What do open source patent clauses mean for a product company?

Some licenses carry an explicit patent grant from contributors, and some stay silent. Apache 2.0 and GPLv3 spell out patent terms. The Apache text also ends the patent license of anyone who sues over the work. Add a patent column to your license review, and send questions to counsel.

What the texts say

Apache License 2.0, section 3, says each contributor grants you a perpetual, worldwide, non exclusive, no charge, royalty free, irrevocable patent license, with a stated exception, to make, use, sell and otherwise transfer the work, limited to patent claims the contributor can license that are necessarily infringed by their contribution. It then adds a defensive clause: if you start patent litigation alleging that the work or a contribution in it infringes a patent, the patent licenses granted to you for that work end on the date the litigation is filed.

GPLv3, section 11, defines contributors and their essential patent claims, and says each contributor grants you a non exclusive, worldwide, royalty free patent license under those claims. GPLv3 section 10 also says you may not impose further restrictions on the exercise of the rights it grants, and gives the example that you may not initiate litigation alleging that a patent claim is infringed by making or selling the program.

The MIT text grants permission to use, copy, modify and sell, and does not mention patents. That is a fact about the words, and what follows from it is a legal question.

Why a product company should care

A product company typically holds patents, files them, or is bought by someone who does. The patent terms of components you ship can interact with that. Two common situations:

1. You sue a competitor on a patent and a component you ship is Apache licensed. The defensive clause is about litigation over the work you got under Apache, not about all your patents, but the interaction should be known before the lawsuit, not after.
2. You are acquired and the buyer's diligence asks which components carry patent grants and which are silent.

None of this makes a license good or bad. It makes a license informative.

A patent column for your review

Record the answers once per license, not once per package. A license family decision applies to every package under it. The structure in our post on allow, review and deny tiers is the right home for the rule.

What not to do

Do not read patent silence as patent safety, and do not read a grant as a guarantee. A grant covers claims the contributor owns or controls and that are infringed by the contribution, within the terms. It does not cover claims held by others.

Do not make the call alone in engineering. Patent interaction is a decision for counsel and the business, with engineering supplying the inventory of what ships. This post is general information, not legal advice.

Try it yourself

Click through it at your own pace, or open it full screen. Find the license field on a few components, since that is the starting point for any patent column.

Safeguard's SBOM and dependency scanning builds the component and license inventory counsel can review, and policies can gate a pull request on a license rule you define. You can try a free scan at gold.safeguard.sh.

Quick check

Sources

• Apache License 2.0 text, SPDX License List
• GNU General Public License v3.0 text, SPDX License List
• MIT License text, SPDX License List

Last reviewed: 19 October 2026.