No. The GNU FAQ states the GPL does not require you to release your modified version, or any part of it. You can use modifications privately, and a company can use a modified version internally without releasing it outside the organization. Duties begin when you release it to others. Not legal advice.
Definition
The GPL's source duties attach to distribution, not to use. The FAQ says that if you release the modified version to the public in some way, the GPL requires you to make the modified source available to the program's users, under the GPL. It adds that the decision of whether to release is up to you.
What counts as distribution inside a company
The FAQ says making and using multiple copies within one organization or company is not distribution. The organization is making copies for itself. So a company can develop a modified GPL program and use it across its offices without a release duty.
Giving copies to a contractor or a customer is a different matter, because they are outside parties. Treat those as distribution unless counsel says otherwise.
| Scenario | Source duty under the GPL |
|---|---|
| Modify, use inside your company | None |
| Modify, run on your own web server, never give out copies | None (the FAQ says this is the same case) |
| Modify, ship in a product to customers | Yes, source of your version to recipients |
| Modify, send to a contractor | Treat as distribution, check with counsel |
| Modify an AGPL program and run it for network users | Different: the AGPL asks you to offer source to users |
What this means for developers
Teams often fear that touching a GPL library forces them to publish. The FAQ shows the line is shipping, not editing. Two cautions follow:
- Changing hosting or product shape changes the answer. A tool that was internal becomes distribution the day you ship it in an installer.
- License type matters. The FAQ explicitly separates the GPL from the AGPL for modified software offered over a network.
Steps to keep a private fork safe
- Record every GPL component you modify, with the license and version.
- Record where the modified build runs: internal servers, customer sites, a product.
- If the build ever moves to customers, treat that as a trigger to prepare source for the exact release.
- Keep your changes in a clean branch so they can be released without exposing unrelated code.
- Recheck the license when you upgrade, since AGPL or version changes alter duties.
Try it yourself
The continuous monitoring demo shows how an inventory is watched over time. Click through it and look at how changes to a component are surfaced, which is how a quiet license change on an upgrade gets noticed.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning and policies and gates help you track which components ship and hold changes for review. A free scan is available at gold.safeguard.sh/scan.
Quick check
Do I have to publish my GPL changes to the world?
No. The FAQ says the GPL does not require modified versions to be posted to the public. Recipients of your distribution are entitled to the source.
Is giving a copy to another team distribution?
The FAQ says copies within one organization are not distribution.
What changes if the program is under the AGPL?
The FAQ says the AGPL requires offering source to users interacting with modified versions over a network.
Sources
Last reviewed: 19 October 2026.
