Open Source in Delivered Software: What Should Management Verify?
Commercial use does not mean no conditions
A contractor says open source avoids additional licence fees. Management should still ask which components are included, which licence versions apply and whether the intended use meets their terms. There is no need to reject all open source, but “free to use” should not replace verification of rights and delivery obligations.
The Open Source Initiative explains that open source permits commercial use, but this does not mean every restriction on downstream recipients is allowed. Licences differ, and some impose obligations upon distribution. This article is an information-gathering framework for responsible reviewers, not a conclusion that every product must, or need not, disclose its source.
Tie the component inventory to the delivered version
Request component names, versions, upstream sources, licence names and versions, modifications and where each component is used, including transitive packages and subcontractor contributions. A software bill of materials, or SBOM, can start the review, but its existence is not complete proof of legal compliance. Reconcile it with the actual delivery.
A project name followed by “open source” is insufficient, particularly where versions, licence options or add-ons differ from the core. Separate verified licence evidence from unresolved entries and assign follow-up owners. Do not fill gaps from familiarity or marketing material alone.
Usage and delivery change the review questions
Have the business specify internal use, customer installations, partner distribution or network access, including who modifies the code and who receives copies. Do not assume these arrangements have identical consequences, or that web delivery removes all relevant conditions. Review the actual licence alongside the architecture and delivery method.
Hypothetically, delivered software contains an MIT-licensed component but omits its copyright and licence notices. MIT requires these notices in copies or substantial portions of the software. The reviewer should request the missing delivery evidence before closing the item, not infer a duty to publish all source merely from the MIT name. Other components require their own review.
Assign responsibility for acceptance conditions and costs
Assign who prepares the inventory, reviews terms, supplies any required notices or source, and updates the evidence after version changes. If terms conflict with the business plan, options may include changing the usage model, replacing a component or considering an alternative licence actually offered by the rights holder. Assess timing, cost and maintenance consequences together.
Kerwin & Vance lists business legal advisory, IP planning and technology services. A component inventory, development contract and intended-use description enable focused advice. Before approval, show cleared and unresolved items, owners and accepted conditions. Licensing review complements security and maintenance checks; valid licensing does not establish vulnerability-free software or automatic support.
