Study finds 62% of AI supply chains lose license tracking

Researchers conducted a large-scale audit of AI artifact licensing practices by tracing 232,270 chains of datasets, models, and applications across two major platforms: Hugging Face (a repository for AI models and datasets) and GitHub (a code repository). Their goal was to measure whether license obligations—the legal terms that should bind anyone using or redistributing an artifact—actually survive when artifacts move downstream through the supply chain.

The study identified two distinct forms of license laundering. The first occurs when artifacts with no declared license acquire a definitive license label as they move downstream, essentially gaining a false legal identity. The second happens when one license category is replaced by a different one during redistribution, altering the legal obligations that apply. For example, a dataset released under a restrictive open-source license might be relabeled as permissive, or an unlicensed dataset might be absorbed into a model with a permissive label.

The findings are stark: 62.3% of the 232,270 chains pass through at least one artifact with no declared license. Critically, these unlicensed artifacts are concentrated in a small set of foundational datasets—the core building blocks on which many models depend. The end-to-end survival rates tell an even more troubling story. While permissive licenses (which impose minimal restrictions on use and redistribution) achieve 95.1% survival across the full chain, every obligation-bearing license category—those carrying legal requirements for users—falls below 7% survival. This means that the vast majority of legal obligations tied to datasets are lost or stripped by the time applications are released to end users.

Based these findings, the researchers provided actionable recommendations aimed at multiple stakeholders: practitioners building AI systems should verify and preserve licenses throughout their supply chain; model publishers should ensure clear license attribution; rights holders should implement better tracking mechanisms; and platform owners (like Hugging Face and GitHub) should enforce license declarations and visibility. The implication is that without intervention, the AI supply chain will continue to lose the legal accountability that licenses are meant to provide.

The study reveals a critical gap in AI governance: while individual artifacts carry licenses intended to protect creators' rights and set obligations for users, those licenses do not reliably persist through the AI supply chain. The concentration of unlicensed artifacts in foundational datasets—which feed into downstream models and applications—means that compliance risks accumulate at scale. The disparity between permissive licenses (95.1% survival) and obligation-bearing ones (below 7%) suggests that legal requirements tied to datasets and models are being systematically lost or stripped as artifacts move downstream, either through deliberate relabeling or simple neglect. This creates a downstream asymmetry: permissive terms survive and compound, while restrictive or protective terms disappear, potentially leaving developers and users unaware of their actual legal obligations.

No comments yet. Be the first to share your thoughts!