AI Policy

This page is a working draft. There is currently no official policy.

Proposed Policy

The GnuCash project neither encourages nor discourages the use of generative AI tools to help create code or other content: That decision is up to each contributor. We recognize that many contributors are already using these tools and find them indispensable productivity enhancers while many others consider them anathema. We do need to know when they are used and in order to make the best use of our small core team's time we need to require that those who do use them take full responsibility for the results and ensure to the best of their ability that the results are of high quality before submitting them for consideration.

Scope

This policy applies to commits to any GnuCash project repository where content is generated by generative AI. It does not apply to use of tools like spelling checkers, symbol-completion features in IDEs, or linters like clang-tidy. It also does not apply to generative AI uses where the tool is directed to perform specific editing tasks, for example to find every instance of an int variable foo and change it to bar.

Rules

• The human submitter is expected to thoroughly understand in detail and be able to defend all aspects of the submission. That might mean that the contribution turns into a learning experience because the submitter will have some studying to do if the tool ventures into unfamiliar APIs or language features.
• All AI-generated commits must be carefully and thoroughly reviewed by a human and the human must indicate that review by amending the commit to add a trailer of the form Signed-off: name <email address>. AIs shall not insert that trailer.
• All AI-generated commits shall include a trailer Assisted-by: agent model or Generated-by: agent model. Use Generated-by: only when the generative AI tool wrote most of the commit content with minimal input from the human. Those cases should be relatively rare.
• Generative AI tools must be instructed to read and follow the instructions in AGENTS.md and CONTRIBUTING.md if they are present in the repository.

Issues

Use of generative AI tools in program development has become widespread, with top-level developers calling its use "rocket fuel". On the other hand many are skeptical, particularly in the open-source community, raising several concerns:

• Quality: Although generative AI tools are improving rapidly, even the latest (which happen to also be the most resource-consuming and therefore expensive) are estimated by their makers to be wrong 25-30% of the time. Sometimes that manifests with the model going off and solving a problem that isn't real, sometimes it means that the model writes code that doesn't work, sometimes it means that it writes code that does work most of the time, or that works all of the time but has poor performance.
• Provenance: Unless the tool is based on a model that is open-source with a well documented training history there is no way to know where the content produced by a model came from. Sometimes it's completely novel and sometimes it's regurgitated from the model's training data. If republished the latter case could expose the publisher to legal liability for infringement.
• Copyrightability: Only work written by humans can be copyrighted. Open Source licenses depend on the code being copyrighted to be enforceable because (software patents aside) it is the right to republish that is being licensed. Works that are not protected by copyright have nothing to license: Anyone may use them however they like.
• Skill development: If all of the grunt work of writing code is delegated to generative AI tools then there is no path for new programmers to gain the experience and skills needed to evaluate the output of those AI models.
• Ethics: There are two facets to this: One is that generative AI model trainers have been very, very bad internet citizens, DDoSing many open source software servers (including GnuCash's, they're why you have to ask for a Bugzilla account). The other is that these tools consume an enormous amount of electricity straining the resources of and raising rates for the communities that host the data centers. Using them contributes to both of those impacts and is considered by many to be unethical or immoral.

Other Projects:

A number of Free/Open Source projects have created policies for generative AI use ranging from "Heck No!" to "Do whatever you want". Some of the more widely cited ones include:

• The Apache Foundation allows use of AI tools subject to the constraints that "The terms and conditions of the generative AI tool do not place any restrictions on use of the output that would be inconsistent with the Open Source Definition." and recommends disclosure of any AI tools used in a submission.
• The Fedora Foundation allows using AI tooling provided that the human contributor takes full responsibility for the submission and discloses the use of the specific AI tool used with a git message trailer.
• While the Gnome Foundation has not articulated a policy, the Gnome Shell has written and Gnome Circle has adopted the following:

"While it is not prohibited to use AI as a learning aid or a development tool (i.e. code completions), app developers should be able to justify and explain the code they submit, within reason. Submissions with large amounts of unnecessary code, inconsistent code style, imaginary API usage, comments serving as LLM prompts, or other indications of AI-generated output will be rejected."

• The Linux Kernel policy is very permissive, requiring only that a human developer review all of the code in a submission and certify that it is correct, meets the licensing requirements and assumes full responsibility. It also recommends tagging submissions with an "assisted-by" tag with the particulars of the AI tool used.
• The LLVM compiler project allows use of AI tooling provided that "there must be a human in the loop. Contributors must read and review all LLM-generated code or text before they ask other project members to review it. The contributor is always the author and is fully accountable for their contributions. Contributors should be sufficiently confident that the contribution is high enough quality that asking for a review is a good use of scarce maintainer time, and they should be able to answer questions about their work during review."
• OpenInfra allows AI tool use with similar provisos about disclosure, responsibility, and understanding.
• OpenTelemetry allows AI tools but insists that the majority of a contribution should be written by a human.
• The QEMU emulator project disallows AI-generated content but allows other uses of AI by contributors who then create the content provided that use is disclosed in a commit trailer.
• The Zig language project completely disallows 'any' use of AI, but that has more to do with their intentions for a community than licensing or code quality concerns.

Two other articles are quite informative:

• How open source projects are drawing the line on AI contributions provides a nice discussion of policies and implications with some recommendations.
• The Software Freedom Conservancy has publish Recommendations When Using LLM-backed Generative AI Systems for FOSS Contributions. The recommendations are mostly about the ethical impact of LLM-based Generative systems, particularly proprietary ones, on software freedom.