When open source is found inside a deliverable: what to do first
Finding open source inside a deliverable does not by itself change who owns the work. The first task is practical, not legal: freeze distribution of the affected build, list every open-source component with its licence, and check whether that licence is permissive or copyleft. Only after that inventory does the ownership question become answerable.
The legal basis
Copyright protection of software is harmonised across the EU by Directive 2009/24/EC. It treats a computer program as a literary work and gives the rightholder control over reproduction and adaptation, including adaptation by combination with other code. If the deliverable also carries a structured dataset rather than only code, a separate layer of protection can apply: Directive 96/9/EC sets out the sui generis right in databases, which sits independently of the copyright in the surrounding code.
Neither directive tells you, on its own, what a particular open-source licence requires. That answer sits in the licence text itself, which is a contract, not a statute. The directives explain why the underlying code is protected at all, which is the question that makes a licence breach meaningful in the first place.
What changes in practice
Once open source is confirmed inside a deliverable, three things can happen at once. The client's use of the deliverable may already be a breach of the open-source licence. The developer's own claim to full ownership of the deliverable weakens, because part of it was never original. Warranties given to the client about clean, exclusively-owned code become inaccurate for as long as the finding stands unresolved.
Deployment location matters here too. A deliverable copied onto infrastructure in a different region does not reset any licence clock; it only adds a jurisdiction to track. Questions of that kind are close to what arises when a hosting provider changes region technology contract forces a review of where a system actually runs.
What to do first
- Freeze. The engineering lead halts any further distribution or public deployment of the affected build the same day the component is found.
- Inventory. The engineering team lists every open-source component inside the deliverable, its version, and the exact licence text attached to it.
- Classify. IP counsel sorts each licence into permissive, weak copyleft, or strong copyleft, since the obligations differ sharply between the three.
- Check the trigger. Counsel confirms whether distribution, modification, or network deployment has already occurred, because most copyleft obligations activate at that moment, not at the moment of discovery.
- Decide the remedy. The product owner and counsel jointly choose between removal, replacement, or compliance with the licence's own disclosure terms.
- Record it. The project manager logs the finding, the classification, and the decision in the delivery file, with the date attached.
Who decides
| Question | Who decides | On what basis |
|---|---|---|
| Whether a licence obligation has been triggered | IP counsel | Licence text and the distribution or deployment log |
| Whether the component is removed or the disclosure obligation is met instead | Product owner and counsel, jointly | Commercial risk against the cost of rewriting |
| Whether the client is notified before the next delivery milestone | Engagement partner | The delivery contract and the materiality of the finding |
Two scenarios
If the component carries a permissive licence such as MIT or Apache, the usual outcome is an attribution notice added to the deliverable, and the freeze can be lifted quickly.
If a strong copyleft licence applies and the code has already been distributed or run as a network service, a disclosure obligation may already be running against the deliverable, independent of anything the client contract says.
If the deliverable also includes a tokenised component, ownership can extend past copyright into a separate set of questions, of the kind that arise when a token gives voting rights in detail is being assessed on its own terms.
Factors that decide the cost
The cost of resolving an open-source finding depends on a small number of factors, not on the deliverable's price. It depends on how many components are found, how many licences among them are copyleft rather than permissive, whether the deliverable has already shipped to more than one jurisdiction, and whether the client is already relying on the affected build in production.
A first response from a partner arrives within minutes during business hours. A price for the licence audit itself is set within one working day, once the scope of components to be checked is confirmed.
How the file is structured
The working file for this situation is built around three records: the component inventory with licence texts attached, the distribution or deployment log showing when the trigger occurred, and the decision memo recording who chose the remedy and on what date. Nothing in the file is a narrative account of a past client; it is a template for how this specific finding gets tracked from discovery to resolution.
Sources and limits
This page does not resolve whether two specific licences are compatible with each other inside the same deliverable; that comparison depends on the exact licence texts, not on general principle. It does not cover litigation strategy once a rightholder has already issued a claim, and it does not cover criminal provisions in any single national law.
Where the ownership question already needs to be traced against a counterparty's assets, a due-diligence report such as Asset in United Kingdom in practice narrows the question to what a public register search can actually support.
Where a counterparty's solvency is the concern rather than ownership itself, Debtor in United Kingdom and the evidence works from the same class of registers.
Reviewed 2025 against the sources named above: Directive 2009/24/EC and Directive 96/9/EC, both as published on EUR-Lex.
Related situations
A related ownership question, closer to who may lawfully use finished work rather than what it contains, is set out in What to do first in this situation explained.
FAQ
What is the first step when open source is found inside a deliverable?
Freeze further distribution the same day, and build a full inventory of every component and licence found inside the build.
Which deadline is already running?
The licence's own trigger clock. It usually starts at the moment of distribution or network deployment, not at the moment the component is discovered.
Who decides, and on what evidence?
IP counsel decides whether a licence obligation is triggered, based on the licence text and the distribution log. The engagement partner decides whether the client is notified before the next milestone.