Open source compliance in a deliverable: stages and deadlines
An open source compliance review inside a deliverable moves through four stages: inventory, licence classification, remediation, and sign-off. Each stage has its own owner and its own deadline inside the wider delivery schedule. The review closes only when every third-party component carries a matched licence file and a recorded compliance decision.
What the review changes in your delivery timeline
A deliverable cannot pass acceptance testing while a licence conflict stays open. Every unresolved component pushes the acceptance date and holds up the final delivery milestone. Once the inventory is signed off, the schedule for the remaining stages runs from that date, not from the original contract date.
| Stage | Owner | Typical duration |
|---|---|---|
| Inventory | Engineering lead | 1–2 working days |
| Licence classification | Compliance officer | 1–2 working days |
| Remediation | Legal reviewer and engineering lead | 3–10 working days, depending on the number of flagged components |
| Sign-off | Project manager | same working day as remediation closes |
Steps to run the review
- The engineering lead pulls a full dependency tree from the build system, including transitive packages.
- The compliance officer classifies each licence: permissive, weak copyleft, strong copyleft, or unclear.
- The compliance officer flags any component with a strong copyleft or unclear licence for legal review.
- The legal reviewer decides whether the flagged component stays, is replaced, or needs a separate licence.
- The engineering lead applies the decision and updates the software bill of materials.
- The project manager records sign-off and attaches the final bill of materials to the delivery file.
If the contract also requires a code deposit, the licence review and the deposit run on separate schedules; read Source code escrow is demanded technology contract the deadline for how the two interact.
Who decides and how long it takes
The client's compliance officer, or a delegated legal reviewer, decides whether a flagged licence is acceptable for the delivery. Internal escalation, when needed, goes to the contracting partner, not to an external body. A straightforward review, with no contested licence, closes in three to five working days. A review with one contested licence typically adds one to two working weeks, depending on how quickly the counterparty answers.
Common scenarios
If the deliverable contains only permissive licences, sign-off follows the inventory stage directly, without a legal escalation step.
If one component carries a copyleft licence that conflicts with the client's distribution model, the legal reviewer proposes a replacement component or a separate licence, and the deadline moves by the time needed to test the replacement.
If the supplier disputes the classification, the review pauses until both sides agree on the licence text that applies; The deadline that matters in this situation sets out how a stalled response is normally handled.
What this page does not cover
This page does not resolve a dispute over who owns the underlying code — that question belongs to a separate stage of the ownership file. It does not cover a compliance regime for a jurisdiction outside the one named in the client's contract. It also does not set out costs; costs depend on the number of flagged components and are confirmed separately once the inventory stage closes.
Sources and limits
This procedure page describes the stages and deadlines routinely followed in an ownership-of-results file. It draws no distinction between a licence settled by statute and one settled purely by contract term, because the mechanics of the review are the same either way.
Where a deliverable also produces a data asset that a client later reports on for its own records, the connected file is described in Asset report when maintenance is in doubt and its.
Where the client is based in Estonia and the review needs to reach a local counterparty who has stopped responding, the relevant intake is described in Debtor in Estonia in detail.
Reviewed on 5 November 2025. No statute, regulation or court decision is cited on this page; the review described here rests on licence texts and internal file records, not on a public register.
Related reading
For a deliverable that also carries an escrow clause on the underlying code, the adjacent stages are set out in Escrow of development artefacts ownership of results.
Get a compliance review started
Send the delivery file and the current dependency list. A partner responds within minutes during business hours; a quote and a fixed deadline follow within one working day.
Frequently asked questions
How long does open source compliance in a deliverable take in practice?
A straightforward review with only permissive licences closes in three to five working days. A review with one contested licence usually adds one to two working weeks.
Which documents are needed to start?
The current dependency tree, the licence file for each third-party component, and the delivery contract's ownership clause. Without these three documents, the review cannot start.
What happens if the other side does not respond?
If the counterparty holding the disputed licence stops responding, the review proceeds on the licence text already in hand. The file records that a response was requested and not given. The deadline is not extended indefinitely for a silence.