When open source is found in the delivery: what it costs to be wrong
Finding open-source code inside a delivery is not, by itself, a breach. The cost appears once you check what the licence actually requires — attribution, source disclosure, or a restriction that your own contract does not permit you to pass on. What you owe depends on the licence terms, not on how the code arrived in the build.
The legal basis
The legal protection of computer programs in the EU rests on Directive 2009/24/EC. It sets out how software is protected by copyright and what use requires the rights holder's authorisation. An open-source licence does not remove that protection. It grants permission under stated conditions, and those conditions survive resale, integration, and further development of the code.
This is why a delivery contract cannot simply declare open-source components "cleared". The clearance depends on which licence applies to which file, and on what your own product does with that file afterwards.
What changes in practice
A breach usually sits at one of three points: a missing attribution notice, an incompatible licence mixed into proprietary code, or a copyleft term triggered by distribution. Each point carries a different remedy and a different clock.
| Licence family | What triggers exposure | What is exposed |
|---|---|---|
| Permissive (MIT, BSD, Apache) | Missing attribution or notice file | The notice itself, low cost to cure |
| Weak copyleft (LGPL, MPL) | Modifying and distributing the covered files | Source of those specific files |
| Strong copyleft (GPL, AGPL) | Distribution, or network use for AGPL | Source of the combined work |
The clock does not wait for a full audit. It starts once the licence condition is triggered — usually the moment the software is delivered, deployed, or distributed to a third party, whichever the licence names.
What to do now
- Engineering lead: freeze distribution of the affected build until the component and its licence are identified.
- Delivery team: pull the exact package name, version, and the licence file that ships with it.
- Contract owner: check the delivery contract for a warranty or indemnity covering third-party code.
- Counsel: classify the licence into permissive, weak copyleft, or strong copyleft before any further release.
- Delivery team: fix attribution or notice gaps immediately; hold on any copyleft-triggered release until advised.
Who decides, and on what evidence
Absent a separate agreement, the question is decided under the dispute-resolution clause of the delivery contract — by the forum and the law that clause names. The evidence that matters is the package manifest, the licence file as shipped, and the build log showing when distribution occurred.
If enforcement is later sought against the holder of rights in the open-source component itself, the sequence differs from a contractual claim between customer and supplier: When enforcement is sought against a holder step by sets out that separate path.
If you want a read on your specific delivery before deciding the next step, Put the question to a partner.
If your situation is different
If the component is permissive-licensed only, the fix is usually a notice correction and nothing more escalates.
If the component is copyleft but merely linked, not modified, check whether the licence's linking exception applies before treating it as a disclosure trigger.
If the component is copyleft, modified, and already distributed, stop further copies and escalate to counsel before shipping anything else built on that code.
What this page does not cover
This page does not identify which licence applies to your specific code, does not set a jurisdiction-specific deadline, and does not replace a code-level audit. It states the order of decisions, not the outcome of any one of them.
Where the open-source component or the counterparty on the other side of the delivery sits in the United States, the underlying facts can be established as a separate, documented file rather than assumed: Counterparty in United States and its limits in detail, and, for the artefact itself, Document in United States step by step.
Verified
Checked against Directive 2009/24/EC. State on date: this page was last checked on 2025-05-01. No court record is cited, since none carries a confirmed status for this situation in the registry.
Related situations
Ownership of open-source-adjacent improvements raises a related but separate question: When a customer wants ownership of improvements and its walks through that fork on its own terms.
FAQ
What is the first step when open source is found in the delivery?
Freeze further distribution of the affected build and identify the exact package and licence file before deciding anything else.
Which deadline is already running?
The licence's own compliance window, where the licence states one, starts at the moment of delivery or distribution — not when the audit finishes.
Who decides, and on what evidence?
The forum named in the delivery contract's dispute clause decides, on the manifest, the licence file as shipped, and the build log.