Open source software: licences and risks in the company

Practically every piece of business software today incorporates open source components. It is a formidable resource, but “free” does not mean “without rules”. Every component comes with a licence that imposes obligations, and ignoring them exposes you to concrete risks: loss of control over your own code, disputes, blockers during due diligence. The topic concerns those who develop software just as much as those who merely use it.

Open source does not mean without constraints

The underlying misconception is thinking that open source software is in the public domain. It is not: it is protected by copyright, and whoever publishes it grants use under certain conditions through a licence. Using the component means accepting that licence. If you do not respect its conditions, you fall short of the terms that authorised you to use it. The question is not “can I use it”, but “under what conditions”.

The two great families of licences

Simplifying, open source licences fall into two categories with opposing logics:

Permissive: they allow very broad use, including in commercial and closed products, generally asking for little: keeping the copyright notices and the licence text. They are the easiest to manage in a corporate context.
Copyleft: they require that, under certain conditions, derivative works be distributed under the same licence, making the source code available. The goal is to keep free what is born from free software.

Within copyleft the crucial distinction is between strong and weak copyleft: the former can “propagate” to the entire work that integrates the component, the latter limits the obligation to the modified component alone. For a company that develops proprietary software, integrating a strong-copyleft component without knowing it can entail the obligation to make its own code public.

The concrete risks for the company

Contamination of proprietary code: using copyleft components in a way incompatible with a closed product can create the obligation to open the source, or the need to remove and rewrite parts of the product.
Breach of conditions: failing to respect the obligations (attribution, licence text, source) exposes you to claims from the rights holders.
Blocker in due diligence: in an investment, acquisition or sale, the analysis of open source licences is now standard. Poorly managed components surface risks that reduce value or block the deal.
Hidden dependencies: a component pulls in others, each with its own licence. The risk nests in the indirect dependencies that no one has examined.
Security: outdated components bring known vulnerabilities. It is an operational risk before it is even a legal one.

How to manage open source without surprises

The solution is not to ban it, which would be unrealistic, but to govern it:

Inventory of components: keep a bill of the software used and its licences, indirect dependencies included.
Internal policy: define which licence categories are freely permitted, which require assessment and which are to be avoided in certain products.
Verification before integration: check a component’s licence before including it, not after.
Compliance with minimum obligations: keep copyright notices, licence texts and attributions. These are simple duties that, if neglected, create disproportionate problems.
Care in case of distribution: many copyleft obligations trigger when the software is distributed to third parties. Those who use the software only internally often have different constraints from those who deliver it to clients.

In summary

Open source is protected by copyright: the licence imposes conditions to be respected.
Permissive licences are simple; copyleft, especially strong copyleft, can force you to open your own code.
The biggest risks are contamination of proprietary code, breaches and blockers in due diligence.
Governance is needed: inventory, policy, upfront verification and compliance with attribution obligations.

How we help

We help you build an open source policy, review the licences of the components in use and secure your software before a distribution or an extraordinary transaction. Let’s talk about your licences.