Open source projects mostly allow AI with human oversight rules
"We Permit the Use of AI, but [...]": The Landscape of AI Policies in Popular Open Source Projects
Software Engineering
Summary
Many open source software projects now have rules about using AI to help write code. Most projects say using AI tools is okay, but they want people to stay very involved and be responsible for the code. Nearly half of these projects ask contributors to say when AI helped, like in code notes. The rules also try to stop careless or low-quality AI help. These rules keep changing as projects learn what works best.
What this means in practice
- •For open source maintainers: Design or update project policies on AI-assisted coding contributions based on common practices and evolving standards identified in the study.
- •For software development compliance teams: Develop guidelines for tracking and managing AI usage in code submissions to align with emerging disclosure and accountability trends.
A survey. It maps existing work.
Authors
Andre Hora, Romain Robbes, Stefano Zacchiroli
Abstract
Open source communities are converging on a new governance artifact: the AI contribution policy. These policies barely existed a few months ago and are now being written and adopted. We analyzed 281 AI contribution policies, and manually classified them along the six dimensions; to study how policies change, we also tracked 92 dedicated AI policy files over time. We answer four research questions on (1) AI usage allowance, (2) AI disclosure practices, (3) AI slop countermeasures, and (4) AI policy evolution. We find that, first, permission is the norm rather than the exception: 83.3% of policies permit or encourage AI in code contributions. But permission comes with conditions, as 67.3% require a high level of human involvement and 43.4% assign accountability. Second, AI disclosure is required by 48.8% of policies, most often in pull request descriptions and commit messages, but what must be disclosed varies widely. Third, we identify ten countermeasures against AI slop, targeting pull requests, users, and autonomous agents. Finally, policies are not static: half of the dedicated AI policy files have already been revised since creation. Our results give maintainers and researchers a baseline and a labeled corpus for studying the impact of AI policies.