When open source terms conflict with the licence: what to do first
An open source term and a commercial licence rarely collide by accident. The first step is not renegotiation — it is a clause-by-clause comparison: which permissions the open source term grants, which restrictions the licence imposes, and where the same act (distribution, modification, sublicensing) is treated differently by each. Everything else follows that comparison.
Basis
Software incorporating open source components is protected as a literary work under Directive 2009/24/EC. The directive treats the rightsholder's exclusive acts — reproduction, adaptation, distribution — as the baseline. Any licence, open source or commercial, only narrows or widens permission within that baseline.
A conflict exists when the open source term permits an act that the commercial licence forbids, or the reverse. Directive 2009/24/EC does not resolve that conflict on its own. It confirms only that both instruments are licences over the same exclusive rights, not two separate legal orders operating side by side.
Practical consequence
The practical effect depends on which act is contested. If a product bundling a copyleft component is redistributed under a proprietary licence, the redistribution itself may already be unauthorised, regardless of what the commercial contract with the client says about ownership.
If the conflict surfaces only during an audit or a due diligence review, the immediate risk looks different. A counterparty is more likely to treat the licence as void for the affected module than to challenge the whole product.
Timing is the part clients underestimate. Some open source terms attach automatic termination to a breach, and that termination runs from the breach itself, not from the moment anyone notices the conflict.
Cost factors and turnaround
This page does not price the fix. The cost driver is the number of affected modules, the number of jurisdictions where the product is distributed, and whether a counterparty has already raised the conflict in writing. A single component swap is a different task from an audit across a distributed codebase.
Where the matter is already active, the first response from a partner arrives within minutes during business hours. A scoped estimate for the work itself follows within one business day.
What to do first
| Step | Action | Owner |
|---|---|---|
| 1 | Isolate the affected component and record the open source term exactly as it stood at the time it was used | Engineering lead |
| 2 | Map every act actually performed with the software — distribution, SaaS delivery, modification — against both licence texts | IP counsel |
| 3 | Check whether the open source term has already triggered automatic termination on breach | IP counsel |
| 4 | Decide between replacing the component, obtaining a separate commercial licence for it, or restructuring distribution | Client and counsel |
| 5 | Record the decision and its date before any further distribution takes place | Client |
The order matters more than the speed. Deciding on a fix before step 2 is complete is the most common source of a second, avoidable conflict.
Who decides
No single forum decides an open source conflict in the abstract. Where the dispute stays contractual, between the client and its commercial licensor, the forum is whichever court or arbitration clause the commercial licence itself names.
Where the dispute concerns copyright infringement through unauthorised distribution, the forum is the court with jurisdiction over the distribution, applying Directive 2009/24/EC as implemented in the national law that governs the act.
Evidence in both settings is the same three items: the version of the component actually shipped, the licence text attached to that specific version, and the internal record of who approved the distribution.
Three scenarios
- If the component in conflict also carries a name that overlaps with a registered mark, the conflict is not limited to permission to copy code. It also raises permission to use that name in distribution, a separate question covered in When a celebrity name blocks the filing in detail.
- If the codebase was assembled partly from work delivered by an earlier contractor and partly from open source components, ownership must be settled before the licence question is even framed. The ownership sequence is set out in What to do first in this situation in detail.
- If the software is distributed through a tokenised licensing structure, terminating the open source permission does not remove the token that still points to the deployed copy. That mismatch, for tokenised deployments, is addressed When a licence terminates but the token remains in detail.
What this page does not resolve
This page does not draft the replacement clause, does not calculate damages for unauthorised distribution, and does not certify that a specific open source licence has been correctly attributed to a component. Those steps require the actual component list and the actual distribution history, neither of which fits a general situation page.
Verified
The reference above is Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs, codified version, checked against the source listed for this material. The directive carries a low-volatility rating, so no additional date tag attaches to the reference itself.
This page does not process personal data beyond what is described in Cookies and what is switched off by default overview.
Related publications
A similar first-step logic applies when a lender enforces a pledge over intellectual property rights instead of a licensor invoking termination: A pledge over rights is enforced IP licence.
FAQ
What is the first step when open source terms conflict with the licence?
Compare the open source term against the commercial licence clause by clause, for the specific act actually performed — distribution, modification, or SaaS delivery. Do not renegotiate before that comparison is written down.
Which deadline is already running?
Some open source terms attach automatic termination to a breach, and that clock starts at the breach itself, not at discovery. Check the specific component's term for such a clause before assuming there is time to negotiate.
Who decides, and on what evidence?
A contractual dispute goes to the forum named in the commercial licence; a copyright dispute goes to the court with jurisdiction over the distribution. Both rely on the shipped component version, its attached licence text, and the record of who approved the distribution.