Safeguard
Compliance•

What is the Apache 2.0 patent clause and when does it end?

Apache 2.0 grants a patent license from each contributor, which ends for you if you sue alleging the work infringes a patent. Here is the plain reading.

Safeguard Security Team
3 min read

Apache License 2.0 includes a patent license: each contributor grants you a perpetual, worldwide, royalty free license to the patent claims their contribution necessarily infringes. The license for that work ends for you if you file patent litigation alleging the work or a contribution infringes a patent.

The text in plain words

Section 3 of the license grants a patent license that is perpetual, worldwide, non-exclusive, no-charge, royalty-free and irrevocable except as stated. It covers making, using, selling, importing and otherwise transferring the Work. It applies only to patent claims that the contributor can license and that are necessarily infringed by their contribution alone or combined with the work they contributed to.

The same section then adds the termination rule: if you institute patent litigation against any entity, including a cross-claim or counterclaim, alleging that the Work or a Contribution incorporated in it infringes a patent, then the patent licenses granted to you for that Work end on the date the litigation is filed.

What it means for a normal user

For most engineering teams the first half is the point. Using Apache 2.0 code comes with a patent grant from the contributors, which a bare MIT or BSD text does not spell out. The second half matters mostly to companies with patent portfolios or disputes.

I am not giving legal advice, and anything involving a real dispute should go to counsel.

Why scanners and policies care

  • Some organizations rank licenses with an explicit patent grant as easier to approve than ones that are silent on patents.
  • Companies with active patent litigation sometimes want a list of Apache 2.0 components they rely on, to understand the effect of the termination rule.
  • Acquirers ask about it in diligence.

Practical steps

  1. List Apache-2.0 components in your inventory.
  2. Ask your legal team whether your company has any patent assertion activity that could touch the rule.
  3. Record the answer in your decision log.
  4. Keep notices and NOTICE files in shipped builds, since those are separate conditions in section 4.

What the clause does not do

It does not remove the need to keep notices, mark modified files and provide the license text. It also does not turn contributors' other patents into free licenses, because it covers only the claims necessarily infringed by their contribution.

Related reading: Apache NOTICE files and where to ship them.

Quick check

Does the patent grant cover everything the project's company owns?

No. It is limited to claims necessarily infringed by the contributor's own contribution, alone or combined with the work.

Does suing a different company over unrelated code end my license?

The termination text refers to litigation alleging the Work or a Contribution infringes. Ask counsel about your facts.

Safeguard's SBOM and dependency scanning gives you the Apache-2.0 component list for step one.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.