AI-based code generators are powerful applications of generative AI. These tools leverage AI to assist code developers using AI models to auto-complete or suggest code based on developer input or testing. These tools pose at least three types of potential legal issues.
- Does using open source code to train an AI model constitute infringement, or do I have to comply with the terms or restrictions of the open source license even if my use is licensed?
- Will using the output of the AI Code Generator subject the developer to an infringement claim?
- For developers creating new software applications to use AI-generated code, does the application need to be licensed under an open source license and its source code made available?
This article addresses these legal issues and discusses some practical solutions to mitigate these issues.Part 1 of the article discusses legal issues. Part 2 describes the solution.
AI code generator
These tools can greatly simplify and speed up the code development process. The AI models used are typically trained on billions of lines of code, most of which is publicly available open source code. Based on developer requests and existing code, the tool can generate code recommendations, from code snippets to fully coded functions. This happens in real time in seconds. These tools are easy to use and work with many programming languages. A simple example is shown below.
Train an AI Code Generator Model
AI Code Generator model training data is typically based on large repositories of open source code. Many people believe that because the code used is open source, they can use it freely without any legal issues. After all, the point of open source is to allow its use freely. Also, a true open source license does not discriminate between uses of open source software.1
Open source license basics
Open source software is generally free to use, but that freedom is based on the license that accompanies the software. Most open source licenses allow users to copy, modify, and redistribute open source code. However, these freedoms come with conditions. These terms vary by license and range from simple compliance obligations to more onerous and substantive requirements.
Examples of sample compliance obligations include maintaining copyright notices, providing attribution notices, and including license terms when redistributing. A more substantive provision would require that software containing or derived from open source software be licensed under the terms of an open source license and that the source code for that software be made freely available. You can include the requirement that These conditions are often referred to as “contamination” of the software. Licenses with these rights are often referred to as “restricted” open source licenses.
Contamination is a big problem for commercial developers who want to develop proprietary software that can be licensed for a fee under a proprietary license. If developers have to license and release the source code under an open source license, the value of the software is greatly reduced. This is because an open source license gives the recipient the right to copy, modify, and redistribute the software free of charge.
Failure to comply with these terms, whether simple compliance or a more substantive obligation, may result in legal problems. Failure to comply may be considered a breach of contract. Or, your license may terminate and you may lose your right to use the open source software. Continued use after termination may result in claims of copyright infringement.
Open source legal issues regarding AI code generators
Does using open source code to train an AI model constitute infringement, or do I have to comply with the terms or restrictions of the open source license even if my use is licensed?
Using only open source code to train an AI model is unlikely to constitute a breach. However, legal issues can arise if open source license compliance obligations are not met.
A recent lawsuit against CoPilot, an AI code generator, alleges that when using open-source code to train a model, the tool violated its license by removing copyright notices and license terms from the code. CoPilot claims that its output copies code (or portions thereof) but does not contain copyright notices or attribution, and fails to meet other compliance obligations. Legal claims include breach of contract due to violation of license terms, violation of DMCA Section 1202 regarding removal of copyright management information (CMI), and various other claims. Section 1202 prohibits intentional removal or modification of CMI or distribution of copyrighted material with knowledge that CMI has been removed or modified.
Training AI models and removing CMI may violate DMCA Section 1202. It may also be in breach of contract by not adhering to the relevant open source license terms. However, each of these issues is fact-specific. One fact depends on specific license terms. For example, some open source licenses require you to meet compliance obligations if you redistribute open source code. Not yet redistributed by the company. If Company A’s AI code generator outputs the code at the user’s request, it may be redistributed.
Another factual issue relates to how Company A trains its model. If your model contains open source code, you may want to maintain CMI with that code. However, if the model is generated by learning information about the code and later builds new code based on this information, the problem can be different. In this case, the model itself may not contain a copy of the code. Some AI code generators claim not to search for copies of code to generate output.4
The bottom line is that you should consider licensing terms and how the model is trained and used to assess whether training an AI model on open source code violates the law.
Will using the output of the AI Code Generator subject the developer to an infringement claim?
Open source licenses permit copying, modification, and redistribution of open source code, so simply outputting code from an AI tool may not be infringing. However, if the code is emitted and the license compliance obligations are not met, it may be in breach of contract. Under some open source licenses, such violations may result in termination of the license. Continued use after termination may constitute infringement.
For developers creating new software applications to use AI-generated code, does the application need to be licensed under an open source license and its source code made available?
If the code output from the AI Code Generator is covered by a restrictive open source license, using that code in another program will taint that program. As explained above, this requires the entire program to be licensed under the same terms as a restricted open source license, and the source code for the entire program must be made available. This means that recipients may copy, modify and redistribute the program free of charge. This is not the ideal solution if you want to build proprietary software that can be licensed for a fee.
Solve open source problems with an AI-based code generator
The above three problems seem insurmountable to some. Many companies ban developers from using AI code generators to avoid contamination issues and minimize the potential for infringement lawsuits. While this is a legally safe option, it does not allow developers to reap the benefits of her AI code generator. Fortunately, there are many practical solutions that mitigate these risks and allow developers to safely use AI code generators.
Part 2 of this article describes some of these solutions. As a preview, these solutions can include:
- Filters to prevent bad code from being emitted
- Code reference tools for flagging problematic output
- A code scanning tool that helps developers comply with open source.
Conclusion
Many companies prohibit developers from using AI code generators because of the legal risks and uncertainties that come with using open source code to train models. In my view, these issues can be managed using various known solutions. These solutions can significantly reduce the risk and uncertainty of using AI code generators. Developers, companies, and their in-house counsel who struggle with how to manage legal risk with AI code generators will want to learn about these solutions.
