Open source compliance review: stages and deadlines
An open source compliance review in a technology contract moves through five stages: intake, licence identification, obligation mapping, remediation, and sign-off. A single-repository review with clean licence records typically closes within two working weeks. Mixed licence stacks, undocumented dependencies, or a supplier who does not respond extend the process and push the point of no return further into the contract.
Why the review exists
A technology contract that absorbs open source code inherits the licence terms attached to every component it uses. Once the code ships to a customer or moves into production, replacing a non-compliant component becomes expensive and sometimes contractually impossible. The review exists to catch obligations before that point, while a licence swap or a renegotiated supply term still costs a few engineering days rather than a product recall.
Stages and who owns them
Each stage has a named owner and a working-day estimate that assumes one codebase and a cooperative supplier.
| Stage | Who is responsible | Typical duration |
|---|---|---|
| Intake and dependency mapping | Engineering lead | 2–3 business days |
| Licence identification | Engineering and counsel | 3–5 business days |
| Obligation mapping | Counsel | 2–4 business days |
| Remediation | Engineering, with counsel sign-off | 5–15 business days |
| Final sign-off | Compliance officer or board | 1–2 business days |
Mixed licence stacks, more than one supplier, or a counterparty who does not answer the first request usually add one to three weeks to that total.
What to do first
The steps below assume a technology contract already in negotiation or already signed with an open source dependency flagged.
- Engineering compiles a full dependency manifest, including transitive dependencies, before counsel starts work.
- Counsel classifies every licence as permissive, weak copyleft, or strong copyleft, and flags anything unclear.
- Counsel maps each licence's obligations against the contract's distribution model: internal use, SaaS delivery, or a shipped binary.
- Engineering and counsel agree a remediation list: replace the component, isolate it, or accept it with disclosure.
- A compliance officer or the board signs off once every remediation item closes.
If the contract also assigns custody over tokenised rights or on-chain assets, that due diligence runs on a separate track and does not merge with this review (see Custody tokenised rights explained step by step).
Who decides and when the clock stops
The compliance officer, or the person named in the contract as technical lead in smaller teams, makes the final call on acceptable risk. Sign-off closes the review. After that point, a newly discovered licence conflict becomes a contract issue rather than an engineering fix. Most reviews reach sign-off within ten to twenty working days from intake, depending on the number of repositories and suppliers involved.
Common scenarios
If the codebase already carries a signed licence audit from an earlier transaction, the review starts at obligation mapping and skips intake, cutting the timeline by roughly a third.
If a supplier does not respond within the agreed window, counsel logs the missing confirmation as an open risk and escalates it in the remediation list rather than waiting indefinitely.
If the review surfaces a strong copyleft licence attached to a component slated for distribution, remediation usually means replacing the component rather than negotiating around the licence terms.
What this review does not cover
This review does not price the work, and it does not resolve a dispute that has already started between the parties. If a counterparty involved in the contract changes name mid-review, the compliance timeline does not reset, but supplier records need updating separately (see Counterparty report when the counterparty changes name: what to).
The review also does not address a code assignment that was never signed. A licence conflict and an unsigned assignment carry different costs and different fixes (see Document report when an assignment is unsigned explained).
Verified
This overview reflects current market practice on licence review timing as of 1 October 2025, drawn from supplier documentation, published licence texts, and escalation logs from completed reviews. It does not cite specific statutory provisions, because open source compliance in a technology contract sits primarily in the licence terms and the contract itself, not in a single national rule.
Data handling described on this page follows our published policy (see Cookies and what is switched off by default and).
Related publications
For the stage that follows a compliance review once a contract ends, see Exit and transition planning technology contract.
Next step
If a counterparty has already demanded source code escrow before the compliance review closes, the deadline changes (see When source code escrow is demanded and the deadline).
FAQ
How long does open source compliance review take in practice?
A single-repository review with clean licence records closes in ten to fourteen business days. Several repositories, multiple suppliers, or an unresponsive counterparty extend that to three to five weeks.
Which documents are needed to start?
Counsel needs the dependency manifest, the licence texts for each component, the contract's distribution model, and any prior licence audit. Missing documents delay intake, not the later stages.
What happens if the other side does not respond?
Counsel logs the missing confirmation as an open risk in the remediation list and sets a deadline for escalation rather than pausing the review. The contract's notice provisions govern how long that wait can last.