Open Source Software Policy

An internal policy for using, tracking, contributing to and releasing open source software safely, with licence categories, an approval process, SBOM and vulnerability rules.

Editable Word document
14
10pages
Guidance notes included
aml consultancy solutions

Tech & SaaS

Open Source Software Policy

About this document

What it’s for

An internal policy for your development team that sets out how open source software may be used in your products and internal systems. It reduces the risk of licence breaches, security vulnerabilities and ownership problems that can surface in customer contracts, investment rounds or a sale of the business.

When to use it

  • Any business that builds software, websites or apps
  • Before investor or buyer due diligence, or a large customer’s security review
  • When adopting AI coding assistants or software composition analysis tools

What’s inside

The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.

  1. Purpose
  2. Scope
  3. Definitions
  4. Roles and responsibilities
  5. Policy principles
  6. Licence categories and approval
  7. Procedure for using OSS
  8. Distribution, SaaS and delivery models
  9. Notices and attribution
  10. Security and vulnerability management
  11. AI coding assistants and generated code
  12. Contributing to external open source projects
  13. Releasing Company code as open source
  14. Customer contracts and deliverables
  15. Breaches of this policy
  16. Records
  17. Training
  18. Monitoring and review
  19. Related documents

Also included

  • Components and licences
  • Notices
  • Security
  • AI and contributions
  • Customer and contract
  • Sign-off
  • Policy acknowledgement

How to complete it

  • Name the Open Source Lead and approvers in clause 4
  • Adjust the licence categories in clause 6 to your business model (SaaS, distributed software or mobile apps)
  • Set the vulnerability fix times in clause 10 to what your team can achieve
  • Use Appendix A for approval requests and Appendix C before each release

Key points to check

  • Licence categories here are general guidance – take advice on unusual licences
  • If you sell software into the EU, check the EU Cyber Resilience Act timetable

Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.

Included in the pack

Tech & SaaS

£20

for every document in this category

Editable Microsoft Word files

Guidance notes in every document

Written for UK businesses

Download and keep

Get the packSee every document in this pack →

Need more than one category?

Documents All-Access gives you every category for 12 months for £295.

Compare options →

Need it tailored?

We can adapt any template to your business, or write a document from scratch.

Talk to us →