Yes, it can. GPLv3 says you may not impose further restrictions on the rights it grants, so a EULA that forbids copying or modification of a GPL component conflicts with the license. The usual fix is a clause that says third party components keep their own license terms, plus a check of what you bundle.
Where the conflict comes from
A EULA is your contract with the customer. It often says the customer may not copy, modify, reverse engineer or redistribute the software. Open source licenses grant exactly those rights for the component they cover.
GPLv3, section 10, says you may not impose further restrictions on the exercise of the rights granted or affirmed under the license, and gives the example that you may not impose a license fee or royalty for exercising them. The same idea sits in GPLv2 and in the AGPL. It is what keeps a distributor from using separate terms to take away what the license gave.
Permissive licenses are less sensitive here. MIT lets you use, copy, modify, merge, publish, distribute, sublicense and sell, subject to keeping the notice. You can usually include MIT code under a proprietary EULA, as long as the notice survives and your EULA does not claim you own that component. This is general information, not legal advice.
The warranty line
Open source licenses disclaim warranties. The MIT text provides the software "as is" without warranty of any kind. The Apache 2.0 disclaimer says the licensor provides the work on an "as is" basis without warranties or conditions of any kind, and you are solely responsible for determining the appropriateness of using it.
Your product contract may give the customer a warranty, support commitment or indemnity for the whole product. Those are your promises, made by you. They are not promises the upstream authors made, and you cannot pass the upstream disclaimer through as a defense to your own commitment. Product and legal teams should look at where the contract says "the Software" and decide whether it should include bundled components.
A review checklist
- List the components you ship to customers, from your SBOM, with licenses.
- Mark any under copyleft licenses. Read your EULA restrictions against each.
- Add a third party components clause. The wording goes along these lines: some components are licensed under their own terms, which are listed at a stated location, and those terms apply to those components in place of anything in this agreement that conflicts.
- Publish the notices at that location. Our post on what to send when a customer asks for notices lists the pieces.
- Check anti reverse engineering language. A blanket ban may conflict with a copyleft component, so carve those out.
- Check technical restrictions such as license keys or locked containers for components with anti lockdown terms.
- Re-run the check when the component list changes.
Where to put the work
This belongs in the release checklist, with a named reviewer from legal. Engineering supplies the inventory. Legal owns the contract text. A shared record of who decided what prevents the same question coming up each release. A license decision log is a good home.
A related case is distribution through channels with their own terms. Where a store or marketplace imposes terms of service on recipients, the same further restrictions question can come up for copyleft components. Ask counsel before shipping GPL code through such a channel.
Try it yourself
Click through it at your own pace, or open it full screen. See how a gate blocks a change, then think about where a copyleft rule would block a bundled component before it ships.
Safeguard's policies and gates can block a pull request on a license rule you set, and SBOM and dependency scanning supplies the component list your EULA review starts from. You can try a free scan at gold.safeguard.sh.
Quick check
Can I use a third party components clause to fix any conflict?
It helps, but it does not rescue a restriction the license forbids. If a clause cannot be reconciled for a copyleft component, change the contract language or the component.
Does MIT code need to appear in my EULA?
Not in the EULA itself. MIT asks that the notice be included in copies, which a notices file or about screen usually handles.
Sources
- GNU General Public License v3.0 text, SPDX License List
- MIT License text, SPDX License List
- Apache License 2.0 text, SPDX License List
Last reviewed: 19 October 2026.
