App Developers and Vibe Coders: The Legal Layer Behind the Product

IP ownership: your code, your clients' code, and everything in between

Under the Copyright Act 1968 (Cth), the default position for commissioned software is often not what founders assume. Client work should have clear IP assignment or licence terms, distinguishing between the deliverable, background IP, third-party components and any generic tooling. For products built with AI assistants, the extent to which AI-generated code carries copyright, and the licence terms of the underlying models and datasets, are live questions worth thinking through.

Open-source licences and third-party components

Every serious codebase pulls in open-source components. Licence compliance under MIT, Apache 2.0, GPL, AGPL and MPL varies materially in what it requires — particularly the reciprocal obligations in copyleft licences. A dependency audit before a raise or acquisition is standard due diligence, and clean answers save weeks.

Client engagement, SaaS terms and consumer protection

Development and SaaS contracts should address scope, change control, acceptance, warranties, IP, data handling, liability caps and exit. Standard-form contracts with consumers or small businesses are subject to the unfair contract terms regime in the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)), which now carries civil penalties. Marketing claims about uptime, security and AI capability also engage the misleading and deceptive conduct rules in section 18.

Privacy, data and cross-border transfers

If your app collects personal information, the Privacy Act 1988 (Cth) and the Australian Privacy Principles may apply, alongside the Notifiable Data Breaches scheme and, in some sectors, the Consumer Data Right regime. Cross-border data flows, hosting in the US or EU, and use of third-party AI APIs all need to be mapped to a privacy notice that reflects reality.

Founders, contractors and revenue share

Small teams often mix co-founders, contractors and revenue-share collaborators. Documenting equity, IP assignments (especially from anyone who has touched the codebase), and the founder relationship early avoids painful conversations at raise or acquisition. Employment characterisation under the Fair Work Act 2009 (Cth) remains a recurring risk area.

Practical steps you may wish to consider

• Get IP assignment in place with every contractor and collaborator who touches the code
• Run an open-source and dependency audit as part of your normal release process
• Standardise SaaS and dev contracts, and review against unfair contract terms rules
• Match your privacy notice to your actual data flows, including AI vendors and offshore hosting
• Formalise co-founder, revenue-share and cap-table arrangements before revenue arrives

This article contains general information only and does not constitute legal advice. Envision Legal accepts no liability for any loss arising from reliance on this content. You should seek independent legal advice tailored to your specific circumstances. For enquiries, contact Envision Legal.