Open-Source Supply Chain

Open-source supply chain refers to the ecosystem of freely available software components, libraries, and frameworks that organizations integrate into their applications and systems. For AI governance, managing open-source dependencies is critical because these components can introduce security vulnerabilities, licensing compliance risks, and unvetted algorithmic behaviors into enterprise AI systems. Organizations must establish processes to track, audit, and maintain visibility over open-source components used in AI development to meet regulatory requirements and mitigate risks related to model transparency, data provenance, and supply chain integrity.

1 item

Corporate PolicyEU2026-07-23

Codeberg Bans LLM Training on Member Data and Blocks AI-Generated Projects, Raising Open-Source Supply-Chain Governance Questions

Codeberg e.V., the EU-based nonprofit hosting the Forgejo-powered Codeberg forge, passed two member-voted resolutions at its 2025 annual assembly: a permanent prohibition on using project or user data to train large language models or other generative AI tools, and a terms-of-use change banning so-called 'vibe-coded' projects that consume disproportionate platform resources. The policies apply immediately to all hosted repositories and users. Enterprise teams that source open-source components from Codeberg or allow developers to contribute code there must update their supply-chain risk assessments and acceptable-use policies accordingly.

Codeberg open-source supply chain training data policy acceptable use data governance EU vibe coding software bill of materials