I'm working on a draft AI policy template that we can share with Eclipse Foundation projects as a recommended open source best practice during Progress Reviews. The goal is to provide projects with a lightweight, practical policy aligned with existing Eclipse Foundation guidance. Here is the [**proposed file**](https://docs.google.com/document/d/1vIFxPhV34_-G57Wb5EuHN-WqXx2QsEIDh8TYN1rmDF0/edit?usp=sharing): > # AI Usage Policy > > **Version:** 1.0 > **Status:** Proposed > > ## 1. Purpose > > This project permits the use of Artificial Intelligence (AI), including Generative AI, in support of project activities. All AI-assisted contributions must comply with Eclipse Foundation policies, intellectual property requirements, security practices, and project governance. > > Our commitment to transparency and meritocracy is fundamental. Transparency about the use of AI is essential for community trust. All AI-assisted contributions must adhere to the Eclipse Foundation's commitment to fairness, non-discrimination, and high-quality standards. > > For additional guidance, see the Eclipse Foundation Project Handbook: > > https://www.eclipse.org/projects/handbook/#ai > > ## 2. Requirements > > All Eclipse Foundation project Contributors using AI tools: > > * **MUST** review and validate all generated code and other generated content before submission. > * **MUST** verify technical correctness, security, and licensing compliance. > * **MUST** comply with Eclipse Foundation Intellectual Property Due Diligence requirements. > * **MUST NOT** submit confidential, proprietary, personal, or otherwise sensitive information—including API keys, credentials, private SSH keys, or local configuration files such as `.env` files—to AI systems unless explicitly authorised. > * **SHOULD** disclose material AI assistance using commit metadata or other project-approved mechanisms. > > ## 3. Human Oversight > > A human contributor remains responsible for all submitted content, regardless of whether AI tools were used. > > AI-assisted contributions are subject to the same review, testing, and approval requirements as any other contribution. > > Automated or agentic systems **MUST NOT** merge or commit changes without human review and approval. > > Committers **MUST** retain meaningful and effective human oversight, control, and accountability over AI-assisted or automated activities. AI systems **MUST NOT** replace human authority for decisions for which committers or maintainers are responsible. > > ## 4. Security > > Contributors using AI tools **MUST** ensure that AI-assisted contributions meet the project's security requirements. > > In particular, contributors: > > * **MUST** review AI-generated code, configurations, workflows, and documentation for security risks before submission. > * **MUST NOT** assume that AI-generated content is secure, correct, or free from vulnerabilities. > * **SHOULD** use available security analysis, scanning, and testing tools appropriate for the project. > * **SHOULD** verify that AI-generated dependencies, libraries, and external references are appropriate and maintained. > * **MUST** follow all project and Eclipse Foundation security policies and processes. > * **MUST NOT** share non-public project information, internal logs, private configuration files, or credentials with third-party AI systems. > > AI-assisted contributions are subject to the same security review and remediation requirements as any other contribution. > > ## 5. Copyright and Licensing > > Contributors should be aware that AI-generated content, by itself and without significant human interaction, is generally not eligible for copyright protection. Human actions, such as curation, modification, verification, and integration, are necessary to ensure contributions meet the project's licensing and copyright standards. > > Contributors are responsible for ensuring that all AI-assisted content complies with the project's intellectual property and licensing obligations. > > ## 6. Attribution and Disclosure > > ### 6.1 Commit Metadata > > Where AI materially contributes to a change, contributors **SHOULD** include an `Assisted-by` trailer in the commit message. > > An `Assisted-by` trailer **SHOULD** be included when AI assistance materially affects the substance of a contribution. Examples include: > > * generation of significant code blocks; > * generation or modification of complex logic or algorithms; > * substantial structural refactoring; > * generation of significant configuration, build, or workflow definitions; > * substantial documentation generation; or > * other generated work or materials that form a meaningful part of the submitted contribution. > > Minor assistance that does not materially contribute to the resulting work, such as spelling corrections, formatting suggestions, or simple completion of text already authored by the contributor, does not normally require an `Assisted-by` trailer. > > Recommended format: > > ```text > Assisted-by: <Provider> <Model Family> (<Version>) > ``` > > Example: > > ```text > Assisted-by: OpenAI ChatGPT (GPT-5.5) > ``` > > ### 6.2 Source Files > > For files that are substantially AI-generated, contributors **SHOULD** include an AI disclosure alongside the project's standard copyright and licensing headers. > > Example: > > ```text > AI Disclosure: Portions of this file were generated with the assistance of an AI system and subsequently reviewed, modified, and verified by a human contributor. > > SPDX-License-Identifier: EPL-2.0 > Assisted-by: OpenAI ChatGPT (GPT-5.5) > ``` > > ## 7. References > > * [Eclipse Foundation Project Handbook – AI Guidance](https://www.eclipse.org/projects/handbook/#ai) > * Eclipse Foundation Development Process > * Eclipse Foundation Intellectual Property Due Diligence Process > * Eclipse Foundation Generative Artificial Intelligence Usage Guidelines for Eclipse Committers > > ## 8. Disclaimer > > Artificial Intelligence technologies, regulations, and industry practices continue to evolve. This policy may be updated as needed to reflect changes in legal, technical, governance, and community requirements. > > This policy supplements, and does not replace, Eclipse Foundation policies and processes. In the event of a conflict, Eclipse Foundation policies and processes take precedence.