Open-source licenses allow third parties to view, modify, and distribute code, but they tie use and modification to certain conditions. The so-called copyleft effect is a core licensing principle that ensures derivative works are subject to the same license obligations as the original software. Copyleft was originally devised to keep source code free and to guarantee that open-source software can be used, modified, and shared in all subsequent versions. Anyone who modifies software under a copyleft license, or integrates it into other software and distributes the result, must disclose the source code of the derivative software and pass it on under the same copyleft license.

With the rise of AI-powered software development, the question of how license and copyleft obligations should be interpreted is being asked anew. AI coding tools let developers write code more efficiently. Code generators such as GitHub Copilot or Lovable are frequently trained on large volumes of publicly available source code, including open-source code under copyleft licenses. Companies using such tools can find themselves facing copyright and open-source licensing problems. In particular, when these systems are trained on copyleft code and then output new source code, the question is whether the generated code counts as a "derivative work" subject to the license obligations.  

Legal and business implications of the copyleft effect for companies

Copyright uncertainties

It has not yet been conclusively settled, legally or technically, whether and when training use or a generated output constitutes a use or derivation relevant under copyright law. Under the currently prevailing view, AI-generated code is itself not eligible for copyright protection and, under the terms of use of the AI tool involved, must be placed in the public domain. A copyright infringement can therefore arise if the AI reproduces licensed code without proper attribution, or if code generated by an AI tool is adopted and its use does not comply with the open-source license terms.

Companies using AI tools in software development should therefore:

• Demand transparency about training data and licenses,
• document the provenance of generated code, and
• establish internal guidelines for handling AI output.

License obligations and compliance risks

Companies that integrate copyleft software into their own products must carefully assess whether that creates a "dependency" or "coupling" in the licensing sense. If a developer integrates open-source-licensed code, it could "contaminate" the entire proprietary codebase, which would then be treated as open-source code. In that case, the open-source license would apply to it, and it would have to be published. Depending on the license variant, the disclosure obligation can cover either the entire software (strong copyleft) or only specific, directly linked components (weak copyleft).

Overlook these effects and you risk license violations, which can trigger injunction, damages, and recall claims. On top of that, the reputational damage from license violations becoming public should not be underestimated.

Mitigating the risks of using AI to develop new code: Technical and organizational requirements

So how do you avoid (or at least minimize) the risk of inadvertently violating open-source licenses and copyrights?

Avoiding these risks requires systematic open-source compliance management. Measures such as component-level documentation, license review whenever third-party code is integrated, and clear development guidelines reduce the risk of unintended use. Compliance with license and OSS terms must be ensured through rigorous input controls. Licensed open-source code can be identified either through manual code review or with automated code-scanning tools.

It is therefore advisable to set up an internal OSS compliance program. The following organizational and technical measures can help:

• Issue work instructions to developers to ensure that AI-generated code components integrated into the codebase are reviewed, adapted, and/or modified.
• Maintain a whitelist/blacklist of coding tools.
• Implement the human-in-the-loop principle and clearly document human involvement in AI-assisted development.

As part of output control, you also need to ensure that the required distinction from the source code is maintained.

Bottom line: Is copyleft an opportunity or a risk?

• The copyleft effect lets companies build on high-quality open-source components.
• There is, however, no certainty that AI-generated code is protected by copyright.
• There is also the risk that your own code is effectively "infected" and must be disclosed as well.
• By documenting human contributions, enforcing clear internal compliance guidelines, and maintaining rigorous reviews and controls, developers can use AI tools to generate code components while avoiding unnecessary liability risks.
• Sound license selection and assessment is therefore a core task for the compliance team.

‍