# Review open-source licenses in our software for compliance risk

Sorts dependencies by license type, flags copyleft and distribution triggers, and lists the notices and actions engineering must take.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Coding, Analyze, Code, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/review-open-source-licenses-in-our-software-for-compliance-risk

## Prompt

```text
Help me review the open-source licenses used in one of our products.

**Dependency list:** [PASTE - component, version, license as reported by the scanner or package manager]
**Product type and how it is delivered:** [e.g. "SaaS only, no code distributed", "mobile app", "on-prem software shipped to customers", "embedded device"]
**How components are used:** [linked / modified / bundled / dev-tooling only - if known]
**Our commercial model and customer commitments:** [e.g. "customer contracts promise no copyleft code"]
**Company OSS policy:** [PASTE, or "none"]

Do this:
1. Group components by license family: permissive (e.g. MIT, BSD, Apache-2.0), weak copyleft (e.g. LGPL, MPL), strong copyleft (e.g. GPL), network copyleft (e.g. AGPL), source-available or non-OSI licenses, and unknown/missing licenses.
2. For each group, explain in plain English what triggers obligations (distribution, network use, modification, linking) given our delivery model.
3. Flag high-risk items: strong or network copyleft in distributed or networked code, licenses with field-of-use or commercial restrictions, unknown licenses, license conflicts, and dual-licensed components where we must choose.
4. List obligations: attribution notices, license texts, NOTICE files, source-code offers, change notices.
5. Note dev-only or build-time tools that are likely lower risk [CONFIRM WITH ENGINEERING].

Return: a table (Component | License | Use | Risk | Obligation | Action), a prioritized remediation list, and a one-paragraph summary for leadership. Scanner output can be wrong; a qualified lawyer must confirm license interpretations before relying on them.
```

## What to fill in

- linked / modified / bundled / dev-tooling only - if known
- e.g. "customer contracts promise no copyleft code"
- PASTE, or "none"
- CONFIRM WITH ENGINEERING

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.