You open your IDE on Monday. Copilot is on. Your team is shipping against a deadline. By Wednesday, pieces of your product’s core logic have been ingested into training data for a model that will ship to your competitors in eighteen months.
You haven’t breached your license. Neither has your developer.
The clause that would have prevented this doesn’t exist in any major commercial software license.
That’s the problem.
The gap
Commercial source-available licenses were drafted for a world that didn’t have autonomous code assistants. BUSL was published in 2017. Elastic License 2.0 in 2021. PolyForm in 2019. All three address the legitimate threats of their era… hosted-service competition, cloud-provider free-riding, unauthorized redistribution.
None of them addresses the threat that now matters most: that the act of working with source code, using the tools developers actually use, quietly becomes an act of exfiltration into someone else’s model.
This is not a theoretical problem. It is happening right now, at scale, through default configurations of widely-deployed AI tools, and the licensing layer has not caught up.
The reflex response from license authors has been to ignore it, because addressing it looks hard. The reflex response from buyers has been to ignore it, because addressing it looks expensive. Both reflexes are wrong. The clause is not actually hard to draft once you see the shape. The cost of not having it is much higher than the cost of writing it.
What a useful clause has to do
A clause that actually works has to solve four problems at once.
It has to prohibit the obvious abuse. The case where the licensee deliberately feeds your code into a model it is training or fine-tuning, whether for its own purposes or for a third party. This part is easy. Every draft I have seen handles it correctly.
It has to not criminalize ordinary work. Developers use AI tools. A clause that prohibits all AI interaction is unenforceable in practice, because nobody will agree to it, and performative in principle, because it does not stop the thing you want to stop. This is where most drafts fail. They are either too permissive, with an AI training prohibition that has no enforcement mechanism, or too restrictive, with a blanket ban that gets struck from the final agreement during redline.
It has to handle the vendor layer. The licensee is not actually the party doing the training. The vendor is. The licensee is a customer of the vendor. A license that only binds the licensee leaves the real exfiltration channel wide open. The clause has to reach through the licensee to the vendor relationship, but it can only do so through an obligation the licensee is actually capable of fulfilling.
It has to be enforceable without surveillance. You cannot watch every IDE. You cannot audit every prompt. A clause that requires you to prove which token got ingested when is a clause that cannot be enforced. The enforcement mechanism has to be structural, not forensic.
These four constraints do not admit much drafting freedom. There are only a few ways to satisfy them simultaneously. Here is the one I have settled on.
Auditable · Commercial License
The structure
The clause has three layers.
Layer one is the prohibition itself, qualified by knowledge. The licensee may not knowingly use the licensed work as training data, fine-tuning data, or evaluation data for any AI system. The word “knowingly” is doing serious work.
- It moves the enforcement question from “did a token from your code appear in a model”, which is unprovable,
- To “did the licensee do something that a reasonable person would understand to be training”, which is answerable from emails, configuration files, and contracts.
This is the shape every enforceable commercial prohibition takes, because it is the shape a court can actually rule on.
Layer two is a safe harbor for ordinary AI tool use. The licensee may use AI tools to work with the licensed code in the course of permitted internal use, provided the tools are operated under terms that do not, by default, incorporate user inputs into training.
This carve-out is the load-bearing piece.
It tells the licensee: you are allowed to use Copilot on your enterprise plan, Cursor on a business tier, Claude Code with training-opt-out defaults. Use a tool whose enterprise terms exclude training and you have safe harbor for the entire category of permitted AI work, full stop.
You are not allowed to use a consumer-tier tool whose terms of service explicitly permit training on user inputs, or to configure an enterprise tool to opt back in. The safe harbor tracks market reality, every major AI tool now offers an enterprise tier with training-opt-out as default, and anchors the prohibition to a test the licensee can actually verify.
For most enterprise development teams, the practical effect is null: their procurement already mandated enterprise-tier AI tools for unrelated security reasons. Compliance under §2.3 is the configuration they already have. The clause adds a contractual obligation, not a workflow change.
Layer three is the flow-through obligation. The licensee shall not enter into any agreement with an AI tool vendor that requires the licensee to permit the use of the licensed work as training data, and shall notify the licensor and seek remediation if it becomes aware that a tool it uses has incorporated the licensed work into training in breach of this section.
This is the clause that reaches past the licensee to the vendor layer. It does not make the licensor a party to the AI vendor contract. It makes the licensee responsible for not signing away the licensor’s protection, and for acting in good faith when exfiltration is discovered.
The practical edge case worth surfacing for procurement… if a vendor changes its terms and your team silently click-accepts the new version at renewal, which is how enterprise SaaS renewals usually happen, that click is knowing acceptance of an agreement that may now violate the flow-through obligation.
The clause does not impose a continuous term-monitoring duty; it does ask that contract-renewal review include a check for new training-permission language. That is the one operational ask this clause makes that other commercial licenses don't, and procurement teams that don't add the check are the ones most likely to be surprised by a breach finding later.
Together, these three layers give you a clause that is prohibitive where it needs to be, permissive where it needs to be, and enforceable on evidence that actually exists.
What’s not in the clause, on purpose
It is worth saying explicitly what this clause does not try to do.
It does not prohibit AI assistance for licensees. Developers will use AI tools. Pretending otherwise wastes everyone’s time.
It does not require licensors to prove training occurred. That is the enforcement problem, and the clause is structured to avoid it.
It does not reach downstream AI models. A model trained in breach of this clause is not itself a party to the license. Remedies flow through the licensee who permitted the breach, not through the model that inherited the data. That is how contract law works, and no clever drafting changes it.
It does not create a cause of action against AI vendors directly. The flow-through obligation runs through the licensee, not the vendor. Making the vendor directly liable would require a different legal instrument, a contract between the licensor and the vendor, which no license can create unilaterally.
It does not survive the Change Date. When a self-expiring commercial license like ACL converts to Apache 2.0 on its four-year anniversary, the AI training restrictions convert with it. This is intentional.
The credibility of a self-expiring license rests on the sunset being clean; carving out exceptions to the Change License invents a new license rather than inheriting the trust of the one you are converting to. Enterprise legal teams know Apache 2.0. They do not know Apache-2.0-minus-training, and they will treat any such variant as a novel restriction requiring fresh review, which defeats the entire point of the conversion.
The training value of four-year-old code is also low enough that the protection is meaningful where it matters: on current and recent versions, where the architectural patterns are live and the code is still under active development. By the time a version ages out of restriction, the licensor’s commercial interest has already moved to the next release, which still has another four years of protection. Licensors who require indefinite AI-training protection should evaluate whether a self-expiring license is appropriate for their work; for most commercial software, the trade-off is the right one.
These are not bugs. They are the shape of what a license can and cannot do. Understanding the boundaries is what separates a clause that survives review from a clause that reads well and falls apart the first time anyone actually tests it.
What surrounds the clause
A standalone AI training clause does not solve the protection question by itself. The fear that kills enterprise adoption of any non-permissive license is vendor lock-in: what happens to me if the licensor disappears?
Source escrow has been the answer for thirty years and it has been a bad one — expensive, third-party-dependent, almost never tested in practice.
The reference license addresses this mechanically, inside the document. Section 5.6 defines a Continuity Event… bankruptcy, acquisition gone wrong, abandonment, or 180 days of vendor silence, that automatically accelerates the Change Date for every then-current version to thirty days after the failure. No escrow agent, no key ceremony, no contract gymnastics. Adopters get to Apache 2.0 on a short fuse, by operation of the license itself.
The AI training protection has an exit on both ends, by design: the scheduled four-year sunset for healthy licensors, and the accelerated thirty-day sunset for failed ones.
Adopters are never trapped.
That symmetry is what makes the protection acceptable to enterprise procurement, and what separates this approach from a bare AI clause grafted onto a license that doesn’t address the surrounding deal.
Why this matters now
The window for getting this right is narrower than it looks.
Every commercial license drafted in 2026 and 2027 will end up with some version of this clause. The question is whether the standard version is one that was written carefully, with the enforcement problem in mind, or one that got pasted in from a boilerplate generator because someone’s legal team said “we need to cover AI training.” The first version protects both sides. The second version protects nobody, gets litigated in five years, and produces case law that hurts everyone.
The clause you write now, or the clause that gets written for you, will define how commercial software interacts with the AI layer for the next decade.
This is the same pattern that played out with open-source licenses in the early 2000s. The licenses written by people who thought carefully about the enforcement model — GPL, Apache 2.0 — became the durable standards. The licenses that got pasted together without care are now the licenses nobody uses.
If you are a commercial software author, publish this clause. If you are a buyer’s counsel, demand it. If you are a license steward, adopt it into your next version. The clause is not proprietary.
I have published it as Section 2.3 of the Auditable Commercial License (ACL), a complete commercial license built around the familiar BSL-style bargain (source access, internal use only, automatic Apache 2.0 conversion four years after each release), with §2.3 as the differentiator and §5.6 (Continuity Event) as the answer to vendor-lock-in fear.
Use the clause on its own, adopt the whole license, or fork either. The text is published under CC0.
The ask
If you are writing or reviewing a commercial software license in the next year, look at the AI training clause first. If it is not there, add it. If it is there, ask whether it has the knowledge qualifier, the safe harbor, and the flow-through obligation. If it is missing any of the three, it is not done yet.
The standard is coming either way. It will either be written by the people who understood the problem, or by the people who inherited the drafting from a template they did not read. Which version becomes the default depends on who publishes first and who adopts it.
Write it. Publish it. Link to it. Adopt it.
The full text of the Auditable Commercial License (ACL) v1.0, including the AI training clause in Section 2.3 and the Continuity Event mechanism in Section 5.6, is published at auditablelicense.org. The site includes a generator that customizes the text to your entity and jurisdiction. Adoption takes about a minute.