A contractor writes your product's core module. Nobody signs an IP assignment agreement, because everyone assumes paying the invoice settles it. Under EU copyright law, it doesn't. The code still belongs to the contractor, not the company that paid for it, because the one EU rule that hands ownership to a business automatically covers employees, not contractors. Every ranking page read for this piece is written for US or Canadian law, so none of them mention that gap.
Does a contractor own the code they write for you?
Copyright law starts from one default nearly everywhere: whoever creates a work owns it until they transfer those rights to someone else in a way the law recognizes. Employment law layers a different default on top of that for employees. Nothing does the same for contractors, and that's the gap that trips up companies who assume a purchase order or an invoice counts as a transfer.
If there's no written assignment, the default holds: the contractor, not the company, owns the copyright in the code, the design files, the architecture docs, everything they created. The company that paid for the work has, at most, an implied license to use it, and implied licenses are narrower and shakier than most founders assume, no exhibit of what's actually covered, no clarity on whether it survives if the relationship ends badly.
Paying for work and owning the copyright in it are two different legal events, and only one of them requires a contract.
The EU rule, and why it doesn't cover contractors
The EU does have a default that assigns ownership automatically, but it's narrower than most buyers assume. Directive 2009/24/EC on the legal protection of computer programs, Article 2(3), states: "Where a computer program is created by an employee in the execution of his duties or following the instructions given by his employer, the employer exclusively shall be entitled to exercise all economic rights in the program so created, unless otherwise provided by contract."
Read that again for the word doing the work: employee. The directive hands ownership to the employer only when an employer-employee relationship exists. A contractor engaged directly, or a staff-augmentation engineer working under a flexible contract rather than an employment relationship, sits outside that default entirely. Nothing in the directive transfers a contractor's code to the company that hired them without a separate written agreement doing that job.
That scope matters for a company sourcing engineers across borders. The directive binds every EU member state a company hires in, including Poland, Hungary, Slovakia, Slovenia, Romania and Spain. It doesn't bind Serbia, because Serbia isn't an EU member state, so a Serbian engagement sits outside this rule entirely and needs its own legal analysis.
Worker classification is a separate question from ownership, and worth keeping separate in your head. If the contractor comes through an outsourcing intermediary rather than a direct contract, the EU Platform Work Directive, which runs the same worker-classification test against outsourcing intermediaries, governs whether that arrangement counts as disguised employment. It says nothing about who owns the code either way.
What one EU member state requires in writing: Poland
Poland's Copyright Act sets a formality most contractor agreements miss even when a written assignment exists. Article 53 of Poland's Copyright Act requires it: "A contract to transfer the author's economic rights shall be made in writing under pain of nullity." Not in writing, no transfer, regardless of what an invoice or an email chain says.
Writing alone isn't enough. Article 41(2) of the same act requires the contract to name what it actually covers: "A contract for the transfer of the author's economic rights or for the use of the work... shall cover the fields of exploitation specified expressly therein." A generic "all IP belongs to the company" clause that doesn't list the specific uses, reproduction, distribution, modification, public display, whatever applies, doesn't satisfy this on a strict reading.
For contrast, Article 74(3) shows what the employee default looks like on the ground: "Unless the contract of employment stipulates otherwise, the author's economic rights in a computer program created by an employee while performing of his/her duties under the employment relationship shall be owned by the employer." That's the same employer-favorable default Directive 2009/24/EC sets at the EU level, mirrored in Polish national law, and it still only reaches employees.
This is Poland's statute, not a description of EU law generally. Hungary, Slovakia, Slovenia, Romania and Spain each have their own copyright act, and each may set different formalities for a valid transfer. None of those five statutes is cited here, so don't assume Poland's written-form rule or its fields-of-exploitation requirement applies the same way anywhere else in the EU. And Serbia, again, isn't an EU member state, so none of this reaches a Serbian engagement either.
What a valid IP assignment agreement should actually include
Three things separate an agreement that actually transfers ownership from one that just gestures at it.
Present and future work product both need covering. A clause that only assigns what's already been delivered leaves every future deliverable in the same undefined state the contractor started in. Triumph Law's IP assignment guide structures this as a standing assignment: everything the contractor creates under the engagement, not just a snapshot at signing.
Scope needs to be spelled out. Poland's fields-of-exploitation requirement is a national formality, but the underlying instinct, name what's actually being transferred rather than writing "all IP" and hoping a court reads it generously, holds up as good drafting practice regardless of jurisdiction. LegalZoom's IP assignment template handles this with an attached exhibit listing the specific IP covered, rather than folding it into one vague sentence in the body of the contract.
Timing is where companies often get it backward. Sign the assignment before work starts, not after. A contractor who's already delivered the code has the stronger hand in a post-hoc negotiation than one who's about to start, and "we'll sort out the paperwork later" is how companies end up owning nothing.
Treat the checklist above as a starting point, not a contract, and don't treat it as legal advice either. Get a lawyer licensed in the contractor's country to review the actual agreement before anyone signs it, because the formalities above are Poland's specifically, and a different country's court will read a different statute.
FAQ
Does an NDA already cover this?
No. An NDA protects confidentiality, it stops a contractor from sharing your code or specs with someone else. It says nothing about who owns the copyright in what they create. Companies that only have an NDA on file with a contractor have no ownership transfer at all, just a confidentiality promise sitting next to a legal vacuum.
Do I need a new agreement for every contractor, or does one clause in the main contract work?
Either works, as long as it meets the formal requirements of the jurisdiction the contractor is in. A standalone IP assignment agreement is cleaner to track across multiple contractors, but a well-drafted assignment clause inside the main services contract does the same job, provided it's in writing, names the fields of exploitation where a jurisdiction like Poland requires that, and covers future work product, not just what's already delivered.
What happens if the agreement is verbal or was never signed?
In Poland, nothing transfers. Article 53 makes a copyright transfer void without a written contract, so a verbal agreement or an unsigned draft leaves the contractor holding the rights regardless of what everyone assumed at the time. The company that paid for the work ends up with, at best, an implied license, not ownership.
Does GDPR have anything to do with who owns the code?
No, and it's worth keeping the two apart. GDPR governs how personal data gets processed, not who owns intellectual property. If your contractor also handles personal data as part of the engagement, that's the data processing agreement GDPR Article 28 separately requires, a different document answering a different question.