Don't Trust the Label: License Laundering in AI Supply Chains

2026-07-22

AI Summary

This study presents the first large-scale empirical investigation into the erosion of licensing obligations across AI supply chains, focusing on the phenomenon of license “laundering”—where licenses are either omitted or altered—during the flow from datasets to models and downstream applications. By tracing 232,270 end-to-end supply chain paths on Hugging Face and GitHub, the authors find that 62.3% of chains contain at least one component lacking any declared license. End-to-end retention rates for copyleft licenses fall below 7%, in stark contrast to 95.1% for permissive licenses. The findings expose significant compliance risks and offer actionable governance recommendations for developers, platform operators, and rights holders to strengthen license adherence throughout the AI development lifecycle.

Abstract

AI artifacts move through a multi-platform supply chain, spanning datasets and models on Hugging Face and applications on GitHub. While each artifact carries a license whose obligations should propagate through redistribution, no study has yet measured whether those obligations survive the chain or are stripped and replaced as artifacts move downstream. We trace 232,270 dataset$\rightarrow$model$\rightarrow$application chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream, and when one declared license category replaces another during redistribution. We find that 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), and that every obligation-bearing license category falls below 7% end-to-end survival while the Permissive category reaches 95.1%. Based on these findings, we provide actionable recommendations for practitioners, model publishers, rights holders, and platform owners.

Problem

• license laundering
• AI supply chains
• software licensing
• model redistribution
• dataset licensing

Innovation

• license laundering
• AI supply chain
• model licensing
• dataset provenance
• compliance