Open Source Software Licence Compliance Check

Why this matters

Almost every UK business that builds a website, app or internal tool now relies on open source code, often without realising it. Open source is not “free for any use”: every component comes with a licence, and that licence is a legally binding set of conditions. Under the Copyright, Designs and Patents Act 1988, using software outside the terms of its licence is copyright infringement, and the owner can seek an injunction, damages or an account of profits. Permissive licences such as MIT and Apache 2.0 mainly require attribution and notices to be kept. “Copyleft” licences such as the GPL and AGPL go further, and can require you to share your own source code if you distribute, or in the AGPL’s case simply host, a product that incorporates them. The risk has grown as software supply chains have deepened and as AI models, datasets and code assistants have arrived with their own bespoke licences, some of which restrict commercial use or require specific notices. Licence problems usually surface at the worst moment: during investor due diligence, a company sale, a large customer’s procurement questionnaire, or a complaint from a rights holder. Businesses are also increasingly asked to produce a software bill of materials (SBOM) by customers, and the Software Security Code of Practice published by the UK government expects organisations to understand what third-party components they depend on. A short, regular check of what you use, under which licence, and whether you are meeting its conditions is far cheaper than unpicking a product after the fact.

What you'll need

• Whether your business develops, customises or hosts software, apps or websites for customers or internal use
• Whether you know which open source libraries, frameworks and AI models your products depend on
• Whether any open source components are distributed to customers or offered as a hosted service
• Whether developers or contractors can add third-party code without review
• Whether a customer, investor or buyer has asked about your software components

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.