A NOTICE file is a text file some Apache License 2.0 projects include to list required attributions. If a component you redistribute has one, the license says you must include a readable copy of those attributions in a NOTICE file, in documentation, or in a display your software shows. Components without a NOTICE file add no such duty.
What the license text says
Section 4 of the Apache License 2.0 sets conditions for redistribution. In short, if you redistribute the work or derivative works you must:
- Give recipients a copy of the license.
- Mark modified files with prominent notices that you changed them.
- Keep copyright, patent, trademark and attribution notices in the source form.
- If the work includes a NOTICE text file, include a readable copy of its attribution notices in at least one of three places: a NOTICE file distributed with your work, the source form or documentation if you provide it, or a display generated by your software where such third party notices normally appear.
The same section adds that the contents of the NOTICE file are informational and do not modify the license. You may add your own attributions alongside them.
The three places, compared
| Place | Works well for | Watch out for |
|---|---|---|
| A NOTICE file in your distribution | Libraries, CLIs, server packages | It must travel with the artifact, not sit only in your repo |
| Documentation shipped with the work | Products with a docs bundle | Only counts if the docs are provided along with it |
| A display in the software | Mobile and desktop apps, with an about or licenses screen | The notices must appear where third party notices normally appear |
A practical routine
- List every Apache 2.0 component you redistribute. A license report gives you this list.
- For each, check whether the package contains a NOTICE file. The license report will not always tell you.
- Copy the attribution text into one combined notices file, keeping each component's name.
- Ship that file with the build, or surface it in an about screen.
- Re-run the check when a dependency updates, because a NOTICE file can change between versions.
Common mistakes
Copying only the LICENSE text and skipping NOTICE is the usual miss. Another is keeping the notices in a repo folder that never reaches the shipped artifact. A third is combining notices but dropping the component names, which makes them hard to audit.
If your product is a hosted service and nothing is distributed, your counsel can tell you how these conditions apply to you. This post is not legal advice.
Quick check
Do I need to ship a NOTICE file if the component has none?
No NOTICE duty arises from a missing file. The license copy and other notice duties still apply when you redistribute.
Can I edit the NOTICE text?
You may add your own notices alongside it. Do not remove attributions that pertain to the code you ship.
Safeguard's SBOM and dependency scanning gives you the component list that step one needs.
Sources
Last reviewed: 19 October 2026.
