License Compliance
License compliance is the process of identifying the open source and third-party licenses used by a software project's dependencies and ensuring the project meets each license's obligations, such as attribution or source disclosure.
License compliance is the discipline of tracking the licenses attached to every third-party and open source component in a codebase and confirming that the project honors each license's terms. Common obligations include preserving copyright notices, including license text, providing attribution, and, for some licenses, making source code available.
In practice, teams inventory their dependencies, often using a software bill of materials (SBOM), detect the license of each component, and evaluate obligations and compatibility. Automated tooling flags licenses that conflict with a company's policy, licenses that are missing or ambiguous, and combinations of licenses that cannot legally coexist in the same distribution.
For developers and organizations, license compliance reduces legal and business risk: non-compliance can lead to litigation, forced source disclosure, or the need to remove and replace components late in a project. Managing it continuously as dependencies change keeps the risk visible and manageable rather than surfacing it as a surprise during audits, releases, or acquisitions.