Tell your CFO that open source is free to download but not free of terms. Each component carries a license with obligations, and a few licenses can force you to share your own code or can stall a deal in due diligence. Compliance means knowing what you use, checking it against a policy, and keeping the record.
What is the one-minute version?
Your product contains other people's code, and each piece comes with permissions and conditions. Most conditions are light: keep a notice, give credit. A few are heavy: share changes, or share the source of the combined work. If you ship something that breaks a condition, the owner can ask you to stop, fix or pay. Nobody wants that conversation in the middle of a funding round or an acquisition.
This framing keeps the CFO in familiar territory. It is a contract risk, not a coding puzzle.
Where does the money risk show up?
Three places, each with a different clock.
Deals. Customers and acquirers ask for a bill of materials and a list of licenses. If you cannot produce one, deals slow down. Safeguard's docs describe the risk plainly: a copyleft license in the wrong place can force open-sourcing of proprietary code, lose a deal, or fail due diligence.
Product plans. A license that is fine for a hosted service may be a problem for software you hand to customers. The same component can be low risk in one product and expensive in another, so the question has to be asked per product and per delivery model.
Remediation. Replacing a component late costs more than avoiding it early. Engineering time is the number the CFO will recognize.
We are not giving legal advice. Your counsel decides what a license requires in your situation, and we do not know of a public statistic that prices this risk for companies your size, so we do not quote one.
How do licenses differ, in business terms?
The SPDX list gives each license a standard identifier so tools and lawyers use the same names. The Open Source Initiative publishes the Open Source Definition that licenses must meet. For a CFO, group them by what they ask of you:
- Permissive (such as MIT, BSD, Apache): mostly attribution. Low friction.
- Weak copyleft (such as MPL, LGPL): share changes to that component, with conditions on how you link it.
- Strong copyleft (such as GPL): share the source of combined work in some cases.
- Network copyleft (such as AGPL): obligations can attach even when you only run the software as a service.
- Unknown or no license: treat as a problem until someone confirms.
What does a control look like?
A control the CFO can audit has four parts: an inventory of components and their licenses, a written allow, review and deny policy, a gate that checks new dependencies against the policy, and a record of exceptions with an approver. Safeguard's license compliance features detect licenses from several sources, flag conflicts when signals disagree, and enforce a policy you define across code, containers and vendor SBOMs. That is a way to run the control, but the policy decisions stay with your legal and product leaders.
There is also a process standard. ISO/IEC 5230, the OpenChain specification, defines key requirements of a quality open source license compliance program, covering processes, roles and sustainability. Organizations can adopt it by self-certification or through a partner. It tells a customer how your program is organized, which helps when they ask.
What are the limits?
Tools identify licenses from metadata, text and headers, and they can be wrong when a package is mislabeled or has custom terms. A scan cannot interpret a negotiated commercial license, and it does not replace legal review of an unusual case.
What to do
- Ask engineering for a dependency and license inventory for each shipped product.
- Have counsel approve a three-bucket policy: allow, review, deny.
- Add an automated check on new dependencies, with an exception log.
- Decide who may approve a review-bucket license, and how fast.
- Add the inventory to your data room and customer security pack.
- Review the policy yearly, and when you change delivery model.
- Give the CFO one slide: components, flagged licenses, open exceptions.
Quick check
Is open source free to use in commercial products?
Often yes, under conditions. Each license sets terms, and some carry obligations that matter for commercial distribution or hosting.
Does a scan make us compliant?
No. It finds and classifies licenses. Compliance means acting on the findings under a policy your counsel agrees with.
Sources
- SPDX License List
- Open Source Initiative: The Open Source Definition
- OpenChain: ISO/IEC 5230 license compliance
- Safeguard docs: License compliance
Last reviewed: 18 October 2026.
