Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
What open-source software risks show up in M&A?
Last verifiedOSS diligence inventories dependencies (SBOM), license-family obligations, provenance, and known vulnerabilities. Permissive and copyleft licenses are different obligation sets. This page does not interpret a license for YOU. It is not legal advice.
OSS risk in M&A, last verified 10 September 2026 against the SPDX License List, OpenChain (ISO/IEC 5230), CISA / NTIA SBOM guidance, OSI license texts, and OWASP dependency guidance. Informational only — not legal advice on license interpretation. Not investment advice.
Inventory first, interpretation with counsel
Audience: acquirer counsel or CTO. This page is not legal advice and not investment advice. Kind of text: SPDX identifiers are a naming standard. OpenChain (ISO/IEC 5230) is a process standard. CISA / NTIA SBOM guidance is agency guidance. OSI texts are license texts — reading them here is not an interpretation for YOUR facts. OWASP dependency guidance is community best practice.
License-family table
Obligation summaries are informational, not advice. Last verified 10 September 2026. Not legal advice.
| Family (examples) | Typical obligation theme | Diligence flag if missing |
|---|---|---|
| Permissive (MIT, BSD, Apache-2.0) | Notice preservation; Apache-2.0 adds patent grant and NOTICE file practice. | Missing NOTICE / attribution pack in distributions. |
| Weak copyleft (MPL-2.0, LGPL) | Source-share often limited to the modified file or library boundary — counsel must apply the text. | Linked modules without a source-offer process. |
| Strong copyleft (GPL, AGPL) | Distribution (and AGPL network use) can trigger source-share of a larger work — counsel applies the text to YOUR product. | Undeclared GPL/AGPL in a SaaS or distributed binary. |
| Proprietary / unknown / “custom” | Not OSS. Treat as inbound commercial license risk. | Dependencies with no SPDX id and no vendor contract. |
Decision tree for flagged licenses
If a copyleft or unknown license appears in a distributed or network-facing component: (1) confirm the SPDX id and version, (2) confirm how the component is shipped or linked, (3) ask counsel whether YOUR distribution model triggers share-alike, (4) decide remediate, replace, or accept with a written residual. This page does not run step 3. Last verified 10 September 2026. Not legal advice.
SBOM standards named
Name the format you expect: SPDX or CycloneDX, plus NTIA minimum elements as CISA discusses them. An SBOM that is a marketing PDF with no component list is not an SBOM. Pair it with vuln ingest — a clean license story can still be a KEV story.
What to do now
Operational steps. Last verified 10 September 2026. Not legal advice.
- Demand an SBOM and a license exception list before confirmatory ends.
- Park interpretation of GPL/AGPL/LGPL with counsel. Do not take a hallway answer.
- Open the AI-generated-code and cyber-checklist pages — training-data and supply-chain risk sit beside OSS.
- If you already have a session: Dependabot ingest, blast radius (transitive npm), vulnerability management, and the obligation map. Naming those surfaces is not a public href.
Checklist
Question list. Not legal advice.
- Do we have an SBOM in a named standard?
- Are copyleft hits listed with how they are linked?
- Has counsel seen the strong-copyleft row?
- Are KEV-class issues on those components also tracked?
Where this shows up in ShipReady Metrics
Dependency / Dependabot ingest, transitive-npm blast radius, vulnerability management, and the obligation map. The product does not interpret licenses and does not give legal advice.
Primary sources (last verified 10 September 2026)
SPDX License List. OpenChain (ISO/IEC 5230). CISA SBOM pages and NTIA minimum elements. OSI license texts. OWASP dependency guidance. Not legal advice.