TL;DR
One of the oldest Linux distributions has settled its position on AI-written code by ballot. Debian contributors may use generative tools, provided they take full responsibility for what they submit. Disclosure is encouraged but not compulsory. It is the most formal governance decision yet on a question every engineering organisation is quietly improvising an answer to.
How the decision was reached
Members ranked eight competing proposals, spanning an outright prohibition, cautious permission, and a rejection grounded in the environmental cost of large models. Just under 600 ballots were cast, with the project’s election team discarding a substantial number, leaving roughly 450 valid votes.
The winner was proposal E, titled “Responsible Use of Generative AI”. Its formulation is studiedly neutral: the project “neither endorses nor prohibits” these tools across software, packaging, documentation and other published material. The rationale offered is productivity — volunteers have limited time, and tools that absorb routine work leave more of it for judgement, review and collaboration.
The liability clause is the substance
What gives the policy teeth is its refusal to accept the tool as an excuse. Contributions must satisfy the same “standards of quality, correctness, maintainability, and legal compliance” no matter how they were produced, and using a generative tool does not dilute the contributor’s responsibility for the result. Anyone submitting must understand, review and test the output first. Uploading AI-generated material without meaningful human review, the text states, “is inconsistent with Debian’s established development practices”.
That is a more demanding standard than it first appears. It converts “the AI wrote it” from a mitigation into an aggravation, since the contributor has admitted to shipping work they did not verify.
Looking forward
The open-source world is now visibly split: Gentoo has banned the practice, NetBSD and OpenBSD reject machine-written contributions, and Linus Torvalds has been publicly relaxed about AI-assisted patches while complaining that AI-generated bug reports have overwhelmed the kernel security list. For UK organisations, the value here is a drafted, debated and adopted policy text available to borrow. Most firms have a vague position on AI-assisted development and no written one; Debian has now done the argument in public, and the reusable idea is that permission and accountability travel together.