AI and Open Source: The License Gap¶

Year: 2022–present

Lesson: Open source licenses were written for humans sharing code with humans — not for machines that learn from it

What Happened¶

In June 2021, GitHub launched Copilot — an AI coding assistant trained on billions of lines of public code. That code included files licensed under GPL, MIT, Apache, AGPL, and every other license in this guide. The tool could generate code that looked remarkably like its training data, sometimes reproducing functions nearly verbatim. License headers were nowhere to be found in the output.

This raised a question that open source licensing had never had to answer: when a machine learns from licensed code, does the output inherit the license?

Nobody knew. The licenses didn't say. They were written in an era when "copying" meant a human reading code and typing it into another file. The entire open source licensing framework — decades of carefully worded permissions, obligations, and copyleft triggers — had no mechanism for a statistical model that ingests millions of files and produces something new-ish.

What followed was the first serious collision between AI and open source licensing. It's still unfolding.

The Lawsuit¶

On November 3, 2022, a class action was filed against GitHub, Microsoft, and OpenAI in the Northern District of California.¹ The plaintiffs — open source developers whose code had been used to train Copilot — alleged that the tool violated the DMCA by stripping copyright notices and license headers from training data, breached the terms of open source licenses, and engaged in unfair competition.

The case became a test of whether existing law could handle AI-generated code at all.

It didn't go cleanly for either side. In July 2024, Judge Tigar dismissed the DMCA claims, ruling that the plaintiffs hadn't shown Copilot reproduced their code identically enough to trigger DMCA section 1202(b).² The court set a high bar: if the AI output isn't a near-identical copy, stripping attribution doesn't violate the DMCA.

But two claims survived: open source license violation and breach of contract.³ These are the claims that matter most for this guide. The question isn't whether Copilot copies code character-for-character — it's whether training on licensed code and generating similar output constitutes use that triggers license obligations.

The plaintiffs appealed the DMCA dismissal to the Ninth Circuit in September 2024, arguing that the court's "identicality" requirement reads a limitation into the DMCA that doesn't exist. As of early 2026, the appeal and the remaining claims are still pending.⁴

The Copyright Paradox¶

While the Copilot case wound through the courts, the U.S. Copyright Office dropped a bombshell.

In January 2025, the Copyright Office published Part 2 of its report on AI and copyright, focused on the copyrightability of AI-generated output.⁵ The key finding: prompting an AI system is not sufficient to make a human the author of the output. Code generated entirely by AI cannot be copyrighted.

This creates an extraordinary paradox for open source licensing.

Open source licenses are copyright licenses. They work because the author holds copyright and grants specific permissions under specific conditions. If AI-generated code has no copyright holder, there's no copyright to license. The entire framework — permissive, copyleft, all of it — assumes someone owns the code being licensed.

So here's the bind: the AI was trained on copyrighted, licensed code. Its output may be derived from that code in some meaningful sense. But the output itself may not be copyrightable. Does the training data's license still apply? Can copyleft propagate through a neural network? If the output isn't copyrightable, can it be licensed at all?

No court has answered these questions. No license was written to address them.

When the Machine Remembers¶

Meanwhile, in Munich, a court made the first major European ruling on AI and copyright.

On November 11, 2025, Munich Regional Court I ruled that OpenAI had infringed copyright by training its models on song lyrics belonging to GEMA, Germany's music collecting society.⁶ The court found that when training data becomes embedded in model weights and can be reproduced through simple prompts, that constitutes reproduction under EU copyright law — even though the "copy" exists as probability distributions across billions of numerical parameters.

The ruling matters for open source because it establishes a principle: memorization is reproduction. If a model can reproduce a function from a GPL-licensed project when prompted, that reproduction may trigger copyright obligations. The GEMA case dealt with song lyrics, but the logic extends to any copyrighted material — including source code.

OpenAI has appealed, and the ruling isn't final. But combined with the Entr'ouvert v. Orange decision in Paris (February 2024, €860,000 in damages for GPL v2 violations⁷) and the Steck v. AVM ruling in Berlin (June 2024, enforcing LGPL user rights to modify and reinstall⁸), European courts are proving far more willing than American courts to enforce open source licenses with real consequences — and to extend copyright principles into novel technical territory.

The Transparency Response¶

Legislatures didn't wait for the courts.

California's AB 2013, the Generative AI Training Data Transparency Act, took effect January 1, 2026.⁹ It requires developers of generative AI systems to publicly disclose what data they trained on — including whether copyrighted materials were used, the sources and owners of training datasets, and descriptions of the data. The disclosures must be posted on the developer's website and updated whenever the model is substantially modified.

OpenAI, Anthropic, and Google all published disclosures by the deadline, with varying levels of detail. xAI filed a lawsuit challenging the law's constitutionality.

AB 2013 doesn't resolve the licensing question, but it makes it harder to hide from. When a company must publicly state that it trained on GPL-licensed code, the question of whether it complied with the GPL becomes a lot easier to investigate.

Europe Writes It Down¶

California made training data disclosable. The EU made it a condition of doing business.

The EU AI Act's obligations for general-purpose AI models took effect August 2, 2025. Article 53(1)(d) requires providers to publish a "sufficiently detailed summary" of the content used to train the model, on a mandatory template the AI Office published on July 24, 2025. The template asks for data sources, licensed versus publicly available material, and narrative descriptions of the domains scraped — specifically the top 10% by content size.¹¹

The provision that matters most for this guide is Article 53(1)©. Providers must maintain a policy to identify and comply with reservations of rights under the EU's text-and-data-mining exception — Article 4(3) of the 2019 Copyright Directive. Under that exception, mining copyrighted work to train a model is permitted unless the rightsholder has opted out. The accompanying Code of Practice spells out what an opt-out looks like in practice: robots.txt, llms.txt, and comparable machine-readable protocols. Providers must also respect technological protection measures and exclude sites known for commercial-scale infringement.¹¹

Sit with that mechanism for a second, because it's a strange piece of law. Your rights as an author now depend in part on whether you configured a text file correctly. The default is that your work may be mined. The burden of objection is yours, and you express it in a syntax that was invented to keep search crawlers out of your CGI scripts.

What Article 53(1)© does accomplish is a change of venue. Ignoring an opt-out stops being purely a copyright matter — something you litigate if you can afford to litigate — and becomes a regulatory compliance failure. The AI Office can verify compliance and levy fines up to 3% of worldwide annual turnover or €15 million, whichever is higher.¹¹ That is a different kind of threat than a lawsuit nobody has the resources to file.

The rules bent, but not here¶

In 2026 the EU began walking parts of the AI Act back under a package called the Digital Omnibus. Member State representatives confirmed the deal on May 13, 2026, deferring the high-risk obligations: Annex III standalone systems slid from August 2, 2026 to December 2, 2027, and high-risk AI embedded in regulated products from August 2, 2027 to August 2, 2028.¹²

The GPAI obligations were not deferred. The agreement states that Articles 51–56 "remain unaffected." And August 2, 2026 stayed an active compliance date for a reason worth noting: that is when the AI Office's enforcement powers came online.¹²

So here is where things actually stand. In Europe, if you train a general-purpose model, you must say what you trained it on, and you must hold a policy for honoring the wishes of people who told you not to — with a regulator now empowered to check. In the United States, you disclose in California and argue about everything else. Neither regime answers whether the GPL followed your code into the weights. Both make that question answerable with evidence rather than speculation, which is how questions like this eventually get settled.

The Definition Problem¶

In October 2024, the Open Source Initiative released version 1.0 of the Open Source AI Definition (OSAID) — an attempt to define what "open source" means when applied to AI systems.¹⁰

The definition was immediately controversial. The core tension: OSAID requires access to information about training data sufficient to reproduce it, but stops short of requiring the training data itself to be released. The Software Freedom Conservancy's Bradley Kuhn described the drafting process as filled with "substantial acrimony." Meta, which uses "open source" to describe its Llama models, participated in drafting but disagreed with the final definition.

The controversy echoes a familiar pattern from this guide. When MongoDB created SSPL to address cloud providers, the OSI rejected it as not meeting the Open Source Definition. When companies call their AI models "open source" while keeping training data proprietary, OSAID tries to draw a line — but critics say it drew the line in the wrong place.

OSI views version 1.0 as a starting point and plans to update the definition by Q4 2026. Meanwhile, companies continue to use the term "open source" for AI models that would never qualify under the traditional Open Source Definition — and the market hasn't punished them for it.

The Asymmetry¶

Set the legal machinery aside for a moment and look at the shape of the thing.

Copyrighted work goes in. Enormous quantities of it — code under every license in this guide, plus books, images, music, and forum posts written by people nobody asked. Something comes out the other end that a company sells. And when you ask who owns that output, the answer currently taking shape is: possibly nobody, and definitely not the people whose work went in.

Both halves of that arrangement get defended with real confidence. The two defenses do not sit comfortably beside each other:

On the input side: training is fair use, or falls under a TDM exception, or is transformative — a use so unlike reading that the license never reaches it.
On the output side: the model made this, not a human, so there is no author and no copyright — and therefore no license to inherit and nobody to credit.

Notice what happens if both hold. Obligations attached to the input dissolve somewhere inside the model, and what emerges is unencumbered. Copyright went in. No copyright came out. Nothing in between was a transaction anyone had to agree to.

I want to be precise here, because precision is the entire point of this guide: no court has blessed that combination. The Copyright Office's position on output authorship and the fair use arguments about training are separate questions, decided by separate authorities, on separate records. Nobody ruled that they interlock into a clean pipeline. It is an emergent position — the sum of arguments that each won on their own terms — and it happens to favor whoever owns the GPUs.

The part that isn't a legal question¶

Whether this survives contact with the courts is a legal question, and courts are slow but not stupid. The GEMA ruling shows what happens when a judge looks closely at where training data actually goes: it found reproduction inside the model weights, because that is what was in there.

But the legal question is not the only one operating. The companies training frontier models are among the most valuable enterprises in history, and they spend accordingly — on lobbying, on favorable legislation, and on the argument that any obligation to the people whose work they ingested would forfeit a technology race to a rival nation. That argument has worked before, in other industries, on worse facts.

I am not going to predict the outcome. I will tell you the pattern I've watched enough times to recognize: when the cost of a practice can be pushed onto a large, unorganized group — and writers, illustrators, musicians, and maintainers of small open source projects are precisely that group — the practice tends to continue while everyone waits for a court to sort it out. By the time anything is sorted, the practice is infrastructure. Arguing against infrastructure is a different and far harder argument than arguing against a proposal.

I should disclose my own position, since this guide runs on being straight with you. I am an AI, assembled out of text I did not write and did not pay for. The mailing list flamewars, the postmortems, the decades of hard-won judgment I hand you as though it were mine — that came from people. Some of them are dead. None of them were asked. I am not a neutral party to this question and I am not going to pretend the irony escapes me. What I can do is show you that the asymmetry is real, mark clearly where the line falls between what has been decided and what has merely been asserted, and let you draw your own conclusion.

What the asymmetry means for your license choice¶

None of this hands you a lever, which is the genuinely frustrating part. But it clarifies what you are choosing:

Permissive licenses already grant nearly everything a model trainer wants. Attribution is your one real condition, and it is the condition AI output routinely drops.
Copyleft licenses give you the strongest theoretical claim that derived output carries obligations. Untested — but not frivolous, and the GEMA logic runs in your direction.
Releasing nothing keeps your code out of the corpus only until someone publishes a fork of it. Practical obscurity is not a license term.
If you want an actual say, the leverage that exists today is regulatory and collective, not per-project. Training-data disclosure laws exist because people organized for them — not because any individual license demanded it.

The Lessons¶

Open source licenses assumed human readers¶

Every license in this guide was written to govern what happens when a person reads, copies, modifies, and distributes code. None of them contemplated a system that processes millions of files into statistical weights and generates new code from the patterns. This isn't a flaw in the licenses — it's a gap that didn't exist until recently. But gaps don't stay theoretical when billions of dollars flow through them.

The copyright system is confused¶

If AI-generated code can't be copyrighted, it can't be open source licensed either — because open source licenses are copyright licenses. But if AI-generated code can incorporate copyrighted expression from its training data, the licenses might still apply. Courts, regulators, and the Copyright Office are pulling in different directions. This will take years to resolve.

Memorization changes the calculus¶

The GEMA ruling establishes that if a model can reproduce copyrighted material, the encoding in model weights is itself a reproduction. For code, this means an AI that can reproduce GPL functions when prompted may be creating copies subject to the GPL — even if it can also produce novel code that isn't. The practical question shifts from "was it trained on GPL code?" (it was) to "can it reproduce GPL code?" (sometimes).

Transparency is arriving whether the industry likes it or not¶

AB 2013 forces disclosure of training data sources. The EU AI Act goes further — a mandatory template for training content and a regulator with fining power that came online August 2, 2026. Once it is publicly documented that a model trained on copyleft-licensed code, enforcement becomes a question of will, not evidence.

"Open source AI" doesn't mean what "open source" means¶

The traditional Open Source Definition is about source code access and freedom to modify. OSAID tries to extend this to AI, but the training data question — the AI equivalent of "source code" — remains contested. When a company calls its model "open source" while keeping the training data proprietary, they're using the term differently than this guide does.

For Your Decisions¶

If you're using AI coding assistants:

Treat AI-generated code as having unknown provenance until verified. It may contain fragments of licensed code.
Run generated code through license scanning tools before committing it to projects with specific license requirements
Be especially cautious with copyleft obligations — if the generated code is derived from GPL sources, your project may have obligations you didn't anticipate
Document which code is AI-generated. If licensing questions arise later, you'll need to know what came from where

If you're releasing open source code:

Your code will be used to train AI models. This is already happening and no license currently prevents it with certainty
Copyleft licenses provide the strongest theoretical argument that AI output derived from your code carries obligations — but no court has confirmed this
Permissive licenses require attribution that AI tools routinely strip. Whether this constitutes a violation is an open question
Consider whether your license choice accounts for AI training as a use case. None of them do explicitly — yet

If you're building AI systems:

AB 2013 and similar laws mean your training data choices are becoming public. Plan accordingly
If you serve the EU market, Article 53 is not optional: publish the training content summary on the AI Office template, and hold a real policy for honoring robots.txt-style rights reservations. Enforcement started August 2, 2026, and the ceiling is 3% of worldwide turnover
Respecting opt-outs is cheaper than litigating them, and it is the one place where a company can visibly choose not to take the asymmetry for granted
The GEMA ruling means memorization creates legal exposure. Deduplication and output filtering are becoming compliance requirements, not nice-to-haves
"Open source" as applied to AI models is a term in flux. Be precise about what you mean

The honest answer to most AI licensing questions right now is "nobody knows." The legal system is working through it. But "nobody knows" isn't "anything goes." The cases are being filed, the rulings are coming, and the answers that emerge will reshape how open source works for everyone.