Statement of the TYPO3 Association Board on GPL Licensing and AI-Generated Code

The Best Practices Team's questions concern both the TYPO3 Core and TYPO3 extensions. The Board addresses them together at the level of principle, while noting one procedural distinction. Extensions are already covered by an existing (but still internal) discussion draft on AI-assisted code. This draft will be published for community review as a pull request on the Association’s policy repository shortly. The Core follows a separate governance process. The principles stated here express the Board's position and will be operationalized for the Core through that process rather than taking effect automatically.

The request is based on the premise that only code written by a human is copyrightable, and that, consequently, only human-written code can be placed under a given license. The Board considers this premise to require an important refinement before it can carry the weight the questions place on it.

The copyright status of AI-generated output is not settled uniformly across jurisdictions. In some, notably under the current practice of the United States Copyright Office, output that lacks meaningful human authorship is treated as not protectable. In others, including within the European Union and Switzerland, the question appears unsettled and is generally understood to depend on the extent to which sufficient human creative choices can be identified, and remains the subject of evolving law. The Board does not attempt to resolve this debate, and it does not need to in order to answer the questions put to it.

The decisive clarification is this. A lack of copyright protection does not render code incompatible with the GPL. The GPL is a license that operates under copyright law. Where a piece of code attracts no copyright protection, no copyleft obligation is triggered and no conflicting restriction attaches. To the extent that AI-generated output attracts no copyright protection, it does not appear to create an inherent incompatibility with GPL v2. Uncopyrightable AI output is therefore the straightforward case, not the problematic one. The genuine licensing risk lies elsewhere, and it is precisely the second scenario raised by the Best Practices Team.

A generative model can, in some circumstances, reproduce a substantial and recognizable portion of the material on which it was trained. Where that reproduced material is itself protected by copyright and licensed under terms incompatible with GPL v2, the reproduction carries the source license regardless of the fact that an AI produced it, and regardless of the contributor's intent. The risk is one of provenance and contamination. It belongs to the same category as the risk that arises when a human contributor copies code from another project or from a public forum without regard to its license.

This leads to the Board's central position. The determinative question is not whether a tool was used, but whether the contribution infringes a third party's rights or imposes a license obligation incompatible with GPL v2. The mechanism of authorship does not change the analysis.

To the question whether it is always, never, or under certain circumstances compatible with the project's license to add AI-generated code, the Board's answer is: under certain circumstances, where the determinative circumstance is provenance rather than the tool.

AI-generated code is not inherently incompatible with GPL v2. It is compatible when the contribution can lawfully be licensed under GPL v2 and does not reproduce third-party material under incompatible terms. It is incompatible in the same situations in which human-written code would be incompatible, namely when it carries or infringes rights that cannot be reconciled with GPL v2. The Association does not treat AI-assisted code as a separate category subject to a different licensing standard.

Responsibility rests with the contributor who submits the code. It follows from the terms under which TYPO3 accepts contributions, namely that every contribution is licensed inbound under the same GPL v2 that governs the project, on the well-established principle that the inbound license equals the outbound license. By contributing, the contributor represents that the contribution may be published under GPL v2 and that it does not violate the rights of third parties. This obligation is indivisible and is not diminished by the use of an AI tool. A tool does not assume responsibility; a contributor does.

The Association currently operates without a Contributor License Agreement. The Board sees no reason to reintroduce one solely on account of AI, since the responsibility analysis set out here does not depend on it.

Where code incompatible with the project's license is nonetheless discovered after the fact, the project responds as it would to any other license violation. The affected portions are identified and either removed or reimplemented from a clean basis, corrected releases are issued where necessary, and the matter is documented. Reviewers and Core mergers are the first line of defense through diligent review, and Association governance provides escalation and the policy framework for handling such cases.

The Board candidly notes that diligent review and a contributor warranty reduce, but do not eliminate, the project's exposure, since contaminated material may pass undetected. This is exactly why transparency about AI assistance and rigorous human review matter, and why the Association's approach favors disclosure and accountability over prohibition.

The Association already has, or is preparing, the instruments needed to give effect to this position. These are the aforementioned discussion draft on AI-assisted code in extensions, the option of a Developer Certificate of Origin sign-off as described in section 6, a lightweight disclosure convention for substantially AI-assisted contributions, and the embedding of this guidance in the Coding Guidelines and the review process. The Association will continue to monitor developments that bear on this area, including System Package Data Exchange (SPDX) and emerging bill-of-materials approaches to recording software provenance, the Developer Certificate of Origin, and evolving case law on the copyright status of AI-generated output.

As for now, given certain circumstances and the preconditions mentioned above, AI-generated code can be compatible with the GPL v2 license of the TYPO3 Core under the same conditions that govern any other contribution. Compatibility is determined by provenance and the absence of conflicting third-party rights, not by the tool used. The contributor bears responsibility and warrants the right to contribute. Where incompatible code is found, it must be removed or reimplemented as in any other license violation. The Association regulates AI-assisted contributions through transparency, accountability, and existing review processes rather than through prohibition.