Debian is voting on whether AI-written code is allowed
Debian's LLM general resolution has four ballot options, from an outright ban to accept-with-disclosure. The overlap is the policy you should adopt now.
The oldest volunteer-run Linux distribution just put AI coding tools on the ballot. Debian opened the discussion period on a general resolution titled "LLM usage in Debian" on July 24, 2026, with four competing options ranging from a flat ban to explicit permission. If you ship anything on Debian or Ubuntu — and if you run containers, you do — the outcome sets a precedent your upstreams will copy.
What actually happened
Per the ballot on debian.org, four proposals are in play:
- A — Ban (Matthias Geiger): prohibit contributions created with LLM assistance, citing unclear copyright status, accuracy problems, reviewer burden, and scraping practices
- B — Allow with guidelines (Lucas Nussbaum): permit AI-assisted work under six conditions
- C — Discourage (Ian Jackson): ask contributors to avoid LLMs, require human-written communications, mandate disclosure, and treat violations as Code of Conduct infractions
- D — Accept with responsibility (Pierre-Elliott Bécue): treat AI use as unenforceable to ban, and govern it instead
Proposal B's six conditions are the most concrete: verify the tool's terms don't conflict with Debian's distribution rights, confirm you have the right to submit any third-party code in the output, take full accountability and be able to justify the change, disclose when a significant portion is AI-generated, discuss bulk or automated changes in advance, and don't send non-public project data to cloud tools.
Why the Debian LLM vote matters for your business
Ignore who wins. Look at what B, C, and D all agree on: disclose it, own it, and don't paste private data into someone else's model. Three proposals written by people who disagree about nearly everything converged on the same three controls. That's your internal policy, available today, at zero cost.
Make it mechanical or it won't happen. Add a commit trailer — Assisted-by: claude-opus-5 or whatever you actually used — so the record exists in git rather than in someone's memory nine months later. Put the "no sensitive project data to cloud providers" line in writing next to your existing secrets policy, since that one is a real leak vector and not a philosophical position. And name a human on every AI-assisted PR who can defend the diff line by line, because "the model wrote it" is going to stop working as an answer.
Proposal C is the one worth reading twice. It covers communications, not just code — bug reports, mailing list posts, issue comments. If it passes, an LLM-drafted upstream bug report becomes a conduct problem. Plenty of teams have quietly automated exactly that. Check whether yours is one of them before an upstream maintainer checks for you.
Key takeaways
- Debian's "LLM usage in Debian" general resolution entered its discussion period on July 24, 2026, with four ballot options
- The options range from an outright ban (A) to explicit acceptance with guidelines (B and D), with C discouraging use and treating undisclosed use as a conduct violation
- Every non-ban option agrees on three things: disclosure, human accountability, and no private project data in cloud AI tools
- Adopt that overlap now — a commit trailer for AI-assisted changes and a named human owner per PR costs nothing
We use AI agents on client code and we keep the receipts. Every AI-assisted change is disclosed, reviewed by a human who can defend it, and kept out of any tool your data shouldn't touch. See how we work.
Sources: Debian General Resolution: LLM usage in Debian, Debian voting information.
- #debian
- #open-source
- #ai-coding
- #governance
- #contribution-policy
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Cursor's ₹649 India tier: dev seats go geographic
Cursor launched a ₹649/month India-only plan, roughly a third of its $20 Pro tier. AI dev tool pricing is now segmented by market, and that changes your budget math.
Read itvBulletin RCE exploit went public: get to 6.2.2 today
A working exploit for vBulletin CVE-2026-61511 dropped four weeks after the patch. Unauthenticated remote code execution, no in-the-wild reports yet. That window closes fast.
Read it