en.Wedoany.com Reported - As generative artificial intelligence penetrates the industrial sector, corporate attention is shifting towards copyright, open-source licensing, training data management, and software supply chain transparency. Legal liability for AI-generated outcomes, verification of training data sources, and responses to global regulations have become new business challenges, with a corresponding increase in demand for building governance systems.
At the "Open Source & AI Conference 2026" held on the 11th at The Raum in Gangnam-gu, Seoul, participants explored risk factors arising from the use of open source and data in the AI era and sought corporate-level response strategies. This year marks the 15th edition of the event, which has expanded from its original focus on open source to include the AI domain. Sponsored by the Korea Open Source Business Council (OSBC) and Insignary, the conference brought together domestic and international companies and legal experts to share insights on copyright disputes, AI Bill of Materials (AI-BOM), Software Bill of Materials (SBOM), and supply chain management solutions.
In his opening remarks, OSBC Representative Kim Taek-wan stated that AI and open source are now inseparable, expressing hope that this event would serve as an opportunity to understand the various risk factors emerging from AI usage and explore countermeasures. Attendees agreed that since the expansion of AI applications is inevitable, managing technological innovation, copyright, data governance, and supply chain transparency must go hand in hand. Industry experts predict that, as AI develops based on open source and data, future corporate competitiveness will no longer depend on "what was created," but on the ability to explain "how it was created."
The first keynote speaker, Lim Hyung-joo, Head of the Yulchon AI DC Center, pointed out that the next challenge for the AI industry is not technology but legal risk. Referencing the Gartner Hype Cycle, he noted that one of the main reasons the AI industry is currently in the "Chasm" is not technology itself, but conflicts with existing rights systems and regulations. With the formal implementation of regulations such as South Korea's AI Basic Act and the EU AI Act, potential legal risks are becoming a reality.
Lim Hyung-joo explained that copyright disputes related to AI are rapidly increasing. Lawsuits related to generative AI in the United States have surged over the past two years, with representative cases including Getty Images vs. Stability AI, The New York Times vs. OpenAI, and major record labels vs. AI startups. Citing the Getty Images case, he mentioned that the use of watermarked images for AI training is a key point of contention, with both the AI training process and the generation of results becoming subjects of copyright disputes. However, he noted that U.S. courts primarily rely on the "Fair Use" doctrine when adjudicating disputes over generative AI training. The core of fair use determination lies in whether the use causes substantial harm to the market for the original work, and whether it creates a competitive relationship with the original author, leading to market cannibalization, which is becoming an important criterion. He predicted that the outcomes of ongoing lawsuits between domestic broadcasters and AI companies in South Korea will also serve as important benchmarks in the future. Additionally, personal information, trade secrets, and non-public data could create legal disputes even more complex than copyright. Finding a balance between the development of the AI industry and the protection of creators' rights is a core future challenge, and courts and regulatory bodies worldwide are currently in a transitional phase of establishing guidelines.
The second keynote speaker, Mike Pittenger, Chief Strategy Officer (CSO) of Insignary, pointed out that AI-generated code also carries licensing obligations. He explained that open source has become the standard for modern software development, and due to reduced development costs and shorter time-to-market, most current software relies on various open-source components. The problem, he noted, is that with the proliferation of AI coding tools, "Hidden Dependencies" that are difficult to detect with traditional methods are increasing. Pittenger explained that after learning from open-source code, AI can regenerate code snippets that perform specific functions. In such cases, the generated code segments are not recorded in package managers or build files, making them undetectable by existing SCA (Software Composition Analysis) tools and SBOMs. He pointed out that open-source code segments included in AI-generated code may also carry the original licensing obligations. Even if only part of the code is used, copyright notices and license compliance obligations do not disappear. He specifically warned that if code under Copyleft licenses like GPL is included, it could lead to disputes over derivative works. Citing research results, Pittenger stated that over half of AI-generated application files contained undeclared open-source code snippets, but existing SCA tools identified only about 23% of all dependencies. He emphasized that adopting AI is not optional, but neither is risk management, and there is a need to establish governance and technical controls that ensure code-level visibility.
Cho Jung-won, Attorney at LG AI Research, emphasized that AI-BOM is a proof system for the data supply chain. Attorney Cho stated that open-source compliance has been standardized for years, but management standards for AI training data have not yet been fully established. Current copyright disputes in the U.S. and Europe ultimately boil down to the legality of data sources and usage. He also pointed out that different countries have varying criteria for judging AI training and outputs. Even for the same AI service, different conclusions may be reached depending on the country of the court with jurisdiction. Therefore, companies need to establish a proof system capable of tracking data sources, licenses, processing history, and redistribution processes. Attorney Cho stated that AI-BOM is not just a document, but a basis system for explaining the data supply chain. In the future, companies will face situations where they need to prove what data was used and through what process the model was built. LG AI Research currently operates a data compliance system that analyzes training data for copyright, personal information, and dispute history, and is developing Data Provenance tracking technology.
Norio Kobota, Senior Open Source Strategist at Sony Group, emphasized the importance of ensuring SBOM quality amidst expanding global supply chain regulations. He noted that with the emergence of various regulations such as those from the U.S. NTIA and CISA, and the EU Cyber Resilience Act (CRA), companies need to simultaneously address different requirements. Kobota stated that in the past, SBOMs were documents for people to check licenses and vulnerabilities, but as supply chains scale up, manual verification has reached its limits. He further emphasized that accurate package identification information, traceable metadata, and a smooth information exchange system among supply chain participants are crucial. The quality of the SBOM will directly determine the reliability of the supply chain.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
