License compliance, copyleft analysis, and contribution governance for companies built on open source, so the code you ship stays an asset, with no obligations inherited by accident.
Nearly every modern product is built on open source, and every open source component carries license terms that bind the company shipping it. Open source software counseling is the work of managing those obligations on purpose, by selecting licenses, auditing dependencies, and setting policy, so a codebase is still a strength on the day an acquirer looks closely at it.
The hard part is rarely the headline license; it is the long tail of transitive dependencies, the copyleft terms that reach further than expected, and the inbound contributions whose provenance no one recorded. A permissive component and a reciprocal one can sit side by side in the same build, and the distinction only becomes urgent when the code is distributed, a product ships, or an acquirer's counsel opens the data room. By then the cheap fixes are gone.
We work the question early and keep it managed. License selection is matched to how the company distributes and monetizes its software. Dependency and code audits map what is in the build before it matters. A written policy gives engineering clear rules for what to use and how to contribute upstream. The result is an open source posture that holds up under diligence and that an investor or buyer reads as discipline.
Choosing the right inbound and outbound licenses, whether permissive, weak-copyleft, or strong-copyleft, matched to how the company distributes, embeds, and monetizes its software so the model and the licenses agree from the start.
Tracking and satisfying the attribution, notice, and source-disclosure obligations that attach to each component, with a process that keeps compliance current as dependencies change, so nothing has to be reconstructed under deadline.
Mapping where GPL-family and other reciprocal terms reach in a codebase, flagging incompatible license combinations, and identifying where proprietary code risks exposure before it ships.
Open source audits for financings and M&A, building the software bill of materials, surfacing high-risk and unknown-provenance components, and scoping remediation before the diligence clock starts.
Drafting written open source policies and standing up an open source program office, with approved-license lists, intake and approval workflows, and governance scaled to the size and risk of the engineering organization.
Inbound and outbound contribution governance, including contributor license agreements, developer-certificate-of-origin processes, and the rules that let employees contribute upstream without leaking the company's own IP.
Open source terms are conditions on a copyright license, so shipping outside them is infringement rather than a contract claim for lost royalties. GPLv2 terminates automatically on breach. GPLv3 gives a first-time violator thirty days to cure once notified, the window a remediation plan is built around.
The license you chose is rarely the problem. The transitive dependencies, the libraries your libraries pull in, are where unexpected copyleft and unknown provenance tend to surface.
Copyleft usually triggers on distribution, so SaaS companies assume they are safe. The AGPL closes that door: users who interact with a modified version over a network must be offered the source. How far one AGPL component reaches into neighboring code is a linking question, best asked before launch.
Acquirers and investors audit open source posture as a matter of routine. An unmanaged dependency tree can cut valuation or stall a deal, and the cleanup is far cheaper before the data room opens.
An approved-license list: permissive licenses by default, weak copyleft with review, AGPL and source-available licenses prohibited, each named by its SPDX identifier so a scanner can enforce it. The gate is a check on the pull request. Anything longer is read once and ignored.
Letting engineers contribute upstream is healthy, but without a CLA and a clear process, outbound contributions can carry the company's own IP out the door. The framework keeps the exchange one-directional.
A scan is only the start. Every direct and transitive dependency is identified, its license resolved from the actual source headers rather than the package registry's guess, and unknown-provenance snippets flagged for tracing by a person.
For each reciprocal component, we work the distribution question. Is it linked, embedded, shipped, or merely run server-side? How it is distributed determines if GPL-family terms reach the proprietary code sitting next to it.
Problem components are replaced, re-architected behind a process boundary, or relicensed by negotiation with the rightsholder, and attribution and notice files are rebuilt so the obligations that remain are satisfied in full.
The audit hardens into standing governance, with an approved-license list, an intake workflow, CLA and contribution rules, and a maintained bill of materials, so the next financing opens the data room to a settled question.
Copyleft is only a trap for companies that ship first and read second.
Open source software counseling is the legal work of managing the open source components a company uses, distributes, and contributes to. It covers license selection and compliance, copyleft and attribution obligations, dependency and code audits, contribution policy, and the governance that keeps an engineering organization from inheriting obligations it did not intend, so open source stays an asset.
Almost every modern codebase is built on open source, and each component arrives with license terms that bind the company that ships it. Some licenses require attribution, some require source disclosure, and some are incompatible with proprietary distribution altogether. Getting the analysis wrong can expose source code, trigger enforcement, or surface as a diligence problem in a financing or sale, which is why compliance is best handled before the code ships.
Copyleft licenses, meaning the GPL family and similar terms, can require that software distributed with the covered code be released under the same license, including source. Used deliberately, copyleft is fine. Used inadvertently, it can put proprietary code at risk of disclosure. We map where copyleft and other reciprocal terms reach in a codebase so the company can make that choice on purpose, before an acquirer's diligence finds it.
Yes. Acquirers and investors routinely audit a target's open source posture, and an unmanaged dependency tree can reduce valuation or stall a deal. We run code and license audits, document the bill of materials, and remediate problem components before the data room opens, so open source is a clean line item in diligence.
Most companies that build software benefit from a written open source policy, and many growing engineering organizations formalize it into an open source program office, or OSPO. A policy sets the rules for which licenses are approved, how dependencies are vetted, and how employees contribute upstream. We draft the policy, the contribution and contributor-license-agreement framework, and the approval workflow, scaled to the size and risk of the organization.
License and contribution counseling is general intellectual property and contract work that our team handles directly. Where a matter turns on patent prosecution or a registered-practitioner filing before the USPTO, we coordinate with registered patent counsel so the patent-specific work is handled by a registered practitioner while we manage the licensing, compliance, and corporate strategy around it.
SaaS, cloud, data, and technology licensing agreements, the commercial contracts that move software and IP between companies on terms that hold up.
Explore →Formation-through-growth counsel for startups and technology ventures, covering IP strategy, financing, data and operational compliance, and the regulatory questions that arrive with scale.
Explore →Patent, trademark, copyright, and trade-secret strategy, plus the licensing and fair-use agreements that monetize and defend the assets carrying a company's enterprise value.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.