Debian Votes to Allow AI Code Under Responsible Use Policy After Two-Week Community Vote

Debian Votes To Allow "Responsible Use Of Generative AI"

"Using its power under Constitution section 4.1 (5), the project issues the following statement describing its current position on AI-assisted contributions. This statement describes the position of the project at the time it is adopted. That position may evolve as time passes without the need to resort to future general resolutions. The GR process remains available if the project needs a decision and cannot come to a consensus. Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software, packaging, documentation, and other media published within the Debian Project. We recognize that such tools can substantially improve the productivity of contributors when used responsibly, allowing volunteers to spend more of their limited time on work that requires technical expertise, judgment, review, and collaboration. The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance. The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian's established development practices. We [encourage] our contributors to disclose whether a contribution was made with AI [assistance], but do not require them to do so. Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions, including questions relating to copyright, authorship, licensing, and potential reproduction of training material. The Project does not seek to resolve these unsettled legal questions through this General Resolution, nor does it adopt a position on whether AI-generated output is, in whole or in part, copyrightable or derived from copyrighted works. Instead, Debian continues to rely on the judgment and responsibility of its individual contributors. Project members are expected to exercise appropriate care when using generative AI tools, to consider the provenance and licensing implications of material they contribute, and to avoid introducing content whose legal status they cannot reasonably justify. Existing Debian policies governing licensing, copyright, software freedom, and the acceptance of contributions continue to apply irrespective of the tools used to produce those contributions. Contributors are expected to exercise appropriate care when designing and implementing workflows that incorporate generative AI tools. In particular, they should ensure that confidential information, private communications, security-sensitive information (such as embargoed information about security bugs that is not yet public), cryptographic keys, credentials, and other non-public material relating to the Debian Project, its infrastructure, or its community are not disclosed to third-party AI services unless such disclosure has been explicitly authorized and is consistent with Debian's security and privacy requirements. The use of generative AI does not alter Debian's established expectations regarding large-scale or automated project actions. Contributors intending to perform actions with broad project impact, such as mass bug filing or patch submission, large-scale code modifications, or other automated changes or requests affecting many packages or contributors, should seek prior discussion and consensus through the appropriate project channels before proceeding. Any such automated process should be overseen by a human who remains accountable for its behavior and output. This resolution therefore affirms that generative AI is neither exempt from nor subject to special rules beyond the standards already expected of Debian contributors. The responsibility for every contribution rests with the contributor who submits it, who remains accountable for its technical quality, legal acceptability, and suitability for inclusion in Debian."

Debian gives the green light to AI code after a two-week vote, but submitters are responsible for it

* The Debian developers picked Choice 5: Responsible Use of Generative AI via Schulze voting. * AI-generated code now allowed, mirroring the kernel: submitters are on the hook for quality. * You don't have to declare AI use, but must review, test, and accept legal responsibility. For the past few weeks, the developers of Debian have been voting on whether or not AI code is allowed in the codebase. Now, the votes have been tallied, and a result has been declared. The community has declared that they want to allow AI code, but put the onus of quality wholly on the submitter, something that mirrors the Linux kernel's own rules. The Debian developers vote to keep generative AI code But submitters are on the hook for it In an email from the Debian Vote Engineer (Devotee for short), the community had decided that Choice 5 was the winner. As a reminder, here's what all the options were. They're a little vague, so be sure to cross-reference them with the descriptions in the original email to see the declarations for each choice: * Choice 1: Ban LLM contributions from Debian via Social Contract * Choice 2: Allow AI-Assisted Contributions with conditions * Choice 3: Reject LLMs as far as practical, update Code of Conduct * Choice 4: Accept AI contributions for Debian-specific work * Choice 5: Responsible Use of Generative AI * Choice 6: A cautious approach to generative AI * Choice 7: Debian is created by humans * Choice 8: Avoid the use of LLMs: climate destruction is a deal breaker * Choice 9: None of the above Debian used the Schulze voting method to decide the most popular choice, meaning it wasn't a simple "count the votes for each option and crown a winner based on sheer quantity" deal. Instead, the winner is chosen by seeing which option was voted for the most over the other options. Here's the table of results. To read it, look at the row for a specific option; it lists how many votes that option won over the others. For instance, if you look at row 1 (Ban LLM contributions from Debian via Social Contract), you'll see that it scored 111 votes over Option 2 (Allow AI-Assisted Contributions with conditions), 88 votes over Option 3 (Reject LLMs as far as practical, update Code of Conduct), and so on. To see how many people voted for a different option over a specific one, look at its respective column. For Column 4 (Accept AI contributions for Debian-specific work), 232 people preferred Option 5 (Responsible Use of Generative AI), 189 people preferred Option 6 (A cautious approach to generative AI), and so on. Option 1 2 3 4 5 6 7 8 9 Option 1 111 88 118 115 108 95 92 144 Option 2 273 257 181 148 178 238 229 267 Option 3 213 125 133 127 118 132 124 176 Option 4 274 136 259 115 164 238 228 259 Option 5 287 203 272 232 210 251 244 281 Option 6 277 173 260 189 130 236 225 276 Option 7 230 149 193 150 139 133 148 213 Option 8 232 162 203 164 154 155 179 225 Option 9 257 139 230 146 126 133 192 176 After some calculations, Debian declared that "Choice 5: Responsible Use of Generative AI" was the winner. Even without those calculations, you can kind of eyeball the result from the table alone; for Choice 5's column, every single entry is well under 200 votes, with the maximum being 154 votes that preferred Choice 8 (Avoid the use of LLMs: climate destruction is a deal breaker). Every other option lost to at least one competitor by over 200 votes, with Choice 5 being that one competitor. What this means for Debian moving forward The conditions are laid out pretty clearly Now that we know who won, it's time to dig down into what, exactly, the people voted for. We can do that by referring to Proposal E in the original email and see what it detailed. For the most part, this proposal is pretty ambivalent toward generative AI; it neither endorses nor condones the practice. It accepts that for some, it's a productivity enhancer, while others may not want to use it. The onus is not on the practice, but on the person: The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian's established development practices. The new rule says that contributors don't need to declare whether or not they used AI. They do, however, need to take responsibility for the legality of AI code, which the proposal says cannot be fully rectified in this vote alone.

The Linux community is split over AI-generated code and Debian just chose the controversial side

A lifelong musician, Hamed plays multiple instruments, including guitar, bass, and oud. He is equally fascinated by smart-home technology and can happily spend hours geeking out over connected lights, speakers, sensors, and automations that make everyday life a little more interesting. When he isn't covering the latest tech news, he explores more creative topics on his Medium blog, works on his music, or clears his head by riding his motorcycle. * Debian will allow AI-assisted contributions, provided they meet its existing quality, security, and maintainability standards. * Contributors remain responsible for everything they submit, but disclosing AI assistance is encouraged rather than required. * Sensitive data must be protected, while mass AI-generated changes require prior discussion and human supervision. Developers behind Debian have voted to allow generative AI-assisted contributions to one of the world's most influential Linux distributions. After weeks of debate and a ballot containing eight competing policy proposals, the result came down to "Responsible Use of Generative AI." Other rejected alternatives included discouraging LLMs and banning their output from direct Debian contributions. According to Debian's official General Resolution, AI tools may be used in software development, maintenance, packaging, and documentation. Naturally, Debian emphasizes that the work must meet its existing standards, and anyone submitting AI-assisted code will remain accountable for its quality and security. Debian is trusting contributors to keep AI-generated code safe Disclosure is encouraged, but not required The chosen policy doesn't endorse AI, and neither does it prohibit it. Contributors are still expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. That said, Debian only encourages (and doesn't oblige) developers to reveal whether AI assisted a contribution. For a distribution whose major appeal is that it is boring on purpose, this is a surprisingly permissive conclusion. Debian prioritizes reliable packages and predictable behavior over chasing every new trendy development workflow. One of the rejected proposals argued that AI's "move fast and break things" culture was fundamentally incompatible with the very identity that makes Debian what it is today -- and that allowing LLM contributions would leave human maintainers reviewing low-quality work. On the flip side, it's easy to understand why Debian made this decision. Indeed, vibe coding can turn a rough idea into working software in a fraction of the time traditionally required. For a project largely built by volunteers, using AI for repetitive work could preserve the contributors' time for technical decisions and collaboration. That's the justification offered by the winning resolution. The main dispute is over whether ordinary review is enough to detect problematic code generated by chatbots. There are some types of projects you simply should not vibe code. That's especially true regarding systems that require airtight security, where plausible-looking output can conceal vulnerabilities, outdated practices, and edge cases that can be catastrophic. To address the concerns, Debian does impose a few boundaries. Contributors should ensure they do not give third-party AI services credentials, private communications, embargoed security information, or other sensitive data unless doing so has been explicitly authorized. Contributors planning large-scale automated changes, including mass patch submissions, should also seek prior discussion and consensus, while any automated process should remain under human supervision. While it is true that Debian has now placed the responsibility back in human hands, it's up to those hands to understand and audit every line the machine churns out for them.