Firmware hacking with Claude: What German and EU law actually allows

What this is about

Over the past few weeks we've published a whole run of tinkering stories. A Californian got his 1994 Jeep through a smog check with help from Claude and Codex. Hobbyists are unlocking features on Sony, Sigma and Nikon cameras that the manufacturers keep for pricier models. A hobbyist security researcher used Claude Opus 4.8 to find around 23 bugs in the firmware of a Prusa printer. Mike Lothian used Claude to write a free Linux driver for DisplayLink docks, then pulled it after Synaptics threatened him with patents. And Elektron banned the sharing of firmware mods on its forum.

On their own, these are anecdotes. Taken together, they raise a question that will soon matter to a lot of device owners: What am I allowed to change in my own device's software when an AI does the tedious work for me? The short answer for Germany and the EU: copyright gives you more room than you might expect. The real limits come from patents, type-approval law and manufacturer contracts. This isn't legal advice, just a guide to get your bearings.

The thesis: effort used to be the filter

The framework comes from a paper posted to arXiv in late October by Ilan Mandel, Madiha Zahrah Choksi, Joey Castillo, Sebastian Benthall and James Grimmelmann (Cornell). The abstract page now carries the shorter title "Cheap Reverse Engineering and What It Will Do". The authors argue that the law broadly permits reverse engineering, meaning working out how a finished product functions internally. But it relies on how hard reverse engineering is to act as a filter between legitimate re-implementation and forbidden copying. Remove that hurdle and the text of the law stays the same, but its effect changes.

"The law of reverse engineering was built for a world in which opening up a device took time, tools and rare expertise."

The authors predict that manufacturers will move as much functionality as possible into the cloud and lean harder on encryption, Secure Boot (a boot process that only accepts signed software) and contract clauses. One caveat: the paper almost exclusively analyzes US law, meaning DMCA §1201, the CFAA and fair use. EU law barely comes up. So for Germany, we have to do the math ourselves.

Copyright: more generous than many people think

Firmware is a computer program. Germany's Copyright Act (UrhG) has special rules for programs (§§69a–69g UrhG), based on the EU Software Directive 2009/24/EC.

• Observing and testing is free. Under §69d(3), anyone lawfully using a program may observe, study and test how it works in order to understand the ideas behind it. That's exactly how a clean-room approach like Vino's works: you capture the USB traffic instead of copying someone else's code.
• Decompiling for interoperability is allowed. Decompiling means translating machine code back into readable code. §69e permits it when it's needed to make an independently written program work with others. But you can't use the information you gain to build a "substantially similar" competing program.
• Decompiling to fix bugs is allowed. On October 6, 2021, the CJEU ruled in Top System (C-13/20) that lawful acquirers may also decompile a program to correct errors. The conditions, according to the law firm GvW: there has to be a genuine malfunction, fixing it has to actually require decompiling, and the results can only be used for that purpose. Contracts can't rule out bug fixing entirely, but they can set the "modalities".
• Contracts can barely override this. Under §69g(2), clauses that conflict with §69d(3) or §69e are void. So a "reverse engineering prohibited" line in the license terms only gets the manufacturer so far.

Correcting a common assumption: You'll often read that, under §69a(5), the anti-circumvention protection in §95a UrhG doesn't apply to computer programs. That really was the wording until 2021. But the current text of §69a(5) no longer contains that reference. According to Telemedicus and MKM Legal, the 2021 copyright reform moved the distinction to §69f. Under §69f(3), only §95b applies by analogy to technical protection mechanisms for programs, and the explanatory memorandum still considers §§95a et seq. inapplicable to software. The upshot: there's no general ban on circumventing copy protection on pure software. §69f(2) only covers tools "solely intended" to circumvent such mechanisms without authorization, and requires them to be destroyed. The exception is video games: after the CJEU's Nintendo ruling (C-355/12), they count as complex works covered by the general anti-circumvention rules.

Where copyright does hold you back: New features aren't bug fixes. If you rewrite firmware to, say, teach the Nikon Z30 higher bitrates, you're "adapting" a program. For software, §69c No. 2 generally requires the rights holder's consent for that. Distributing ready-made modified firmware files is clearly illegal (§69c Nos. 3 and 4). That's why projects like Wonder Lantern have users supply the original firmware themselves and only distribute the patcher. And if all you change is a stored setting, like the shutter angle on the Sony A7 IV, the code isn't being adapted at all.

Patents: the hurdle clean-room doesn't get you over

The Synaptics case shows a limit that copyright doesn't draw at all. Patents protect methods, not code. So even a driver you wrote entirely yourself can infringe them. According to LWN, the dispute played out like this:

The two patents are GB2484736 ("Image generation") and GB2485613 ("Display control device"). LWN mixes up the titles; we checked them on Google Patents. There, neither lists any family members at the European Patent Office, in Germany or in the US, and the expected expiry date is 2030. Whether Synaptics holds comparable patents elsewhere is unclear. The company only refers vaguely to "multiple jurisdictions".

Germany has an extra wrinkle. Under §11 No. 1 PatG, a patent doesn't extend to acts done "privately for non-commercial purposes". So using your own driver privately would be fine in Germany. Publishing it is the risky part: under §10(3) PatG, private users don't count as "entitled" parties. Anyone offering them the means to use a patented invention may therefore commit contributory patent infringement. Our take: the public GitHub repo is the attack surface, not the tinkering itself.

Cars, radios, repair: the special rules

Emissions and type approval: With cars, copyright is a side issue. Under §19(2) StVZO, a vehicle's operating permit lapses if a modification worsens its emissions or noise, or could endanger other road users. Software in vehicles on the road is also subject to official regulations and the state of the art. A vehicle without an operating permit can't be driven on public roads. A Jeep hack that genuinely reduces nitrogen oxides is essentially a repair. Without sign-off from an inspector, though, you're in a gray area. A change that only gets the car through the test while it emits more in everyday driving is clearly prohibited.

Radio equipment: For a long time, open-source activists feared that Article 3(3)(i) of the Radio Equipment Directive could force manufacturers to allow only certified software. That would have hit things like alternative router firmware. According to the FSFE, the European Commission dropped the rule in January 2026. Its own impact assessment described the risks as "theoretical". The cybersecurity requirements from Delegated Regulation 2022/30 have applied since August 2025. They're being repealed by Regulation 2026/339 and, according to specialist sources, will be replaced by the Cyber Resilience Act from December 2027.

Right to repair: Article 5(6) of Directive (EU) 2024/1799 bans contract clauses as well as hardware and software techniques that obstruct repairs. Exceptions are only allowed for "legitimate and objective reasons", explicitly including the protection of intellectual property. Germany implemented this in §479e BGB: the Bundestag approved it on June 25, 2026, and the Bundesrat on July 10. The catch for tinkerers: the ban only covers goods listed in Annex II, such as washing machines, refrigerators, displays, servers and smartphones. Cameras, docks, synthesizers and 3D printers aren't on the list, and unlocking features isn't a repair anyway. Legal scholars at NOVA University Lisbon criticize the fact that EU copyright law has no matching exception for technical protection measures.

Data Act: Since September 12, 2025, users of connected devices can demand access to the data their device generates. For products placed on the market after September 12, 2026, that data has to be directly accessible out of the box. The Data Act doesn't include any right to modify firmware.

Manufacturers: house rules, warranties and open doors

Where the law doesn't prohibit something, manufacturers set their own rules. Since September 16, Elektron has been removing posts that share files, tools or instructions for firmware mods. Its reasons: devices that no longer boot after a mod, blocked updates, warranty issues and the protection of intellectual property. General discussion is still allowed. That's the company exercising house rules on its own forum, not a ban on modifying your own device. Sony said back in 2016 that devices running uncertified firmware would no longer qualify for warranty repairs. We couldn't find any more recent statement on the AI hacks from Sony, Sigma or Canon. Worth knowing: a manufacturer's warranty is voluntary. Your statutory warranty rights against the retailer remain, but they don't cover damage the mod itself caused.

It doesn't have to be this way. Prusa publishes its firmware under the GPL-3.0 license. According to Prusa's help pages, breaking the seal you have to open before flashing custom firmware doesn't void the warranty. Prusa just isn't liable for any resulting damage. M-Vave responded to the wave of AI-written firmware for its FM-1 synthesizer by releasing an official developer project on October 17: source code under GPLv3, with the sound engine as a closed SDK. With Lidl's Monsieur Cuisine Smart kitchen robot, on the other hand, nobody is hacking the device at all. Unofficial MCP servers talk to an undocumented interface reverse-engineered from the web app. Here, the service's terms of use apply, exactly as the Grimmelmann paper predicts for cloud services.

The traffic light

Our analysis

Tinkerers start from a better position in Europe than in the US, where the DMCA's anti-circumvention ban also covers software. Copyright law explicitly allows observation, interoperability and bug fixing, and contract clauses against them are partly void. Our take: if Grimmelmann and his colleagues are right that effort has been filtering out abuse until now, other levers will decide things in Europe going forward. Those are patents, which work even against clean-room code. Then there's type-approval law, forum house rules, warranty terms and, above all, the move of features into the cloud, where terms of service and account bans bite harder than any law.

Plenty remains open. Nobody knows yet whether AI-assisted clean-room work is actually clean if the model may have seen the original code during training, a point the paper raises too. The software-blocking ban in the Right to Repair Directive covers only a handful of product groups so far. And the Synaptics case shows that a hobby developer will often give up before a court ever looks at whether a patent is even valid. Lothian himself says he simply can't afford a defense. The law is on the tinkerers' side, but the litigation risk is theirs to carry.