Lithuania

Law No. XV-106 of 14 January 2025 amended article 1(2) of the Law on Information Society Services No. X-614 so that it sets out the powers of the Communications Regulatory Authority (RRT) to perform the functions of the national competent authority acting as market surveillance authority, and of the single point of contact, named in Regulation (EU) 2024/1689. Article 5 of Law No. XV-106 sets 1 April 2025 as the day it enters into force.

Article 13 of the Law on Technology and Innovation No. XIII-1414, as restated by Law No. XV-105 of 14 January 2025, has state technology and innovation policy implemented by an institution the Government authorises. Point 12-2 that Law No. XV-105 added to article 14(2) has that institution perform the functions of the notifying authority under Articles 28(1) and 70(1) of Regulation (EU) 2024/1689.

Under article 9 of Law No. XV-105, point 12-2 enters into force on 2 August 2025 and the sandbox point 12-3 on 1 January 2026, while the rest of that law enters into force on 1 April 2025. Point 12-3 has the same institution set up and supervise a limited AI regulatory sandbox under Article 57(1) of the Regulation, in the manner the minister of economy and innovation sets.

Criminal Code Art. 309(2) bans producing, acquiring, possessing, exhibiting, advertising, offering, or distributing pornographic material depicting a child, or a person presented as a child, or using information and communication technologies to acquire or provide access to such material, punishable by a fine, restriction of liberty, arrest, or imprisonment for up to four years.

The 'person presented as a child' wording reaches a simulated or artificially generated depiction and does not require the material to show a real child. Article 309(3) provides imprisonment of up to five years for producing or acquiring with intent to distribute, or distributing, a large quantity of material depicting a child under 14. A legal entity is also liable under Article 309(5).

This is a general criminal-law prohibition rather than an AI-specific statute, and it binds any person regardless of the tool used to produce the material.

A controller must notify VDAI without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Lithuania, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

A provider of public electronic communications networks or services must notify the State Data Protection Inspectorate without delay of a personal data security breach. The provider must also notify the subscriber, registered user or other person where the breach may adversely affect the security of their data or their privacy, unless it proves to the Inspectorate that appropriate technical measures made the data inaccessible to unauthorized persons.

The Inspectorate may order a provider that has not yet notified the subscriber or user to do so. The notice describes the nature of the breach, gives contact details and recommends measures to reduce its adverse effects. Both notices are made in line with Regulation (EU) 611/2013. Providers must keep a record of personal data breaches, with their causes, effects and the measures taken.

Law XI-1552 of 28 June 2011 set out the duty to notify the Inspectorate of a personal data breach as Article 62 of the Law, and it came into force on 1 August 2011. The duty now stands as Article 74 of the Law, as set out by Law XIV-635 of 11 November 2021.

The Law on Legal Protection of Personal Data gives the General Data Protection Regulation (GDPR) domestic effect in Lithuania and is enforced by the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI). Article 6 sets the age at which a child can consent to information society services at 14, below the GDPR default of 16.

Under Article 15, VDAI must give a controller the authorization for an Article 46(3) cross-border transfer, or a reasoned written refusal, within 20 working days of receiving all the documents it needs. Where the case is complex, that period can be extended once by up to 10 working days.

Transferring personal data of a person in Lithuania outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Under Article 15(1) of the Law on Legal Protection of Personal Data, VDAI must give a controller the authorization for an Article 46(3) transfer, or a reasoned written refusal, within 20 working days of receiving all the documents it needs. Under Article 15(2), VDAI can extend that period once by up to 10 working days.

General Data Protection Regulation (GDPR) Article 22 gives a person in Lithuania the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply directly in Lithuania: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller.

VDAI monitors the application of the General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data and ensures that they are applied. The private-sector fine ceiling follows the standard GDPR Article 83(5) figures, up to EUR 20 million or 4 percent of global annual turnover.

Under Article 33(1) of the Law, VDAI may fine a public authority or body that infringes GDPR Article 83(4)(a) to (c) up to 0.5 percent of its current-year budget and the total annual income it received in the previous year, but not more than EUR 30,000. Under Article 33(2), the ceiling is 1 percent, and not more than EUR 60,000, for an infringement of GDPR Article 83(5)(a) to (e) or 83(6).

Under Article 33(3), a public authority or body that carries on commercial economic activity faces the full GDPR Article 83(4), (5) and (6) ceilings. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 5(4) of the Law on Legal Protection of Personal Data requires an employer that processes video or audio data at the workplace, or data on employees' conduct, location or movement, to inform the employees by signature or in another way that proves they were informed, giving the information listed in GDPR Article 13(1) and (2).

Article 198-2 punishes producing, transporting, importing, selling, giving access to or otherwise distributing, acquiring or holding, for criminal purposes or otherwise unlawfully, devices or software directly intended or adapted to commit criminal offenses, and passwords, codes or similar data intended for connecting to an information system or a part of it, with a fine, restriction of liberty, arrest or up to four years' imprisonment. A legal entity is also liable for the offense.

The article was added to the Criminal Code by Law IX-1992 of 29 January 2004, published in the Official Gazette on 14 February 2004. Article 70 of the Constitution puts a law into force once the President has signed and officially promulgated it, unless the law itself fixes a later day. Law IX-1992 came into force on 14 February 2004, the day it was published in the Official Gazette.

Article 198-1(1) punishes unlawfully connecting to an information system or part of it by breaching that system's security measures, up to two years' imprisonment, and is keyed to breaching a security measure, so a crawl of a page with no security measure to breach is not reached by it.

Article 198-1(2) punishes unlawfully connecting to an information system or part of it that has strategic significance for national security or great significance for state governance, the economy or the financial system, up to three years.

Articles 196 and 197 punish unlawfully destroying, damaging, deleting, or altering electronic data, or disrupting an information system's operation, causing damage, up to two years, rising to six years where the act reaches many systems or a system of strategic or great significance, uses another person's personal data, or causes great damage.

Article 198 punishes unlawfully observing, recording, intercepting, acquiring, holding, disseminating, or otherwise using non-public electronic data, up to four years, rising to six years for such data of strategic significance for national security or great significance for state governance, the economy or the financial system. A legal entity is also liable for each offense.

A database maker who proves substantial qualitative or quantitative investment in selecting, compiling, verifying and presenting the database content has the right to prohibit moving the whole content or a substantial part of it to another medium. The maker may also prohibit making the whole content or a substantial part publicly available over computer networks or other means of transmission, and distributing copies by rental or sale.

The maker of a database that has lawfully become publicly available cannot prevent lawful users from moving to other media or re-using small parts of the content. A lawful user of such a database must not act against its normal use or infringe the maker's legitimate interests. Repeated and systematic extracts and use of small parts of the content are not allowed where they conflict with the normal use of the database or infringe the maker's legitimate interests.

A lawful user may move or re-use a larger part of the content without the maker's permission for text and data mining, but only where the rights holders have not expressly reserved the right by appropriate means, which for content made publicly available online must be machine-readable. Research organizations and cultural heritage institutions may move a database to carry out text and data mining for scientific research. Contracts that contradict the lawful user's rights in Article 62 are void.

The maker's rights are protected for 15 years after the date the database was made, or for 15 years after its publication if it became publicly available in that period. The terms are counted from 1 January after the year in which the database was made or first became publicly available. The original text of the Act already contained a chapter of special (sui generis) provisions on the legal protection of databases, with Article 52 on the rights of database makers. The Act entered into force on 9 June 1999. The current edition of the Act has applied since 21 March 2003.

Article 14 requires a cybersecurity subject entered in NKSC's Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law to adopt and keep current cybersecurity policy documents, periodically analyse and manage its cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure its supply chain, and deploy technical cybersecurity measures.

Under Article 11(2), a cybersecurity subject takes on the duties set for cybersecurity subjects only from its registration in the Cybersecurity Information System. The Government's Cybersecurity Requirements Description sets out the detailed technical and organisational measures Article 14 requires, with 12 months from registration to implement the requirements and 24 months for the technical requirements it names.

Article 14(7) separately requires the subject's management-body members, head and designated representative to complete cybersecurity training at least once every two years.

A named subset of digital-service "special subjects" includes a DNS service provider, a top-level-domain registry, a cloud or data-centre service provider, a content-delivery-network, managed-service or managed-cybersecurity-service provider, an electronic-marketplace provider, and an internet-search-engine or social-networking-service-platform provider.

A special subject or trust service provider must comply only with the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690 risk-management measures from the moment of its own entry into the Register, under Article 14(4) of the Law. Only an essential entity's activity or services may be temporarily suspended, and only an essential entity's head may be temporarily removed from office by a district court order on NKSC's request.

Law No. XV-894 of 12 May 2026, published in the Register of Legal Acts on 15 May 2026, amended only article 31 of the Law on Cyber Security No. XII-1428 and not article 14. Law No. XV-1076 of 25 June 2026, published on 3 July 2026, amended articles 2, 11, 12, 13, 19, 23, 28, 30, 31 and 38 and Annexes 2 and 3 of that law, none of them article 14.

Article 1(3) disapplies Article 14, Article 15 and Article 18(1)(1) and (2) to a cybersecurity subject whose applicable EU legal acts require cybersecurity risk-management measures, notification of significant cyber incidents or designation of the persons responsible for cybersecurity with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

A person applying for radio frequencies for electronic communications, whether in a tender, an auction or on direct request, must give the Communications Regulatory Authority (RRT) information on the manufacturers, suppliers and maintenance and support providers of the equipment, devices and software it plans to use that appear on the list set by the Minister of National Defence (Article 69(2)).

The RRT must refer the applicants, and the manufacturers, suppliers and maintenance and support providers on that list, to the Commission for the Coordination of the Protection of Objects Important to Ensuring National Security for a vetting of their conformity with national security interests (Article 69(3)).

An applicant loses the right to take part, or is refused the frequencies, if the Government decides under the Law on the Protection of Objects of Importance to Ensuring National Security that the applicant or its planned supplier does not meet national security interests (Article 69(4)).

A holder of the right to use frequencies who intends to use equipment, devices or software from other manufacturers or suppliers, or other maintenance and support providers, than those declared must notify the RRT, and may not use them for electronic communications activity until the vetting finds that the supplier meets national security interests (Article 69(5)). The text is the consolidated edition in force from 1 July 2026 of an Act restated from 1 December 2021 by Act Nr. XIV-635.

Article 18 requires an essential or important cybersecurity subject to notify NKSC of a significant cyber incident without delay and not later than within 24 hours of becoming aware of it, then follow within 72 hours with an assessment of the incident's severity and impact and any evidence of compromise. Under Article 11(2), a cybersecurity subject takes on the duties set for cybersecurity subjects only from its registration in the Cybersecurity Information System.

A final report is due within one month of the day the 24-hour early warning was submitted, and NKSC may request an interim report. A minor incident, one that does not meet the Law's major-incident criteria, is notified to NKSC without delay and not later than 72 hours after becoming aware of it, under point 13 of the Government's National Cyber Incident Management Plan.

The Law requires an essential or important subject to notify NKSC of every cyber incident affecting it, not only a significant one. A subject with no statutory duty to report may still notify NKSC of a cyber incident, threat or near-miss voluntarily. NKSC is developing a centralised national cyber-incident reporting and management platform, not yet launched, under a single-window principle for NKSC, the Lithuanian police and the State Data Protection Inspectorate to coordinate on.

Law No. XV-894 of 12 May 2026, published in the Register of Legal Acts on 15 May 2026, amended only article 31 of the Law on Cyber Security No. XII-1428 and not article 18. Law No. XV-1076 of 25 June 2026, published on 3 July 2026, amended articles 2, 11, 12, 13, 19, 23, 28, 30, 31 and 38 and Annexes 2 and 3 of that law, none of them article 18.

Article 1(3) disapplies Article 14, Article 15 and Article 18(1)(1) and (2) to a cybersecurity subject whose applicable EU legal acts require cybersecurity risk-management measures, notification of significant cyber incidents or designation of the persons responsible for cybersecurity with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Article 81, paragraph 1 of the Electronic Communications Law allows the use of electronic communications services, including sending electronic mail messages, for direct marketing only with the prior consent of the subscriber or registered user of public electronic communications services.

That consent is not needed where the subscriber or registered user is a legal person, who must instead be given a clear, free and easily exercised possibility to refuse further use of electronic communications services for direct marketing.

Under paragraph 2, a person who obtains electronic mail contact details from a customer who is a natural person in the course of providing services or selling goods may use them to market its own similar goods or services, if the customer is offered a clear, free and easily exercised possibility to refuse at the time of collection and, unless the customer objected at first, in every message sent.

Paragraph 3 prohibits sending electronic mail for direct marketing that conceals the identity of the sender on whose behalf the information is sent, in breach of the requirements of the Law on Information Society Services, that gives no valid address at which the recipient can demand that sending stop, or that encourages recipients to visit websites that do not meet those requirements. Article 81 was amended by Law No. XV-815 of 16 April 2026, published on 21 April 2026.

Article 14(1) of Law No. XV-815 sets 1 July 2026 as the date for the Law except its Article 10, which set Article 81 out anew. The register of consolidated texts shows the edition containing that change from 22 April 2026.

Article 9, paragraph 1 of the Law on Information Society Services requires commercial information forming part of an information society service to be clearly identifiable as commercial information, and commercial information sent without the recipient's prior consent in a case set by the Electronic Communications Law to be clearly identifiable as sent without prior consent. The commercial information must make it possible to identify the natural or legal person on whose behalf it is provided.

Promotional offers such as discounts, premiums and gifts, and promotional contests or games, must be clearly identifiable, and the conditions for obtaining or taking part in them must be easily accessible and presented clearly and unambiguously. Under paragraph 2, commercial information may be sent by electronic mail without the recipient's prior consent only in the cases, in the manner and on the conditions set by the Electronic Communications Law.

The consolidated text records a new edition of the Law from 28 June 2024, under Law No. XIV-2702 of 13 June 2024, published on 27 June 2024.

Article 73, paragraph 4 of the Electronic Communications Law allows storing information in, or giving access to information already stored in, the terminal equipment of a subscriber or actual user of public electronic communications services only on condition that the subscriber or user, who has been given clear and comprehensive information including the purposes of processing, has given consent.

The rule does not prevent technical storage or use of data whose sole purpose is to transmit information over an electronic communications network or, where necessary, to provide information society services that the subscriber or user orders. Law No. XIV-635 of 11 November 2021 set out the Electronic Communications Law anew. Article 2(1) of that Law brings the new text into force on 1 December 2021.

Article 73, paragraph 1 of the Electronic Communications Law prohibits listening to, recording, storing or otherwise intercepting the content of messages and traffic data, or becoming acquainted with them, without the consent of the actual users of public electronic communications services, except where the law lawfully allows it under Articles 77, 78 and 96.

Without the users' consent it is also prohibited to disclose the content of messages carried over electronic communications networks or the related traffic data, or to make it possible to learn them, except in cases set by law. Paragraph 2 provides that these rules do not apply to the recording of information and related traffic data carried out in lawful business practice to provide evidence of a commercial or other business transaction that may have legal consequences under legislation.

Before the recording starts, the actual users of public electronic communications services must be informed of the recording and its purpose. The recorded content and related traffic data may be kept no longer than the period during which the validity of the transaction can be legally challenged. Under paragraph 3, businesses that provide electronic communications networks or services must take appropriate organizational and technical measures to implement paragraph 1.

The State Data Protection Inspectorate supervises how those businesses implement the confidentiality requirements of paragraph 1. Law No. XIV-635 of 11 November 2021 set out the Electronic Communications Law anew. Article 2(1) of that Law brings the new text into force on 1 December 2021.

Article 14(1) of the Law on Information Society Services provides that the conditions for exempting providers of mere conduit, caching and hosting services from liability are those set in Articles 4 to 6 of Regulation (EU) 2022/2065. Article 14(2) provides that these providers are not treated as failing the exemption conditions because of voluntary investigations, and that no general monitoring or active fact-finding duty is imposed on them, as Articles 7 and 8 of the Regulation define.

Article 15(3) lets persons whose rights are infringed by information a provider transmits or stores complain to the provider, settle the matter before trial, or apply to a court to end or prevent the infringement, even though the provider is not liable for it under Article 14.

Article 15(4) provides that an account holder who removes an unlawful comment under a post of their own on an online platform is not subject to the duty in Article 17 of the Regulation to give the commenter a statement of reasons. Article 15(4) keeps the statement of reasons duty in Article 17 of the Regulation for the online platform itself when it restricts content generated by a recipient, comments included.

Article 15(5) imposes no general duty to monitor information and no duty to seek out facts about unlawful content on holders of platform accounts, and it provides that authorities that find unlawful content give account holders binding instructions to remove content they prepared or unlawful comments beneath it.

Article 15(1) treats a provider as having learned of unlawful activity or content when it has reliable factual data about it, or learns of facts and circumstances from which it is evident that a recipient's activity or content is unlawful.

Article 15(1) lets the provider obtain such data on its own initiative or from notices by recipients, supervisory authorities, and natural or legal persons, if the notices are accurate, complete and substantiated enough for the provider to assess the content and act. Article 15(1) requires a provider that gets no answer from the recipient within a reasonable time, or finds the explanation unfounded, to decide to treat the information as unlawful content and restrict access to it.

Article 15(1) applies Article 16(2) of the Regulation, with the necessary changes, to the requirements for notices from recipients and from natural and legal persons. Article 15(2) requires a hosting service provider that decides information is unlawful content and restricts access to it to give the recipient a reasoned statement within one working day under Article 17 of the Regulation, if it knows the recipient's electronic contact details.

Article 17 requires hosting service providers to inform the police at once on learning of information that raises a suspicion that a criminal act threatening the life or safety of a person has been, is being or is likely to be committed, in line with Article 18 of the Regulation. Article 21(1) requires the authorities that issue orders to act against illegal content or to provide information to follow the requirements for such orders in Articles 9 and 10 of the Regulation.

Article 21(2) requires an authority other than the Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT) that issues such an order to send it to the RRT, with any information received from the provider about its response, within five working days.

Article 1(2) of the Law on Information Society Services names the Communications Regulatory Authority, the State Data Protection Inspectorate, the State Consumer Rights Protection Authority and the Inspector of Journalists' Ethics as the competent institutions that ensure Regulation (EU) 2022/2065 is carried out. Article 23 makes the Communications Regulatory Authority the digital services coordinator, performing the functions the Regulation gives that coordinator.

Article 16(1) requires providers of very large online platforms and very large online search engines to assess and mitigate the systemic risks in Article 34 of the Regulation, including risks from removal and blocking of lawful content and from algorithmic systems, taking account of Lithuanian language norms and usage. Article 19(2) has the Communications Regulatory Authority set the procedure for certifying bodies that settle disputes out of court under Article 21 of the Regulation.

Article 24(2) lets the Authority investigate and inspect intermediary service providers established in Lithuania, and in an investigation it may ask the provider, its employees or its representative for oral and written explanations and require the provider to come to the Authority's premises.

Article 34(1) lets a recipient of the service or another body named in Article 53 of the Regulation file a complaint with the Communications Regulatory Authority about possible breaches by intermediary service providers. Article 40(1) has the Communications Regulatory Authority fine up to 6 percent of the provider's total annual income in the previous financial year for breaches of the Regulation, other than the breaches assigned to other institutions.

Article 40(2) to (4) give the State Data Protection Inspectorate, the State Consumer Rights Protection Authority and the Inspector of Journalists' Ethics the same fine of up to 6 percent for breaches of the articles of the Regulation assigned to each.

Article 40(6) sets a fine of up to 1 percent of total annual income for supplying incorrect, incomplete or misleading information, for failing to answer the competent institution, for failing to correct or submit information for checking, and for not complying with the institution's requirements in an on-site check. Article 39(2) allows a fine to be imposed within five years of the breach, or of its discovery for a continuing breach.

The Commission's register of national transposition measures for Directive 85/374/EEC lists the Civil Code approval law, Act No. VIII-1864, as the single Lithuanian measure. Article 6.292 of the Civil Code, headed liability of the producer and the supplier of services, opens the section on damage caused by products or services of inadequate quality. Article 6.300 of the Civil Code, headed limitation of actions, closes that section. The Civil Code entered into force on 1 July 2001.

Article 6.292(1) makes a producer or a supplier of services liable to compensate damage caused by products or services of inadequate quality. Article 6.292(2) treats as the producer the maker of the final product, of a part of it or of raw materials, the supplier of services, and any other person who presents itself as the producer by marking the product or service with its name, trade mark or another distinguishing sign.

Article 6.292(3) makes a person who imports a product of inadequate quality into the European Economic Area in the course of its business, in order to sell, hire out or otherwise distribute it, liable as a producer. Article 6.292(4) treats each person who sold the product as the producer where the producer cannot be identified, unless that person tells the injured person within a reasonable time who the producer is or who supplied the product.

Article 6.292(5) applies the section only where the products or services are acquired for consumption and not for business purposes. Article 6.293(1) defines a product as every movable thing, including primary agricultural products and game, and a movable thing that forms part of another movable or immovable thing. Article 6.293(1) also counts electricity as a product.

Article 4.1 of the Civil Code describes things as the parts of the material world taken from nature or created in a production process. Article 1.97(1) of the Civil Code lists things, other property, the results of intellectual activity and information as separate objects of civil rights.

Article 6.294(1) makes a product or service defective if it does not meet the safety requirements that a consumer can reasonably expect, judged by its stated properties and advertising, its expected use, the time it was put into circulation, its design or formulation flaws and other circumstances. Article 6.295 requires the injured person to prove the damage, the defect and the causal link between them.

Article 6.296 makes the persons whose acts caused the damage, for example the producer of a defective product and the person who built it into another thing, liable jointly. Article 6.298(1) releases a producer that proves it did not put the product into circulation, that the product probably was not defective at that time or deteriorated later, or that it did not make the product to sell, hire out or distribute for business purposes.

Article 6.298(1) also releases a producer that proves the quality deteriorated because mandatory rules set by public authorities were followed, that scientific and technical knowledge when the product was put into circulation did not allow the defect to be discovered, or that the damage arose from the design of the product it was built into or from the final producer's instructions.

Article 6.298(3) allows the liability to be reduced or excluded where the damage was caused also by the fault of the injured person. Article 6.299(1) covers damage from death or injury to health, including non-pecuniary damage, and damage of at least EUR 500 to property of the injured person that is intended and normally used for personal needs, other than the defective product itself. The EUR 500 threshold does not apply where the damage was caused by services of inadequate quality.

Article 6.300 sets a limitation period of three years from the day the injured person learned or should have learned of the damage, the defect and who the producer is, and extinguishes the right to sue ten years after the producer put the product into circulation. Act No. XV-1080 keeps these rules in force for products placed on the market or put into use before 9 December 2026.

Act No. XV-1080 of 25 June 2026 replaces the fourth section of chapter XXII of part III of book six of the Civil Code, which covers liability for damage caused by products of inadequate quality. The Register of Legal Acts published the Act on 2 July 2026. The President of the Republic promulgated the Act. The Act enters into force on 9 December 2026. Products placed on the market or put into use before 9 December 2026 stay under the Civil Code rules that applied until 8 December 2026.

Article 2 of the Act adds Directive (EU) 2024/2853, which repeals Council Directive 85/374/EEC, as point 11 of the Civil Code annex. Article 6.292(1) makes an economic operator liable to compensate damage caused by a product of inadequate quality. Article 6.293(2) defines a product as a movable thing, including a thing that is part of another movable or immovable thing or is connected with it.

Article 6.293(2) also counts electricity, a digital manufacturing file, a raw material and software as a product. Article 6.299(2) excludes damage caused by free and open-source software developed or supplied outside commercial activity. Article 6.292(2) makes the manufacturer of a product or component liable also for damage caused by a component integrated into or connected with a product under the manufacturer's control.

Article 6.292(2) makes a person who substantially modifies a product outside the manufacturer's control and places it on the market or puts it into use liable as a manufacturer. Article 6.292(3) point 1 treats a manufacturer as in control of a product when it integrates a component into it, connects a component to it or supplies a component, including software updates or upgrades.

Article 6.292(3) point 2 also treats a manufacturer as in control when it is able to supply software updates or upgrades itself or through a third party. Article 6.292(4) makes the importer or authorized representative liable where the manufacturer is established outside the European Union. Article 6.292(4) makes the fulfilment service provider liable where no importer or authorized representative established in the European Union can be identified.

Article 6.292(5) makes a distributor liable where no manufacturer, importer, authorized representative or fulfilment service provider established in the European Union can be identified and the distributor does not name one of them, or its own supplier, within a month of the injured person's request.

Article 6.292(5) applies the same rule to an online platform provider within the meaning of the Digital Services Act that is not an economic operator, where consumers can conclude distance contracts with traders on the platform and the conditions of Article 6(3) of that Regulation are met. Article 6.292(6) applies the section where liability arises for damage to a natural person.

Article 6.294(1) makes a product defective if it does not meet the safety requirements set by product-safety law or other safety requirements that a natural person is entitled to expect. Article 6.294(1) point 3 lists among the circumstances the effect of any ability of the product to keep learning or to acquire new features after it was placed on the market or put into use. Article 6.294(1) point 6 lists the product's safety requirements, including safety-relevant cybersecurity requirements.

Article 6.295 requires the injured person to prove the damage, the defect and the causal link between them. Article 6.296(2) denies a manufacturer that integrates a software component into a product a right of recourse against the maker of the defective component where that maker was a micro or small enterprise when it placed the component on the market and the manufacturer waived the right in their contract.

Article 6.297(1) point 1 presumes a product defective where the defendant, on the court's demand, does not disclose relevant evidence that the claimant requested and showed to be relevant. Article 6.297(1) point 2 presumes a product defective where the claimant proves that it does not meet product-safety requirements that protect against the risk of the harm suffered.

Article 6.297(1) point 3 presumes a product defective where the claimant proves that the damage was caused by an obvious malfunction in use as intended or in ordinary circumstances. Article 6.297(2) presumes the causal link where the product is defective and the losses suffered match the damage that a product of that quality ordinarily causes.

Article 6.297(3) presumes the defect, the causal link or both where the claimant faces excessive difficulties, including technical or scientific complexity, and makes it likely that the product is defective or that the causal link exists. Article 6.298(1) point 1 releases an economic operator that proves the product probably was not defective when it was placed on the market, put into use or supplied by the distributor, or that the defect arose later.

That release does not apply where the inadequate quality of a product under the manufacturer's control was caused by a related digital service, by software including updates or upgrades, by the lack of software updates or upgrades needed for safety, or by a substantial modification. Article 6.298(1) point 2 releases an economic operator where the quality of the product deteriorated because mandatory legal requirements were followed.

Article 6.298(1) point 3 releases an economic operator where the objective state of scientific and technical knowledge, when the product was placed on the market or put into use or while the manufacturer controlled it, did not allow the defect to be discovered. Article 6.298(3) does not reduce an economic operator's liability where the damage was caused both by the defect and by the act or omission of a third party.

Article 6.299(1) point 1 covers damage from death or injury to health, including damage to psychological health. Article 6.299(1) point 2 covers damage from the destruction or corruption of data, as the Data Governance Act defines data, that is not used for professional purposes.

Article 6.299(1) point 3 covers damage to any property except the defective product itself, a product damaged by a defective component that the manufacturer integrated or connected under its control, and property used exclusively for professional purposes. Article 6.300(1) sets a limitation period of three years from the day the injured person learned or should have learned of the damage, the defect and the identity of the liable economic operator.

Article 6.300(2) extinguishes the right to sue ten years after the defective product was placed on the market or put into use. Article 6.300(2) extends that period to 25 years where a court finds that a later-revealed disability or other injury to health prevented the injured person from suing within the ten years.

Article 4 classifies public information causing a negative effect on minors' mental or physical health or their physical, mental, spiritual or moral development. Content of an erotic nature is one of the categories the article lists, alongside violence, gambling promotion, self-harm, and other harmful subject matter.

A Constitutional Court ruling of 18 December 2024 held point 16 of Article 4(2), which covered information disparaging family values, contrary to the Constitution, and the Register of Legal Acts records the ruling as an amendment of that point dated 18 December 2024. The restrictions, exceptions and prohibitions this Law sets apply to all public information, including advertising, commercial audiovisual messages, trailers, trademarks, user-generated video, and public events.

Article 7 bars disseminating such information directly to minors and confines it to places minors cannot access or times they would not be using it, unless the discloser instead uses technical measures that let a person responsible for a child's upbringing control the child's exposure, among them tools intended to verify a user's age, parental-control tools, or content-filtering systems.

Content still reaching a general audience without such technical measures must instead carry an index and observe a broadcast-time band.

Index 'S' runs from 23:00 to 06:00, index 'N-14' runs from 21:00 to 06:00 for content harmful to under-14s, and index 'N-7' applies at any time for content harmful to under-7s. A provider of public computer-network (internet) access must install and operate content-filtering measures the Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT) approves, and RRT itself supervises that duty's implementation.

A computer game's producer or distributor must separately label the game by a user age threshold under Government-set procedure. Supervision of the Law's implementation generally rests with the Inspector (Žurnalistų etikos inspektorius, the Office of the Inspector of Journalist Ethics). The Inspector may open administrative-offense proceedings under the Code of Administrative Offenses and impose an administrative penalty against a violator.

Article 40-4 of the Law on the Provision of Information to the Public requires video-sharing platform providers under Lithuanian jurisdiction to take measures to protect minors from programmes, user-generated videos and commercial audiovisual communications that spread information with a negative effect on minors.

Paragraph 2 of that Article lists the measures a provider implements at its choice, among them the creation and application of age-verification systems for platform users in respect of content with a negative effect on minors. Paragraph 2 also lists parental control systems managed by end users for such content. Under paragraph 3, the strictest access-control measures must be applied to the most harmful content.

Under paragraph 5, the Radio and Television Commission assesses the measures and may require a provider to apply specific measures where it finds the chosen ones inappropriate. Law XIV-180 replaced Article 40-4 with its present text. The amending Law took effect on 1 February 2021.

Article 57-1 gives an electronic press publisher the exclusive right to permit or prohibit an information-society service provider from reproducing an electronic press publication or part of it, or making it publicly available online. The right does not reach an individual user's private or non-commercial use, a hyperlink, or a publication first published before 6 June 2019.

It also does not reach the use of individual words from the publication or an extract of 125 or fewer print characters, not counting the heading and spaces. An electronic press publisher must ensure that the authors of works included in the publication receive an appropriate share of the revenue the publisher earns from an information-society service provider's use. Absent another agreement between the publisher and the author, that revenue is split equally.

Article 21 permits reproducing, publishing, and communicating to the public, including online, a small part of a lawfully published or publicly disclosed work, in the original language or in translation, as a quotation for criticism or review in another work, without the author's permission or remuneration, provided the source and author's name are cited where possible and the use is fair and does not exceed what the purpose of quotation requires.

The article's current wording took effect 1 May 2022, when Law No. XIV-970 entered into force, though its quotation exception itself dates to an earlier amendment (Law No. XI-1833 of 21 December 2011).

Article 24 permits reproducing in the press and communicating to the public, including online, published or publicly disclosed articles on current economic, political, or religious topics, and analogous broadcast works, without the author's permission or remuneration. This use is permitted unless the authors or other rightsholders have prohibited such use, and provided the source and author's name are given in the copies bearing the work or by other means.

A separate point of the same paragraph permits reproducing in newspapers and periodicals, or communicating to the public by any means, political speeches, excerpts from public lectures and similar works, including speeches made in court proceedings, to the extent the purpose of informing the public justifies it. The article's current wording took effect 10 January 2012, when Law No. XI-1833 entered into force.

Article 22-1 lets a research organization or cultural-heritage institution reproduce, without the author's permission or remuneration, a work it can lawfully access for non-commercial text-and-data-mining research, keeping the copies under restrictions on their use and distribution and retaining them for research purposes, including to verify the research results. A contract term barring reliance on this exception is void.

Article 22-2 lets anyone reproduce a lawfully accessible work for text-and-data-mining purposes without permission or remuneration. That limitation applies only unless the rightsholder has expressly reserved that use by appropriate means, which for content publicly available online means machine-readable means. The same pairing of exceptions reaches a database's contents.

Article 63(1)(6) gives research organizations and cultural-heritage institutions an equivalent unconditional right to extract a database for text-and-data-mining research. Article 63(1)(7) extends the general, opt-out-conditioned exception to any lawful user extracting a database for text-and-data-mining purposes.