A SaaS company entered acquisition talks valued at $50 million.
Their development team had been using GitHub Copilot, ChatGPT, and other AI tools for six months. Shipping velocity doubled. The product roadmap accelerated.
During technical due diligence, the buyer scanned the codebase for open source license compliance. They found thousands of lines matching GPL-licensed projects.
The AI had generated code based on open source software with copyleft licenses. Under the GPL terms, the company must either open source its entire product or remove all the violating code. The acquisition value dropped to $20 million. Closing is delayed six months for remediation.
Nobody on the development team knew AI-generated code could create license violations.
How AI Creates License Problems
AI coding tools are trained on billions of lines of open source code. That training data includes code under GPL, AGPL, and other copyleft licenses that require derivative works to be open-sourced.
When developers ask AI to generate code, it produces output based on patterns from training data. Sometimes that output closely resembles GPL-licensed projects. The developer uses the code, commits it to the repository, and ships it in the product. The company just violated the GPL license terms without anyone noticing.
GPL (GNU General Public License) is a copyleft license with strict terms. If you incorporate GPL code into your product, you must license your entire product under GPL and make all source code publicly available. There are no exceptions for commercial software. Using GPL code without compliance is copyright infringement, and the original authors can sue.
Once GPL code is integrated throughout a product, there’s no easy fix. You either comply with the GPL by open-sourcing everything (destroying commercial value) or rewrite all the violating code (expensive and time-consuming). When AI generates GPL-based code, it creates this problem automatically.
When Companies Discover The Problem
Most companies have no process for checking AI-generated code licenses. Developers use AI tools to work faster and paste generated code directly into projects. Nobody asks what the code is based on or what licenses might apply. Code review focuses on functionality and bugs, not license compliance.
The violations accumulate for months before discovery, which typically happens during high-stakes moments. M&A due diligence is the most common trigger – buyers run automated scans that detect open source code matches and find GPL violations throughout the codebase. Deal values drop or deals die entirely.
Enterprise sales also surface these issues when large customers require software license compliance certification. Vendors can’t certify because of GPL violations, and deals get blocked. Sometimes competitors examine products, find GPL violations, and threaten enforcement or use it as competitive leverage.
By the time violations are discovered, fixing them is extremely expensive or impossible.
Real Impact on Deal Value
A company valued at $50 million enters acquisition talks. Due diligence finds that 30% of the codebase has GPL violations. Remediation is estimated at six months and $2 million in development costs. The valuation drops to $20 million to account for the risk and delay.
Another startup in acquisition talks has its buyer discover that core features were built with GPL-violating AI code. Removing the code would break the product. The buyer walks away entirely.
In a third case, a company sells for $30 million. Post-closing audits find GPL violations the seller didn’t disclose. The buyer claims $10 million from escrow for remediation costs and breach of representations and warranties.
Why “The AI Did It” Doesn’t Work
Companies try arguing they didn’t write the infringing code – the AI generated it. This defense fails completely.
The company shipping the code is liable for license compliance regardless of how the code was created. It doesn’t matter whether a human developer wrote it or an AI tool generated it. If your product contains GPL code, you’re responsible for complying with the license.
GitHub, OpenAI, Anthropic, and other AI vendors all disclaim responsibility for license violations in their terms of service. They explicitly state that users are responsible for ensuring compliance with applicable licenses. You can’t shift liability back to them.
Copyright infringement is strict liability. It doesn’t require intent or knowledge. Using GPL code improperly is infringement, whether you knew about it or not. “We didn’t know the AI was copying GPL code” isn’t a defense that works in court.
AI tool providers won’t indemnify you for license violations their tools create. The contracts are clear about this – you’re on your own when violations surface.
The company is fully liable for fixing the problem, which means either complying with the GPL terms by open-sourcing your proprietary product or removing all the violating code. Both options are expensive and potentially business-destroying.
What Companies Should Do
If developers use AI code generation, you need license compliance processes immediately. Start by scanning your existing codebase using automated tools like Black Duck, Snyk, or FOSSA to detect open source matches and identify what licenses apply.
Create policies requiring developers to review AI-generated code for license issues before committing it to your repository. This adds a step to the workflow, but it prevents violations from accumulating silently.
Document what code came from AI tools and when, so violations can be traced if they’re discovered later. This provenance tracking becomes critical during due diligence when buyers want to understand the origin of your code.
If you’re planning to raise funding or pursue an acquisition, run compliance scans before entering those conversations. Finding violations during your own review is far better than having buyers discover them during due diligence when it tanks your valuation.
Train your development team that AI-generated code carries license risk. Most developers don’t realize this and assume AI output is safe to use without restrictions.
The Questions Buyers Will Ask
During M&A technical due diligence, sophisticated buyers now ask AI-specific questions. They want to know if your developers use AI coding tools. They ask whether you’ve scanned for open source license violations in AI-generated code. They require documentation showing the origin and licensing of all code in the product.
If you can’t answer these questions confidently with supporting documentation, expect valuation hits or deal delays while you scramble to audit your codebase and remediate violations.
The problem is widespread enough that buyers now assume AI code presents license risk and adjust their due diligence accordingly. Companies that haven’t addressed this proactively are at a significant disadvantage.
Schedule a 30-minute AI Code License Risk Assessment where we’ll review whether AI-generated code created license violations in your codebase, show you what scanning tools can detect GPL and copyleft issues, help you create developer policies for safe AI code use, and prepare you for the M&A due diligence questions that will come.
Because using AI to ship faster feels like winning until the buyer’s lawyers discover your code violates licenses that legally require you to open source everything.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor