Although there’s no definitive case employing a few simple precautions: law in the UK on copy left infection, Implement an acceptable use questions of code ownership can policy that explains how and raise a red flag for potential investors when OSS can be used. and buyers down the line, who may require a set of indemnities and Educate internal stakeholders warranties in relation to any OSS on the risks of using OSS and AI- contained in what they’re buying or generated OSS. investing in. We’ve also seen buyers Appoint a dedicated person/team use fears of infection (whether real or responsible for specific aspects opportunistic) to lower valuations. of OSS use. A further level of complexity is added Consider limiting the use of AI by the use of open source generative code assistants to those that AI tools like Unity Machine Learning have been trained on internal (or Agents Toolkit and AI code assistants otherwise vetted) source code. such as Github Copilot, where it can be challenging to understand the Track the use of OSS using an OSS degree to which OSS is incorporated management programme like in the output and the licence terms Black Duck Protex. that apply. Implement periodic audits to With that said, OSS and AI code assess the effectiveness of assistants are becoming a standard your AUP and tracking. part of the developer’s toolkit, and much of the risk can be mitigated by 50