Answer customer questions about open source licenses with facts you can back up: how you inventory components, which license categories your policy allows, reviews or blocks, and what evidence you can share. Avoid absolutes such as "we use no copyleft code" unless a recent inventory proves it.
What the customer is really asking
Typical questions are: do you use open source, do you track its licenses, do you use GPL or AGPL code, and can you provide a bill of materials. Behind them is one concern: will using your product put an obligation on us, or expose us to a claim?
Answer patterns
| Question | A sound answer |
|---|---|
| Do you use open source? | Yes. We keep an inventory per release, generated from lock files and build output. |
| Do you track licenses? | Yes. Each component's license is recorded, and a policy sorts licenses into allow, review and deny. |
| Do you use GPL or AGPL code? | State what the latest inventory shows. If some exists, say where and how it is used or isolated. |
| Can you share an SBOM? | Say what format and under what terms, for example under NDA. |
Words to avoid
- "Fully compliant" with no scope or date.
- "None" or "never" without evidence.
- Certification language such as "certified" for a process you have not completed. A process standard such as ISO/IEC 5230 is not a product certification, and a self checklist is not an external audit.
Steps to prepare
- Generate a fresh inventory for the product in question.
- Filter for licenses on your review and deny lists.
- Write one paragraph per flagged item: where it is, how it is used, and the decision.
- Prepare a short policy summary you can paste into questionnaires.
- Decide which documents you share freely and which need an NDA.
- Date every answer so a reader knows how fresh it is.
When you are unsure
Say so and offer to follow up, rather than guess. A reviewer can accept an honest "we are checking that component and will confirm" more easily than they can undo a wrong answer later. For AI drafted answers, see review rules for AI drafted questionnaire answers.
Keep one source of truth
Store approved answers once and reuse them, updating after each release. Mixed answers across questionnaires are a common cause of follow up questions. See the SBOM questionnaire answers.
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, which can help you keep an inventory and supporting records current. A free scan shows the inventory side.
Quick check
Should we share our full dependency list?
Often under an NDA, in an SBOM format. Decide with legal and your customer what level of detail is appropriate.
Is this legal advice?
No. The answers describe facts about your inventory. For what a license obligates, ask counsel.
Last reviewed: 19 October 2026.
