Policy decisions directly impact the legal stability of open source licenses and the classification of developer infrastructure. Understanding these shifts helps engineers navigate compliance requirements for AI transparency and age-appropriate design without compromising technical autonomy.
Policy decisions increasingly shape how developers build, collaborate, and participate in open source. That makes it important not only to be transparent about how GitHub responds to government requests, but also to help developers understand policy proposals that could affect their work and create opportunities for the open source community to engage.
With that in mind, we’re sharing our latest Transparency Center data, looking back at an unusually active 2026 state legislative session, and highlighting a few policy conversations we’ll be following in the months ahead.
One notable change in our H1 2026 Transparency Center data is a sharp increase in government takedown requests received, from 98 requests in all of 2025 to 708 requests in the first half of 2026 alone. This increase largely reflects changes to our reporting methodology rather than a change in our moderation practices.
As we noted in our H1 2025 update, we expanded our reporting to include all government takedown requests received, regardless of whether they reference local law, a Terms of Service violation, or simply request the removal of content. We also updated our internal tracking to count all requests received, including duplicate requests concerning the same content.
As a result, the higher number reflects the volume of government reporting activity GitHub receives, not a corresponding increase in content removals. Takedowns processed under local law or for Terms of Service violations remain relatively rare, and requests involving content deemed unlawful in a particular jurisdiction continue to be published in our government takedowns repository.
This year, GitHub has been more active than ever on state policy, including sharing developer-focused updates about policy proposals for age assurance, or approaches to verifying a user’s age online in order to provide them with age-appropriate experiences, and content provenance, which provides transparency about whether content was generated or altered by AI.
We publish these updates in part to help developers understand legislation that could affect the tools they use and the open source projects they contribute to. But they’re also a place to mark progress, especially when it comes from open source community engagement and policymakers developing a better understanding of how open source software works.
With the 2026 state legislative session winding down, here’s where some of the issues we’ve been following landed and what we’ll be watching next.
In California, sustained engagement from GitHub and the broader open source community helped improve the California AI Transparency Act (SB 1000, previously SB 942), which seeks to help people identify the origin of digital content by preserving and displaying information about whether content was created or altered by AI. Earlier versions would have required providers to revoke licenses under certain circumstances, a requirement fundamentally incompatible with widely used open source licenses, which are irrevocable.
The legislation ultimately moved toward a narrower notice-and-response approach that resolved the fundamental conflict with open source licenses. The final package is substantially improved from an open source perspective, although implementation questions remain. SB 1000 was enrolled on August 30, 2026 and is now awaiting California Governor Gavin Newsom’s signature by September 30, 2026.
We also continued working on AB 2713, a follow-up bill intended to refine how the California AI Transparency Act’s content provenance requirements apply in practice, particularly to platforms. The underlying law, AB 853, defines “large online platform,” “file-sharing platform,” and “GenAI hosting platform” in ways that could be interpreted to include developer infrastructure like code repositories. We don’t think those definitions align with regulatory intent, and applying them to code hosting could create legal uncertainty for open source developer infrastructure and implementation challenges without addressing the risks the Act was designed to target. Governor Newsom’s signing message last year encouraged follow-up legislation in 2026 on technical feasibility, and we took a support-if-amended position on AB 2713 asking that these definitions be refined. Those amendments were not adopted this session, so we expect this to remain a priority next year.
Age assurance was another major focus. As we’ve written previously, laws designed for consumer-facing services can have unintended consequences when broad definitions sweep in open source operating systems, developer tools, and other infrastructure that work very differently.
In California, our engagement on the Digital Age Assurance Act (AB 1043) has focused on keeping age assurance requirements from sweeping in open source operating systems, developer tools, and other services that aren’t consumer-facing. In Colorado, changes to the Age Attestation on Computing Devices law (SB 26) addressed key concerns about impacts on open source software and developer infrastructure, showing what coordinated engagement from the open source community can accomplish. In Illinois, the Children’s Social Media Safety Act (HB 5511) was signed into law with important issues remaining. We’ll continue working with policymakers and stakeholders on amendments to address implementation challenges and unintended impacts on open source.
Together, these debates reinforced something we’ve seen repeatedly this year: developers have important technical context to contribute when policymakers consider rules that affect the software ecosystem. Creating opportunities for that expertise to reach policymakers early can lead to more informed and workable policy.
As policy increasingly shapes how developers build, collaborate, and participate in open source, we’ll keep working to make sure developers have a voice in those debates. That means tracking emerging policy issues, helping the community understand what they could mean for developers, bringing technical expertise to policymakers, and working with open source stakeholders toward policies that support developers and the broader ecosystem.
Looking ahead, we’re following the DMCA Section 1201 triennial rulemaking, a process that considers temporary exemptions allowing developers and researchers to bypass technological protections for certain lawful activities. The current proceeding includes petitions relevant to developers, including FOSS license-compliance investigations, scholarly text and data mining, and renewal of the good-faith security research exemption that GitHub has supported in previous cycles. We’re also engaging in emerging debates about young people’s access to AI tools, where we want policymakers to distinguish consumer-facing conversational services from tools for learning, creating, and building software.
More broadly, open source and open source AI will remain a major policy focus. As policymakers grapple with growing concerns about AI, from cybersecurity and safety to global competition, we want to make sure developers and the open source community are part of the conversation. That means helping policymakers better understand how open source is developed, bringing together a broader coalition of open source stakeholders, and creating opportunities for developers to inform policy as these debates evolve. We’ll continue working collaboratively on approaches to emerging challenges while advocating for policies that support a vibrant and well-resourced open source ecosystem and preserve the transparency, research, collaboration, and innovation that openness makes possible.
The post Developer policy update: Transparency, state policy, and what’s ahead appeared first on The GitHub Blog.
Continue reading on the original blog to support the author
Read full articleAs AI agents accelerate code production, manual security reviews are no longer sufficient. Engineers must adopt automated, low-latency security tools that can detect secrets at the speed of agentic development to prevent large-scale credential exposure.
This article highlights the shift in open-source maintenance caused by AI. It explores how to manage high-volume, AI-generated contributions while maintaining security and community trust, offering a blueprint for future projects in the age of automated development.
This event defines the roadmap for AI-integrated development, offering engineers practical strategies for LLM evaluation, advanced Git workflows, and enterprise AI scaling. It is a primary venue for learning how industry leaders are evolving their development stacks.
As AI agents handle more implementation, engineers must evolve into architects who design the guardrails and workflows ensuring AI-generated code is safe and reliable. This shift prioritizes system orchestration and human oversight over manual coding.
