Ukraine: An Overview

How Ukraine Regulates AI-Generated Products: The Rules Most Companies Have Never Read

Ukraine wrote one of the world's first legal regimes for AI-generated output into law in 2022. By 2026, those rules governed every module Copilot writes inside a Ukrainian company, every image Midjourney makes for a Ukrainian brand and every algorithm fine-tuned on Ukrainian data – and most companies still do not know they are bound by them.

In 2026, a Ukrainian software company sits down to its annual audit and finds that its most valuable component – the recommendation engine shipped last quarter – legally belongs to nobody it can name. The four lines of code a developer wrote that morning are protected by copyright. The next 60, generated by Copilot in the half-second it took to accept the suggestion, are not: they sit in a separate legal regime most CEOs have never heard of, and pre-2023 IP clauses do not pull them into the company's name.

For Ukrainian IT, the comfortable assumption used to be that paying for the development meant owning the code, but courts disagreed. The AI era brings a sharper version where writing the prompt implies owning the output, which sounds intuitive but is just as wrong because owning a tool is not the same as owning what it produces, and Ukrainian law now says so in writing.

Ukraine has no statute equivalent to the EU AI Act. Its government chose a different path, where the Ministry of Digital Transformation's June 2024 White Paper on AI Regulation sets a two-stage model, starting with a preparatory stage that includes a regulatory sandbox, voluntary AI-content labelling and codes of conduct, followed by binding legislation modelled on the EU Act. Oversight is split across the digital ministry, the data-protection ombudsman, the broadcasting council and the IP office, with no single AI regulator. The catch is timing because the absence of an AI act does not suspend the laws already on the books since copyright, civil and data-protection rules apply to AI-generated products today, meaning the regime is already here.

Most discussions of AI and copyright assume the question is binary regarding whether an object is protected or not, but Ukrainian law makes it three categories, and the difference is concrete enough to put on a balance sheet. Article 20 of the 2022 Copyright Law applies where a natural person made a substantial creative contribution, such as design, structure, selection or prompt engineering, which demonstrably shaped the output. The term lasts for the life of the author plus 70 years and includes economic and moral rights, which is the regime every standard IP clause was written for.

Article 33 applies where the object is generated by a computer program without direct involvement of a natural person. To qualify, it must pass three tests pertaining to:

• novelty where it differs from existing outputs;
• automated generation resulting from the software's technical functioning; and
• the absence of human creativity where involvement is limited to activating the tool.

The term for this category is 25 years from January of the following year and grants economic rights only, with no moral rights because there is no human author to protect. The third category is no protection at all where the object meets neither standard and falls into the public domain, held together only by whatever a trade-secret regime and a non-disclosure agreement (NDA) can manage.

Seventy versus 25 versus zero shows that the same line of code can sit in any of the three categories, and one product can run all three in parallel. Classification is not academic because it is the first question a court or an acquirer's diligence team asks. In 2024, the Ukrainian IP office registered the first objects containing AI-generated elements, including a children's book's illustrations, a poetry collection and a series of postcards, which proves the mechanism is live and not theoretical. Owning a tool remains distinct from owning what the tool produces.

Once an object qualifies under Article 33, the law names four candidates who holds the rights, including the program's developer, a licensee, the person who initiated the creation and the holder of the economic rights to the program, and then states that the rights may belong to any of them with no tiebreaker. This collision is not hypothetical. For example, Company A licences a foundation model to Company B, an employee of B writes the prompt that generates a recommendation algorithm and B ships it inside a product sold to Company D for USD50 million. This scenario allows:

• A to claim as developer;
• B to claim as licensee and economic-rights-holder; and
• the employee to claim as initiator.

This creates three candidates for one algorithm and one valuation due to statutory ambiguity. Academic commentary gives priority to the person who lawfully initiated the creation unless the contract says otherwise. Three years in, no Ukrainian court has ruled on this collision, and this silence is specific to sui generis rather than IP litigation in general, which stays busy with hundreds of commercial, civil and criminal IP cases annually. The machinery simply has not been pointed at an Article 33 claim yet, making the contractual allocation of right-holder status the only way to make title clear before a dispute begins wherever AI touches a deliverable.

Article 14 transfers the economic rights in a work made for hire to the employer from the moment of creation unless the contract provides otherwise, which is the rule that settled most Ukrainian IT disputes for years. However, AI tools break this construction because Article 14 presupposes an author-employee. When a developer uses Copilot and 40% of the resulting code is generated by the model, then for that 40% there is no work in the traditional sense, but rather a sui generis object under Article 33 that Article 14 does not reach automatically.

The result is a hybrid product whose status is partially unclear. The human portion transfers through work-made-for-hire, but the AI-generated portion transfers only if the employer can establish an independent basis, such as being the person who initiated the creation, which is unlikely if the employee wrote the prompt, or being the person holding the economic rights to the program, which works if the company licensed Copilot Business but fails if the employee used a personal account at home.

On separation, a disgruntled developer can credibly claim the most valuable modules are sui generis outputs from their personal account, leaving the employer with the burden of disproving it. The only way to close the gap is contractual, by stating expressly in the job description and employment contract that AI tool use falls within the employee's duties and that all such outputs, including Article 33 objects, belong to the employer, since Article 14 does not extend to sui generis objects automatically.

Article 15 transfers economic rights in a commissioned work to the client in full unless agreed otherwise, but it speaks of works rather than non-original objects under Article 33. A standard IP clause that works for human-authored code does not cover the layer of AI-generated output. The fix is a dual IP clause providing separate transfer under Article 20 for traditional code and Article 33 for AI-generated elements, along with the contractor's confirmation that it lawfully initiated the creation, warranties on AI tool licensing via corporate accounts and training data non-infringement.

The Copyright Law contains no text-and-data-mining exception like the ones found in the EU, meaning that using works protected by Ukrainian copyright to train generative models requires the right-holder's authorisation. This position remains unsettled, and the risk of infringement claims is not nil. For a CEO, this creates three risk zones. The model developer must audit its training data and secure licences or establish public-domain or first-party provenance. At the deployment layer, using a foreign model in products sold into Ukraine carries indirect infringement risk if that model trained on unlawfully used Ukrainian works, as theoretical IP risks can turn existential the day a precedent lands.

At the title layer, a defendant may argue your sui generis rights themselves rest on unlicensed data, which constitutes an abuse of rights under the Civil Code.

Different jurisdictions have answered this challenge in various ways. The United Kingdom extended authorship by deeming the author of a computer-generated work to be the person who made the arrangements for its creation. The United States went the other way when its Copyright Office refused protection to AI-generated images due to insufficient human authorship. The EU has not addressed ownership at the Union level. Ukraine differs from all three by establishing a separate legal category for AI-generated objects that neither extends authorship nor refuses protection. The regime is younger and less tested but is converging on EU standards, especially since Ukraine completed the EU accession screening for intellectual property. For CEOs operating Ukrainian-touched AI assets, the advantage is real through recognition by design rather than improvised case law, provided the contract is built to claim it.

A sui generis dispute will not unfold like a traditional copyright case. Previous Supreme Court rulings show that a code fragment attached to a registration certificate can prove insufficient to identify a program, and the risk is analogous for Article 33 objects, meaning the record needed is broader. Four kinds of evidence matter:

• the prompts and generation parameters such as query text, seed, temperature, model version and timestamp;
• the model and its licensing status;
• the initiation architecture – including employment contracts and handover certificates linked by date; and
• the generation logs themselves, which should ideally go through corporate application programming interface (API) wrappers rather than personal accounts whose history belongs to the provider.

Academic commentary proposes a dedicated register logging contribution, process and investment as metadata, but until one exists, building that record falls on the business.

The lesson is procedural rather than philosophical, meaning that classification as an Article 20 work, Article 33 sui generis or something outside protection must happen at creation instead of in litigation years later. An internal AI tool policy should:

• define permitted models;
• mandate corporate licences;
• ban personal accounts for official tasks; and
• require centralised logging of prompts and parameters.

Outsourcing agreements need the dual IP clause and delivery of all generation artefacts alongside source code, while M&A due diligence needs an AI IP audit as a line item to check inventories, corporate licences and training data risks.

Two regulatory fronts compound the exposure. Where AI processes personal data, the Law on Protection of Personal Data already applies, and incoming draft legislation aims to align Ukraine with the General Data Protection Regulation (GDPR) and lift penalties significantly. Voluntary AI-content labelling, which is an early-stage instrument today, is hardening into a default before it becomes mandatory.

The exposure is no longer only the company's. The Civil Code allows courts to hold managers personally liable for breaching their duties and bar them from management for three years. Furthermore, legal provisions impose strict, no-fault liability on whoever controls a source of increased danger, a category Ukrainian scholarship argues should extend to autonomous AI. A board that deploys AI without documented oversight is exposed in its directors' own names rather than only on the company's balance sheet.

In 2026, every commercial AI product touching Ukraine is judged not by the cleverness of its prompts, the talent of its engineers or the depth of its investors. It is judged by the pages of contract its lawyers wrote before the model was switched on. Companies that wrote them hold clean legal title, while those that did not hold litigation instead.