Engineering Software Licensing

Any organisation developing or fine tuning AI systems, particularly LLMs, needs to be ALL OVER how their IP is protected. IP protection for model components such as weights is a complex legal issue. Model weights in AI are numerical values that determine the strength of connections between nodes in a neural network. AI models adjust these weights during training to improve predictions or decisions based on input data. This adjustment process allows the model to "learn" from vast amounts of data, fine-tuning its accuracy in tasks such as image recognition or language translation. Traditionally, copyright does not extend to facts or the functional aspects of a creation. Model weights straddle this boundary, being both a product of immense computational effort and a representation of the underlying data on which the AI was trained. Current legal frameworks do not explicitly address the status of AI-generated data, including model weights (however in the USA it seems to be the case AI generated data is not protected by copyright). The principles underlying the EU’s Software and Database Directives provide a foundation for analysis. While the software enabling AI functionalities might be copyrightable as a literary work, the status of model weights is more ambiguous due to their nature as outputs from processing vast datasets, rather than direct human creation. The key question revolves around originality and the role of human authors in the creation process. According to the CJEU, for a work to be protected under copyright, it must be the author's own intellectual creation, reflecting the author's personality and choices (the Painer case). These criteria becomes blurred when considering model weights, where the "creation" process is largely automated and driven by algorithms following predefined objectives. Given the challenges associated with copyright protection, the sui generis rights established under the EU Database Directive offer an alternative approach. These rights protect substantial investments in obtaining, verifying, or presenting the contents of a database, regardless of originality. Model weights could potentially be viewed as part of a database, particularly if one considers the extensive computational resources and expertise required to train AI models. However, this interpretation hinges on whether model weights can be considered a "database" in the legal sense. The Directive's broad definition of databases may provide sufficient ground for this argument, especially given the structured nature of model weights within an AI's architecture. The potential application of copyright or sui generis database rights to AI model weights has significant implications for the commercialisation of AI technologies. Recognising these protections would grant developers legal mechanisms to control the use, distribution, and modification of their AI models, influencing licensing agreements and business models within the AI industry.

What metrics should we use to measure AI’s impact? Laura Tacho, CTO at DX, recommends 3 key dimensions to track: 1. Utilization Are developers using the tools? Which tools and how often? - Weekly and daily active users - Percentage of PRs that are AI-assisted - Percentage of merged code that is AI-generated 2. Impact Are the tools delivering real value? Are they improving workflows or just adding overhead? - Direct impact: AI-driven time savings, developer satisfaction - Indirect impact: Improvements in metrics like PR throughput, Developer Experience Index, or Perceived Rate of Delivery 3. Cost Is the organisation getting a positive return on its investment? What high-value use cases exist that we should be replicating? - AI spend (total, and per developer) - Net time gain per developer - Agent hourly rate (HEH / AI spend) To learn more, read the latest article that I did in collaboration with Laura, called "How to Measure AI Impact in Engineering Teams" here: https://lnkd.in/e9FyxJyz

🧩 Technical Standards every MedTech professionals should know! Whether you're dealing with a Class I device, Class III or building an AI-based SaMD, aligning with the right standards is critical for regulatory success and product quality. But where do you start? Which ones are essential for your compliance? Of course, specific standards depend on device type, intended use, and market. But today I decided to share those standards that form the foundation of regulatory expectations across the industry. 👇 Here's a selection of technical standards every MedTech or regulatory team should be aware of, with recent updates and what’s coming!   🛡️ 𝗚𝗲𝗻𝗲𝗿𝗮𝗹 𝘀𝗮𝗳𝗲𝘁𝘆 𝗮𝗻𝗱 𝗾𝘂𝗮𝗹𝗶𝘁𝘆 📌 ISO 13485 Medical Devices - Quality Management Systems 📌 ISO 14971 Medical Devices - Risk Management 📌 IEC 62366-1 Medical Devices - Usability Engineering 📌 ISO 10993 series Biological Evaluation for Medical Devices 📌 IEC 60601 Series Electrical Safety Requirements 📌 ISO 15223-1 Medical Devices - Labelling 💻 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲, 𝗜𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗔𝗜 📌 IEC 62304 Software Life Cycle Processes 📌 ISO 27001 Information Security Management Systems 📌 ISO 42001 Information technology - Artificial intelligence - Management system 🧪 𝗖𝗹𝗶𝗻𝗶𝗰𝗮𝗹 𝗜𝗻𝘃𝗲𝘀𝘁𝗶𝗴𝗮𝘁𝗶𝗼𝗻, 𝗖𝗹𝗶𝗻𝗶𝗰𝗮𝗹 𝗣𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲 𝗦𝘁𝘂𝗱𝗶𝗲𝘀 📌 ISO 14155 Medical Devices - Clinical Investigations 📌 ISO 20916 IVDs – Clinical performance studies 📣📣 What’s New: 📘 ISO 14155:2026 → Clinical investigation of medical devices for human subjects — Good clinical practice → Edition 4, 2026 published in March. 📘 ISO 10993-7:2026 → Biological evaluation of medical devices Part 7: Ethylene oxide sterilization residuals → Edition 3, 2026 just published. 📘 ISO 20417:2026 → Medical devices - Information to be supplied by the manufacturer → 2026 Edition published, and 2021 officially withdrawn. 📣 What’s Coming: 📘 ISO 18969 → A new standard for clinical evaluation of medical devices → Under development, now in Draft International Standard (DIS) stage. ⚠️ Staying up to date and monitor standards stage is not just good practice, it's essential to ensure compliance as expectations evolve.   New versions may change what's acceptable in risk management, testing, documentation, and more. This is why, on the MedBoard platform regulatory intelligence is not just about regulations and guidance. 👉 Real-time monitoring includes standards updates, adoptions, and country recognitions. So teams can stay informed, all in one place.   💬 Which of these do you use most?   #MedBoard #MedTech #MedicalDevices #RegulatoryAffairs #QualityManagement #RiskManagement  #ClinicalEvaluation #Compliance #ISO13485 #ISO14971 #MDSW #ClinicalAffairs #PostMarketSurveillance

I reviewed an AI vendor's standard enterprise agreement recently. Liability capped at 12 months' fees. No IP indemnification for AI outputs. The DPA permitted "de-identified" data use for "service improvement", meaning the vendor could train models on derivatives of your data. The AI-specific section was two paragraphs bolted onto a SaaS MSA. This is the norm. AI contracts are still drafted on SaaS skeletons, but the risks are different. SaaS manages access to software. AI manages systems that process, learn from, and generate outputs using your data, risk categories traditional frameworks weren't built for. After negotiating a fair number of these, here are the patterns that keep surfacing. Lesson 1: Standard terms heavily favour the vendor Stanford/TermScout research: only 17% of AI contracts include documentation compliance warranties (vs. 42% in SaaS). Only 33% offer IP indemnification. Liability caps sit well below enterprise software norms. AI vendors argue, not without merit, that probabilistic outputs make rigid warranties difficult. But negotiate tiered warranties linked to use-case risk, performance metrics with remedies, and indemnification covering training data provenance and output IP claims. Lesson 2: The AI addendum is where real protection lives Most agreements separate AI terms from the core MSA. This addendum is where data training restrictions, output ownership, audit rights, and performance standards should be addressed. If the vendor doesn't offer one, ask. If it's two paragraphs of aspirational "responsible AI" language with no operative provisions, push back. Lesson 3: Output ownership needs explicit treatment Copyright protection for AI outputs is unsettled. Your agreement should assign output ownership to the customer, confirm no secondary use rights for the vendor, and address the IP chain: the vendor should represent its model was trained on permissioned data. If they won't warrant provenance, understand the exposure you're accepting. Lesson 4: Audit rights and transparency are negotiable You should have the right to audit, or receive third-party reports on, the vendor's AI practices. Fairness testing, bias evaluations, training data documentation. These are standard expectations under the NIST AI RMF and EU AI Act. At minimum, require model cards describing intended use and known risks. Lesson 5: Build regulatory change into the contract The EU AI Act's GPAI obligations took effect August 2025. Texas, Colorado, Utah, California are advancing AI legislation. Include a mechanism for amendments triggered by law changes, without full MSA renegotiation. AI vendor agreements are maturing. But you don't have to wait for the market. If your vendor says "we can't change standard terms", in my experience, they usually can. (Depends on party position, deal size, and context. Not legal advice.) #AIContracts #ContractNegotiation #InHouseCounsel #AIinLegal I go deeper in my newsletter. Link in the comments.

 GenAI productivity claims fall apart fast. Measure it the way leaders do. Measuring GenAI productivity is challenging when tools remain fragmented. Some expose APIs, others hide them, and many provide no access at all. This makes it difficult to correlate their impact across the development lifecycle. The real value comes from connecting data across the stack - Git repositories, product management systems, HR data, and GenAI usage. By consolidating these sources, leaders gain a unified view of how AI influences engineering work. With this foundation, unique metrics emerge. Cycle Time, from first commit to merge, becomes more meaningful when filtered by AI involvement. Comparing PRs influenced by Copilot, Cursor, or Windsurf reveals how each tool affects development speed. In one case, PRs assisted by Windsurf showed significantly lower Cycle Times than other vendors. Milestone connects these dots by attributing AI impact down to the commit level. This clarity allows organizations to see where GenAI truly accelerates delivery and where it falls short.

𝗬𝗼𝘂𝗿 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 𝘁𝗲𝗮𝗺 𝗶𝘀 𝗯𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗮 𝗺𝗲𝗱𝗶𝗰𝗮𝗹 𝗱𝗲𝘃𝗶𝗰𝗲 𝘁𝗵𝗮𝘁 𝘄𝗶𝗹𝗹 𝗹𝗲𝗴𝗮𝗹𝗹𝘆 𝗻𝗲𝘃𝗲𝗿 𝗯𝗲 𝗮𝗹𝗹𝗼𝘄𝗲𝗱 𝘁𝗼 𝗹𝗮𝘂𝗻𝗰𝗵. Few years ago I heard this from cross functional "I used to think compliance was just a paperwork exercise." If you are trying to scale a medical device, treating compliance like a final checklist will stall your launch by months—or kill it entirely. The Perception Most engineering teams look at the stack and only see two massive, annoying blocks: 🔹 Quality Management (QMS): Dismissed as just standard procedures. 🔹 Regulatory Approvals: Viewed as a final submission step to get to market. The 12-Layer Reality In reality, a successful launch requires shipping 12 micro-layers simultaneously. If you miss one, the whole stack collapses. Save this 4-stage framework for your next architecture review: Stage 1: The Foundation 🚀 Intended Use: Dictates your entire regulatory pathway. 🚀 Design Controls (ISO 13485): Building quality into the code, not testing it in later. 🚀 Risk Management (ISO 14971): Mapping every failure mode before it happens. Stage 2: The Build ⚙️ Usability & Human Factors: Can a stressed clinician use this safely? ⚙️ Software Lifecycle (IEC 62304): Strictly tracking your development process. ⚙️ Clinical Evidence: Proving the device actually works in the real world. Stage 3: The Verification 🛡️ Supplier Agreements: You are only as compliant as your third-party vendors. 🛡️ V&V Testing: Proving you built the device right, and built the right device. 🛡️ Biocompatibility & Sterility: Making sure the physical tech safely interacts with biology. Stage 4: The Market 📈 Post-Market Surveillance (PMS): The work starts after you launch. 📈 CAPA & Change Management: Safely deploying updates without breaking compliance. 📈 Global Vigilance: Monitoring reporting rules across different countries. Build compliance into your sprint cycles from day one. It is not a roadblock. It is the product blueprint. How does your team balance rapid software iterations with strict IEC 62304 standards without slowing down momentum? Follow KIRAN KUMAR PRABU for more insights on Medtech & Healthcare. ---------------------------------------------------- 𝑫𝒊𝒔𝒄𝒍𝒂𝒊𝒎𝒆𝒓: 𝑻𝒉𝒆 𝒗𝒊𝒆𝒘𝒔 𝒂𝒏𝒅 𝒐𝒑𝒊𝒏𝒊𝒐𝒏𝒔 𝒆𝒙𝒑𝒓𝒆𝒔𝒔𝒆𝒅 𝒊𝒏 𝒕𝒉𝒊𝒔 𝒑𝒐𝒔𝒕 𝒂𝒓𝒆 𝒆𝒏𝒕𝒊𝒓𝒆𝒍𝒚 𝒎𝒚 𝒐𝒘𝒏 ��𝒏𝒅 𝒅𝒐 𝒏𝒐𝒕 𝒓𝒆𝒇𝒍𝒆𝒄𝒕 𝒕𝒉𝒆 𝒐𝒇𝒇𝒊𝒄𝒊𝒂𝒍 𝒑𝒐𝒍𝒊𝒄𝒚, 𝒑𝒐𝒔𝒊𝒕𝒊𝒐𝒏, 𝒐𝒓 𝒆𝒏𝒅𝒐𝒓𝒔𝒆𝒎𝒆𝒏𝒕 𝒐𝒇 𝒂𝒏𝒚 𝒂𝒇𝒇𝒊𝒍𝒊𝒂𝒕𝒆𝒅 𝒐𝒓𝒈𝒂𝒏𝒊𝒛𝒂𝒕𝒊𝒐𝒏. #MedTech #FDA #RegulatoryAffairs #DigitalHealth #Innovation #HealthcareAl #HealthTech #DigitalHealth #MedicalDevices #MedicalDevice #HealthcareInnovation #Medicine #PatientSafety #LifeScience #PharmaceuticalIndustry #Pharma #DrugDiscovery #Quality #ISO #EUMDR #MDR #mdd #usfda #Management #Technology #ISO13485 #BiomedicalEngineering

Your most valuable technology shouldn't depend on a handshake and an NDA. MP Materials just sued USA Rare Earth in federal court, alleging a former engineer walked out the door with proprietary magnet manufacturing formulations and handed them to a competitor. These are processes that took years and millions of dollars to develop. The alleged vehicle for the theft? One departing employee. NDAs, noncompetes, nonsolicitation agreements: these are the conventional tools companies rely on to protect trade secrets. But they all share the same weakness. They depend on the behavior of people who no longer work for you. Patents don't have that problem. A patent becomes your IP as of the filing date. It doesn't care whether your lead engineer leaves for a competitor next month. It gives you the ability to enforce your rights, build a competitive moat around your technology, and stop others from practicing your inventions. No goodwill required. In sectors like critical minerals, where the talent pool is small and the stakes are enormous, relying on trade secret protection alone is a gamble. Patents turn your innovation into a defensible asset instead of a liability that walks out the door every night. Protect the tech. File the patent. #PatentLaw #IntellectualProperty #TradeSecrets #Mining #CriticalMinerals #IPStrategy

🔒 Strategic IP Protection for Machine Learning: Challenges and Opportunities 🚀 As Machine Learning (ML) becomes a cornerstone of global innovation, the question of intellectual property (IP) protection is more critical than ever. 🌍💡 Unlike traditional technologies, ML models do not fit neatly into existing IP frameworks, raising complex legal and strategic challenges. How can organizations effectively safeguard their ML-driven assets? Let’s explore. 1️⃣ The Challenge: Protecting ML Innovations in an Uncertain Legal Landscape Developing a high-performing ML model requires extensive investments in: 🔹 Data collection and preprocessing – ensuring diverse, high-quality inputs. 🔹 Model architecture and parameter tuning – optimizing accuracy and efficiency. 🔹 Computational power and training cycles – refining predictions and scalability. However, without robust IP protection, these investments are at risk. Competitors can: ⚠ Extract insights from publicly available models and replicate core functionalities. ⚠ Reverse-engineer architectures and optimize them for their use. ⚠ Bypass training costs by leveraging pre-trained models without proper licensing. 2️⃣ What Can Be Protected? Rethinking IP for ML Given the non-physical nature of ML models, traditional IP protections apply unevenly: 📜 Copyright → Protects source code and creative aspects (unique data labeling, watermarking). However, it does not prevent competitors from replicating functionality through independent development. 🔬 Patents → Can apply to ML-driven applications (e.g., autonomous vehicles, fraud detection), but software-heavy innovations face high rejection rates due to restrictive patentability standards. 📊 Database Rights → Protect in select jurisdictions (e.g., EU) for substantially curated datasets. However, many global markets lack equivalent protections. 🔐 Trade Secrets → Highly effective for keeping ML architectures, training sets, and hyperparameters confidential, provided strict internal security measures are enforced. 3️⃣ Emerging Solutions: Watermarking and Security Mechanisms 🔍 To strengthen ML IP protection, companies are turning to technical safeguards: ✅ Watermarking ML Models – Embedding imperceptible signatures into model outputs to detect unauthorized copies. ✅ Confidential Computing – Securing inference processes against extraction attacks. ✅ Federated Learning – Training models collaboratively without sharing raw data, reducing exposure to IP theft. 4️⃣ The Future of ML IP: A Strategic Imperative 🚀 With AI-driven industries expanding, companies must adopt a multi-layered IP strategy that combines: 🔹 Legal mechanisms (patents, copyrights, trade secrets). 🔹 Technical defenses (watermarking, encrypted deployment). 🔹 Contractual safeguards (licensing agreements, NDAs). 🌟 How is your organization adapting its IP strategy for the ML era? Let’s discuss it. 💬👇 #MachineLearning #ArtificialIntelligence #IntellectualProperty #IPStrategy

Section 101 rejections remain one of the toughest hurdles for software patents. How you approach it can make all the difference. The real question isn’t whether the invention does something useful—it’s whether it solves a technical problem in a technical way. That’s where many applications go wrong. Too often, they frame the idea as a business objective implemented on a computer. The USPTO sees right through that. What examiners want to see is a clear, concrete improvement in computing itself—faster processing, better memory use, more secure data handling, or new interactions between hardware and software. When I work with software clients the goal is always the same: make the invention sound like engineering, not abstraction. That means precise claims, supported by a detailed specification with diagrams, pseudocode, and performance data. If you can show how the invention improves technology, you’ve already done half the work of overcoming Alice. I also encourage clients to anticipate 101 early. Build the eligibility rationale right into the application. Don’t wait for a rejection to start thinking about it. During prosecution, be prepared to cite the USPTO’s own examples, talk to your examiner, and if necessary, use declarations to emphasize what’s unconventional about the invention. Software remains patentable in the U.S.—but only when it’s drafted as a technical solution, not a business plan translated into code. The difference is subtle, but it’s the difference between rejection and allowance.

Lifecycle Regulatory Requirements for SaMD in Europe This analysis examines how the EU regulatory framework—MDR 2017/745 and associated standards—maps onto every phase of the Software as a Medical Device (SaMD) lifecycle. It identifies how lifecycle-based oversight shapes development predictability, certification complexity, and long-term maintenance obligations for software-driven medical technologies. Key Takeaways: 1️⃣ Lifecycle compliance relies on a multi-standard architecture. The paper shows that MDR, ISO 14971, ISO 13485, IEC 62304, IEC 62366 and IEC 82304 must be applied together across development, maintenance and post-market phases, forming an integrated compliance stack rather than isolated requirements. 2️⃣ Rule 11 drives higher-risk classification for software. Under MDR Annex VIII Rule 11, many software products transition to higher risk classes, triggering more complex conformity assessment processes and third-party notified-body involvement. 3️⃣ Maintenance and change control are major regulatory burdens. The authors highlight that adaptive, corrective and preventive updates require structured change-control, re-validation when needed, and risk reassessment—making post-market phases as resource-intensive as development. 4️⃣ Post-market surveillance is continuous and multi-layered. PMS requirements include incident reporting, usability monitoring, cybersecurity management, UDI traceability and updates to technical documentation, embedding ongoing regulatory obligations throughout the product lifecycle. Synthesis: The authors conclude that SaMD regulation is fragmented across standards, but becomes coherent when mapped onto lifecycle stages. They identify key risks stemming from unaligned processes, insufficient early planning, and the growing regulatory impact of iterative software modifications. They recommend lifecycle-integrated planning using MDR-aligned standards, structured risk and usability processes, and rigorous post-market surveillance to maintain safety, performance and compliance. ➡️ How should investors factor lifecycle-wide compliance and change-control obligations into valuation models for SaMD companies? 🔗 Source(s): Navigating Regulatory Challenges Across the Life Cycle of a SaMD. Francesconi M., et al. Journal of Biomedical Informatics, 2025. #digitalhealth #healthinvesting #venturecapital #healthcareinnovation #governance