Why the absence of licence notices gives rise to new liability risks for manufacturers
It is now almost impossible to imagine any digital product without open-source software (OSS). Whether it’s a router, a vehicle or a digital medical device, the integrated software regularly contains a variety of OSS components, ranging from the operating system to individual programme libraries. However, OSS is not licence-free. Almost all OSS licences require licence texts and copyright notices to be included. Copyleft licences, such as the GNU General Public Licence (GPL), also stipulate that the source code must be made available.
Latest developments: Customers are also raising claims of licence infringements
To date, breaches of OSS licences in Germany have been pursued almost exclusively by rights holders, i.e. members of the OSS community. Anyone who fails to comply with the relevant licence terms forfeits their right to use the software and infringes the rights of the rights holder. For manufacturers, the risk of such breaches being enforced was relatively manageable.
However, an increasing number of customers who have purchased the manufacturer’s products are also bringing their own claims on the grounds of an OSS licence infringement. This trend began with a lawsuit brought against a router manufacturer before the Regional Court of Berlin. The claimant had purchased a router and demanded the complete source code for the libraries licensed under the GNU Lesser General Public Licence (LGPL‑2.1), including the scripts for compilation and permanent installation. He argued that the licence agreement between the manufacturer and the rights holders was a contract for the benefit of users under Section 328 of the German Civil Code (BGB). During the proceedings, the manufacturer provided the requested material and bore the costs. A law firm specialising in IT law is currently taking a different approach: In August 2025, it brought a claim before the Munich I Regional Court against a German importer of an electric car which the firm itself leases. The claimant law firm alleges a lack of licence texts, copyright notices and source code. The claim is based on sales law. The licence infringements are alleged to constitute a defect in the vehicle’s legal title and to give rise to a corresponding warranty for defects.
What are the risks for manufacturers?
A final judicial ruling is still pending. The case before the Munich I Regional Court is due to be heard at the middle of October. In some instances, a legal defect on the grounds of exhaustion of distribution rights has been ruled out. However, if the argument based on the sales law prevails, customers could in future demand subsequent performance. Should this fail, customers may be entitled to claim a reduction in price or rescission of the contract, as well as compensation for damages. This applies to any product containing OSS (or OSS components). Consequently, manufacturers face the risk of a significant increase in their liability.
What should manufacturers do now?
- Stock-taking: Identify OSS components and relevant licences, for example in a Software Bill of Materials (SBOM), which the Cyber Resilience Act will in future require for many products anyway.
- Licence information: Check the licence texts and copyright notices for your product and the accompanying documentation.
- Source code: Set up a process for handling source code requests.
- Supply chain: Incorporate OSS compliance obligations into supplier contracts.
- Development: Take OSS compliance into account at an early stage in the development process.
Conclusion
The risk of licensing liability no longer comes solely from rights holders. This makes ensuring compliance with open-source software licences all the more important. Therefore, manufacturers should fulfil their licensing obligations systematically before customers take legal action to enforce them.
back