Attribution and notice
Procurement reviewers and counsel look for different things. Confusing them is one of the most common gaps on compliance pages.
Last updated: July 2, 2026
Notice tells recipients that third-party software is included. It is often a copyright line or short statement in documentation, about screens, or a dedicated page header.
Notice alone does not satisfy licenses that require full license text or specific attribution wording. The Apache License 2.0, for example, requires retaining notices and any NOTICE file contents, distinct from a one-line credit.
Attribution names the project, authors, or copyright holders as the license requires. Some licenses specify exact wording; others accept a standard credit block.
Attribution files are often bundled in installers or shipped alongside binaries, separate from a public compliance URL.
Because most enterprise reviewers need the complete license for each component, not a summary, so they can confirm the exact obligations attached to what you ship. MIT and Apache are short; GPL and custom licenses are not.
A compliance page should link or embed full text for reviewed components, after someone has confirmed the match to what ships.
Notice, attribution, and full license text are separate obligations. A page that satisfies one can still fail the other two.
| Duty | What it is | What satisfies it |
|---|---|---|
| Notice | Telling recipients that third-party software is included | A copyright line or statement in docs, about screens, or the page header |
| Attribution | Naming the project, authors, or copyright holders as required | A credit block with the wording the license specifies |
| Full license text | The complete license for each in-scope component | Embedded or reliably linked text, confirmed against what ships |
Continue reading
One idea per page: Follow the path that matches your next question.
Cookies on sourcetrust.dev
We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.