Review open-source licenses in our software for compliance risk
Sorts dependencies by license type, flags copyleft and distribution triggers, and lists the notices and actions engineering must take.
The prompt
Help me review the open-source licenses used in one of our products.
Dependency list: [PASTE - component, version, license as reported by the scanner or package manager]
Product type and how it is delivered: [e.g. "SaaS only, no code distributed", "mobile app", "on-prem software shipped to customers", "embedded device"]
How components are used: [linked / modified / bundled / dev-tooling only - if known]
Our commercial model and customer commitments: [e.g. "customer contracts promise no copyleft code"]
Company OSS policy: [PASTE, or "none"]
Do this:
1. Group components by license family: permissive (e.g. MIT, BSD, Apache-2.0), weak copyleft (e.g. LGPL, MPL), strong copyleft (e.g. GPL), network copyleft (e.g. AGPL), source-available or non-OSI licenses, and unknown/missing licenses.
2. For each group, explain in plain English what triggers obligations (distribution, network use, modification, linking) given our delivery model.
3. Flag high-risk items: strong or network copyleft in distributed or networked code, licenses with field-of-use or commercial restrictions, unknown licenses, license conflicts, and dual-licensed components where we must choose.
4. List obligations: attribution notices, license texts, NOTICE files, source-code offers, change notices.
5. Note dev-only or build-time tools that are likely lower risk [CONFIRM WITH ENGINEERING].
Return: a table (Component | License | Use | Risk | Obligation | Action), a prioritized remediation list, and a one-paragraph summary for leadership. Scanner output can be wrong; a qualified lawyer must confirm license interpretations before relying on them.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- linked / modified / bundled / dev-tooling only - if known
- e.g. "customer contracts promise no copyleft code"
- PASTE, or "none"
- CONFIRM WITH ENGINEERING
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Review a customer's redlines to my SaaS subscription agreementA clause-by-clause read of an enterprise customer's markup with risk ratings, fallback positions, and reply language.
- Check my dietary supplement labels and marketing for FDA compliance risksFlags disease claims, missing disclaimers, and labeling gaps in supplement packaging and ads under US FDA and FTC rules.
- Assess our security against a framework and find the gapsMaps your current controls to CIS Controls or NIST CSF, scores maturity, and builds a prioritized improvement roadmap.
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.