Makes credit decisions, in Lithuania

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Where a decision based solely on automated processing about a person in Lithuania rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Do not subject a person in Lithuania to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Lithuania on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Lithuania of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Republic of Lithuania Law No. XIII-1426, in force 16 July 2018 (as amended) · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Lithuania, including data collected by crawling.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024

• Tell people when they are interacting with a bot.
• Label AI-generated synthetic content as artificially generated.
• Publish a summary of the training data used for general-purpose AI models.
• Honor a rights holder's text-and-data-mining opt-out request.

Law No. XV-106 of 14 January 2025 amending the Law on Information Society Services No. X-614; Law No. XV-105 of 14 January 2025 amending the Law on Technology and Innovation No. XIII-1414 · Read the law's page

• These laws designate Lithuania's AI Act authorities and a sandbox institution; they create no separate duty on an AI developer or deployer beyond the duties of the AI Act itself.

Lietuvos Respublikos civilinio kodekso šeštosios knygos III dalies XXII skyriaus ketvirtojo skirsnio ir priedo pakeitimo įstatymas Nr. XV-1080 · Read the law's page

• These rules are enacted but do not apply yet: they apply from 9 December 2026, and the Civil Code rules in force until 8 December 2026 keep governing products placed on the market or put into use before then (Art. 3 of Act No. XV-1080).
• If you develop or make a product, software included, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing sign on it, you answer as its manufacturer for damage a defect in it causes (Arts. 6.292(1) and 6.293(1) point 1 and (2)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: you keep control if you integrate or supply a component or can supply updates or upgrades yourself or through a third party, and a defect caused by software, by an update or upgrade, or by a missing update needed for safety is not excused because it arose after you placed the product on the market (Arts. 6.292(3) and 6.298(1) point 1).
• Treat safety-relevant cybersecurity requirements and any recall or other corrective action as part of what decides whether your product is defective (Art. 6.294(1) points 6 and 7).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Art. 6.294(1) point 3).
• Keep evidence you could produce if a court orders you to disclose it: failing to disclose relevant evidence the claimant requested presumes the product defective (Art. 6.297(1) point 1).
• Meet the product-safety requirements that apply to your product: failing a requirement that protects against the risk of the harm suffered presumes it defective (Art. 6.297(1) point 2).
• If you are outside the EU, your importer or authorized representative established in the EU answers for the product in your place, and where there is neither, the fulfilment service provider answers (Art. 6.292(4)).
• If you distribute a product, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are met, name the manufacturer, importer, authorized representative, fulfilment service provider or your own supplier within a month of the injured person's request, or you answer for the damage (Art. 6.292(5)).
• If you substantially modify a product outside the manufacturer's control and then place it on the market or put it into use, you answer as its manufacturer (Art. 6.292(2)).
• If you build a software component into a product, you have no recourse against the maker of a defective software component that was a micro or small enterprise when it placed the component on the market, where you waived recourse in your contract with it (Art. 6.296(2)).
• Free and open-source software developed or supplied outside commercial activity is outside these rules (Art. 6.299(2)).
• A claim must be brought within three years of the day the injured person learned, or should have learned, of the damage, the defect and who the liable operator is, and the right to sue is extinguished ten years after the product was placed on the market or put into use, or 25 years where a court finds that a later-revealed injury prevented suit within ten (Art. 6.300).