Built from a run recorded on 24 Sep 2026 against the live services.

  1. CK 6.252 30
  2. CK 6.211 8
  3. CK 6.217 484
  4. CK 1.37 90
Lithuanian court rulings that apply each Civil Code article. Measured 24 Sep 2026 by our capture script; the run is below.

A payment institution wants to buy an AI system that reads incoming customer complaints, sorts them by topic and urgency, and drafts replies that staff review before sending. The vendor sends its standard SaaS contract. Compliance has to say, before signature, what the contract lacks.

We recorded that check on 24 September 2026 for an illustrative institution. The vendor’s draft, also illustrative: liability capped at twelve months of fees, termination for convenience for the vendor only, sub-processors of the vendor’s choice, no clause on exit or data return, governed by Irish law. The law came from the live services through Datailo: Rekvira for DORA, the GDPR and the AI Act, Avokata for the Lithuanian Civil Code.

Which provision does each gap touch?

Gap in the draftProvisionWhat it requires (as held, quoted or summarised)
No exit or data-return clauseDORA Art. 30(2)(d); for critical or important functions also 30(3)(f)access, recovery and return of personal and non-personal data “in an easily accessible format” on insolvency, discontinuation or termination; an exit strategy with a mandatory transition period
Sub-processors of the vendor’s choiceDORA Art. 30(2)(a); GDPR Art. 28(3)(d)the contract states whether subcontracting is permitted and on what conditions; the processor “respects the conditions referred to in paragraphs 2 and 4 for engaging another processor”
Termination for convenience for the vendor onlyDORA Art. 30(2)(h); Civil Code Art. 6.217termination rights and minimum notice periods; under the Code a contract can be terminated unilaterally in the cases it provides for, so the contract must provide them for the institution too
Liability capped at twelve months of feesCivil Code Art. 6.252(1), 6.211a cap does not apply to losses caused intentionally or by gross negligence; exclusion clauses are void where unfair
Governed by Irish lawCivil Code Art. 1.37(1), (3)the parties may choose the law; the choice does not displace Lithuanian mandatory rules

DORA Article 28(1)(a) frames all of it: a financial entity using ICT services “shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law”. The vendor’s contract cannot move that responsibility.

What does DORA require in the contract?

Article 30(2) lists nine elements every ICT contract must contain; 30(3) adds six for services supporting critical or important functions. Read in full through Rekvira, the ones the illustrative draft missed are (d), data return, and (h), termination rights. Point (d), verbatim:

“provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements”

Source: Regulation (EU) 2022/2554, Article 30(2)(d), as held by Rekvira (text as of 2 September 2026). Whether complaint handling supports a critical or important function is the institution’s own assessment; if it does, 30(3) adds service-level targets, audit rights and the exit strategy.

Is the AI system high-risk?

The AI Act’s deployer duties in Article 26 apply to high-risk systems. Article 26(1), as held:

“Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.”

The run searched the Act for the nearest financial use, credit scoring, and Rekvira put Annex III, point 5 (access to essential private and public services) first. A system that sorts complaints and drafts replies for staff to review is a different use; the institution checks it against point 5 and the rest of Annex III and records the conclusion. If it is not high-risk, Article 26 does not apply, but the DORA and GDPR points above still do.

What does Lithuanian contract law add?

The draft chose Irish law. Article 1.37(3) of the Civil Code (in Lithuanian, as Avokata returned it): a choice of foreign law “nėra pagrindas atsisakyti taikyti Lietuvos Respublikos ar kitos valstybės imperatyvias teisės normas” (is no ground to refuse to apply the mandatory rules of Lithuania or another state). Two of those rules matter for the liability cap:

“Šalių susitarimas dėl civilinės atsakomybės už nuostolius (žalą), padarytus dėl skolininko tyčios ar didelio neatsargumo, netaikymo ar jos dydžio apribojimo negalioja.”

(An agreement excluding or limiting liability for losses caused by the debtor’s intent or gross negligence is void.) Civil Code Article 6.252(1), e-TAR; Avokata confirmed the provision exists and is in force on 24 September 2026. Article 6.211 adds that clauses excluding or limiting liability are void where, given the nature of the contract, they are unfair.

How often do Lithuanian courts apply these articles? Avokata’s citator counted the rulings for each (chart above): Article 6.217 on termination, 484; Article 1.37 on applicable law, 90; Article 6.252 on liability limits, 30; Article 6.211 on exclusion clauses, 8. A provision the courts apply often is one the other side’s lawyer will know.

What the run did not do

It did not answer the vendor’s AI questionnaire, fill in the DORA register of information or read the actual contract. Those are stages of the Datailo job “AI vendor due diligence”, whose recorded run is not published yet. It did not approve or reject the vendor: the file goes to the people who sign. The services return sources, not legal advice.

The recorded run

A Lithuanian payment institution is about to contract an AI vendor: which AI Act, DORA, GDPR and Civil Code provisions does the due-diligence file need? The payment institution and the vendor are illustrative. The law and every citation came from the live services. Recorded 24 Sep 2026 through https://mcp.datailo.com/mcp; 20 calls, each with the time it took from our test machine.

Every call in the run (20)
  1. datailo_connect email=content-proof-2@example.test 71 ms. sign-in started with an email address
  2. datailo_connect_verify request_id=[redacted], code=[redacted] 32 ms. signed in; the hub issued a key for the later calls
  3. datailo_enable service=rekvira 72 ms. Rekvira switched on (keyless)
  4. datailo_enable service=avokata 298 ms. Avokata switched on (partner)
  5. datailo_invoke → rekvira.read_unit regulation=dora, pinpoint=Article 28(1) 463 ms. DORA Article 28(1)
    • DORA Article 28(1) Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a) financial entities that have in place…
  6. datailo_invoke → rekvira.read_unit regulation=dora, pinpoint=Article 30(2) 464 ms. DORA Article 30(2)
    • DORA Article 30(2) The contractual arrangements on the use of ICT services shall include at least the following elements: (a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether…
  7. datailo_invoke → rekvira.read_unit regulation=dora, pinpoint=Article 30(3) 467 ms. DORA Article 30(3)
    • DORA Article 30(3) The contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following: (a) full service level descriptions, including updates and…
  8. datailo_invoke → rekvira.read_unit regulation=eu-ai-act, pinpoint=Article 26(1) 347 ms. EU AI Act Article 26(1)
    • EU AI Act Article 26(1) Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.
  9. datailo_invoke → rekvira.read_unit regulation=gdpr, pinpoint=Article 28(3) 505 ms. GDPR Article 28(3)
    • GDPR Article 28(3) Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and…
  10. datailo_invoke → rekvira.search_regulation regulation=eu-ai-act, query=AI systems intended to be used to evaluate the creditworthiness of natural persons 452 ms. 25 passages
    • ANNEX III(5) Access to and enjoyment of essential private services and essential public services and benefits: (a) (a) AI systems intended to be used by public authorities or on behalf of…
    • ANNEX III(3) Education and vocational training: (a) (a) AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training…
    • ANNEX III(4) Employment, workers’ management and access to self-employment: (a) (a) AI systems intended to be used for the recruitment or selection of natural persons, in particular to place…
  11. datailo_invoke → avokata.cited_by act_number=CK, pinpoint=6.252 straipsnis, limit=3 5,199 ms. 30 rulings apply CK 6.252
  12. datailo_invoke → avokata.cited_by act_number=CK, pinpoint=6.211 straipsnis, limit=3 4,922 ms. 8 rulings apply CK 6.211
  13. datailo_invoke → avokata.cited_by act_number=CK, pinpoint=6.217 straipsnis, limit=3 5,495 ms. 484 rulings apply CK 6.217
  14. datailo_invoke → avokata.cited_by act_number=CK, pinpoint=1.37 straipsnis, limit=3 5,059 ms. 90 rulings apply CK 1.37
  15. datailo_invoke → avokata.search_law query=sutarties sąlygos atsakomybės ribojimas, codes=["CK"], limit=3 4,617 ms. 3 Civil Code passages
    • 6.665 straipsnis. 6.665 straipsnis. Rangovo atsakomybė už netinkamos kokybės darbą 1. Jeigu darbai atlikti nukrypstant nuo sutarties sąlygų, dėl kurių darbų rezultatas negali būti naudojamas pagal sutartyje nurodytą…
    • 6.211 straipsnis. 6.211 straipsnis. Atsakomybę naikinančios sąlygos Sutarties sąlygos, kurios panaikina ar apriboja šalies atsakomybę už sutarties neįvykdymą arba leidžia ją įvykdyti tokiu būdu, kuris iš esmės…
    • 3.105 straipsnis. 3.105 straipsnis. Negaliojančios vedybų sutarties sąlygos Negalioja vedybų sutarties sąlygos, kurios: 1) prieštarauja imperatyviosioms įstatymų normoms, gerai moralei arba viešajai tvarkai; 2) keičia…
  16. datailo_invoke → avokata.read_paragraphs document_id=lt.e-tar:TAR.8A39C83848CB#1728, pinpoint=6.252 straipsnis, count=2 1,297 ms. CK 6.252 straipsnis
    • 6.252 straipsnis. 6.252 straipsnis. Šalių susitarimai dėl civilinės atsakomybės netaikymo ar jos apribojimo 1. Šalių susitarimas dėl civilinės atsakomybės už nuostolius (žalą), padarytus dėl skolininko tyčios ar didelio neatsargumo, netaikymo ar jos dydžio apribojimo negalioja. Draudžiama apriboti ar panaikinti civilinę atsakomybę už sveikatos sužalojimą, gyvybės atėmimą ar neturtinę žalą. 2. Šalys savo susitarimu…
  17. datailo_invoke → avokata.read_paragraphs document_id=lt.e-tar:TAR.8A39C83848CB#1728, pinpoint=6.211 straipsnis, count=2 1,341 ms. CK 6.211 straipsnis
    • 6.211 straipsnis. 6.211 straipsnis. Atsakomybę naikinančios sąlygos Sutarties sąlygos, kurios panaikina ar apriboja šalies atsakomybę už sutarties neįvykdymą arba leidžia ją įvykdyti tokiu būdu, kuris iš esmės skiriasi nuo to, kurio protingai tikėjosi kita šalis, negalioja, jeigu tokios sąlygos atsižvelgiant į sutarties prigimtį bei kitas aplinkybes yra nesąžiningos.
  18. datailo_invoke → avokata.read_paragraphs document_id=lt.e-tar:TAR.8A39C83848CB#1728, pinpoint=6.217 straipsnis, count=2 1,489 ms. CK 6.217 straipsnis
    • 6.217 straipsnis. 6.217 straipsnis. Sutarties nutraukimas 1. Šalis gali nutraukti sutartį, jeigu kita šalis sutarties neįvykdo ar netinkamai įvykdo ir tai yra esminis sutarties pažeidimas. 2. Nustatant, ar sutarties pažeidimas yra esminis, ar ne, turi būti atsižvelgiama į tai: 1) ar nukentėjusi šalis iš esmės negauna to, ko tikėjosi iš sutarties, išskyrus atvejus, kai kita šalis nenumatė ir negalėjo protingai…
  19. datailo_invoke → avokata.read_paragraphs document_id=lt.e-tar:TAR.8A39C83848CB#1728, pinpoint=1.37 straipsnis, count=2 1,373 ms. CK 1.37 straipsnis
    • 1.37 straipsnis. 1.37 straipsnis. Sutartinėms prievolėms taikytina teisė 1. Sutartinėms prievolėms taikoma prievolės šalių susitarimu pasirinkta teisė. Toks šalių susitarimas gali būti numatytas pagal šalių sudarytos sutarties sąlygas arba gali būti nustatomas pagal faktines bylos aplinkybes. Šalys savo susitarimu gali pasirinkti tam tikros valstybės teisę, kuri bus taikoma visai sutarčiai arba atskirai jos…
  20. datailo_invoke → avokata.verify_citation citation=CK 6.252 str. 1 d. 1,192 ms. exists: held; in force: {'state': 'in_force', 'asked_about': '2026-09-24', 'in_force_from': '2000-09-06', 'in_force_to': None, 'versions_held': 100, 'version_coverage': {'status': 'named', 'held': 100, 'earliest_held': '2004-04-27', 'latest_held': '2026-04-01'}}

Try it in your assistant

Add the address to your client (setup per client), then paste the prompt. Signing in takes an email code; the three services are free during the beta.

Connector address
https://mcp.datailo.com/mcp

Then say

Use Datailo: we are a Lithuanian payment institution contracting an AI vendor. Read DORA Article 30(2) and 30(3) and GDPR Article 28(3), and tell me what the Lithuanian Civil Code says about limiting liability and choosing a foreign law.