Why Open Source Matters in M&A
Almost every company, regardless of industry, relies on software to operate and, increasingly, this software includes OSS components, which are widely available for use, modification, and distribution under various licenses. Some of those licenses are straightforward; however, others carry obligations that can turn into problems if overlooked during a transaction.
Key Risks Associated with Open Source Software
1. Not all OSS is Created Equally
OSS is governed by a range of licenses, from permissive (e.g., MIT, Apache) to restrictive (e.g., GNU General Public License “GPL” v2.0 or v3.0). Many restrictive licenses apply the concept of “copyleft” and contain clauses requiring the sharing of your own source code if you incorporate a copyleft license into your project. Non-compliance can lead to legal claims, forced code disclosure, or expensive re-engineering of products.
2. IP Uncertainty
OSS is written by a wide mix of contributors, and sometimes ownership isn’t easily traceable. In some cases, the author(s) and/or applicable license(s) cannot be identified, causing uncertainty about the source of the code and the risk of third-party IP disputes.
3. Potential Vulnerabilities
Some OSS projects are backed by strong, active communities. Others, not so much. If updates or patches are inconsistent, or if code is no longer supported, security vulnerabilities can expose the acquirer’s post-deal operations.
4. Operational Disruption
Discovering compliance problems late (especially after closing) can be painful, as remediation of OSS license concerns may require significant time and effort. Replacing OSS components, renegotiating contracts, or halting distribution can throw a serious wrench in integration plans and affect the company’s ability to generate revenue.
Best Practices for Managing OSS Risks in M&A
1. Conduct Thorough Due Diligence
- Inventory All Software Assets: Ask the target to provide a comprehensive list of all software used, including OSS components, their versions, and associated licenses.
- Third-Party Review: Notwithstanding whatever list the target provides, and particularly for high value software assets, don’t rely only on the target’s own representations. OSS usage is usually understated, so consider either engaging a third-party to conduct an audit of the target’s proprietary software or use readily available software composition analysis (SCA) tools to provide a more comprehensive OSS listing.
- Evaluate Compliance Processes: Determine whether the target has established policies and tools for tracking OSS usage and compliance. A lack of process increases the risk of undisclosed or improperly used OSS.
- Review License Terms: Assess the specific obligations of each OSS license. Pay special attention to licenses that may require source code disclosures (e.g., copyleft licenses), contain commercial use restrictions, or have other conditions inconsistent with expected usage.
2. Put It in the Deal Documents
- Representations and Warranties: Include specific representations regarding the target’s OSS usage, compliance with license terms, and the absence of undisclosed OSS in proprietary software and key products.
- Indemnities: Negotiate indemnities against OSS-related losses, especially if a hidden issue could threaten the proprietary value of what you’re buying. When establishing the indemnities’ basket and caps, consider the cost of having to either rework software to address the target’s undisclosed use of OSS, or a challenge to the ownership and/or confidentiality of the acquired software itself.
3. Post-Closing Steps
- Plan for Integration: Develop a post-closing integration plan that includes OSS management, ensuring that compliance is maintained during and after the integration.
- Set OSS Policies: Make sure the post-closing company has clear rules for using and tracking OSS. If you don’t have an OSS policy, now is a great time to establish one.
- Fix the Gaps: Address any compliance gaps discovered during due diligence. Replace non-compliant code, update licenses, or get permissions as needed.
- Keep a Watchful Eye: Use software composition analysis (SCA) tools to continuously monitor OSS usage, security, and vulnerabilities going forward.
In the context of M&A, OSS carries obligations and risks that can’t be ignored. Companies that handle OSS well (through thorough diligence, appropriate representations and indemnities, and post-closing oversight) have a better chance of ending up with smoother integrations and fewer surprises.
Proactive management of OSS is not just a legal necessity; it’s a strategic imperative. It’s not just about avoiding lawsuits or code headaches but rather protecting deal value and building a stronger foundation for the long run.