Say you inventory licenses for every component, apply a written policy with allowed, review and prohibited categories, handle copyleft cases through legal review, and produce attribution notices for releases. Offer the policy and a license report as evidence. Do not claim legal clearance you have not had.
What buyers worry about
They want to avoid inheriting a license problem, such as a component whose terms conflict with how they will use your software. In acquisitions and procurement, license issues can delay or reprice deals.
The five parts
Inventory. License data comes from the same component inventory as your security scans. Unknown or missing licenses are flagged, not assumed safe. See blank license field: treat it as unknown.
Policy. Three tiers work well.
| Tier | Meaning | Example handling |
|---|---|---|
| Allowed | Permissive terms | Use freely, keep notices |
| Review | Terms with conditions | Legal and engineering decide per use |
| Prohibited | Terms that conflict with your distribution model | Block at merge |
Copyleft. State how you treat strong and network copyleft licenses given your delivery model, and who decides. See AGPL network clause: SaaS obligation.
Change handling. Licenses can change between versions. Say how you notice. See dependency changed its license: response playbook.
Notices. Say how you generate third-party notices and attribution for each release.
A model answer
"We record the license of every third-party component in our inventory and flag missing or unrecognised licenses. A written policy classifies licenses as allowed, review or prohibited, and prohibited licenses are blocked in the pipeline. Components needing review go to legal. We generate attribution notices with each release and can share our policy and a license report."
Evidence
The policy, a sample license report with dates, a record of one review decision and a sample notices file.
Keep it honest
An automated license field is only as good as the package metadata. Say that you verify high-risk components manually. Do not say your product is "free of copyleft" unless you have checked and can show it. Counsel, not a scanner, makes the legal call.
Handle acquisitions and audits
If a buyer or an acquirer asks for a full license review, give them the inventory with license fields and the policy, and be ready to explain every item in the review tier. Teams that keep a decision log for each reviewed component can answer these requests in days instead of weeks. Keep that log next to the inventory, with the reviewer and date, and update it whenever a component is added or its license changes.
Check contracts as well
Some customer agreements contain their own license restrictions, such as a ban on certain copyleft terms in delivered software. Compare your policy with the contracts you have signed, and note any customer specific rules so that engineering can see them.
Quick check
Do we share the full license list?
Often it is shared under NDA with an SBOM that includes license fields. Public notices cover what is distributed.
Does this apply to SaaS?
Yes, though obligations differ by license and delivery model. Ask counsel about network use terms.
Safeguard provides SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
