The trigger is shipping, not using

Most companies carry a half-remembered warning: use free software and one day you will be forced to publish your own code. It is wrong in the form most people carry it. The rule underneath is real, far narrower, and you can check your exposure without a lawyer in the room.

This is not legal advice. It is a plain reading of licence texts, for a business owner deciding what to ask their developers. Real money riding on the answer is a reason to call a Malaysian IP lawyer.

Using it triggers nothing

Most free software carrying a disclosure obligation carries the GPL. That obligation is not triggered by using the software. It is triggered by handing copies out.

GPLv3's own definitions do all the work. "Propagate" covers anything you could be liable for under copyright law, "except executing it on a computer or modifying a private copy". "Convey" is propagation "that enables other parties to make or receive copies" — and then comes the sentence that settles most of this: "Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying."

GPLv2 is older and vaguer — "distribute or publish" rather than "convey" — but lands in the same place. The duty attaches when a copy leaves.

So an internal stock system, internal dashboards, a tool nobody outside ever sees: built on GPL parts, never handed out, nothing to publish. The Free Software Foundation, which wrote the licence and has every incentive to read it broadly, says the same — copies made within one organisation are the organisation making copies for itself.

What does count: selling a device with the software inside, handing a client a copy of the system you built for them, selling the business.

What you owe when the duty does attach

It is a process, not a catastrophe. GPLv2 section 3 gives you a choice: ship the complete corresponding source alongside the product, or hand the customer a written offer to supply it, valid for at least three years, at no more than what it costs you to physically deliver it. GPLv3 section 6 has equivalent options, including putting the source on a network server. That is a step your developers can build into a release checklist, not an event that ends the business.

Not every copyleft licence reaches as far. Some libraries carry a softer version, the LGPL — that one asks for the library's source and your changes to it, not your application's. In exchange, LGPL-3.0 section 4 asks you to leave the user able to swap in their own copy of the library: either by using it in a form that can be replaced without rebuilding your product, or by supplying enough of your own build material that the user can recombine it with a modified library. It also wants a prominent notice that the library is used, a copy of the licence texts, and the library's copyright notice where you display your own.

And the licences with no disclosure duty at all — MIT, BSD, Apache 2.0 — still have terms. You must keep the copyright and licence notices with what you ship. Apache 2.0 section 4 adds prominent notices on files you changed and carries forward any NOTICE file. For a small company this, not disclosure, is the realistic breach: a product goes out with no attribution file and nobody ever checked.

AGPL moves the trigger from shipping to serving

One licence does not work this way, and it is worth knowing by name.

The AGPL closes a gap the GPL deliberately leaves open: run modified GPL software as a web service, never ship a copy, never owe anyone anything. Section 13 says that if you modify the program, your modified version must "prominently offer all users interacting with it remotely through a computer network... an opportunity to receive the Corresponding Source of your version".

Three details the shorthand loses. It bites only if you modify the program — running it as you received it triggers nothing, and configuring is not modifying. The source is owed to the network users, not to the world. And whether your own application calling an AGPL component counts as modifying it is contested, for the same reason the linking question below is.

Google Open Source publishes a policy prohibiting the use of AGPL-licensed code. We located the policy page but did not read its text at source, and we are not going to characterise the reasoning behind it. Take it for what it is: one firm's risk appetite, not a legal conclusion.

What is genuinely unsettled

If your program links to a GPL library, does it become part of the GPL work? The FSF says yes, reasoning that the program as actually run includes the library. Lawrence Rosen, former general counsel of the Open Source Initiative, argued the opposite: linking to a library built to be used as a library does not by itself create a derivative work.

No court has ruled on it. The common belief that dynamic linking is safer than static is not a tested escape route; it matters for the LGPL requirement to leave the user able to swap in their own copy of the library, not for whether the GPL reaches you.

A second grey zone: handing modified code to an outside agency, rather than your own employee, is a transfer to a separate legal entity. Some treat contractors as inside the company. Nobody has settled it.

Read the enforcement record literally

German courts did enforce the GPL — a preliminary injunction against Sitecom in Munich in 2004, upheld on appeal, and — on secondary reports, we have not read the German judgment — a Frankfurt judgment against D-Link in 2006. Both were about non-compliant distribution. A preliminary injunction is not a final ruling on the merits.

In the United States, Artifex v. Hancom produced a ruling that the GPL can be enforced as a contract, not only a copyright licence — then settled in December 2017 on confidential terms. There was no finding that Hancom infringed. SFC v. Westinghouse produced damages and a permanent injunction in 2010, but by default judgment: Westinghouse, in financial distress, did not defend. That is not a contested ruling on what the GPL means, and should not be quoted as one.

SFC v. Vizio went to trial on 10 August 2026. SFC alleges Vizio breached GPLv2 and LGPLv2.1 by shipping its SmartCast smart-TV system, built on Ubuntu Linux, without complete, compilable source code. As of September 2026 no verdict has issued — SFC has said publicly that it expects one within three to six months of the trial's conclusion. There have been procedural wins on both sides and nothing final. Note what kind of case it is: the older GPLv2 and LGPLv2.1, which are the licences real shipped products carry, and a dispute about physical televisions sold to customers. Distribution, not use.

On the record we could find, no court has ordered a company to publish its source code outright. The documented outcomes are injunctions against continued non-compliant distribution, settlements, and quiet compliance after a demand letter. Nor is there a credible figure for how often enforcement happens — most of it is private, and anyone quoting a number is guessing.

And no Malaysian case we could find has ruled on these licences — there is no local precedent to lean on. The German and American results do not transfer.

The two questions

Ask your developers: do we hand any software containing open-source parts to anyone outside this company? And is anything we have modified under the AGPL?

Two noes and the loudest version of the rumour is not about you — subject to the grey zones above. A yes is a compliance question to put to a lawyer, with a much narrower scope than the rumour implies.

Either way, ask a third question: does what we ship carry the copyright and licence notices that came with the parts we used? That is the breach a small company is most likely to be committing already, and it has nothing to do with publishing source.