Copilot does not inherit the license. Your repo does.
Antonio Chagoury, Founder & CEOSeptember 21, 2026
The diligence room has a folder labeled “open source.” Counsel wants a Software Bill of Materials. Someone exported the lockfile. Someone else ran a license scanner. The report is 40 pages of MIT and Apache. Buried on page 19 is a GPL-2.0 hit in a payments helper nobody remembers writing. Git blame points at a staff engineer. The staff engineer points at Copilot. Copilot does not leave a flag. It leaves a file.
I am not writing another explainer of what an AI code audit covers, or how to choose among an audit, monthly oversight, and governed MCP. Those are already up. This is the licensing half of that conversation: what assistants actually paste, why a scanner is not a license review, and why a buyer who has been through a real diligence will not accept “we use Copilot, but we review everything.” If the questionnaire is SOC 2 rather than copyleft, start with the SOC 2 AI code audit. If you need a licensing review on AI-generated code, start with AI-generated code licensing review.
The license did not travel with the snippet
Copilot, Cursor, and Claude Code complete from patterns they have seen. Some of those patterns were published under licenses your product cannot ship. The model does not attach the license. It does not warn you that the 18 lines it just dropped into BillingService look like a copyleft utility from a repo your counsel would never have approved. It looks like your code. It compiles. CI is green. The pull request has two approvals from people who also use the same tools.
That is not a theoretical risk, and it is not a reason to ban the tools. We have been shipping software since 2002. Assistants are now part of how software gets written. The failure is treating a lockfile scan as lineage, and treating lineage as a sentence you cannot attach to an email. Scanners read declared licenses on packages you installed. They do not read whether a generated function is a close copy of GPL code that never became a dependency. Those are different jobs.
The residue post already named this in passing: snippets that carry a license the prompt did not mention. That sentence is not a review. If you need the rest of what assistants leave (authz, tenancy, hallucinated packages, tests that prove themselves) start with what Copilot and Cursor leave in a production repo. This page is only the license line.
What AI-generated code licensing actually is
An AI-generated code licensing review is a point-in-time senior inspection of whether Copilot, Cursor, Claude Code, or similar assistants introduced copyleft, proprietary, or otherwise incompatible licensed material into a defined repository scope, including generated snippets that never appeared as a named package. It is written findings a counsel or buyer can attach. It is not an SBOM export. It is not a scanner PDF. It is not legal advice, and it is not a license opinion letter. Counsel still owns the determination. Engineering still has to stop pretending the lockfile is the whole story.
It is also not a substitute for a full AI code audit. An audit will look at licensing among other pillars. A licensing-led engagement is for the week the diligence folder is already open, or the week a GPL hit appeared and nobody can explain the file. Mixing “what merged,” “which packages we declared,” and “what the questionnaire should say about Copilot” in one Slack thread is how all three get skipped.
Three failure modes that survive a green scan
Most teams who tell me they “already ran FOSSA” or “already ran Black Duck” are describing hygiene. Useful. Incomplete. These are the three patterns that still show up after the green badge.
- Snippet copyleft with no package. The helper was never added to
package.jsonor a.csproj. There is nothing for the scanner to attribute. The risk lives in the function body. A senior reader who has seen GPL-family utilities will sometimes recognize the shape. A license database will not, because there is no package name to look up. - Hallucinated packages that resolve to something else. The assistant invents a helpful import. The name is close to a real library, or it is a name that later appears on a public registry under a different author. Supply-chain and license questions arrive together. The lockfile is now evidence of a decision nobody made.
- Declared MIT on a tree that is not MIT. A generated README, a copied header, or a vendored file that still says GPL while the rest of the service claims Apache-2.0. Docs survive because they sound finished. A buyer will ask for the file, the header, and the product license. If those three disagree, the document is the liability.
None of this requires a fake war story. The patterns are public and boring, which is why they survive review. I will not invent a client quote, and I will not attribute a license incident to FiscalNote, CareMetx, or anyone else in our case studies. Named product work in this company is delivery history. It is not a license trophy case.
What a review you can show counsel actually looks like
If the artifact cannot survive a counsel call, it is not a review. This is the bar.
| What you have | What it proves | What it does not prove |
|---|---|---|
| Lockfile plus a license scanner | Declared packages and the licenses those packages claim | Whether generated snippets copied copyleft code that was never a dependency |
| “We review every PR” | A process exists | That a senior reader looked at lineage, or wrote anything down |
| A policy that bans GPL | Intent | Whether Copilot already pasted GPL into main |
| Named-engineer findings, severity-ranked, dated | What was inspected, what was found, what to fix first | A legal opinion. Counsel still has to decide |
The last row is the product. Read-only access. Agreed scope. Client code stays in your environment. No third-party model on your source. Written findings in days, not a quarter. That is the same access model as the AI code audit. The difference is the question the report is built to answer. If the next email is still “human in the loop,” that sentence is the process claim: it is not the evidence.
A one-page AI coding policy engineers will follow can ban pasting licensed code you do not have rights to, and it can ban consumer chatbots on company source. It cannot inspect the tree. Do not wait on a handbook chapter to open the payments helper.
Hire vs DIY
Run the scanner internally this week when you already know which repos matter, a staff engineer can name the vendored paths, and nobody is asking you to prove lineage on generated snippets. Keep the scanner in CI. Date the export. Send it to counsel. That is hygiene, and it is still the right first hour.
Buy a licensing-led review when a date is on the calendar (diligence, an enterprise exhibit, a GPL hit you cannot explain) and the scanner cannot tell you whether the function body is the problem. That is AI-generated code licensing review. Same senior inspection model as the audit. Narrower question. Not a license opinion letter.
Buy the full snapshot when licensing is one row in a longer questionnaire: security, architecture, SOC 2 change management, PHI. Start with the AI code audit, or the SOC 2-framed audit if the buyer language is Type II evidence rather than copyleft. If the work is specifically Copilot or Cursor, start with Copilot & Cursor code audit. If you will keep merging assistant output after the date, the snapshot goes stale. That is AI code oversight, not a reason to skip the snapshot.
Healthcare and PHI do not change the license question. They change the access model. Clinical product and BAA-capable architecture live at Maxiom Labs. Say PHI on the scoping call so nobody pastes a generic SaaS review over a covered entity. App product work that is not a license review still belongs on Maxiom Apps when the buy is a build, not a findings trail.
We have shipped software since 2002, with more than $100 million in contract value and 221-plus clients. Clutch-reviewed. That is delivery history. It is not a claim that we audited your SPDX file. The work is still a named engineer, a bounded repo, and a report counsel can actually use.
FAQ: AI-generated code licensing
Does Copilot or Cursor check the license of what it suggests?
No. The tools complete from patterns. They do not attach a license to a snippet, and they do not refuse copyleft because your product is proprietary. Your repo inherits whatever landed in main. The model does not.
Is a software composition analysis scan enough?
It is enough for declared packages. It is not enough for generated functions that never became a dependency, and it is not enough when a hallucinated import later resolves to a package you did not intend to take. Run the scan. Do not hand it to a buyer as the license program.
Is this legal advice or a license opinion?
No. Engineering findings. Counsel decides compatibility, notices, and whether you can ship. If your lawyer needs an opinion letter, that is a law firm. We write what is in the tree.
Do we have to ban Copilot to stay clean on licenses?
No. You have to stop pretending last year’s “we do not use GPL” paragraph describes a year of unreviewed assistant output. Ban the tools if you want. Inspect the tree either way.
How is this different from an AI code audit?
An audit covers security, architecture, compliance, tests, and licensing. A licensing review is the same inspection model aimed at copyleft, headers, vendored files, and hallucinated packages. Buy the audit when the questionnaire is broader. Buy the licensing page when the folder on the table is already labeled open source.
Will you run our source through a third-party license AI?
No. Client code stays in client environments. Inspection is a named senior engineer. Scanners you already run can stay in CI. We do not upload the tree to a model to “detect licenses.”
What about MIT, Apache, BSD? Those are fine, right?
Permissive licenses are often fine, and still need notices. Copyleft and proprietary are the diligence magnets. The failure is not “MIT is dangerous.” The failure is not knowing which of those you actually shipped.
We handle PHI. Does licensing change?
The copyleft question stays. The access model gets stricter. Do not paste production PHI into a consumer chatbot to “ask whether this snippet is GPL.” Healthcare product work goes through Maxiom Labs.
Where does this show up on a SOC 2 questionnaire?
Change management and vendor / OSS questions. “How do you know AI-assisted code did not introduce licenses you cannot ship?” is a findings question, not a policy paragraph. If that is the whole packet, use the SOC 2 AI code audit.
If you want the lineage written as an engineering artifact (not a slide) start with AI-generated code licensing review, or request a scoping call. Thirty minutes is enough to pick a scope, or to hear that we are not the fit.
I write from the seat of a working engineering company, not a tool vendor. More at antoniochagoury.com.
