Open source license compliance is shared. Legal owns the policy and the hard calls. Engineering owns inventory, scanning, gates and fixes. Security or an open source program office owns the register and reporting. Naming one accountable person per duty matters more than which team it sits in.
Why it stalls
Legal teams often cannot read a lockfile. Engineers often cannot interpret license text. Each side waits for the other. The result is a policy nobody enforces, or a scanner nobody reviews.
A practical split
| Duty | Lead | Support |
|---|---|---|
| Write the license policy and tiers | Legal | Engineering, security |
| Approve exceptions | Legal | Engineering lead |
| Keep the dependency inventory current | Engineering | Security |
| Run scans and the pull request gate | Engineering | Security |
| Triage unknown licenses | Engineering first, legal for decisions | |
| Produce notices and source offers | Release engineering | Legal |
| Own the register and metrics | Security or program office | Legal |
| Answer customer questions | Security | Legal, sales |
This is one workable model, not a standard. Small companies often merge roles. The point is that each row has one name.
Decisions to make up front
- What tiers exist: allow, review, deny. See the three tier model.
- What counts as distribution for your products.
- Who can approve an exception and for how long.
- How quickly unknown licenses must be resolved.
- What evidence you keep for customers and auditors.
Measures that show it works
Count unknown licenses, open exceptions past their expiry, time to resolve a review, and releases shipped with a complete notices file. These are operational counts you can read straight from your own tooling.
Handing off cleanly
When engineering finds a license it cannot classify, it sends the exact text and the use case to legal, not just a package name. When legal decides, it records the ruling against the license text so the next case is automatic. See writing an open source policy.
Review the split twice a year. Companies change, products move from hosted to distributed, and a duty that was easy for one team can become heavy. When an incident or a customer question exposes a gap, fix the owner first and the tool second. A tool with no owner produces reports that nobody acts on.
Safeguard offers SBOM and dependency scanning, policies and gates, and compliance evidence automation. Try a free scan.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one piece of evidence can map to several controls, which is how a policy and a register help an audit.
Quick check
Can engineering decide license questions alone?
For clear allow cases under an approved policy, yes. Unclear or custom licenses should go to legal.
Do small teams need all these roles?
No. Merge them, but keep one named owner per duty.
Last reviewed: 19 October 2026.
