Debian's AI code vote: review is the rule, not disclosure

Debian counted the ballots. The Debian AI code policy is now settled: generative AI is neither endorsed nor banned, disclosure is encouraged but not required, and the contributor stays fully responsible for whatever lands in the archive. We covered the four-way ballot in July. The result is not the option most people were arguing about.

What actually happened

Per the results page on debian.org, voting on general resolution 2026/002 ran from August 15 to August 28, 2026. 425 ballots were cast against a quorum of 48.49. Nine options were on the ballot, from a Social Contract amendment banning LLM contributions outright to a proposal opposing them on climate grounds.

Option 5, "Responsible Use of Generative AI," won under Debian's Condorcet method, beating every alternative. Its narrowest margin was against Option 2, the allow-with-conditions proposal.

The operative language is short. Debian "neither endorses nor prohibits" generative AI in development, maintenance, or documentation. Contributors are expected to understand, review, test, and where appropriate modify AI-assisted output before it goes in. And on disclosure: contributors are encouraged to say whether AI helped, but are not required to.

That puts Debian in a different place from its neighbors. The Register notes that Gentoo banned AI-assisted contributions outright, and NetBSD and OpenBSD reject AI-written code.

Why this matters for your business

Most internal AI coding policies we see are disclosure policies. Tag the PR, add a checkbox, done. Debian just held a two-week vote among 425 maintainers and landed on the opposite emphasis: the tag is optional, the review is not.

That is the right order. A disclosure label tells you where the code came from. It does not tell you whether anyone read it. If your policy stops at the checkbox, you have built an audit trail for a review that never happened.

The enforceable version is the one Debian wrote. Whoever opens the PR owns it, can explain every line under questioning, and does not get to blame the tool when a regression ships. That standard is identical to the one you already apply to code a junior engineer copied from Stack Overflow — which is exactly why it survives contact with reality and a mandatory-disclosure rule does not.

Ubuntu is downstream of Debian. If you run containers, you run this decision.

Sources: Debian GR 2026/002 results, The Register.