Every few months a business owner arrives with the same problem. The agency that built their platform has gone quiet, or gone under, or simply become too expensive to work with, and nobody can find anything. Not the repository, not the server credentials, not even the registrar login for the domain. The invoices were all paid in full. The assumption was that paying for software meant owning it.
Under Irish law, that assumption is wrong more often than it is right. This is the fourth piece in our series on commissioning software in Ireland, after funding, cost and timelines, and it is the one that costs most when ignored, because the bill only arrives at the worst possible moment: when you want to leave.
TL;DR
- Under the Copyright and Related Rights Act 2000, the author of a work is the first owner of the copyright in it. An employee’s work belongs to the employer, but an independent contractor’s work belongs to the contractor unless there is a written, signed assignment.
- Paying an invoice does not transfer copyright. An assignment is not effective unless it is in writing and signed by the assignor. Ireland has no US-style “work made for hire” doctrine for commissioned work.
- Code ownership is only one of roughly a dozen assets. Domains, DNS, cloud accounts, CI/CD pipelines, package registries and design source files are the ones most often left behind.
- Agencies reasonably retain ownership of their reusable internal components. What matters is that you receive a perpetual, transferable licence rather than a dependency you cannot move.
- AI-generated code sits in a copyright grey zone, which makes provenance records, warranties and indemnities more important in 2026, not less.
The default position is not what most clients assume
Section 23 of the Copyright and Related Rights Act 2000 sets the baseline: the author of a work is its first owner. There is a carve-out for employees, where a work created in the course of employment belongs to the employer subject to any agreement to the contrary. There is no equivalent carve-out for independent contractors.
That matters enormously, because almost nobody who commissions software is employing the people writing it. If you hire an agency, a freelancer or a contractor, the copyright in the code vests in them by default and stays there until it is assigned to you. Section 120 of the same Act requires that an assignment be in writing and signed by or on behalf of the assignor to be effective. A paid invoice is not an assignment. Nor is a sales deck promising “full ownership on completion” with nothing to match it in the executed contract.
What you usually do have, absent a written assignment, is an implied licence to use the software for the purpose for which it was commissioned. That is much less than ownership, and it gets murky the moment you want to go beyond that purpose: hand the codebase to a new development partner, fork it into a second product, or sell the business with the software as a core asset. It surfaces most painfully during due diligence, where investors ask to see the chain of title for the code, and “we paid for it” is not a chain of title.
Code ownership is only one of a dozen assets
Even a watertight IP assignment leaves you stranded if the operational assets sit in someone else’s accounts. When we run a handover audit, this is the list we work through:
- Domain names, with your organisation as registrant, not the agency, and registrar access you control.
- DNS management, be that Cloudflare, Route 53 or the registrar’s panel. Whoever holds DNS holds your email and your traffic.
- The source repository, in your GitHub, GitLab or Bitbucket organisation, with full commit history rather than a zip of the final state.
- Cloud and hosting accounts, billed to your card. Sub-accounts under an agency’s master billing account are a lock-in mechanism whether or not anyone intended it that way.
- CI/CD pipelines and deployment credentials, including the secrets and environment variables the build depends on.
- Package registry and app store accounts, particularly Apple Developer and Google Play, which are painful to transfer after the fact.
- Design source files, the editable Figma or Sketch documents, not exported PNGs.
- Third-party service accounts: payment gateway, email, SMS, mapping, error tracking, and any AI provider keys.
- Analytics and search consoles, with historical data intact.
- Documentation: architecture notes, runbooks, decision records and the setup instructions that let a new developer build locally on day one.
- A dependency inventory, ideally a software bill of materials, so you know which open source licences you have inherited.
The pattern is simple. Every account should be created under your organisation’s identity, with the agency added as a collaborator, not the other way around. Retrofitting that after a relationship sours is the expensive path.
Assignment, licence, and the reasonable middle ground
It is worth being fair here, because “we own everything” is not always a reasonable demand. Any competent agency has internal libraries and patterns refined across dozens of projects, and asking them to assign exclusive ownership of those to one client is asking them to stop doing their job.
The workable structure separates three categories. Bespoke work built specifically for you is assigned outright. Agency components that predate your project are licensed to you on a perpetual, irrevocable, transferable, royalty-free basis, so a future developer can maintain them and a future acquirer inherits the right. Third-party open source dependencies are owned by nobody in this conversation, and what you need there is a warranty that the licences are compatible with your commercial intentions, plus the inventory to prove it.
Pay attention to that word “transferable”. A licence that terminates if you sell the company is a licence that quietly caps your exit valuation.
The 2026 wrinkle: who authors AI-generated code
Copyright protection generally presumes a human author, which has left AI-generated output in an uncomfortable position across most jurisdictions. Ireland is unusual in having addressed this decades before it became urgent: the 2000 Act contemplates computer-generated works, treating the author as the person by whom the arrangements necessary for creating the work are undertaken. That is more accommodating than several other jurisdictions have managed, but it has never been meaningfully tested against modern generative models.
The practical consequence is this. If a substantial portion of your codebase was generated by an AI coding agent, a clause assigning “all copyright” to you may be assigning less than either party imagines, because the protectable subject matter is uncertain. Arguing about that is a poor use of anyone’s time. Focus instead on what stays solid regardless of how the question resolves: a warranty that the delivered code does not infringe third-party rights, an indemnity surviving project completion, disclosure of which AI tools were used, and provenance records showing what was generated versus authored. Licence contamination, where a model reproduces copyleft code into a proprietary codebase, is a live commercial risk, and the warranty is your protection against it.
Continuity, and why escrow is mostly obsolete
Source code escrow was the traditional answer to agency failure: a third party holds a copy of the code and releases it if the supplier goes under. It still has a place in enterprise procurement, but for most SMEs it adds cost and ceremony to compensate for an arrangement you should not have accepted in the first place. If the repository lives in your organisation from the first commit, the cloud account is yours, and the documentation is good enough that a competent developer can build and deploy without a phone call, you have continuity by construction. Ask the blunt question instead: if the agency vanished tomorrow, how long until another team could deploy a fix? If the honest answer is more than a few days, the gap is operational, not legal.
Red flags in a proposal or contract
- IP ownership is described in the sales deck but absent from the executed agreement.
- Ownership transfers only on “final payment” with no definition of what final means, effectively giving the supplier a lien on your business.
- The agency is listed as the domain registrant rather than as technical contact, or hosting is resold under its account with no path to migrate.
- The licence to agency components is non-transferable, or terminates on change of control.
- No warranty regarding third-party or open source licences, and no dependency inventory.
- Handover is treated as a separate chargeable project rather than a defined deliverable.
The handover audit: an afternoon’s work
- Find your contract and locate the IP clause. If there is no signed assignment covering bespoke work, that is your first action item.
- Run a WHOIS lookup on your domain and confirm the registrant is your legal entity.
- Log in to the source repository yourself. If you cannot, you do not control it.
- Check who is billed for hosting, and confirm you hold owner-level access rather than a delegated role.
- List every third-party service the application depends on and identify who holds each account.
- Ask your current partner for a dependency inventory and a statement of which AI tools were used.
- Test the documentation by having someone outside the build team follow it to a working local environment.
Nothing on that list requires a solicitor to start. Items one and six may well end with one, and that is money far better spent now than during a dispute.
How we approach it
At REPTILEHAUS we set projects up so this conversation never becomes adversarial. Repositories are created in the client’s organisation, cloud accounts are billed to the client with us added as collaborators, bespoke work is assigned, our reusable components are licensed perpetually and transferably, and handover documentation is a deliverable rather than a favour. That is not generosity, it is the arrangement we would want if we were commissioning the work.
If you are not certain what you own, or you are about to commission a build and want the ownership structure right from the first commit, get in touch. We are happy to walk through a handover audit with you, whether or not we built the thing.
This article is general commentary on commissioning practice and is not legal advice. Take advice from a qualified Irish solicitor on your specific contracts.
📷 Photo by Radission US on Unsplash
