advertising is becoming increasingly blurred, especially in the digital environment, where communication occurs via social media, educational platforms, and artificial intelligence tools.

From the perspective of entrepreneurs, this means a shift in thinking about medical device marketing. Instead of treating compliance as a final stage of reviewing advertising materials, it’s worth viewing them as an integral element of the process of designing market communication. Early involvement of legal, regulatory, and quality specialists not only reduces the risk of administrative sanctions but also builds brand credibility and audience trust.

It can be expected that the requirements for communication transparency will systematically increase in the coming years. The development of artificial intelligence, data-driven marketing, and message personalization will force supervisory authorities to increasingly scrutinize not only the content of advertisements but also their distribution and impact on audience decisions. In this environment, competitive advantage will be achieved not by those businesses that conduct the most aggressive marketing communications, but by those that manage to combine innovation with regulatory responsibility.

Artykuł Biostimulants under the microscope of the law – where does information end and prohibited advertising of medical devices begin? pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.