A developer types a comment, pauses, and hits Tab. The assistant fills in a dozen lines of working code. It compiles. It passes the tests. It ships. Nobody in that loop stopped to ask where the code came from — and, increasingly, nobody could answer if they tried.
For more than two decades, enterprises have built careful governance around Free and Open-Source Software (FOSS). We invested in software composition analysis, licence reviews, Open-Source Review Boards (OSRBs) and developer education to stay on the right side of licences such as GPL, Apache, MIT and BSD. The discipline is well understood by now: know what you have borrowed, honour the terms, keep a record.
Generative AI (GenAI) is quietly pulling that settled arrangement apart.
Traditional FOSS compliance is about software you incorporate: a known component, a known licence, a known source. GenAI hands us something stranger: software that writes software. And that raises a question most legal and intellectual property (IP) teams have never had to ask.
Can the FOSS governance we spent a decade perfecting actually cope with AI-generated code?
Honestly? Increasingly, no.
The provenance problem
Here is the awkward part. A developer leaning on a coding assistant, an open-weight model, or an internally hosted large language model (LLM) can produce something that closely resembles a licensed open-source repository and never realise it. The better tools are engineered to avoid reproducing code word for word, and so far, courts of law have been unconvinced that these assistants routinely emit identical copies of protected code. But “less likely” is not “never,” and no enterprise can safely assume that every generated line is clean.This is not a hypothetical dreamed up by lawyers. In Doe v. GitHub, a group of developers alleged that AI coding tools had been trained on their open-source repositories with no regard for the licences attached. A US district court threw out most of the claims because the plaintiffs could not point to a specific work that had been specifically copied but the breach-of-licence and DMCA theories survived, and the case is now before the Ninth Circuit. However it ends, it has already done one thing that matters: it turned AI-assisted coding from an engineering question into a governance one.
New questions the old framework never asked
Classic FOSS governance runs through a familiar checklist. What licence governs this component? Do we owe attribution? Does a copyleft obligation kick in?GenAI stacks a second, less comfortable set on top:
- Which model wrote this code?
- Was it trained on data anyone was actually licensed to use?
- Is the output substantially similar to open-source code that already exists?
- Can we show, if asked, how our AI-assisted code came to be?
- And when an infringement claim lands, who is left holding the liability?
None of these sit neatly in one place. They straddle copyright law, contracts, procurement and everyday engineering practice, and no component scanner answers them on its own.
Why India makes this urgent, not academic
For Indian technology and services firms, this stopped being an imported debate a while ago. In ANI Media Pvt. Ltd. v. OpenAI, the Delhi High Court in July 2026 refused an interim injunction, on a prima facie view, holding that storing copyrighted material to train a LLM model could fall within the fair-dealing exception in Section 52(1)(a) of the Copyright Act, 1957, and that the model’s outputs had not been shown to closely reproduce the claimant’s work. It is worth being precise about what the ruling is and is not. It is interim, the suit continues, and it concerns training the model and not what an enterprise developer generates downstream. But the reasoning it rests on, including statutory fair dealing, and the all-important question of substantial similarity, is exactly the ground on which the next fight over AI-generated code will be fought here.
So, the takeaway for in-house teams is not relief. It is preparation. A reassuring interim view on model training tells you very little about your own exposure on the day you ship AI-assisted code to a client under a warranty that it infringes nobody’s rights.
From FOSS compliance to AI-aware governance
The good news is that this is an upgrade, not a teardown. If an enterprise has already built a credible FOSS programme over the past decade, it already owns most of the scaffolding.
Picture a typical delivery organisation. Its DevSecOps pipelines already scan repositories for vulnerable components and licence obligations using software composition analysis tooling. Extend those same instincts to AI-assisted development: capture prompt and tool-usage history where it makes sense, flag code that came from a model, scan generated output for licence conflicts, and keep a human in the loop before anything ships. What you are really building is a provenance record, i.e., the ability to answer, months later, “where did this line actually come from?” This matters most for services companies writing software for clients around the world. The questions in due-diligence calls have already shifted. It used to be “Which open-source components are in here?” Now it is “Did you use AI to write this, and how did you manage the IP risk?” Those are governance questions in a technical costume, and they are turning up in checklists, warranties and audit rights.
Which is the opportunity. Rather than running FOSS and GenAI as two separate workstreams that occasionally wave at each other, legal can pull them into one framework: open-source licences, AI-usage policy, supply-chain security, copyright and data-provenance risk, contractual commitments, and a clear answer to who is accountable when a developer clicks “accept”.
The next chapter of software governance
The meeting of FOSS and GenAI is more than one more compliance chore. It is the next chapter in how govern software will be governed, at all. The firms that invested in serious FOSS programs already begin with a genuine advantage, only if they stretch those programs to cover AI-generated code, model provenance and the IP risks riding along with them.
Because in the age of GenAI, knowing what software developers use is no longer enough. Knowing how that software was made has become the real question and it is coming whether we are ready for it or not.
(The author writes in a personal capacity. This article is intended as general commentary and does not constitute legal advice.)
