Can I license source code to AI?
The short answer
Check three things first: open-source licenses, client-owned code, and export controls. The Ninth Circuit rejected DMCA claims against GitHub but left open-source license claims alive. Under export rules, releasing code to a foreign person in the US counts as an export. A lawyer must read your licenses and contracts.
Code looks like the cleanest asset in a company, since you wrote it. Repositories rarely stay that clean, and I'd open the license report before anything else.
What is inside my repositories?
Open-source packages arrive with licenses, and some licenses carry attribution or sharing duties. FKKS lists licensed code, vendor data and third-party copyrighted material as items needing careful review before a licensing deal.
Code written for a client may belong to the client under the contract. A lawyer checks each client agreement.
What did the Ninth Circuit decide in Doe v. GitHub?
In Doe v. GitHub (No. 24-7700, 16 Sep 2026) the panel held that Section 1202(b) of the DMCA reaches acts against copyright management information attached to an existing work. It didn't reach newly generated output that never contained that information.
Two claims over breach of open-source license terms continue in the district court. Whether the GPL's sharing terms reach a model trained on GPL code is untested in the sources I read.
Why do export controls come up?
The EAR defines "deemed export" at 15 CFR 734.13(a)(2): releasing or transferring technology or source code to a foreign person in the United States.
The text covers a release inside the United States, so a buyer or its labeling team with foreign-national staff can be the trigger. That's my reading. I didn't research export law beyond this section, so export-controls counsel should take it from here.
What about code written for clients?
Our readiness checklist lists repositories and runs a license report, then hands clearance to counsel.
Sidley lists chain of title as the first item in a training-data agreement, meaning who owns or controls each component of the dataset. Code with mixed ownership makes that line hard to write.
Talk to a commercial lawyer in your state before you sign. The rights check asks about customer contracts, NDAs and who can sign, and the free fit check asks whether code repositories are among your systems. Neither reviews open-source licenses.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
