Project team: Kamal Tserakhau, Hleb Shumilau, Stanislau Tarmola

Case summary

Short single-word .com domains are almost impossible to find unregistered today. On the secondary market they sell for tens of thousands of US dollars, and for a brand that lives online its domain eventually does the job a high-street address does for a traditional business.

The client bought such a domain on an open marketplace in January 2019. The company that later filed the complaint did not exist yet, and neither did its trade mark. Over the following years the client built its own brand on the name and registered a trade mark for it.

The Arbitration & IT Disputes team of REVERA law group represented the domain holder in UDRP proceedings. The complaint came from a company in a different industry, which registered a trade mark identical to the domain name only in 2023.

The complainant was convinced the domain had changed hands only recently. It relied on technical changes that came with the launch of the client's project in 2025: the domain moved to new name servers and hosting, and then a launch page appeared on it. From this the complainant inferred both bad-faith registration and an intent to trade on its reputation, and it portrayed the client's business as a threat to its own brand.

The stakes in such a dispute are high. UDRP moves fast: once a panel orders a transfer, the registrar implements it after ten business days, and only a court action can stop that. A premium domain that has passed to another holder is almost impossible to recover in practice.

Losing would have cost the client the address its traffic and customer base are tied to, along with the money spent on the launch and marketing. The client would also have had to rebuild, almost from scratch, a brand the market already knows by that name.

Actions taken by the REVERA law group team

From the outset we knew the case would turn on the date the client bought the domain, and that we would have to prove that date with documents. So our first step was to reconstruct the domain's ownership history from the purchase onwards. The panel itself later called the acquisition date the key factual dispute in the case.

Our response included the marketplace's purchase confirmation dated 15 January 2019 and the registrar's record showing that the domain was added to the client's account the next day. Around the same time the client had bought several other domains built on the same word, and the panel treated this as further support for the date. The documents showed that the domain had passed to the client long before the complainant company existed, let alone filed its trade mark applications. The 2025 technical changes on which the complaint rested reflected the preparation and launch of the client's project, and the owner stayed the same throughout. Some of the evidence in our favour came from the complainant's own filing: the DomainTools report it attached recorded a change of registrar in January 2019 and included an October 2021 capture stating that the domain was no longer for sale.

The second line of defence concerned how the client uses the domain. It runs a licensed business under its own registered trade mark, does not imitate the complainant's product and never refers to it. Two companies in different industries share a name, and that coincidence alone does not make the use bad faith.

The response had to be prepared within the tight UDRP timetable: the rules allow 20 calendar days, and we obtained four more on request. We built the position on settled WIPO practice for domains acquired before a complainant's rights arose. In such cases panels do not normally find bad-faith registration unless the domain was bought in anticipation of the future mark (section 3.8.1 of WIPO Overview 3.1).

Outcome

The WIPO panel denied the complaint. It found that the client acquired the domain on 15 January 2019, before the complainant was incorporated, before it first used the name and before it filed its trade mark applications. In 2019 the client could not have targeted rights that did not yet exist, so the registration was not in bad faith. The panel held that using the domain for a licensed business under the client's own mark is a bona fide offering of services: the complainant had not made even a prima facie case to the contrary, and the client's UK trade mark is presumed valid unless shown otherwise.

The panel also rejected the tarnishment argument: a lawful business does not tarnish another's brand, even if the complainant disapproves of it. Nor did it accept the point about the privacy service, which is not in itself evidence of bad faith, especially as the operator's contact details are published on the website.

The decision was issued six weeks after the proceedings formally commenced, and the client's business operated as usual throughout.

Project highlights

The UDRP was designed to protect rights holders against cybersquatting, and WIPO statistics show year after year that the overwhelming majority of decided cases end with the domain being transferred to the complainant. Holders of premium domains therefore keep them comparatively rarely, and a complaint that fails on two of the three UDRP elements at once is rarer still.

The complainant did hold a trade mark and met the first UDRP element without difficulty. What decided the case was that the client's rights in the domain predated the complainant's trade mark rights, and that the client could prove it with documents.

The decision reaffirms two rules worth remembering for anyone who owns domains. Under the UDRP, what counts is the date on which the current holder acquired the domain, and the date of its original registration (2016 in this case) settles nothing on its own. Changes to name servers, hosting or website content do not, by themselves, prove that the domain has a new owner either.

For online businesses the practical conclusion is simple: a domain bought legitimately and used in good faith can be defended even against the owner of a registered trade mark, provided the holder's rights came first.

What brand owners should keep in mind

Keep the records of your domain purchases. The transaction confirmation and correspondence with the marketplace are worth keeping for years, together with registrar records. In this case the decisive evidence was a purchase confirmation more than seven years old.

Register your trade mark before your brand becomes visible. The panel treated the client's UK registration as valid, which helped show good-faith use of the domain. The earlier you file, the fewer grounds a future complainant has to portray you as a bad-faith acquirer.

Respond to demand letters on the merits. A chronology disclosed in good time often stops a dispute before a complaint is filed and spares both sides the time and cost of proceedings.

Bring in counsel from day one of the proceedings. The UDRP rules give 20 calendar days for a response (plus four more on request), and panels accept further submissions only at their discretion. In practice the response is the only chance to persuade the panel.

Why clients choose REVERA

The Arbitration & IT Disputes practice of REVERA law group has handled domain name disputes systematically for several years. Since the beginning of 2026, REVERA lawyers have represented clients in more than 100 proceedings, and 95% of them ended with the transfer or cancellation of domain names that infringed the clients' intellectual property rights.

We act on both sides of the dispute. Most often we represent rights holders recovering domains from cybersquatters, so we know which evidence persuades panels and where complaints usually fall short. That experience helps us find the weak points in an opponent's complaint and build a defence for the domain holder, as in the case described here.

The team also handles complex matters involving several domains and respondents. In one such case we consolidated ten domains held by several respondents into a single UDRP proceeding and secured the transfer of all ten to the client. The proceeding also helped identify who was behind the infringement, which gave the client a basis for a damages claim.

The team has collected this experience in REVERA's guide to the UDRP procedure, whose co-authors include the authors of this case study. The guide covers the timeframes and cost of proceedings, consolidating several domains in one complaint, and what to do after a denial.

We handle the whole case: we assess the prospects, gather evidence, represent the client before WIPO and see the decision through to implementation. If one procedure is not enough, we add pre-action correspondence and trade mark challenges before the EUIPO and national offices, and go to court in different jurisdictions where needed. Our clients include IT and e-commerce brands and game and app developers, for whom a domain is among the most valuable business assets.

Authors: Kamal Tserakhau, Hleb Shumilau, Stanislau Tarmola.

REVERA law group handles UDRP domain name disputes and brand protection online, from assessing the prospects of a case to representing clients before WIPO.

The post UDRP dispute over a premium .com domain: how REVERA defended its client’s domain appeared first on revera.legal.

The EU AI Act is the world’s first serious attempt to systematically regulate AI systems and AI-based products. Yet founders keep making the same assumption: if the entity isn’t in the EU, the office isn’t in the EU, and the investors aren’t in the EU, then surely none of this applies to them.

In reality, the EU AI Act applies extraterritorially – the law doesn’t care where your company is registered. It asks one question: is the product available to users in the EU? Since the EU market is one of the largest in the world and almost every startup treats it as a priority from day one, the answer is almost always yes – and the requirements apply to you.

2. Clearview AI: why having no EU presence did not help

Clearview AI is a US company that scraped billions of facial images from the open internet and social media and built a facial-search product on top of that database. It has no presence in the European Union. For years, the company argued that its clients were exclusively foreign law enforcement and intelligence agencies, that requests came through foreign IP addresses, and that European law simply didn’t apply. Regulators didn’t buy it.

3. Four countries, four fines — and all under the GDPR

Worth noting: all of this happened in 2022–2024, before the EU AI Act was even in force, so regulators had to fall back on the GDPR. Italy: €20 million (February 2022), Greece: €20 million (July 2022), France: €20 million (October 2022), the Netherlands: €30.5 million (September 2024).

4. What has changed under the EU AI Act

The AI Act splits all AI systems into four risk tiers, from minimal risk to practices that are banned outright. Mass-scraping faces from the internet or CCTV footage to build a facial-recognition database is now expressly prohibited under Article 5 of the AI Act – no exceptions, no proportionality test. This isn’t a high-risk category you can manage with documentation and an audit. It’s a red line, and the price of crossing it is no longer tens of millions under the GDPR – it’s up to €35 million or 7% of worldwide annual turnover for a single infringement.

5. What businesses should check now

To protect your business, start by taking a hard look at two things: whether your product is available to users in the EU, and which of the four risk tiers it falls into. Doing this early lets you pin down exactly which requirements and penalties apply to you.

Lawyers at REVERA Law Group are ready to help assess which risk tier your product falls into, and to guide your AI startup’s launch in the European market with full legal support at every step.

The post How a US AI facial recognition company ended up fined in four countries at once appeared first on revera.legal.

Planning to expand your construction business into Kazakhstan, Uzbekistan, Georgia, Belarus, or Azerbaijan? Before launching a project, it is essential to understand the local legal environment, regulatory requirements, and business conditions that may affect your operations.

REVERA’s International Construction Market Guide provides a comprehensive overview of the key legal and practical aspects of entering construction markets across Central Asia and Eastern Europe. The guide is designed for investors, developers, contractors, engineering companies, and legal professionals seeking reliable information on market entry strategies and regulatory compliance.

Inside the guide, you will find practical insights on:

• Options for establishing a presence in each jurisdiction
• Construction permits, licensing procedures, and regulatory approvals
• Requirements for employing local and foreign workforce
• Import and customs procedures for construction equipment and materials
• Tax obligations, investment incentives, and available benefits
• Special economic zones and preferential regimes
• Key considerations for foreign investors and construction companies
• Legal factors that may impact project planning and implementation

Understanding the differences between jurisdictions can help businesses identify opportunities, minimize risks, and develop effective strategies for successful market entry.

Download the International Construction Market Guide to explore the construction landscape across Kazakhstan, Uzbekistan, Georgia, Belarus, and Azerbaijan and gain valuable legal insights before starting your next project

The post Entry of Foreign Companies into the Construction Markets of Central Asia and Eastern Europe | REVERA Cross-Country Guide appeared first on revera.legal.

Whether you are developing a mod, working for a game studio or planning to build a user-generated content ecosystem around your game, this issue directly affects your ability to monetise the project.

This issue is becoming increasingly relevant to independent developers and game studios in Kazakhstan. As the local gaming industry grows, more teams are using existing game engines and developing user-generated content.

Understanding who owns the rights to modifications is therefore no longer merely an academic question, but an integral part of business strategy.

Why a Mod Is Not Entirely Your Own Work

The history of the gaming industry shows that modifications created by enthusiasts regularly develop into independent commercial franchises.

This raises a fundamental question: does the creator of a mod have any rights in the result of their work where it has been created “on top of” another person’s work?

The legal starting point is clear. By definition, a mod constitutes a derivative work — that is, a work created on the basis of an existing game — within the meaning of Section 101 of the US Copyright Act, because it is based on the existing game, its code, engine and artistic assets. The creation of a derivative work requires the consent of the owner of the copyright in the original work under Section 106(2). In the gaming industry, that consent is almost always granted in advance, but subject to terms determined not by legislation, but by the particular publisher’s End User Licence Agreement (EULA).

What the EULA Determines

It is the EULA, rather than general copyright rules, that determines the actual scope of a modder’s rights. Licence agreements typically grant the publisher the right to use user-generated content without paying remuneration and, in some cases, expressly assign the rights in created modifications to the company.

The mod creator is permitted to create and distribute their work for non-commercial purposes, but does not automatically acquire the right to commercialise it and certainly does not acquire any rights in the underlying material incorporated into the modification.

How DOTA Became a Separate Franchise

The history of DOTA is particularly illustrative. The Warcraft III modification was successively developed by various members of the community — Eul, followed by Guinsoo, Meian, Madcow and IceFrog — and eventually grew into an independent franchise.

In 2012, the rights to the “DOTA” brand were secured by Valve following a settlement in its trade mark dispute with Blizzard. Valve obtained exclusive commercial rights to the name, while Blizzard renamed its competing project Blizzard All-Stars.

IceFrog, the key creator of the later versions of the mod, separately transferred the relevant development rights to Valve in 2010 and joined the company’s team. The rights were therefore secured not as a result of any presumption that the creator of the modification automatically owned them, but on the basis of commercial agreements between the companies.

Why Counter-Strike and PUBG Followed a Similar Path

Counter-Strike, originally a mod for Half-Life, followed a similar path, as did the battle royale genre, which developed out of DayZ: Battle Royale, a modification for Arma 2 created by Brendan Greene, also known as “PlayerUnknown”.

Following several years of further development and related projects, the idea formed the basis of the standalone game PUBG, released by Bluehole in 2017.

In 2018, PUBG Corporation brought legal proceedings against Epic Games in South Korea, alleging that Fortnite Battle Royale had copied elements of PUBG’s visual design and game mechanics. The claim was subsequently withdrawn.

This episode further confirmed a well-established principle in case law: legal protection extends to the specific expression of a game mechanic, rather than to a genre or a general gameplay idea. This is directly consistent with the reasoning in Baker v. Selden.

What Happens If You Sell a Mod Through Steam

A separate risk arises where mods are monetised through official platforms such as Steam Workshop.

Publishing a mod does not create an independent trade mark or brand for its creator. Moreover, the platform’s rules generally provide for the content to be licensed to the publisher of the underlying game where the mod is incorporated into a paid collection.

What Developers Should Do

For studios planning to develop a modding ecosystem around their product, the key task is to regulate the ownership and use of rights in user-generated content clearly and in advance through the EULA.

This helps prevent a situation in which the most commercially successful element of a franchise legally belongs to someone other than the person who originally conceived it.

What to Check Before Publishing a Mod

• whether the EULA permits the creation of mods;
• whether monetisation is permitted;
• who owns the relevant rights;
• whether the publisher may use your content;
• what happens if the mod is incorporated into the official game.

The main conclusion for independent developers is straightforward: creating a popular mod is not enough. Before investing months of work, developers should review the terms of the game’s licence.

Those terms will often determine whether the developer can monetise the project or whether all commercial rights will remain with the publisher.

This material was prepared for Bluescreen.kz.

The post Who Owns a Game Mod: Why Its Creator May Receive Nothing appeared first on revera.legal.

In this article, we examine the principal legal issues that must be reviewed before acquiring an AI business.

What are the key differences between an AI asset and conventional software? What should be considered when preparing a transaction involving an AI target, even where the transaction itself differs little in form from a standard acquisition of shares or a primary, cash-in investment?

Let us examine these issues.

This material will be useful to investors, funds, corporate purchasers, founders of AI start-ups, generative AI developers and the legal departments of technology companies.

What an AI Product Consists Of: Four Distinct Elements

From a legal perspective

In a conventional IT transaction, the intellectual property assessment focuses primarily on the product’s source code. Copyright subsists in the code and, depending on the jurisdiction, is either assigned to the employer or customer under an employment or commissioned development agreement, or vests in the company from the outset, as under the US work-made-for-hire model.

At the same time, the code may be protected as a trade secret and through properly documented confidentiality obligations binding employees and contractors. This protection is often supplemented by trade marks protecting the brand, licences covering the open-source components used in the product and patents protecting individual technical solutions. Taken together, these mechanisms define the scope of protection afforded to a conventional software product, which the investor examines during due diligence.

In the case of an AI product, however, it is not sufficient merely to verify whether the rights in the code have been transferred to the target or whether a trade mark has been registered. In practice, an AI product normally comprises four distinct elements, each of which is regulated and legally protected in a different manner.

Model architecture

This is a description of the structure of the neural network itself: how many layers it contains, which mathematical operations are used and how those operations are interconnected.

In practice, most architectures underpinning modern AI products are described in publicly available scientific publications. For example, the transformer architecture underpins the GPT and Claude families of language models, while convolutional neural networks form the basis of image recognition systems.

This means that the architecture itself does not generally represent the principal source of value. The assessment therefore shifts towards the following three elements.

Model weights

Model weights are the specific numerical values assigned to the parameters of a neural network as a result of its training.

While the architecture determines the model’s “form”, the weights record its “knowledge”, expressed through billions of numbers that determine how the model responds to a particular prompt. The principal economic value of an AI product is concentrated in these weights.

Data sets

These are the collections of data on which the model was trained, on which the quality of its performance was tested and on which it may subsequently be fine-tuned.

Both the model’s behaviour and the legal risks associated with its use depend directly on the quality and provenance of the data set.

Training infrastructure and pipeline

These are the internal tools, scripts and configurations that enable the model to be retrained or further developed without having to rebuild its architecture from scratch.

Without this element, the purchaser acquires only a snapshot of the model as it exists at a particular point in time, without acquiring the ability to develop it following completion of the transaction.

Stages of Model Development and Their Regulatory Features

Different risks arise, and different legal regimes apply, at each stage. Unless the relevant stage is identified, it is impossible to characterise accurately what the company has actually “done with the model” and, consequently, what it is transferring to the investor under the transaction.

Initial training stage: pre-training

At this stage, the model is trained “from scratch” on a large volume of data and acquires “general knowledge”, such as the ability to process language or recognise objects.

Pre-training is resource-intensive and, at the same time, presents the greatest risk in terms of the lawful use of data. As a rule, this stage is undertaken by the model developers themselves.

Fine-tuning stage

At this stage, an existing model is trained further for a particular task or industry vertical, for example using a body of medical reports or legal documents.

Fine-tuning most commonly becomes a matter of dispute in M&A transactions involving mid-market AI companies. Where the model could not have been fine-tuned without documents provided by a customer, the developer may no longer own the entire result of the fine-tuning outright.

Model application stage: inference

This is the operational stage at which the model processes user prompts.

No training takes place as such at this stage. However, separate risks arise, primarily in connection with the processing of data submitted by users and the extent to which the model’s output may reproduce third-party protected content.

Please note

There is an intermediate area between fine-tuning and inference: methods under which the model is not retrained but is instead “extended” by means of an external knowledge base.

One such approach is RAG, or Retrieval-Augmented Generation, under which the model accesses a connected database of the company’s documents when generating a response. Externally, this may appear to be “AI that knows your product”. Legally, however, it is closer to data processing than to the development of a proprietary model.

This distinction is fundamental when assessing a target. A company using RAG is not a model developer in the legal sense, and it would be inaccurate to describe it as an “AI developer” in the transaction documents.

Model Weights as a Separate Transaction Asset

The weights of a modern language model comprise a set of files containing billions of numerical parameters, with a total size ranging from hundreds of megabytes to hundreds of gigabytes.

Without the architecture, these numbers are useless in themselves. Nevertheless, they encode the entire useful result of the training process. Once the weights are known, the original product can be copied with relative ease.

Which forms of protection apply to model weights?

Neither the EU nor the United States currently has a bespoke legal regime specifically protecting the parameters of a trained model.

In practice, protection is achieved by combining existing legal mechanisms.

Copyright

In the United States, the US Copyright Office has consistently taken the position that legal protection requires a creative contribution by a human author.

Model parameters are, in substance, generated automatically during optimisation. Courts and regulators therefore tend to regard them as the result of a computational process rather than as a protected copyright work.

The position in the EU is less restrictive. It may theoretically be possible to classify model weights as a computer program or a database. However, there is currently no established case law on this issue, and it would be premature to rely on such a classification in a transaction.

Trade secrets

For closed-weight models, trade secret protection is currently the principal effective regime.

In both the United States and the EU, the definition of a trade secret covers information that has commercial value because it is not known to third parties, provided that its owner takes reasonable measures to preserve its confidentiality. By their nature, model parameters are capable of falling within this definition.

There is, however, a material limitation: trade secret protection is lost once the asset is made public. Open-weight models such as Meta’s Llama, Mistral and Falcon therefore lose the benefit of this regime, and the applicable licence terms effectively remain the only IP asset.

Contractual restrictions

Once trade secret protection has been lost or weakened through disclosure, for example when a model is deployed on a customer’s servers or when extended access is provided through an API, the use of the weights can be regulated contractually.

An agreement may impose express prohibitions on copying, reverse engineering where relevant, distillation, meaning the creation of a new model using the outputs of the original model, and disclosure to third parties. It may also impose field-of-use and use-case restrictions.

Where trade secret protection is formally weakened because customers gain access to the model, contractual terms compensate for a significant part of that weakening.

What does this mean for an investor?

Where a purchaser acquires an AI company, wording providing for the “transfer of all rights in the software” is insufficient in relation to model weights.

If a court subsequently refuses to recognise the weights as a “computer program” for the purposes of the applicable law, which is a material possibility in the United States, the purchaser may find that the transferred product is effectively protected only as a trade secret. The continued existence of that protection will, in turn, depend on whether the purchaser itself maintains the required level of confidentiality.

Recommendation: when preparing a transaction involving an AI target, include a separate technical schedule of the components to be transferred in the transaction documents.

For each component, the schedule should specify:

• the applicable protection regime, such as trade secret protection, copyright, contractual restrictions or an open licence;
• the storage location, including repositories, cloud storage and version checksums; and
• the terms of the applicable open-source licences.

Such a schedule can simultaneously serve as an attachment to the seller’s representations and warranties and facilitate the practical transfer of the asset following completion.

Who Owns a Model Trained on Third-Party Data?

This is one of the most contentious issues in AI transactions in 2024–2026.

Almost every modern model has been trained using data for which the company did not have a direct licence. This may include materials obtained from publicly available internet sources, content distributed under public licences such as Creative Commons and, in some cases, data of questionable or plainly unlawful provenance.

The relevant questions are whether the use of such data for training itself constitutes an infringement and whether the associated risk is transferred to the purchaser together with the model.

The US Approach: Fair Use and Emerging Case Law

In the United States, the principal defence relied upon by AI companies is the doctrine of fair use. Under this doctrine, certain uses of protected material are permitted without the right holder’s consent where justified by the purpose and character of the use.

The application of this doctrine to the training of AI models is currently being tested in several landmark cases.

In The New York Times v. OpenAI & Microsoft, commenced in 2023, the newspaper brought claims against developers that had used its articles for training purposes. The claimant alleged that, in certain cases, the model reproduced extracts from its publications verbatim.

If the Supreme Court precedent in Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith is applied in this case, training on articles without a licence may be found to constitute infringement.

The principle established by that precedent is that the use of a “copy” for the same commercial purpose as the original does not qualify as fair use and constitutes infringement. In OpenAI’s case, that purpose may be characterised as providing news information to users, which was also the newspaper’s original purpose.

OpenAI’s purpose of providing news information to users therefore coincides with the purpose of the newspaper, which also provides news. If the court finds that OpenAI should have purchased a licence, “free” training will cease to be regarded as fair use because it deprives right holders of their legitimate income from licensing training rights.

In Bartz v. Anthropic, in which an interim ruling was issued in June 2025, the court drew an important distinction for the market. Training a model using lawfully acquired books was characterised as fair use, whereas creating a training corpus using pirated copies was treated as infringement not protected by fair use.

Fair use is not a fact capable of being confirmed by a representation or warranty. It is a legal position that a company may advance if a claim is brought against it. An SPA should therefore not include a warranty stating that the training “constituted fair use”.

A warranty may, however, be given regarding the specific provenance of the training data and confirming that the company did not use clearly unlawful sources.

Recommendation: when acquiring or investing in an AI company, examine the provenance of each material category of training data in detail during due diligence and assess the categories of claims that could theoretically be brought in relation to it.

Any identified risks should be addressed through specific provisions in the SPA, including standalone or fundamental warranties and enhanced indemnity protection.

The European Union Approach: Data-Mining Exceptions and Regulatory Obligations

The European approach to training AI on third-party data is based less on case law and more on express statutory provisions.

The EU Directive on Copyright in the Digital Single Market, or DSM Directive, provides specific exceptions permitting text and data mining: the automated processing of texts and data in order to identify patterns.

For scientific purposes, this may be undertaken without restriction. For commercial purposes, it is permitted provided that the right holder has not opted out of such use in a machine-readable form, for example by means of specific notices on a website. Most European AI developers currently rely on this exception.

In September 2024, the first significant decision was issued by a German court in LAION v. Kneschke. The decision confirmed that non-commercial research use of data by the AI community may rely on this exception, whereas right holders’ opt-outs must be respected in the case of commercial use.

The EU Artificial Intelligence Act, or EU AI Act, imposes separate obligations on developers of large models. These include an obligation to disclose a general description of the data used for training and to maintain an internal copyright compliance policy.

Failure to comply with these requirements creates a separate regulatory risk that must now be taken into account when assessing an AI target.

An Additional Layer of Risk: Personal Data Used for Training

Where a training data set contains personal data, which is almost invariably the case for text models trained on internet-sourced data, the transaction is also subject to the GDPR, the European data protection regime.

The principal difficulty is that the right to erasure granted to individuals is difficult to exercise in relation to a model that has already been trained. A model cannot be made to “unlearn” specific data without substantial retraining.

European regulatory practice developed around this conflict in 2024–2025. In December 2024, the Italian data protection authority, the Garante, imposed a substantial fine of EUR 15 million on OpenAI on grounds connected specifically with the processing of personal data during training.

Please note: when preparing a transaction involving an AI target, compliance with data protection requirements in relation to training is frequently underestimated.

A standard data protection audit will generally review the handling of customer data within the product but may overlook the provenance of the training data.

Fine-Tuning a Model: Who May Claim Rights?

Fine-tuning is the stage at which the interests of the greatest number of parties intersect. It therefore requires the highest degree of contractual precision.

Where Company A takes an existing base model developed by Company B and fine-tunes it using its own data set, the result is, in substance, a new model because the base model now incorporates an additional layer of knowledge.

Depending on the structure of the relationships, several parties may claim rights in the resulting model:

• the developer of the base model, under the terms of its licence;
• Company A, as the party that carried out the fine-tuning, or “adaptation” in software copyright terminology;
• the data set supplier, as the maker or compiler of the database, where the data set was not assembled by Company A itself; and
• Company A’s customer, where the fine-tuning was carried out using the customer’s data and the agreement provides that rights in the resulting work belong to the customer.

In practice, this structure creates a complex combination of potential rights and obligations. Identifying and resolving them is a mandatory part of transaction preparation.

A typical risk: customer data used for training

A very common arrangement allows the model developer to “improve the model using aggregated data from all customers”, while the rights in those improvements remain with the developer.

This arrangement is currently under pressure from two directions: data protection law, because the legal basis for using such data for training may be questionable, and customers themselves, when they discover that their confidential information has effectively been used to develop a product made available to others.

When preparing the transaction, all customer contracts must be reviewed and the following specific question must be answered:

To what extent could customer data have been incorporated into the model’s training, and does the company have a clear contractual and regulatory basis for using the resulting improvements?

The absence of express customer consent, buried in standard terms of service, is a typical risk that may materialise after completion of the transaction in the event of action by a bad-faith competitor or an active regulator.

On-Premises vs SaaS: Different Transaction Risks

The method by which an AI product is distributed directly affects the allocation of risk in the transaction. The same product may be valued differently depending on how it is supplied.

A SaaS model, meaning Software as a Service, is a scenario in which the model weights remain physically under the developer’s control and the customer receives only online access to the model’s operation: the customer submits a prompt and receives a response.

The model parameters themselves are never transferred to the customer. OpenAI API, Anthropic API, Google Vertex and most modern AI start-ups operate under this model by default.

An on-premises model is a scenario in which the model is deployed within the customer’s own infrastructure. Under this model, the customer will usually obtain practical access to the model parameters and may use the model independently.

Many enterprise language models, secure medical models and industry-specific solutions in the financial and defence sectors operate under this model.

What does the customer acquire in each scenario?

In both cases, the principal asset remains the model parameters and the tools used to train it. However, the balance of risks differs.

Under the SaaS model, the model remains within the developer’s environment. The key risks therefore relate to compromise of the internal environment, including insider access and security incidents, and to the stability of the customer base.

Accordingly, when preparing a transaction involving such a target, particular attention must be paid to its information security posture, including:

• certifications such as ISO 27001 and SOC 2;
• access management systems;
• activity and audit logs;
• agreements with key customers; and
• the terms governing the processing of customer data.

Under the on-premises model, the asset effectively leaves the company’s perimeter with each sale. The principal risk therefore shifts to licensing: a former customer holding a copy of the model may potentially become a competitor.

The terms of the licence agreements are consequently material. They should include express prohibitions on distillation and on transferring the model to third parties, together with technical protection measures such as binding the model to particular hardware.

Important: where a model is distributed on-premises, trade secret protection for the weights is effectively weakened with every new customer installation.

If an assessment of the target establishes that customer licences are poorly drafted, no technical protection measures are used and there is no contractual prohibition on distillation, the company’s assertion that its weights are protected as trade secrets becomes unreliable.

A Special Case: Products Built on Third-Party Base Models

A separate category of AI targets consists of companies whose products are built on the APIs of major providers such as OpenAI, Anthropic or Google.

From a technical perspective, such a product consists primarily of a set of model instructions, or prompt engineering, a connected customer knowledge base and a user interface.

From a legal perspective, the principal asset is not the model weights, which belong to the provider, but the agreement with the provider, the accumulated methodologies for working with the model and the user data.

When assessing such a company, it is critical to examine the provider’s terms governing the use of the base model.

For example, OpenAI’s business terms expressly prohibit the use of model outputs to train competing models and impose restrictions on resale.

The risk of dependence on a particular provider must also be assessed. To what extent can the product architecture be migrated to a different model if the provider changes its policies or pricing?

Licences for Open-Weight Models: Read the Terms Carefully

Where a target uses Llama, Mistral, Falcon or Stable Diffusion, the licence terms require separate and careful consideration. The outward appearance of open-source software may conceal material commercial restrictions.

Under the Llama licence, where the threshold of 700 million monthly active users is exceeded, the licence expressly prohibits “improving other large language models through distillation” and imposes mandatory attribution requirements.

Falcon, developed by TII, is distributed under a standard Apache 2.0 licence.

The licence applicable to a Mistral model depends on the particular version, ranging from Apache 2.0 for certain models to the Mistral Research License, which imposes restrictions on commercial use, for others.

Stable Diffusion is distributed under a licence containing express restrictions on particular use cases.

If the assessment establishes that the target is in breach of the licence terms applicable to its base model, this may have a material effect on the transaction. The right holder may terminate or withdraw the licence, effectively depriving the key asset of its commercial value.

Which Forms of Protection Actually Work?

Copyright: effective only for conventional software

The model architecture itself, meaning the mathematical description of its structure, is not protected by copyright in either the United States or the EU.

If the architecture has been published in a scientific paper, it becomes largely available to the public.

The source code of the training and operating infrastructure, including training scripts, internal administration tools and model lifecycle management tools or MLOps systems, is conventional software. Copyright protection applies to it in full, just as it would in an ordinary IT company.

Model weights remain a contentious area. Copyright protection is extremely limited in the United States. In the EU, it is theoretically possible, but this has not been confirmed in practice.

Data sets are protected at two levels.

Individual elements of a data set may be protected as separate copyright works. The company does not acquire copyright in third-party texts or images merely because they have been included in its training corpus.

The data set itself, as a composite object, may be protected as a compilation in the United States or as a database in the EU, provided that substantial investment has been made in its creation.

Model outputs are not protected by copyright in their unmodified form in the United States. Approaches vary between EU Member States but are moving in a similar direction.

Trade Secrets as the Principal Protection Regime and Their Vulnerability

As demonstrated above, copyright protection for the key components of an AI product is limited.

AI assets are therefore most commonly protected as trade secrets, particularly model weights and training infrastructure.

The advantages of this regime are that it:

• does not require registration;
• covers diverse elements, ranging from model weights to individual training parameters;
• has no fixed term; and
• operates in most jurisdictions.

A condition for maintaining trade secret protection is that the company must have taken “reasonable measures to maintain confidentiality”. This requirement determines the direction of the due diligence review when preparing a transaction.

An operational AI company should have:

• a formal access-control system with activity logging;
• confidentiality obligations in the employment contracts of employees who have access to the code and models;
• non-disclosure agreements with all counterparties that have had access to key components;
• storage systems marked as containing confidential information;
• an established process for revoking access when employees leave and procedures for responding to incidents; and
• a policy governing employees’ participation in independent open-source projects.

In the absence of these elements, the company’s assertion that its models are protected as trade secrets has no practical foundation, and the purchaser is acquiring an asset that is not legally protected.

Conclusion

There is currently no universal protection regime for an AI product. In practice, each company establishes a multi-layered system of protection in which each layer supports the others.

The architecture and general methods may be protected as trade secrets or know-how.

The source code may be protected by copyright and the terms of open-source licences.

The weights may be protected through trade secret protection and contractual terms. Where the product is distributed on-premises, these should be supplemented by technical protection measures such as encryption and hardware binding.

Data sets require a lawful basis for the use of the relevant data, including data-mining exceptions, licences or fair use, together with the specific database protection regime available in the EU.

Copyright, design patents and trade marks may be used to protect the user interface and branding.

Due diligence of AI companies is becoming an increasingly complex and comprehensive process.

A lawyer preparing such a transaction must therefore develop a thorough understanding of the product’s structure, verify that each layer of protection is effective in practice and avoid relying on a single protection regime or legal mechanism.

Where protection is weak at any level, for example where model weights are stored without encryption and are accessible to a broad group of employees, this becomes a separate reason to structure the transaction using additional warranties, enhanced indemnity protection and deferred consideration.

Authors: Inna Semenova and Yahor Kulazhenka.

This material was prepared for a third-party media platform: medium.com

How REVERA Can Help

Are you planning to acquire an AI company, raise investment or conduct a legal review of an AI product?

The REVERA team advises on international M&A transactions, investments in technology companies and comprehensive AI due diligence, including the assessment of intellectual property, training data, licences and compliance with the EU AI Act and the GDPR.

Where you are considering a transaction involving an AI business, our specialists will help identify legal risks before the transaction documents are signed and propose the optimal transaction structure.

The post Valuing an AI Asset in M&A: How It Differs from Valuing Software appeared first on revera.legal.

The vast majority of entrepreneurs strive to ensure that their business operations comply with the law. A responsible business environment has long been established, where profitability goes hand in hand with legal compliance, sound decision-making, and corporate social responsibility.

However, unintentional errors and omissions may occur in any business activity. The human factor plays a significant role—from simple mistakes, typos, and inattention to insufficient qualifications, lack of awareness, misunderstandings of legal requirements, or incorrect interpretation of business processes.

At the same time, ignorance of the law is no defense (Ignorantia legis neminem excusat). Moreover, a legal entity may be held administratively liable if it has failed to take all necessary measures to comply with the legal requirements whose violation entails administrative liability. In practice, this means that businesses can face liability even when violations were unintentional.

How can business owners reduce these risks?

One of the most effective preventive tools is an independent audit of the company’s financial and business activities.

This goes far beyond verifying the correct application of tax legislation or reviewing tax returns—although such reviews remain critically important.

There are many other areas where an independent external perspective can help identify hidden risks, including:

• industry-specific regulatory compliance;
• licensing, certification, and other permitting requirements;
• environmental legislation and waste management compliance;
• labor law compliance;
• personal data protection;
• corporate governance and shareholder relations;
• and many other aspects of business operations.

Experienced external professionals, including specialists in specific regulatory areas, are often able to identify issues that internal teams overlook simply because they have become accustomed to existing processes.

For example, under product labeling rules, a unified control mark must be applied to the product, its label, or packaging before the relevant information is entered into the official labeling system—not afterward.

Similarly, the list of goods and packaging subject to environmental fees for waste collection, disposal, and recycling has been amended several times over the years. As a result, businesses may unknowingly become subject to payment obligations for additional categories of goods.

Even document management issues can become costly. During an audit, specialists may discover that an original document remains in the company’s administrative office instead of being included in the relevant compliance file. Such seemingly minor omissions may later lead to financial claims during inspections.

Audits can be scheduled or conducted when needed

Companies may periodically review their operations—for example, by commissioning a comprehensive external audit every three years while conducting specialized compliance audits on a more frequent basis.

Regular internal reviews allow businesses to:

• identify deficiencies at an early stage;
• promptly eliminate violations;
• reduce periods during which penalties or late payment interest may accrue;
• and, in some cases, eliminate liability altogether if statutory limitation periods expire before enforcement proceedings begin.
• Risk-based inspections make preparation even more important

Regulatory authorities increasingly rely on risk-based inspection systems, where inspection plans are formed based on an assessment of both the likelihood of legal violations and their potential consequences.

Inspection schedules are typically published twice a year. Once a company discovers that it has been included in an upcoming inspection plan, it has a valuable opportunity to conduct a pre-inspection audit.

Unfortunately, such audits often take place under significant time pressure, with limited resources available to correct identified deficiencies before inspectors arrive.

The law also provides mechanisms to mitigate liability

In some situations, companies can significantly reduce legal consequences if violations are corrected voluntarily.

For example, filing an amended tax return and paying outstanding taxes before a tax audit begins may eliminate the administrative offense altogether. If tax arrears are paid before the case is considered, the applicable fine may be reduced by half.

Under certain conditions, businesses may also be released from administrative liability and receive only a formal warning instead of a fine.

It is equally important to remember that legislation that mitigates or abolishes liability generally has retroactive effect. If a violation occurred before more stringent legal provisions entered into force, the more favorable rules may still apply.

However, this opportunity may be lost if the company fails to identify and correct the violation in time.

In cases where administrative fines are calculated as a percentage of the amount involved in the violation, authorities may also consider the company’s actual financial result from the relevant transactions. Proper legal arguments and financial calculations can therefore increase the likelihood of reducing the imposed sanction.

Prevention is always more cost-effective than enforcement

Regular audits and effective internal controls enable businesses to identify and eliminate compliance issues before regulators do. This not only reduces potential financial losses but also protects the company’s reputation.

The earlier a business discovers a problem on its own, the greater its chances of resolving it quickly, efficiently, and with minimal legal consequences.

Practical advice for business owners: don’t wait for inspectors to uncover problems. A timely internal or external review of your company’s operations will almost always cost less than regulatory fines, corrective measures, and lengthy legal disputes.

Author: Mikhail Denisyuk

Для вставки в текст отмеченных ссылок используйте шорткод:  НЕУМЫШЛЕННЫЕНАРУШЕНИЯ В БИЗНЕСЕ

The post Unintentional Business Violations: How to Prevent or Mitigate Their Consequences appeared first on revera.legal.

Similar cases are not uncommon abroad either. In 2025, Flexport filed a lawsuit against former employees who had created a competitor, Freightmate AI, before leaving the company and had downloaded code and client lists. In 2026, Apple filed a lawsuit against OpenAI, alleging that senior executives had taken developments to a startup that was later acquired by OpenAI for $6.5 billion.

Kamal Terekhov and Gleb Shumilov, lawyers in REVERA’s Arbitration and IT Disputes Practice with extensive experience handling similar cases, explain in greater detail how to protect an IT business from internal conflicts.

The problem areas are usually the same: management and senior developers. A specialist with full access to the infrastructure can disconnect a company from its own product. A non-technical manager can take the code and team and launch a parallel business with another partner. Other risks include selling data to competitors and poaching key employees.

What can be done?

By default, rights to a product belong to the person who created it, not the person who paid for it. Therefore, without an IP assignment, the author can make claims to the product at any time, and formally, the law will be on their side. An NDA protects the client database, contractual terms and technical architecture, but only if the scope of confidential information is clearly defined. A notable example is Waymo v. Uber: before leaving Google, an engineer downloaded more than 14,000 files containing lidar sensor designs and founded a startup that was later acquired by Uber for $680 million. The outcome was a $245 million settlement in shares and criminal proceedings.

When the documents are properly drafted, protection can work quickly. In September 2025, Elon Musk’s xAI obtained a court injunction against a former engineer who had accepted an offer from OpenAI: within days, the court prohibited him from working with generative AI for his new employer and ordered him to surrender his devices for examination. This was possible precisely because xAI had properly drafted confidentiality agreements in place.

Key measures

1. IP. As soon as you realize that the project is growing, register a company and formalize intellectual property agreements: an IP assignment, a work assignment, and an act of transfer of rights. Do not postpone this for years, because obtaining rights retroactively from a developer who has already gained a strong negotiating position is much more difficult and expensive.
2. NCA, NDA. These instruments work effectively with B2B counterparties. There are nuances when it comes to employees, depending on the jurisdiction; in some countries, restrictions on employees’ competitive activities simply do not apply. Therefore, in addition to having the right documents in place, it is important to know your team well, maintain direct contact with key people, and understand their motivations.
3. Corporate measures. Introduce restrictions and mandatory approval of key actions by the director, including major transactions, asset withdrawals, and the hiring and dismissal of top managers. Do not allow an unchecked connection between a hired director and the accountant; financial flows should be transparent to the owners.
4. Technical measures. Distribute access to infrastructure, code and databases among several people, register them in the company’s name rather than that of a specific employee, and revoke access promptly when an employee leaves. A situation where all access is concentrated in the hands of one person is itself an immediate risk.

All these measures address the same objective from different angles: making the company independent of the goodwill of any particular individual and moving relationships between founders, employees and partners from the realm of verbal agreements into the realm of rights that can be protected in court.

Putting these mechanisms in place at the outset takes a lawyer only a few days of work, whereas a conflict caused by their absence can drag on for years of litigation and cost amounts that are incomparable to the initial investment.

Kamal Terekhov and Stanislav Tarmola,
REVERA Law Group lawyers

The post When the Code Leaves with the Employees: How to Protect Your IT Business Before It’s Too Late appeared first on revera.legal.

For a traditional business, this would look like a catastrophe. For betting and online casinos, however, it is often just part of the daily operating reality. This very feature makes iGaming brands particularly attractive targets for cybersquatters.

Cybersquatting is the registration of a domain name that infringes another party’s trademark rights, usually with the aim of intercepting traffic or otherwise harming the trademark owner. In iGaming, this is rarely accidental. More often, it involves deliberate brand cloning: phishing mirrors, fake “affiliate” websites, typosquatted domains, and look-alike domains registered just days before a major tournament, when traffic associated with the brand is at its peak.

One effective out-of-court mechanism for combating this is the UDRP procedure. In this article, REVERA Law Group lawyers Kamal Tserakhau and Hleb Shumilau explain how it works.

What Is UDRP?

UDRP (Uniform Domain Name Dispute Resolution Policy) is an international out-of-court procedure for resolving domain name disputes, developed by ICANN and applicable to domains in popular zones such as .com, .net, .org, as well as a number of other gTLDs and new gTLDs. By registering a domain in these zones, the domain holder automatically agrees to have disputes considered under the UDRP framework.

Cases are handled by accredited dispute resolution providers, including WIPO, the ADR Forum, and others. Compared with traditional litigation, the process is relatively fast: from filing a complaint to a decision, it typically takes around 45–60 days. For iGaming businesses, where every day that a look-alike domain remains online can result in lost traffic and reputational damage, this difference can be critical.

Stages of the Procedure

• filing a complaint with an accredited dispute resolution provider, online or by email;
• implementation of a registrar lock, preventing the domain from being modified, transferred, or deleted;
• notification of the respondent, who generally has 20 days to submit a response;
• appointment of an arbitration panel consisting of either one or three panelists;
• issuance of a decision, generally within 14 days, ordering the cancellation or transfer of the domain, or rejecting the complaint;
• a 10-day period during which the decision may be challenged in court, after which it may be implemented by the registrar.

Three Requirements for Winning a UDRP Case

For a complaint seeking cancellation or transfer of a domain to the trademark owner to succeed, the complainant must establish all three of the following:

1. the domain name is identical or confusingly similar to the complainant’s trademark;
2. the respondent has no rights or legitimate interests in respect of the domain name;
3. the domain name was registered and is being used in bad faith.

In practice, the third element is often the most difficult to establish. This is where brand recognition can turn from an abstract marketing asset into a concrete legal argument.

Brand Recognition as a Key to Success

Unlike traditional court proceedings, under the UDRP it is not enough for the complainant simply to own a registered trademark. The panel must be satisfied that the respondent knew of the brand and deliberately selected the domain name in order to take advantage of the reputation associated with it.

UDRP practice has developed several indicators that can help establish such awareness:

Widespread recognition of the brand. A well-known operator’s name — in the same way that brands such as Google, Apple, or Samsung are recognized in other industries — can support an inference that the respondent was aware of the trademark. Registration of a highly similar domain without a credible explanation may therefore strongly indicate bad faith.

Similarity of business activities. If the respondent’s website offers sports betting, slots, or casino services — the same services provided by the complainant — this may directly indicate an attempt to commercially exploit the complainant’s reputation rather than a coincidence.

Scale and geographic presence. A long-standing market presence, licenses in multiple jurisdictions, and an active audience on social media can strengthen the argument that the respondent could not reasonably have been unaware of the complainant’s trademark.
Distinctiveness of the mark. iGaming operators often operate under coined or non-dictionary names. The more distinctive and original the trademark, the harder it is for the respondent to argue that the domain was selected by coincidence.

When Brand Recognition Is Not Enough

UDRP practice also includes cases where even a formally similar domain was not transferred to the complainant. A common reason is the failure to prove that sufficient reputation had been established before the domain was registered.

This is particularly relevant for iGaming businesses. An operator licensed in one jurisdiction and known primarily in a local market may not always be able to demonstrate that a respondent in another country was objectively aware of its brand. A national license and local brand recognition do not automatically extend to other markets — just as, under the principle of territoriality, a trademark registered in one country does not generally provide automatic protection in another.

For this reason, trademark owners should proactively collect and preserve evidence of brand recognition, including publications in industry media, website traffic and deposit statistics, player reviews, and the history of trademark registrations across the jurisdictions in which the business operates.

Trademark Registration: The Foundation of Protection

The first of the three UDRP requirements — identity or confusing similarity between the domain and the trademark — makes trademark registration more than a mere formality. It is a fundamental prerequisite for effective protection.

For an operator entering a new market or launching a new brand, it is advisable to register the trademark before a need arises to challenge infringing domains, rather than after the fact.

We handle trademark registration and domain name disputes as part of a single process: the earlier rights in a brand are secured, the faster and more confidently any subsequent dispute can be addressed.

Practical Brand Protection Checklist for iGaming

• register the trademark in advance in all jurisdictions where the business operates or plans to operate;
• continuously monitor domains similar to the brand, including typosquatting variations and newly launched domain extensions;
• collect and preserve evidence of brand recognition, including media coverage, traffic statistics, and social media activity;
• document patterns of bad-faith use — phishing, copied website designs, and false claims of affiliation — as soon as they are identified;
• do not delay filing a complaint: the longer a fraudulent domain remains active, the more traffic, revenue, and player trust it may divert.
• A look-alike domain in iGaming is not an abstract reputational risk. It is a channel through which traffic may be leaking right now. UDRP provides an opportunity to shut down that channel within a matter of months, but this mechanism works most effectively when trademark rights have been secured in advance and evidence of brand recognition has been collected before it is needed in a dispute.

Kamal Tserakhau / k.tserakhau@revera.legal
Hleb Shumilau / h.shumilau@revera.legal

The post iGaming in the Crosshairs: How to Protect Against Cybersquatters and What UDRP Has to Do With It appeared first on revera.legal.

Environmental Social and Governance (or “ESG” for short) is a broad and refers to three key factors when measuring the sustainability and ethical impact of a business or company investment. The most socially aware investors monitor companies using ESG criteria to screen investments.

Environmental criteria look at a company’s contribution to environmental challenges (e.g. waste, pollution, greenhouse gas emissions, deforestation, and climate change) and its performance in this regard. Social criteria look at how companies treat people, for example in terms of human capital management, diversity, and equal opportunities, working conditions, health and safety, and product misspelling. Finally, governance criteria look at the manner in which companies are governed, for example in terms of executive’s remuneration, tax strategy, and practices, bribery and corruption, diversity, and board structure.

At the core of ESG investing is the fundamental idea that businesses are more likely to succeed and deliver robust returns if they create value for all their stakeholders – employees, customers, suppliers, and society at large (including the environment) rather than benefiting only the company owners. Consequently, the ESG criteria examine how companies serve society and how they affect their current and future performance. The ESG analysis goes beyond what the company’s current position. Considering future trends is of critical importance and should intrinsically include disruptive changes that may have a significant impact on the future profitability of a business or on its very existence.

The new edition of European Corporate Insights Magazine (Andersen Global) has an overview of the specific ESG guidelines in different European jurisdictions, any ESG benchmark companies have to adapt to if they want to attract investors, and any impact ESG criteria has on investment decisions and transaction structuring. The Magazine also has two pieces of opinion and a dedicated section with the most relevant Corporate and M&A news in our practice group in Europe.

You can download the magazine here

The post appeared first on revera.legal.