AI Open Source License Audits: Mapping What's In Your Build Before The Diligence Email

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-legal-AI-and-open-source-license-audit-r8a2-adults

1. What is the primary capability of AI when conducting open-source license audits?

   1. Generating new open-source licenses for proprietary code
   2. Automatically rewriting code to remove copyleft dependencies
   3. Serving as legal counsel to make remediation decisions
   4. Walking every dependency manifest and producing a license inventory with risk classification

2. Which type of license exposure should be flagged as high risk when AI detects it reaching code paths shipped to customers?

   1. Permissive licenses
   2. MIT and BSD licenses
   3. Copyleft licenses like GPL and AGPL
   4. Public domain dedications

3. What decision can AI NOT make during an open-source license audit?

   1. Identifying which files contain open-source dependencies
   2. Scanning for license-compatibility conflicts
   3. Determining whether to remediate versus accept residual risk
   4. Flagging missing attribution notices in shipped artifacts

4. What components should a comprehensive license inventory produced by AI include?

   1. Binary hashes of all dependency files
   2. A list of all developers who contributed to each dependency
   3. Only the names of licenses found in the codebase
   4. Full inventory by license type, risk-classified flags for copyleft, attribution gaps, and a remediation plan ordered by risk and effort

5. What is an 'attribution gap' in open-source compliance?

   1. A dispute between two contributors over credit
   2. A time limit for providing attribution that has expired
   3. Missing required credit notices in shipped artifacts for used open-source components
   4. A situation where the original author cannot be identified

6. In what order should an AI-generated remediation plan prioritize actions?

   1. By risk level and effort required
   2. By the date each dependency was first used
   3. Alphabetically by license name
   4. By the number of files using each dependency

7. What does 'diligence readiness' mean in the context of open-source license audits?

   1. Removing all GPL-licensed code from production
   2. Ensuring all code is written by internal employees
   3. The ability to quickly terminate all open-source dependencies
   4. Having completed a proactive audit before any buyer requests due diligence materials

8. What is a license-compatibility conflict?

   1. A conflict between the license and the operating system
   2. A dispute between two companies over license terms
   3. A disagreement between open-source maintainers
   4. A situation where the terms of two different open-source licenses cannot both be satisfied in a single distribution

9. What triggers the significant cost increase mentioned for OSS audits in the context of buyer diligence?

   1. The urgent timeline and rushed processes when forced to respond to a buyer's request
   2. The experience level of the auditors
   3. The complexity of modern codebases
   4. The number of licenses to review

10. Why must human counsel remain involved despite AI's analytical capabilities in license audits?

    1. AI lacks the authority to sign legal documents
    2. AI cannot read license text
    3. AI tools are too expensive for most organizations
    4. Novel license interpretations and complex license-bundle interactions require legal judgment that AI cannot replicate

11. What approach should organizations take to open-source license audits based on the lesson?

    1. Run audits annually before anyone asks
    2. Only audit when a buyer explicitly requests it
    3. Audit only production code, not development dependencies
    4. Audit every five years as part of major release cycles

12. What are dependency manifests in the context of software auditing?

    1. Documentation required by the FDA for medical software
    2. Hardware specifications for deployment
    3. Files that list all external libraries and components a project depends on
    4. Legal contracts between software vendors

13. What does 'relicensing' mean as a remediation option for open-source license compliance?

    1. Selling licenses to use proprietary software
    2. Changing the license under which a company's own code is distributed
    3. Negotiating with the open-source maintainers to change the license of a dependency
    4. Extending the expiration date of a license

14. What does 'accepting residual risk' mean in open-source license management?

    1. Ignoring all open-source license obligations
    2. Choosing to continue using a dependency despite identified compliance risks that cannot be fully remediated
    3. Reporting all license violations to authorities
    4. Eliminating all open-source code from a project

15. What items should be flagged as potential blockers before a diligence event begins?

    1. All development-only dependencies
    2. High-risk licenses, major attribution gaps, and incompatible license combinations that could derail a deal
    3. Any dependency added in the last six months
    4. All dependencies using any open-source license