License compliance
Understand third-party license obligations before someone asks
What accumulates in a shipped product, who owns the duty, where it shows up, and how to keep a maintained record: inventory, review, publish, then watch for drift.
Last updated: July 2, 2026
01Why it matters
Most teams pass security audits but still cannot prove third-party license obligations stay current with what they ship. The gap is not effort: It is that duties from hundreds of dependencies, fonts, and SDKs were never inventoried against what actually releases.
Open source does not mean no legal duties. Every component is a license agreement with notice, attribution, and sometimes copyleft rules that engineering changes every sprint.
Topics in this section
Focused reads on misconceptions, what accumulates, surfaces, responsibility, and business impact.
- MisconceptionsWhy open source is not permission to ship, and the assumptions teams make until procurement or legal asks.Read misconceptions
- What accumulatesHundreds of npm packages, fonts, icons, and SDKs, and the triggers that finally force teams to look.See what accumulates
- SurfacesWebsites, mobile apps, desktop installers, and embedded products: What accumulates on each surface.See surfaces
- Who is responsibleEngineering, legal, and customer-facing roles, and when license obligations apply to your organization.See who is responsible
- Business impactDeal delays, audit surprises, and false confidence: What breaks when nobody operationalizes what ships.See business impact
- Legal outcomesInjunctions, damages, forced disclosure, and deals that stall when license duties are not met.See legal outcomes
- Attribution & noticeNotice, attribution, and full license text are three different duties. What satisfies each one.Read the explainer
- Copyleft basicsGPL, LGPL, and AGPL in plain language: When each applies and what it obligates you to do.Read copyleft basics
- The compliance page, explainedWhat a buyer-facing license page must contain, and why an internal spreadsheet does not count.See what belongs on it
Common questions
Is using open source the same as being allowed to ship it?
No. Open source grants use under specific license conditions: Notice, attribution, copyleft rules, or distribution limits. Each component can differ.
Who is responsible for license compliance?
The organization that distributes the software, not an individual developer. Engineering builds the record; legal or compliance often reviews; procurement shares it externally.
Does a security audit replace a license compliance page?
No. SOC 2, penetration tests, and SBOM programs answer different questions. Buyers still ask for reviewed third-party license disclosure.
Is this legal advice?
No. These pages explain operational duties and common patterns. Legal interpretation stays with your counsel.
Continue reading
Related topics
One idea per page: Follow the path that matches your next question.