The EU's own license. Article 5 reciprocity covers the whole derivative work, and its definition of communication may reach hosting.
On this page
What it does
The European Union Public License 1.2 is published by the European Commission in 23 official EU languages, and every version is equally authentic. It is the default license for European public sector software, so it turns up when you build on national or EU institution code. Its reciprocity lives in Article 5, meaning the license requires what you pass on to stay under the same terms. When you distribute or communicate the Work or a Derivative Work, you do so under the EUPL. The appendix route opens only for a Derivative Work based on both the Work and code under one of the listed Compatible Licences. A derivative work is the whole combined result, not the individual files you edited.
Details
Two points decide most EUPL questions. The first is scope: Article 5 attaches to the derivative work as a whole, so a summary calling this file-level weak copyleft is not defensible. The second is the definition of Distribution or Communication, which the license writes to include making the work available online. Whether pure hosting, with no copy transferred, triggers Article 5 is genuinely debated, and the answer is not settled either way. If you run a hosted product on EUPL code, that is a question for counsel, not a question for a category label.
Pros
- Clear rules for sharing improvements. Recipients of a binary can ask for the corresponding source.
- Widely understood by legal and engineering. Compatibility questions have a large public record.
Cons
- Shipping a combined binary usually means offering corresponding source under the same license.
- Mixing with Apache-2.0 or other patents-bearing licenses is a known compatibility trap on older GPL versions.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
Copyleft can reach a combined work you distribute, not only the original files. How far that reaches in your stack is a counsel question.
Network copyleft
Classic GPL has no network clause. Offering the program as a hosted service, without distributing a copy, does not by itself trigger the source offer.
Obligations
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
What EUPL-1.2 requires when you ship
When you distribute a binary that includes EUPL-1.2 code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You are meeting Article 5 when the derivative work you distribute goes out under the EUPL, or under one of the licenses named in the appendix.
You have covered the source condition when everyone who receives the work can obtain its source, and the notices and disclaimers are still attached.
You are outside Article 5 entirely when the code stays inside your organization, with nothing distributed and nothing made available to outsiders.
You have handled the hosted case honestly when someone has asked counsel whether your deployment counts as communication, and the answer is written down.
The duties named in EUPL-1.2
Notice still travels with the copy. On top of that, EUPL-1.2 names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Things to be aware of
- The EUPL is filed next to the MPL as file-level weak copyleft. Article 5 reaches the derivative work as a whole, so the two are not equivalent.
- A SaaS team reads 'no network clause' off a category label and stops there. The definition of communication is the open question, so read it yourself.
- The compatibility appendix is ignored and a workable combination is abandoned. The appendix is the EUPL's best feature; check it before you drop the dependency.
What the European Union Public License 1.2 does not do
Search results often flatten European Union Public License 1.2 into a slogan. These are the usual misreads. EUPL-1.2 is a grant with conditions, not a permission to skip the paperwork below.
- the European Union Public Licence 1.2 does not let you keep the combined program closed if you distribute it. The reciprocal duty reaches the work as a whole.
- Network use alone is not distribution for GPL-family licenses. Running a GPL program as SaaS, without AGPL, does not by itself trigger the source duty.
How EUPL-1.2 differs from nearby licenses
These licenses are often confused with EUPL-1.2, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- EUPL-1.2
- The EU's own license. Article 5 reciprocity covers the whole derivative work, and its definition of communication may reach hosting.
- AGPL-3.0-only
- AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.
- MPL-2.0
- File-scoped copyleft. The MPL files stay open when you ship a binary, modified or not. Your own separate files stay yours.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
Common questions about European Union Public License 1.2
Answers to common questions about what European Union Public License 1.2 requires, when its duties apply, and what evidence belongs with a release.
What is the European Union Public License 1.2?
The European Union Public License 1.2 is published by the European Commission in 23 official EU languages, and every version is equally authentic. It is the default license for European public sector software, so it turns up when you build on national or EU institution code. Its reciprocity lives in Article 5, meaning the license requires what you pass on to stay under the same terms. When you distribute or communicate the Work or a Derivative Work, you do so under the EUPL. The appendix route opens only for a Derivative Work based on both the Work and code under one of the listed Compatible Licences. A derivative work is the whole combined result, not the individual files you edited.
What does EUPL-1.2 require when you ship a product?
You are meeting Article 5 when the derivative work you distribute goes out under the EUPL, or under one of the licenses named in the appendix. You have covered the source condition when everyone who receives the work can obtain its source, and the notices and disclaimers are still attached. You have used the appendix well when a combination that cannot stay EUPL is relicensed to a listed license such as GPL-3.0, AGPL-3.0, MPL-2.0 or EPL-1.0. You are outside Article 5 entirely when the code stays inside your organization, with nothing distributed and nothing made available to outsiders. You have handled the hosted case honestly when someone has asked counsel whether your deployment counts as communication, and the answer is written down.
Does hosting a product that uses EUPL-1.2 trigger extra duties?
Hosting alone usually does not trigger the source duty for EUPL-1.2. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Does linking to EUPL-1.2 force me to open my application?
For strong copyleft such as EUPL-1.2, the FSF reads static and dynamic linking as one combined work when you distribute the result. Shipping a binary that includes EUPL-1.2 code is the usual trigger. Internal use with no copy leaving the company is a different situation. Read the actual text, not the family nickname.
What is corresponding source for EUPL-1.2?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is EUPL-1.2 different from GNU AGPL v3.0?
EUPL-1.2 asks this: The EU's own license. Article 5 reciprocity covers the whole derivative work, and its definition of communication may reach hosting. GNU AGPL v3.0 asks this: AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source. Open the GNU AGPL v3.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record EUPL-1.2 for a buyer?
This guide and the product's catalog do not fully agree, and you should know where. The catalog row for EUPL-1.2 is weak copyleft with hosted use cleared, so SourceTrust raises only a source offer item, and only in the Distributed binary and Mixed contexts. No network review item is raised for a SaaS project. This guide takes the wider reading of Article 5, so treat the hosted question as open and settle it with counsel rather than reading it off the checklist.
Where do I record EUPL-1.2 for a buyer?
This guide and the product's catalog do not fully agree, and you should know where. The catalog row for EUPL-1.2 is weak copyleft with hosted use cleared, so SourceTrust raises only a source offer item, and only in the Distributed binary and Mixed contexts.
No network review item is raised for a SaaS project. This guide takes the wider reading of Article 5, so treat the hosted question as open and settle it with counsel rather than reading it off the checklist.
Read /docs/reviewing-component for what the checklist does show.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.