Compliance in IT Projects: Risks and Civil Code of the Russian Federation

Compliance Risks in Software Development: Lessons from Court Practice

Analysis of court practice in the RF on IT projects has identified 192 compliance risks among 495 companies in Tomsk Oblast (OKVED 62), resulting in losses totaling 53.2 million rubles. The average damage per risk was 277,000 rubles. The largest cases reached 15.8 million rubles. This analysis shows that failure to comply with Civil Code of the RF provisions when creating IT products often provokes disputes between contractors and customers.

IT Project as a Civil-Law Transaction

An IT project qualifies as a works contract (Chapter 37, Civil Code of the RF) or a paid services contract (Chapter 39, Civil Code of the RF). The IT party acts as the contractor that creates the IT product, while the customer accepts and pays for it.

Definition of IT Product: an object in the form of an IT service or result of intellectual activity (RIA)—software code produced at the end of a sprint, lifecycle phase, or contract. An IT product consists of an IT service and RIA (computer program under Art. 1261, Civil Code of the RF). Terms like software, automated systems, and IS are aggregated under the notion of "program."

Systematizing these objects improves documentation quality, clarifies the parties' expectations, and strengthens contract covenants.

Transfer of Rights to the IT Product

Under Arts. 702, 720, 1296 of the Civil Code of the RF, transfer of ownership and exclusive rights occurs at the "IT project completion" phase upon signing the acceptance act (Art. 1286, Civil Code of the RF). The baseline project plan must include this phase with acceptance procedures.

Example: In case A67-7409/2013, an IT organization recovered 1.8 million rubles after confirming execution of test protocols and acts.

Failure to follow documentation procedures leads to major losses:

• Case A40-81328/2011: 124.2 million rubles in lost profits from using "HIST DoCoMo".
• Case 2-38/2019: 20.2 million rubles for reproduction of "eLearning Metadata Manager".
• Case 02-4545/2017: 100,000 rubles in author's remuneration.
• Case 2-1564/15: dispute over rights holder.
• Case A40-202764/18: 5 million rubles in compensation.

Ways of Disposing of Exclusive Rights

Methods fall into two groups: for a completed IT product and for one being created.

For a Completed IT Product (Art. 1233, Civil Code of the RF)

• Agreement on Assignment of Exclusive Right (Art. 1285, Civil Code of the RF):

- The rights holder transfers full exclusive right to the acquirer.

- Acquirer becomes sole owner (Art. 1281, Civil Code of the RF); prior holder loses rights (Art. 1270, Civil Code of the RF).

- Essential terms: subject, remuneration (not per Art. 424, Civil Code of the RF—specify clearly in covenants).

- If registered in Rospatent—indicate certificate number.

- Written form mandatory (Art. 1234, Civil Code of the RF); violation = invalidity.

• License Agreement (Arts. 1235, 1236, 1286, Civil Code of the RF):

- Licensor grants licensee usage rights within agreement scope.

- Licensor retains exclusive right.

For IT Product Being Created

• Full assignment of rights to customer.
• Grant of non-exclusive license.

Proper documentation minimizes rights-related disputes.

Consequences of Non-Compliance with Compliance Norms

International standards (ISO, PRINCE2, PMBOK) overlook Civil Code of the RF specifics and are advisory only. Court disputes stem from:

• Lack of project completion phase.
• Inadequate rights transfer documentation.
• Covenant breaches on remuneration and subject.

Analysis of 495 IT entities confirms: compliance risks are rare but devastating.

Key Points:

• IT project = civil-law transaction (works/services).
• IT product = IT service + RIA (software code).
• Rights transfer—only at completion phase with act.
• Assignment/license must be documented.
• Average loss per risk—277,000 rubles; max—15.8+ million rubles.

— Editorial Team