IT Law

What this page decides

A technology contract with a Montenegrin counterparty is usually a foreign template with a new name typed into it. Most of it survives. Four things do not, and each of them is decided by a Montenegrin provision the template never contemplated:

• Who owns what your Montenegrin engineers produce — and why the code and everything around the code behave differently.
• What protects the things copyright does not cover: the algorithm, the pipeline, the model weights, the customer list.
• Whether your standard terms contain a clause that is void here.
• Whether the document was validly signed at all.

This page gives the article numbers. Scope: the article-level treatment below is Montenegrin. Our Türkiye practice handles the Turkish side of a cross-border technology file; we do not state Turkish statute on this page, because a page that mixes two regimes without citing either causes the mistake it is meant to prevent. General information on Montenegrin law, not advice on a specific contract.

Who owns the code — and why the assignment clause misses

The statute is the Zakon o autorskom i srodnim pravima, "Službeni list CG" br. 37/2011, 53/2016, 145/2021 and 48/2024. It allocates ownership by category, and the categories do not behave alike.

Article 115 is generous to the buyer: all economic and other rights in a computer program vest in the employer or the commissioning party, unlimited and exclusive, unless otherwise agreed — and it covers commissioned work, not only employment. For the source code itself, Montenegrin law gives you more than most foreign templates assume.

Everything around the code is where the risk sits. Article 100 deems a work created in employment assigned to the employer for five years from completion; Article 100(2) then reverts the rights to the author, and Article 100(3) obliges the author to re-assign on request against appropriate remuneration. UI artwork, documentation, training material, design assets and marketing copy produced by a Montenegrin team therefore carry a clock that the source code does not.

And the sweep-up clause does less than it says. Article 74 requires an assignment to specify the right assigned, whether it is exclusive or non-exclusive, the territory, the period, and whether it may be further assigned. Article 75 then construes strictly: assigning one economic right does not carry the others, and assigning a right does not carry the remuneration rights, in each case unless the Act or the contract says otherwise. A common-law "all right, title and interest" formula is not how this statute reads a contract.

There is a cross-border layer that catches groups with Montenegrin engineers. Under the Zakon o međunarodnom privatnom pravu (Sl. list CG 1/2014, correction 6/2014), Article 35 refers ownership, scope, transferability and infringement of copyright to the law of the state where protection is sought, and Article 36 provides that the law governing the employment contract also governs who holds an IP right arising within that employment. Fixing the master services agreement reaches neither layer. The employment contracts and the local assignment do.

The category-by-category analysis is set out in the four clauses that decide a Montenegrin SaaS or outsourcing contract.

What copyright does not protect, and the Act that does

Copyright answers who owns a program. It does not protect an algorithm, a training pipeline, a pricing model, a customer list or a set of model weights.

A separate Act does: the Zakon o zaštiti poslovne tajne, "Službeni list CG" br. 145/21, in force since the start of 2022 and rarely cited. Article 18 repealed the Zakon o zaštiti neobjavljenih podataka (16/07, 73/08), so anything drafted against the 2007 statute is drafted against a repealed one.

Article 2 defines a trade secret with three limbs, and companies fail the third. The information must not be generally known or readily accessible to people who work with that kind of information; it must have commercial value because it is secret; and the holder must have taken appropriate measures to keep it secret. All three are required. A company that never restricted repository access, never put confidentiality terms in its contractor agreements and never marked anything confidential does not have a weak case here — on the face of Article 2 it does not have a trade secret.

Those measures are then scored twice: Article 9(2) makes them an express factor when the court decides interim measures, and Article 11(6) again when it weighs the proportionality of final remedies.

Article 5(2) matters to every NDA. Use or disclosure contrary to a confidentiality agreement or to a contractual restriction on use is a statutory infringement, not only a contract breach — with the statutory remedies attached. Article 5(5) reaches the downstream recipient who knew or ought to have known the secret came, directly or indirectly, from someone acting unlawfully. That is why buying a dataset, a model or a codebase from a departing team is a diligence question.

Two deadlines decide these files:

Miss the first and the measures are revoked — and under Article 10(2) the applicant can be ordered to compensate the damage those measures caused. The objection that stops most trade-secret claims — that suing exposes the secret — is answered by Article 15, which binds everyone with access to the case file, and Article 15(2), which makes that duty survive the proceedings. The full treatment is in what actually protects your source code and your model.

The clause in your standard terms that is void

If you license software into Montenegro, read the reverse-engineering language. Article 113(2) of the copyright act entitles a lawful user, without permission, to make one back-up copy and to observe, study and test the program to determine the ideas and principles underlying it. Article 114 permits decompilation for interoperability on stated conditions. Both end the same way: contractual provisions restricting those rights are null and void — Articles 113(4) and 114(4).

A blanket "the customer shall not decompile, disassemble or reverse engineer under any circumstances" is unenforceable here to the extent it cuts across those provisions. The trade-secret Act reinforces it from its own side: Article 4(1) point 2 treats observation, study, disassembly or testing of a lawfully obtained product as lawful acquisition.

Governing law, forum, and the clause that quietly reverses

Under the private international law act, Article 38 gives the parties a free choice of law. Article 38(3) is the hard edge: where every other element is connected to one state and the parties choose another state's law, the choice cannot exclude the first state's mandatory rules. A Montenegrin customer, a Montenegrin supplier and performance in Montenegro is not made an English-law contract by an English-law clause.

Say nothing and Article 39(1)(2) decides it — a services contract is governed by the law of the provider's habitual residence. Silence favours the Montenegrin development shop and, in the mirror case, the foreign SaaS vendor. Sell subscriptions to individuals in Montenegro and Article 42 keeps Montenegrin consumer protection in place regardless of the clause.

Two features change how the forum clause should be drafted. Article 104(2) makes an agreed foreign forum exclusive unless the parties agree otherwise — the opposite of the default many templates assume, so if you wanted the option of suing where the assets are, say so. And Article 106 lets your side submit by accident: filing a defence or a counterclaim without contesting jurisdiction establishes the Montenegrin court's jurisdiction.

The clause is only worth what it enforces. Article 145 refuses recognition where the foreign court's jurisdiction rested on a basis Montenegrin rules do not recognise. The practical test at signature is whether you can name the connection between the dispute and the chosen forum. Where the answer is uncomfortable, arbitration is usually the better instrument — the comparison is in arbitration or court in a Montenegrin contract.

The data annex is a gating item, not a schedule

Two provisions of the Zakon o zaštiti podataka o ličnosti (Sl. list CG 079/08, 070/09, 044/12, 022/17, 077/24) turn the processing annex into a pre-signature question.

Article 16 permits a controller to entrust processing only by written contract, only to a processor meeting the technical, staffing and organisational conditions, with return or destruction of the data afterwards. Article 74(1)(5) then makes it a misdemeanour to entrust processing to a processor that is not registered for the activity of personal data processing. That registration requirement has no GDPR analogue and it is resolved before signing, not after. On top of it, Article 41(3) treats a transfer made in order to entrust processing as requiring the supervisory authority's consent, carving out only the EU, the EEA and adequacy-listed states.

The same Act reaches AI deployments without mentioning AI: Article 15a bars decisions on a person's rights based solely on automated processing of their characteristics and abilities; Article 28(1) requires prior consent from the supervisory authority for processing presenting a special risk, expressly including assessment of personality, ability or behaviour and biometric data; Article 43(2)(7) obliges the controller to explain the manner of that automated processing on request, within 15 days. A model you cannot describe cannot answer that request.

One currency check to make before you rely on the chain above. The Government published a Predlog Zakona o zaštiti podataka o ličnosti — a bill to replace this Act — on 10 August 2026 (gov.me document library, checked 6 September 2026). A bill is not law, and the articles cited here are the ones in force on the date of this reading; the published bill is a scanned image without a machine-readable text layer, so we have not analysed its contents and we do not assert what it changes. Confirm the gazette before relying on an article number in a document you are signing.

Why this regime is not GDPR, and what a foreign company actually files, are in Montenegro is not a GDPR country, what a foreign company must do and cross-border data transfers. The AI-specific reading is in what applies to AI in Montenegro today.

Signing it: the tier that binds, and the one that does not

The signature statute is new. The Zakon o elektronskoj identifikaciji i uslugama povjerenja, "Službeni list CG" br. 92/2026 of 30 June 2026, in force 8 July 2026, and Article 122 repeals the previous Act (31/17, 72/19) outright. Any template or internal policy citing 31/17 cites a repealed statute, and the numbering has changed completely.

Article 67 is weaker than it looks: it is a rule of evidence, preventing a court from rejecting a signature merely because it is electronic. It does not tell you the document was validly executed. Only Article 68 does that, and only for the qualified tier.

Two limits survive. Article 3(2) leaves untouched any special form another statute prescribes — notarial processing, solemnisation, registration. A qualified signature equals a handwritten one; it does not equal a notarial act. And Article 64, the automatic recognition of EU-issued qualified signatures, is on the Act's deferral list — enacted, but applying only from accession to the European Union. Today recognition of a foreign qualified signature runs through Article 63(2), which requires a reciprocity-based international agreement. We have not identified a published agreement of that kind in force, and we will not assert one exists or does not on the strength of an absent search result: it is a question for the competent ministry, for the specific certificate and provider, before a signing date is fixed. The detail is in what an electronic signature actually binds and the digital identity wallet.

What we do

We review and negotiate the technology contract against these provisions: governing law and forum, the IP split by category and the assignment in the employment contracts behind it, the confidentiality and trade-secret measures that Article 2 will later require you to prove, the data processing annex and the registration and transfer questions it opens, and the execution route.

We also act where the technology question is really a regulatory one — where an AI or data workflow triggers prior consent, or where a platform's activity brings it inside the anti-money-laundering perimeter. That analysis sits with data protection, AI law and, for regulated activity, fintech and crypto. Where the counterparty entity is still being formed, the company-law questions are on our corporate law page.

If you have a SaaS, development, outsourcing or licensing draft with a Montenegrin party — or you have been told a clause is standard and want the article number behind it — send us the draft, the employment or contractor templates behind it, and the data flow, before it is signed.