This article is an explainer, not legal advice. If you have a specific legal concern about code ownership or licensing in your product, speak with a solicitor or attorney who specialises in software intellectual property.
AI coding tools are trained on large corpora of code from public repositories. When you ask them to write a function, they draw on that training data. In some cases they reproduce snippets that closely resemble or are verbatim copies of existing open-source code. The open-source license attached to the original code does not disappear because the copy was made by a model. If the original was under a copyleft license, using the generated code in your commercial product may create obligations you did not intend to accept.
The License Spectrum
Open-source licenses range from permissive to copyleft. Permissive licenses (MIT, Apache 2.0, BSD) allow you to use, modify, and distribute code in a commercial product with minimal obligations. Apache 2.0 requires you to give recipients a copy of the license, mark modified files and keep attribution notices. The MIT license requires its copyright and permission notice to be included in copies. Neither requires you to open-source your own product.
Copyleft licenses (GPL v2, GPL v3, AGPL v3, LGPL) are different. In the GPL family, if you convey a work based on GPL code you must license the entire work, as a whole, under the same license, and ship the corresponding source when you distribute object code. The GPL says you can run covered works you do not convey without conditions. AGPL v3 adds a network clause: if you modify the program, section 13 requires you to offer all users interacting with it remotely a way to get its source. That makes AGPL code the one most likely to matter for web applications and SaaS products, and building it into a commercial backend is a problem you want to catch early.
Why AI-Generated Code Creates Specific Risk
A developer reading documentation and writing code generally knows what they are drawing on. An AI model generating code does not declare its sources. GitHub Copilot has a code referencing check that compares a potential suggestion and about 150 characters of surrounding code with an index of public repositories on GitHub.com. Per GitHub, matching suggestions can be blocked or shown with information about the matching code, depending on the policy that applies to your account or organisation, and matches occur in under one percent of suggestions. It does not search private repositories or code hosted outside GitHub, so it is a partial safeguard, not a license audit.
The legal status of AI output that reproduces training data is still unsettled as of October 2026. The best-known US case, Andersen v. Stability AI, concerns image generators rather than code; its summary judgment hearing was pushed to 17 February 2027. The case closest to code is Doe v. GitHub: on 16 September 2026 the Ninth Circuit upheld dismissal of the programmers' DMCA section 1202(b) claims, reasoning that Copilot and Codex generated new code rather than removing attribution from existing copies, and it expressly left other theories, including training-stage removal, undecided. We have not found a ruling that settles whether reproduced open-source code in AI output creates license obligations. Until that is resolved, treating AI-generated code as potentially carrying license obligations is the conservative and defensible position.
The Due Diligence Gap
Investor due diligence and acquisition processes typically include an intellectual property audit. This audit asks: do you own all the code in your product, or are there license obligations you have not complied with? A codebase built primarily with AI tools, without any review of the generated code against known copyleft sources, may fail this audit or require costly remediation.
The remediation is not always straightforward. If you have built on top of GPL-derived code for two years, removing the obligation may mean rewriting that code, which can be expensive. Detecting the issue before it is deeply embedded in your codebase is worth more than finding it at the worst possible time: during a funding round or an acquisition.
Tools such as FOSSA, Black Duck and ScanCode exist to audit a codebase for open-source license obligations. ScanCode, for example, is described as detecting the origin (copyrights), license and vulnerabilities of code, packages and dependencies in a codebase. These tools are not perfect, and they are unlikely to identify AI-reproduced code that lacks headers, but they are a sensible preparation step before due diligence.
Practical Steps for Founders
- Check the public-code matching policy in GitHub Copilot (or the equivalent in your AI coding tool) and train developers to review flagged suggestions rather than accepting them automatically.
- Add a license audit step to your CI pipeline or run a tool like FOSSA or Scancode periodically. This catches dependency license issues as well as code-level issues.
- Keep a record of which significant functions or modules were AI-generated. This makes a future audit easier and demonstrates good-faith process.
- Review any GPL, LGPL, or AGPL licensed dependency you add to your project - not just the code the AI writes. AI tools can suggest adding libraries whose licenses you have not checked.
- Before a fundraising round or acquisition, instruct a solicitor to review the IP ownership section of your codebase, including the process by which AI-generated code was reviewed.
Dependency Licenses vs Generated Code
There are two distinct issues that are sometimes conflated. The first is the license on libraries your app imports: a GPL library built into a product you distribute can create an obligation, regardless of whether an AI tool suggested the import. The second is whether the generated code itself reproduces copyleft code verbatim. The dependency issue is the more immediate and well-understood risk for most founders.
AI tools suggest library imports frequently, and a utility library that looks harmless can carry copyleft terms. Checking the license of every library an AI tool recommends before adding it to your package manager is a step most founders skip. It should not be.
Protecting Your Ownership Position
If you have commissioned development work from a contractor or agency, your NDA and IP assignment agreement should explicitly address code generated with AI tools. An assignment clause that says "all work product created" may or may not cover AI-generated code under emerging case law. Being explicit about it - and ensuring the developer is following a review process - is preferable to assuming the clause covers any output regardless of how it was produced.
Protecting your app idea is one concern. Protecting your IP ownership in the code that implements it is a separate concern. Both matter. If you want to understand the broader question of how to protect your app idea as you work with developers, that article covers the structural agreements you need in place.
If you have a codebase built partly or mostly with AI tools and you want an independent technical review before a fundraise or before handing it to a new team, request a technical review. We can look at your dependency tree and flag any obvious copyleft or attribution risks that need attention.
Common questions
Does an open-source license still apply to code generated by AI?
The post says the license on the original code does not disappear because a model made the copy. If a tool reproduces copyleft code, using it commercially may create obligations you did not intend. The legal status is unsettled as of October 2026, and this is not legal advice.
Which open-source license is riskiest for a SaaS product?
AGPL v3, because its section 13 network clause requires you, if you modify the program, to offer all users interacting with it remotely a way to get its source. MIT and Apache 2.0 are permissive and do not require you to open-source your own product.
Who can check my AI-built codebase for license risks before a fundraise?
Investor due diligence typically includes an IP audit, and remediation is costly if GPL-derived code is deeply embedded. Zovintra offers a technical review that looks at your dependency tree for obvious copyleft or attribution risks. For legal questions, speak with a solicitor.
Sources
- GNU General Public License v3 - Free Software Foundation, 2007
- GNU Affero General Public License v3 - Free Software Foundation, 2007
- GNU Lesser General Public License v3 - Free Software Foundation, 2007
- Apache License 2.0 - Apache Software Foundation
- The MIT License - Open Source Initiative
- Code referencing - GitHub Docs, accessed 19 Oct 2026
- Ninth Circuit Clarifies Limits of DMCA Liability for AI-Generated Code - Gibson Dunn, 18 Sep 2026
- Sarah Andersen's copyright lawsuit gets pushed back again - ChatGPT is eating the world, 3 Feb 2026
- ScanCode Toolkit - AboutCode, accessed 19 Oct 2026
