Blog

Synthetic Law | 21 March 2026On 12 March 2026, Polish President Karol Nawrocki vetoed the legislation that would have established the domestic framework for implementing the EU's SAFE programme in Poland. The move sent a shockwave through European defence circles.Poland had secured the single largest national allocation under SAFE — approximately €43.7 billion in low-interest loans earmarked for 139 defence modernisation projects, from air defence and cyber operations to unmanned systems and heavy equipment production.For defence companies positioning themselves in Poland, the question is straightforward: does this veto change the fundamentals of the Polish defence market? The short answer is no. But the longer answer matters more.What SAFE Is and What the Veto Actually Blocks SAFE (Security Action for Europe) is a €150 billion EU-wide loan facility established by Regulation (EU) 2025/1106. It provides member states with long-term, low-interest financing for defence investment. Poland's allocation was approved in January 2026, and the Polish parliament passed the implementing legislation in late February.The implementing act would have created a dedicated financial vehicle - a new fund managed by Bank Gospodarstwa Krajowego (BGK), Poland's national development bank - to receive, manage, and disburse the SAFE loans across all designated projects. It would have covered not only military procurement but also border security, police modernisation, and defence-related infrastructure.The veto does not withdraw Poland from the SAFE programme itself. The EU regulation applies directly to all member states. What it blocks is the specific domestic legal architecture for spending the money efficiently.Why the Veto HappenedThe president framed his decision around sovereignty concerns, arguing that SAFE loans would burden Poland with decades of foreign debt and give Brussels undue oversight over national defence spending. The opposition backed the veto, pointing to the requirement that at least 65% of SAFE-funded contracts go to European suppliers — which they argue could disadvantage American defence firms in a country with deep transatlantic ties.The government and most independent analysts see it differently. Defence Minister Kosiniak-Kamysz described the programme as one designed in Warsaw, not Brussels, noting that Polish military planners authored the project list. The European Commission confirmed its readiness to continue working with Poland regardless of the veto.The political reality is more prosaic than the rhetoric suggests. The veto is widely read as a signal in the ongoing power struggle between President Nawrocki and Prime Minister Tusk's government ahead of the 2027 parliamentary elections. Public polling conducted in the week following the veto consistently showed majority disapproval of the president's decision.The Government's Plan B Within hours of the veto, the government convened an emergency cabinet meeting and adopted a resolution to proceed through an existing mechanism: the Armed Forces Support Fund (Fundusz Wsparcia Sił Zbrojnych), originally established under the Defence of the Fatherland Act passed by the previous government.Under this route, BGK would still receive the SAFE loans, but the fund can only be used for strictly military purposes. That means approximately PLN 16 billion originally planned for non-military security spending — border guard modernisation, police equipment, and defence infrastructure — cannot be funded through this channel.The government's SAFE commissioner, Magdalena Sobkowiak-Czarnecka, confirmed after meetings in Brussels that Poland's participation is intact and that the first tranche of funding could arrive as early as April 2026. For the core military procurement pipeline — unmanned systems, armoured vehicles, air defence, and the vast majority of SAFE-funded projects — the path forward is operationally viable, even if legally contested.What This Means for Defence Companies For manufacturers already engaged in or considering the Polish market, three things matter.Poland's defence spending trajectory is unchanged. The country allocates over 4.7% of GDP to defence — one of the highest ratios in NATO — with a separate national budget of approximately PLN 200 billion for 2026. SAFE is a significant supplementary funding source, but it is not the only one. Polish procurement will continue whether SAFE funds flow smoothly or face bureaucratic delays.The case for local industrial partnerships is stronger than ever. The political debate has intensified public and institutional focus on defence sovereignty and the importance of building domestic production capacity. For foreign manufacturers, this means that a credible polonisation strategy — establishing a local entity, partnering with Polish firms, committing to local supply chains — is now even more central to a successful market entry than it was before.The Broader Signal Poland remains the single most dynamic defence market in the European Union. Its combination of strategic exposure on NATO's eastern flank, political consensus on high defence spending, massive EU-backed financing (veto notwithstanding), and an active push to build sovereign industrial capacity creates an environment unlike any other in Europe.The SAFE veto is a domestic political event, not a structural change in Poland's defence posture. For companies with a serious market entry strategy, the right response is not to pause — it is to accelerate the work that makes them credible local partners when orders materialise.&nbsp; This commentary is published by Synthetic Law for informational purposes and does not constitute legal advice. For specific guidance on entering the Polish defence market, contact us directly.

Poland's Presidential Veto of the SAFE Defence Loan: What It Means and What Comes Next

October 16, 2025&nbsp; In a significant victory for digital businesses and a nuanced interpretation of GDPR, Poland's Supreme Administrative Court (Naczelny Sąd Administracyjny) has sided with a company in a case that challenges the automatic classification of IP addresses and cookie IDs as personal data. The ruling, issued on October 16, 2025, represents a critical moment in European data protection jurisprudence.The dispute began when an individual, J.O., filed a complaint with the Polish Data Protection Authority (PUODO - Prezes Urzędu Ochrony Danych Osobowych) against a company, alleging improper processing of his personal data. Specifically, the complainant argued that the company processed his IP address and artificially assigned cookie IDs without a legal basis.The Data Protection Authority initially sided with the complainant, issuing a decision that ordered deletion of the IP address and cookie IDs and required notification to third parties who received this data. However, both lower courts and ultimately the Supreme Administrative Court found critical flaws in the Authority's reasoning.The Supreme Administrative Court's core holding is straightforward yet profound: Internet identifiers like IP addresses and cookie IDs are not automatically personal data under GDPR.The Court ruled that the Data Protection Authority failed to properly establish whether these digital identifiers actually constituted personal data in the specific circumstances of the case. This determination, the Court emphasized, requires a contextual analysis rather than blanket assumptions.Main findings:&nbsp;The Data Protection Authority's decision failed to even determine which type of IP address was involved in this case - a fundamental oversight that proved fatal to their ruling.Drawing on GDPR's Recital 26, the Court articulated a sophisticated test for determining when identifiers constitute personal data. Critically, the Court referenced the landmark EU Court of Justice case Breyer (C-582/14), which established that a dynamic IP address may constitute personal data for a website operator only if they have legal means to obtain additional information from the Internet service provider that would allow identification.The Court applied similar reasoning to cookie identifiers. The Authority had cited the CJEU's Planet49 case (C-673/17) to support treating cookie IDs as personal data. However, the Supreme Court noted a critical distinction: in Planet49, cookies were linked to registration forms where users provided names and addresses. This connection enabled personalization and identification.The Court concluded that Planet49's holding about cookies involving personal data processing "cannot be considered a proper explanation" for classifying cookie IDs as personal data in circumstances where no connecting information exists.The Court acknowledged an important principle: identification in the digital environment doesn't require knowing someone's name and address. Digital identification involves distinguishing one user from others for the purpose of exerting specific influence.However, this doesn't mean that any form of digital distinction automatically constitutes personal data. The Court emphasized that proper analysis must consider whether there's a reasonable likelihood of identifying the natural person behind the digital identifier.The Supreme Administrative Court stated unequivocally: "There are no grounds to conclude that an IP address - regardless of whether it is static or dynamic, regardless of who controls it, and regardless of what possibilities exist to use it for identifying a natural person - should always be treated as personal data."The Broader European Context While this is a Polish court decision, it contributes to evolving European jurisprudence on digital identifiers. The Court carefully analyzed CJEU precedents (Breyer, Planet49) and applied them with appropriate attention to factual distinctions.The ruling aligns with GDPR's fundamental principle that data protection measures should be proportionate and risk-based. It reinforces that the regulation's scope, while broad, is not unlimited.Related CJEU Cases:Breyer (C-582/14) - Dynamic IP addresses Planet49 (C-673/17) - Cookie consent and personal data

Polish Supreme Court: Cookies Are Not Always Personal Data

A California federal judge has granted preliminary approval to Anthropic's $1.5 billion settlement in a copyright class action brought by authors—one of the largest AI legal rulings to date.Key Details:Settlement covers 482,460 books downloaded from pirate libraries (Library Genesis and Pirate Library Mirror) Authors to receive approximately $3,000 per book Anthropic must destroy all original and copied files Judge William Alsup called the settlement "fair" while noting the complexity of the claims process Judge Alsup emphasized the need for "excellent" legal work to manage this large-scale settlement "ethically," expressing confidence in the legal teams involved.Why This Matters: This landmark case proves that copyright protections remain robust in the AI era. Companies can't simply train on pirated content and hope for the best—there are real consequences.The settlement sends a clear message: AI innovation must respect intellectual property rights. As the industry races forward, legal accountability isn't just catching up—it's already here.

Copyright Isn't Dead—It Just Cost Anthropic $1.5 Billion

From today, the Data Act applies across the EU, reshaping how data from connected devices – including vehicles, robots, energy infrastructure – must be shared.🚗 Just before the deadline the European Commission released 🎈 Guidance on Vehicle Data 🎈 and ... we have already spotted some real issues...&nbsp;📡 Personal vs. non-personal data: the same streams may be “technical” in one context, but personal under GDPR in another. The boundary depends on use, not on the nature of the data – especially in the light of the recent judgment (EDPS vs SRB) which underlined the subjective nature of what qualifies as personal data.&nbsp;💣 Pre-processed vs. derived data: users are entitled to raw and simple processed data (averages, unit conversions), but not to “derived” outputs (eco-score, ADAS object detection). The line is thin – map-matching GNSS is in scope, while collision trajectory analysis is not. This puts hasztag#ADAS providers in a tricky position, as much of their value is built on exactly the type of “derived” insights that fall outside mandatory sharing.🌍 Important: these obligations apply not only to EU entities but also to non-EU manufacturers and operators if their vehicles are offered on the EU market.&nbsp;Stay tuned for more !#DataAct #Automotive #VehicleData #SyntheticLaw #RegulatoryCompliance&nbsp;

Guidance on Vehicle Data under EU Data Act

drone squad, quadrocopters, hologram, control system, high-tech technology, military technology, background, abstraction

<h2>U.S. skies not for Chinese-made drones.&nbsp;&nbsp;</h2>The U.S. Department of Commerce's Bureau of Industry and Security (BIS) has issued an Advance Notice of Proposed Rulemaking (ANPRM) regarding the security of unmanned aircraft systems (UAS), commonly known as drones. This ANPRM is in line with Executive Order 13873, under which other rules have been finalized or are in the process of being finalized, not to mention the one on #ConnectedCars.&nbsp;Growing concerns: Similar to other rules, BIS is concerned about the potential risks associated with the involvement of China and Russia in the design, development, manufacture, or supply of information and communications technology and services (ICTS) that are integral to UAS.&nbsp;What's at stake? The potential for data exfiltration, remote access, and the ability of foreign adversaries to compel companies to cooperate in harmful activities.Key Components of Concern: The ANPRM specifically identifies on-board computers, communications systems, flight control systems, ground control stations, software, data storage, and AI applications as areas of concern.Broad Scope: The proposed rules could affect a wide range of stakeholders, including those in the agriculture, chemical, construction, energy, telecommunications, and other critical infrastructure sectors.&nbsp;Definitions of UAS: BIS is considering various definitions and is seeking input on which is most appropriate. Based on the many comments submitted during the Connected Car ANPRM, we anticipate this will be one of the critical issues.&nbsp;Supply Chain Risks: The request for comment seeks input on supply chain vulnerabilities and the geographic locations where key components of UAS are manufactured.&nbsp;The comment period closes on March 4, 2025. Make your voice heard!#UAS #Drones #Cybersecurity #NationalSecurity #SupplyChain #ICTS #DepartmentofCommerce #PublicComment #Rulemaking #Technology #BIS #China #Russiahttps://www.bis.gov/press-release/commerce-issues-advance-notice-proposed-rulemaking-secure-unmanned-aircraft-systems

U.S. Department of Commerce Seeks Input on Securing the Supply Chain for Unmanned Aircraft Systems (UAS)

AI Laws and Regulations Concept. Hand typing on laptop with digital icons representing artificial intelligence, legal standard, ethics, and regulatory compliance, Technology law and policy, copyright,

<h2>What Are the ICTS Regulations?</h2>The U.S. Department of Commerce has just issued a final rule to formalize the authorities and procedures of the Office of Information and Communications Technology and Services (OICTS). This is a critical step in implementing Executive Order 13873, which aims to address the national security risks posed by vulnerabilities in the information and communications technology and services (ICTS) supply chain.ICTS encompasses a wide range of technologies, including hardware, software, and services that facilitate data processing, communication, and storage. The regulations aim to mitigate risks posed by foreign influence or control over these critical technologies.<h2>Key Components of the ICTS Regulations</h2>The rule applies broadly to ICTS transactions involving hardware, software, and services related to areas like data processing, communications, critical infrastructure, and emerging technologies. The focus is on transactions where the ICTS is designed, developed, manufactured, or supplied by persons owned, controlled, or directed by foreign adversaries.Some key countries covered include China, Russia, and any other nations the Commerce Secretary deems to pose long-term threats to U.S. security. The rule is not limited to just one country, but rather takes a comprehensive approach to safeguarding against malicious foreign interference in American technology systems.<h2>What changed in relation to previous interim rule ?</h2>One of the key changes is removal of unit/user threshold requirement.&nbsp;In the interim rule, the Department of Commerce had included requirements that certain types of ICTS transactions would only be considered in scope for review if they involved over 1 million users or units. Specifically, this threshold applied to:<ul><li>Internet-enabled sensors, webcams, or other end-point surveillance/monitoring devices</li><li>Routers, modems, or other home networking devices</li><li>Software designed primarily for connecting to and communicating via the internet</li></ul>The idea behind these thresholds was that transactions involving a large number of users or units would be more likely to pose a true national security risk, versus smaller-scale transactions. The Department seemingly wanted to focus its limited resources on reviewing the most potentially impactful ICTS deals.However, in the final rule, the Commerce Department has decided to remove these numerical thresholds entirely. There are a few key reasons why they made this change:Risk is not always correlated with transaction volume - The Department recognized that an ICTS transaction could still pose significant national security risks even if it involves a relatively small number of users or units. For example, if the technology is being used to collect sensitive personal data on high-profile government officials, the risk could be very high despite the low transaction volume. Thresholds could enable strategic circumvention - If businesses knew their transactions would only be reviewed if they exceeded 1 million users/units, some might intentionally structure deals to stay under that limit, even if the underlying technology still posed risks. Threshold limitations conflict with the rule's objectives - By excluding transactions below the numerical limits, the Department felt it would be failing to address the full scope of vulnerabilities in the ICTS supply chain, as envisioned in Executive Order 13873.So in the final rule, the Commerce Department has taken a more holistic approach. Rather than relying on arbitrary user/unit thresholds, they will focus their reviews on ICTS transactions most likely to pose undue or unacceptable risks, based on a range of factors beyond just the transaction volume.This change means the final rule has a broader, more comprehensive scope when it comes to the ICTS transactions that are eligible for review. The goal is to give the Department maximum flexibility to identify and address national security vulnerabilities, wherever they may exist in the technology supply chain. <img id="ch8qszz1pm4g5zd8g" src="https://cdn.durable.co/getty/184D9u8VPLtw1TiNGoYxKIeBKoWkEayQwD874KROmiAzCLsyNTPoyZGfp96a3Xeh.jpeg" alt="business technology" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" data-mce-src="https://cdn.durable.co/getty/184D9u8VPLtw1TiNGoYxKIeBKoWkEayQwD874KROmiAzCLsyNTPoyZGfp96a3Xeh.jpeg" data-mce-style="aspect-ratio: 16/9;" style="font-family: var(--body-fontFamily); font-size: calc(18px * var(--body-fontSize, 1)); font-style: var(--body-fontStyle, normal); font-weight: var(--body-fontWeight, 400); aspect-ratio: 16 / 9;">Businesses should consider conducting a thorough review of their supply chains and partnerships to identify any potential risks associated with foreign adversaries. This proactive approach will help ensure compliance while maintaining operational integrity.<h2>Important definitions and processes&nbsp;&nbsp;</h2>&nbsp;Covered Transactions - The final rule applies to a broad range of ICTS transactions, including those involving hardware, software, and services related to information/communications, data hosting and computing, connected applications, critical infrastructure, and critical/emerging technologies. However, transactions already reviewed by the Committee on Foreign Investment in the United States (CFIUS) are generally excluded.Review Process - The Department can initiate reviews of ICTS transactions on its own or based on referrals from other agencies. It first assesses whether a transaction meets the criteria for a "covered ICTS transaction" and involves ICTS supplied by persons owned/controlled by foreign adversaries. If so, the Department evaluates whether the transaction poses an "undue" or "unacceptable" risk based on factors like the ICTS capabilities, the foreign nexus, the parties involved, and potential impacts on national security.Initial and Final Determinations - If the Department identifies undue or unacceptable risks, it will issue an initial determination proposing to prohibit the transaction or allow it with mitigation measures. Parties have 30-60 days to respond before the Department issues a final determination. Final determinations to prohibit a transaction will be published in the Federal Register, while notices of final determinations to allow transactions with mitigation may also be published.<figure id="figure-z53n0wl5lmm4g5zl90"><img id="z53n0wl5lmm4g5zl90" src="https://cdn.durable.co/getty/22FYpjM8ipvdhCWKMvJXMMoFSSxDVYE3dZ5oCzAPfQ0wdIznATjQHgvhHHdMYUEX.jpeg" alt="compliance" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9;" data-mce-src="https://cdn.durable.co/getty/22FYpjM8ipvdhCWKMvJXMMoFSSxDVYE3dZ5oCzAPfQ0wdIznATjQHgvhHHdMYUEX.jpeg" data-mce-style="aspect-ratio: 16/9;"></figure><h2>Penalties</h2>The rule specifies a range of prohibited activities related to covered ICTS transactions. Violations can result in substantial civil penalties up to $250,000 per incident or criminal penalties up to $1 million and 20 years imprisonment. These penalties apply not just to direct participants, but also to those who aid, abet, or make false statements.More information here:&nbsp;<a href="https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program" data-mce-href="https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program">https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program</a>

Understanding the Department of Commerce's New ICTS Regulations

Synthetic Law Kancelaria Radcy Prawnego 

Synthetic Law – Law Firm Warsaw, Poland – expert advice on AI law, GDPR, CCPA compliance, data privacy, cybersecurity, IP tech, and new technology regulations. Support for companies implementing artificial intelligence, processing data, and building solutions based on software and digital assets.

Blog

Poland's Presidential Veto of the SAFE Defence Loan: What...

Polish Supreme Court: Cookies Are Not Always Personal Data

Copyright Isn't Dead—It Just Cost Anthropic $1.5 Billion

Guidance on Vehicle Data under EU Data Act

U.S. Department of Commerce Seeks Input on Securing the S...

Understanding the Department of Commerce's New ICTS Regul...