What to do next
Produce a dependency inventory
You cannot assess exposure without knowing what is actually in the build, including transitive dependencies. A software bill of materials or a licence scan is the starting point, and most organisations are surprised by the result.
Classify the obligations by licence type
Permissive licences mainly require attribution and notice retention. Weak copyleft applies to the modified component. Strong copyleft can reach the combined work. Network copyleft can be triggered by providing the software as a service, which catches SaaS businesses that never distribute anything.
Assess how the component is actually combined
Linking, modification and distribution all affect what is triggered. A dependency used unmodified behind an API is a different question from one compiled into your binary, and the analysis is technical before it is legal.
Respond to a compliance notice carefully
Enforcement often begins with a request for compliance rather than a demand for damages, and most matters resolve through compliance. Preserve the build records and take advice before responding on the merits.
Fix it before it becomes a transaction problem
Replacing a component, isolating it behind a service boundary, obtaining a commercial licence from the copyright holder, or complying with the source obligation. All are cheaper now than during diligence with a deal timetable running.
Frequently asked questions
Is open source really enforceable?
Yes. Courts have treated open source licences as enforceable, and non-compliance can amount to copyright infringement rather than mere breach of contract.
Does using open source mean my code becomes open?
Not automatically. It depends on the licence and how the component is combined with your code. Permissive licences generally impose no such obligation.
We only use it internally - does that matter?
Distribution often triggers the obligations, so internal use is frequently lower risk. Network copyleft licences can be triggered by providing access as a service, so check which licence applies.
Do we need a software bill of materials?
Increasingly acquirers and enterprise customers require one, and you cannot manage the risk without knowing your dependencies.
Who handles this?
A technology or IP lawyer working with your engineering team - the analysis is technical before it is legal.
This is general information, not legal advice. Laws vary by location and every situation is different — speak with a qualified lawyer about your specific circumstances.