Blog

man in black and brown camouflage uniform holding red smoke

<h2>EU's SAFE Programme: Why "Design Freedom" May Be the Biggest Compliance Puzzle in European Defence</h2>Last month I published a viewpoint piece in <a data-mce-href="https://www.nationaldefensemagazine.org/articles/2026/3/27/viewpoint-eus-safe-program-comes-with-potential-pitfalls-for-us-contractors" href="https://www.nationaldefensemagazine.org/articles/2026/3/27/viewpoint-eus-safe-program-comes-with-potential-pitfalls-for-us-contractors">National Defense Magazine</a> examining the practical compliance challenges that the EU's Security Action for Europe (SAFE) programme creates for non-EU defence contractors. The article has generated significant interest, so I wanted to expand on several themes here and explain why the issues I raise are not hypothetical.The core problemSAFE is the EU's €150 billion defence loan instrument designed to accelerate joint procurement and strengthen Europe's industrial base. At its heart lies a distinction between two categories of defence products. Category 1 systems face relatively straightforward eligibility rules. Category 2 — covering air and missile defence, AI, electronic warfare, strategic drones, and other complex platforms — imposes an additional requirement: contractors must demonstrate "design freedom," meaning the unrestricted ability to define, adapt, and evolve their product's design without constraints imposed by non-EU entities.The regulation offers no further guidance on what this means in practice. It describes a capability contractors must possess rather than specifying the legal rights that would satisfy the requirement. For any system built on licensed software components, third-party datasets, or foundation AI models, this creates a compliance gap that neither contractors nor procuring member states can currently resolve with confidence.The classification paradoxIn the NDM article I highlighted what I called a regulatory "Schrödinger's cat." SAFE places cybersecurity systems in Category 1 (exempt from design freedom) and artificial intelligence in Category 2 (design freedom mandatory). In practice, the two are inseparable. Modern cyber defence platforms rely on machine learning models for automated threat detection — models that technically fall under Category 2 restrictions. A contractor supplying an AI-powered firewall cannot know whether Brussels considers it an exempt cybersecurity tool or a restricted AI system.Counter-UAS platforms make this even starker. The same AI system engages small drones (Category 1) and larger drones (Category 2). Only the target's size determines the legal regime — not the system's architecture. Since SAFE operates as a regulation rather than a directive, the European Commission cannot fix these classification issues through implementing acts; it would need a full co-decision amendment.The software forking trapThe second major risk I addressed is what happens to transatlantic software supply chains. The value of U.S. defence software has always been its unified baseline — a patch developed for one customer can be pushed globally because everyone runs the same code. If SAFE forces European consortia to maintain sovereign forks of that software to prove design freedom, those systems get severed from the global update stream. The result is what I described as "orphan" European systems: sovereign on paper, but increasingly expensive to maintain and vulnerable until security patches can be manually reconciled.There may be architectural workarounds. A modular open systems approach (MOSA) could in theory allow a European partner to control the mission layer through open APIs while the U.S.-sourced core remains a protected module. But nobody currently knows whether Brussels would accept that distinction as satisfying the design freedom requirement. The regulation is silent on the question.Why this matters for the European defence marketFrom our work advising defence manufacturers on European market entry, including in Poland&nbsp; which stands to receive over €43 billion under SAFE, the largest single-country allocation we see these compliance uncertainties playing out in real time. Companies structuring their entry into SAFE-funded procurement pipelines need to think about design freedom not as a distant regulatory concern but as a structuring question that affects partnership models, IP licensing, entity formation, and technology transfer agreements today.What comes nextThe Commission will need to provide interpretive guidance on design freedom or the market will develop its own answers through bilateral negotiations between contractors and procuring authorities, which risks fragmentation across member states. We will be watching closely and writing about it as the landscape develops.The full article is available at National Defense Magazine.

EU SAFE Programme & "Design Freedom" Paradox

Synthetic Law | 21 March 2026On 12 March 2026, Polish President Karol Nawrocki vetoed the legislation that would have established the domestic framework for implementing the EU's SAFE programme in Poland. The move sent a shockwave through European defence circles.Poland had secured the single largest national allocation under SAFE — approximately €43.7 billion in low-interest loans earmarked for 139 defence modernisation projects, from air defence and cyber operations to unmanned systems and heavy equipment production.For defence companies positioning themselves in Poland, the question is straightforward: does this veto change the fundamentals of the Polish defence market? The short answer is no. But the longer answer matters more.What SAFE Is and What the Veto Actually Blocks SAFE (Security Action for Europe) is a €150 billion EU-wide loan facility established by Regulation (EU) 2025/1106. It provides member states with long-term, low-interest financing for defence investment. Poland's allocation was approved in January 2026, and the Polish parliament passed the implementing legislation in late February.The implementing act would have created a dedicated financial vehicle - a new fund managed by Bank Gospodarstwa Krajowego (BGK), Poland's national development bank - to receive, manage, and disburse the SAFE loans across all designated projects. It would have covered not only military procurement but also border security, police modernisation, and defence-related infrastructure.The veto does not withdraw Poland from the SAFE programme itself. The EU regulation applies directly to all member states. What it blocks is the specific domestic legal architecture for spending the money efficiently.Why the Veto HappenedThe president framed his decision around sovereignty concerns, arguing that SAFE loans would burden Poland with decades of foreign debt and give Brussels undue oversight over national defence spending. The opposition backed the veto, pointing to the requirement that at least 65% of SAFE-funded contracts go to European suppliers — which they argue could disadvantage American defence firms in a country with deep transatlantic ties.The government and most independent analysts see it differently. Defence Minister Kosiniak-Kamysz described the programme as one designed in Warsaw, not Brussels, noting that Polish military planners authored the project list. The European Commission confirmed its readiness to continue working with Poland regardless of the veto.The political reality is more prosaic than the rhetoric suggests. The veto is widely read as a signal in the ongoing power struggle between President Nawrocki and Prime Minister Tusk's government ahead of the 2027 parliamentary elections. Public polling conducted in the week following the veto consistently showed majority disapproval of the president's decision.The Government's Plan B Within hours of the veto, the government convened an emergency cabinet meeting and adopted a resolution to proceed through an existing mechanism: the Armed Forces Support Fund (Fundusz Wsparcia Sił Zbrojnych), originally established under the Defence of the Fatherland Act passed by the previous government.Under this route, BGK would still receive the SAFE loans, but the fund can only be used for strictly military purposes. That means approximately PLN 16 billion originally planned for non-military security spending — border guard modernisation, police equipment, and defence infrastructure — cannot be funded through this channel.The government's SAFE commissioner, Magdalena Sobkowiak-Czarnecka, confirmed after meetings in Brussels that Poland's participation is intact and that the first tranche of funding could arrive as early as April 2026. For the core military procurement pipeline — unmanned systems, armoured vehicles, air defence, and the vast majority of SAFE-funded projects — the path forward is operationally viable, even if legally contested.What This Means for Defence Companies For manufacturers already engaged in or considering the Polish market, three things matter.Poland's defence spending trajectory is unchanged. The country allocates over 4.7% of GDP to defence — one of the highest ratios in NATO — with a separate national budget of approximately PLN 200 billion for 2026. SAFE is a significant supplementary funding source, but it is not the only one. Polish procurement will continue whether SAFE funds flow smoothly or face bureaucratic delays.The case for local industrial partnerships is stronger than ever. The political debate has intensified public and institutional focus on defence sovereignty and the importance of building domestic production capacity. For foreign manufacturers, this means that a credible polonisation strategy — establishing a local entity, partnering with Polish firms, committing to local supply chains — is now even more central to a successful market entry than it was before.The Broader Signal Poland remains the single most dynamic defence market in the European Union. Its combination of strategic exposure on NATO's eastern flank, political consensus on high defence spending, massive EU-backed financing (veto notwithstanding), and an active push to build sovereign industrial capacity creates an environment unlike any other in Europe.The SAFE veto is a domestic political event, not a structural change in Poland's defence posture. For companies with a serious market entry strategy, the right response is not to pause — it is to accelerate the work that makes them credible local partners when orders materialise.&nbsp; This commentary is published by Synthetic Law for informational purposes and does not constitute legal advice. For specific guidance on entering the Polish defence market, contact us directly.

Poland's Presidential Veto of the SAFE Defence Loan: What It Means and What Comes Next

October 16, 2025&nbsp; In a significant victory for digital businesses and a nuanced interpretation of GDPR, Poland's Supreme Administrative Court (Naczelny Sąd Administracyjny) has sided with a company in a case that challenges the automatic classification of IP addresses and cookie IDs as personal data. The ruling, issued on October 16, 2025, represents a critical moment in European data protection jurisprudence.The dispute began when an individual, J.O., filed a complaint with the Polish Data Protection Authority (PUODO - Prezes Urzędu Ochrony Danych Osobowych) against a company, alleging improper processing of his personal data. Specifically, the complainant argued that the company processed his IP address and artificially assigned cookie IDs without a legal basis.The Data Protection Authority initially sided with the complainant, issuing a decision that ordered deletion of the IP address and cookie IDs and required notification to third parties who received this data. However, both lower courts and ultimately the Supreme Administrative Court found critical flaws in the Authority's reasoning.The Supreme Administrative Court's core holding is straightforward yet profound: Internet identifiers like IP addresses and cookie IDs are not automatically personal data under GDPR.The Court ruled that the Data Protection Authority failed to properly establish whether these digital identifiers actually constituted personal data in the specific circumstances of the case. This determination, the Court emphasized, requires a contextual analysis rather than blanket assumptions.Main findings:&nbsp;The Data Protection Authority's decision failed to even determine which type of IP address was involved in this case - a fundamental oversight that proved fatal to their ruling.Drawing on GDPR's Recital 26, the Court articulated a sophisticated test for determining when identifiers constitute personal data. Critically, the Court referenced the landmark EU Court of Justice case Breyer (C-582/14), which established that a dynamic IP address may constitute personal data for a website operator only if they have legal means to obtain additional information from the Internet service provider that would allow identification.The Court applied similar reasoning to cookie identifiers. The Authority had cited the CJEU's Planet49 case (C-673/17) to support treating cookie IDs as personal data. However, the Supreme Court noted a critical distinction: in Planet49, cookies were linked to registration forms where users provided names and addresses. This connection enabled personalization and identification.The Court concluded that Planet49's holding about cookies involving personal data processing "cannot be considered a proper explanation" for classifying cookie IDs as personal data in circumstances where no connecting information exists.The Court acknowledged an important principle: identification in the digital environment doesn't require knowing someone's name and address. Digital identification involves distinguishing one user from others for the purpose of exerting specific influence.However, this doesn't mean that any form of digital distinction automatically constitutes personal data. The Court emphasized that proper analysis must consider whether there's a reasonable likelihood of identifying the natural person behind the digital identifier.The Supreme Administrative Court stated unequivocally: "There are no grounds to conclude that an IP address - regardless of whether it is static or dynamic, regardless of who controls it, and regardless of what possibilities exist to use it for identifying a natural person - should always be treated as personal data."The Broader European Context While this is a Polish court decision, it contributes to evolving European jurisprudence on digital identifiers. The Court carefully analyzed CJEU precedents (Breyer, Planet49) and applied them with appropriate attention to factual distinctions.The ruling aligns with GDPR's fundamental principle that data protection measures should be proportionate and risk-based. It reinforces that the regulation's scope, while broad, is not unlimited.Related CJEU Cases:Breyer (C-582/14) - Dynamic IP addresses Planet49 (C-673/17) - Cookie consent and personal data

Polish Supreme Court: Cookies Are Not Always Personal Data

A California federal judge has granted preliminary approval to Anthropic's $1.5 billion settlement in a copyright class action brought by authors—one of the largest AI legal rulings to date.Key Details:Settlement covers 482,460 books downloaded from pirate libraries (Library Genesis and Pirate Library Mirror) Authors to receive approximately $3,000 per book Anthropic must destroy all original and copied files Judge William Alsup called the settlement "fair" while noting the complexity of the claims process Judge Alsup emphasized the need for "excellent" legal work to manage this large-scale settlement "ethically," expressing confidence in the legal teams involved.Why This Matters: This landmark case proves that copyright protections remain robust in the AI era. Companies can't simply train on pirated content and hope for the best—there are real consequences.The settlement sends a clear message: AI innovation must respect intellectual property rights. As the industry races forward, legal accountability isn't just catching up—it's already here.

Copyright Isn't Dead—It Just Cost Anthropic $1.5 Billion

From today, the Data Act applies across the EU, reshaping how data from connected devices – including vehicles, robots, energy infrastructure – must be shared.🚗 Just before the deadline the European Commission released 🎈 Guidance on Vehicle Data 🎈 and ... we have already spotted some real issues...&nbsp;📡 Personal vs. non-personal data: the same streams may be “technical” in one context, but personal under GDPR in another. The boundary depends on use, not on the nature of the data – especially in the light of the recent judgment (EDPS vs SRB) which underlined the subjective nature of what qualifies as personal data.&nbsp;💣 Pre-processed vs. derived data: users are entitled to raw and simple processed data (averages, unit conversions), but not to “derived” outputs (eco-score, ADAS object detection). The line is thin – map-matching GNSS is in scope, while collision trajectory analysis is not. This puts hasztag#ADAS providers in a tricky position, as much of their value is built on exactly the type of “derived” insights that fall outside mandatory sharing.🌍 Important: these obligations apply not only to EU entities but also to non-EU manufacturers and operators if their vehicles are offered on the EU market.&nbsp;Stay tuned for more !#DataAct #Automotive #VehicleData #SyntheticLaw #RegulatoryCompliance&nbsp;

Guidance on Vehicle Data under EU Data Act

drone squad, quadrocopters, hologram, control system, high-tech technology, military technology, background, abstraction

<h2>U.S. skies not for Chinese-made drones.&nbsp;&nbsp;</h2>The U.S. Department of Commerce's Bureau of Industry and Security (BIS) has issued an Advance Notice of Proposed Rulemaking (ANPRM) regarding the security of unmanned aircraft systems (UAS), commonly known as drones. This ANPRM is in line with Executive Order 13873, under which other rules have been finalized or are in the process of being finalized, not to mention the one on #ConnectedCars.&nbsp;Growing concerns: Similar to other rules, BIS is concerned about the potential risks associated with the involvement of China and Russia in the design, development, manufacture, or supply of information and communications technology and services (ICTS) that are integral to UAS.&nbsp;What's at stake? The potential for data exfiltration, remote access, and the ability of foreign adversaries to compel companies to cooperate in harmful activities.Key Components of Concern: The ANPRM specifically identifies on-board computers, communications systems, flight control systems, ground control stations, software, data storage, and AI applications as areas of concern.Broad Scope: The proposed rules could affect a wide range of stakeholders, including those in the agriculture, chemical, construction, energy, telecommunications, and other critical infrastructure sectors.&nbsp;Definitions of UAS: BIS is considering various definitions and is seeking input on which is most appropriate. Based on the many comments submitted during the Connected Car ANPRM, we anticipate this will be one of the critical issues.&nbsp;Supply Chain Risks: The request for comment seeks input on supply chain vulnerabilities and the geographic locations where key components of UAS are manufactured.&nbsp;The comment period closes on March 4, 2025. Make your voice heard!#UAS #Drones #Cybersecurity #NationalSecurity #SupplyChain #ICTS #DepartmentofCommerce #PublicComment #Rulemaking #Technology #BIS #China #Russiahttps://www.bis.gov/press-release/commerce-issues-advance-notice-proposed-rulemaking-secure-unmanned-aircraft-systems

U.S. Department of Commerce Seeks Input on Securing the Supply Chain for Unmanned Aircraft Systems (UAS)

Synthetic Law Kancelaria Radcy Prawnego 

Synthetic Law – Law Firm Warsaw, Poland – expert advice on AI law, GDPR, CCPA compliance, data privacy, cybersecurity, IP tech, and new technology regulations. Support for companies implementing artificial intelligence, processing data, and building solutions based on software and digital assets.

Blog

EU SAFE Programme & "Design Freedom" Paradox

Poland's Presidential Veto of the SAFE Defence Loan: What...

Polish Supreme Court: Cookies Are Not Always Personal Data

Copyright Isn't Dead—It Just Cost Anthropic $1.5 Billion

Guidance on Vehicle Data under EU Data Act

U.S. Department of Commerce Seeks Input on Securing the S...