The licence problem in procurement

Why does procurement ask about licences at all?

Because a licence is a condition on use, and some conditions travel. Permissive licences ask for attribution. Copyleft licences ask for more: where covered code is combined with other code and distributed, the obligation can extend to that other code, including an obligation to make source available.

For a company whose value is its proprietary codebase, that is a commercial question rather than a compliance formality. It is why the representation appears in acquisition agreements — that no copyleft-licensed code has been incorporated in a way that requires disclosure — and why buyers ask for the list before they ask for anything else.

Published diligence practice reports licence conflicts in a substantial share of audited commercial codebases. The number varies by who is counting; the direction does not.

How it gets there

Nobody decides to introduce it. A developer needs a library, finds one that works, and installs it. The licence is in a file nobody opened. Three years later it is a transitive dependency of something else and appears in no list anyone has read.

Two other routes matter. Vendored code copied into the tree with its licence header removed, which is invisible to a dependency scanner because it is not a dependency. And pasted code of unknown origin, which has become more common as generated snippets arrive without provenance.

What does answering it require?

Less than most teams expect, if the bill of materials already exists.

An SBOM generated from the built artefact lists components and their licences. Reading it for copyleft in a distributed proprietary product is half a day of work, and the output is a short list: what is there, where it sits, whether the product is actually distributed in a way that triggers the obligation, and what the options are.

An analysed SBOM, produced by inspecting a container image or binary rather than the build, is the route for systems whose build environment no longer exists — which is a common condition in exactly the codebases where nobody has checked.

Where it hides	Found by	Cost to fix, if found early
Direct dependency	Dependency scan and SBOM	Low — replace or isolate
Transitive dependency	SBOM, read to full depth	Low to moderate
Vendored source in the tree	Manual review; scanners miss it	Moderate
Pasted code of unknown origin	Code search and provenance review	Moderate to high
Found by an acquirer instead	Their diligence, mid-deal	Highest — and on their timetable

What this is not

It is not an argument against open source, which every commercial codebase depends on. It is not legal advice, and the question of whether a specific combination triggers a specific obligation belongs with counsel.

What an engineering assessment provides is the factual base that advice needs: the components, their licences, how they are combined, and whether the product is distributed in a way that matters. Without that, the legal question cannot be asked properly.

Where it sits in an assessment

The licence audit is half a day inside our Enterprise Readiness Assessment, and it uses the bill of materials the automated sweep has already produced. It is one of the cheapest steps and one of the two or three most likely to change what a buyer does next.