What Should Corporations Evaluate in an Open Source License Agreement?

Permissive licenses grant broad rights with minimal conditions: the corporation may use, modify, and distribute the software, provided it includes a copy of the license and disclaims warranties. Copyleft licenses impose a reciprocal obligation: if a corporation modifies the code or incorporates it into a larger work that is distributed, the corporation must release its modifications or the entire product under the same open source license.

Courts have consistently upheld copyleft obligations as enforceable contract terms. A corporation that fails to comply with a copyleft license's redistribution requirement may face copyright infringement claims from the original author or license holder. The remedy can include injunctive relief and monetary damages based on unauthorized use of the copyrighted work.

Many software products incorporate multiple open source libraries, each governed by a different license. A corporation must verify that these licenses are compatible, meaning the corporation can comply with all of them simultaneously without creating a legal conflict. Combining GPL with Apache 2.0 may be permissible, but combining GPL with a proprietary closed-source license generally is not.

A systematic approach involves creating a software bill of materials (SBOM) that lists every open source component, its license, and any known conflicts. A corporation should also conduct a dependency audit to identify transitive dependencies and verify their licenses. This documentation becomes critical if the corporation faces a license compliance challenge, as it demonstrates due diligence in selecting and combining components.

Before integrating open source code, a corporation should obtain legal review of the license terms and confirm that the license permits the corporation's intended use. This review must address: (1) whether the license grants the rights needed (use, modification, distribution); (2) whether the license imposes obligations (attribution, source code disclosure, copyleft reciprocity); (3) whether the license conflicts with other open source licenses in the product; and (4) whether the license is compatible with the corporation's product distribution model.

Once the review is complete, the corporation should maintain a record of the decision and approval date. This record demonstrates that the corporation exercised reasonable care in selecting the component and can support a defense against willful infringement claims, which can lead to treble damages. The corporation should also ensure that the license text is included in the product's distribution package and that the source code repository includes a reference to the license and required attribution.

Most open source licenses require that the original license text and copyright notice be included in any distribution of the software or derivative work. MIT, Apache 2.0, and BSD licenses typically require that the licensor's copyright notice and license text appear in the source code and in any binary distribution. GPL licenses impose stricter requirements: if a corporation distributes GPL-licensed software or a product incorporating GPL code, the corporation must provide source code to recipients or offer to provide it upon request, and must include the GPL license text and copyright notices.

A corporation should establish a process to verify that these notices are present in every release. A failure to include required notices can be treated as a material breach of the license, even if the corporation otherwise complied with substantive terms. Courts have recognized that copyright notice requirements are enforceable contractual conditions, and failure to include notices can result in loss of the license grant and copyright infringement liability.

When a corporation incorporates GPL-licensed software into a product, the corporation must determine whether the GPL's copyleft obligation applies to the entire product or only to the GPL-licensed portions. This determination hinges on whether the proprietary code and GPL code form a derivative work or combined work under copyright law. If they are integrated into a single executable, courts generally treat them as a combined work subject to GPL, meaning the corporation must release the entire product under GPL.

To avoid this outcome, a corporation can separate the GPL-licensed component from proprietary code using architectural boundaries, such as separate processes or network communication. If the GPL component runs as a separate service and communicates with proprietary code only through a defined interface, courts may treat them as separate works not subject to copyleft. However, this distinction is fact-specific and not guaranteed; a corporation should seek legal counsel before relying on this separation strategy.

If a corporation discovers that it has distributed a product in violation of a copyleft license, the corporation faces potential copyright infringement claims. The original licensor or copyright holder can demand that the corporation cease distribution, recall the product, and in some cases pay damages for unauthorized use.

The corporation's remedial options depend on the severity of the violation and the copyright holder's willingness to negotiate. In many cases, the copyright holder may accept a retroactive compliance offer: the corporation agrees to release source code, provide proper attribution, and comply with the license going forward. A corporation should document its discovery of the violation, cease distribution immediately, and consult with counsel regarding remediation and negotiation strategy.