Re: [PATCH] docs/devel: relax policy on AI-generated contributions

["Michael S. Tsirkin" <mst@redhat.com>]

On Thu, May 28, 2026 at 02:12:51PM +0200, BALATON Zoltan wrote:
> On Thu, 28 May 2026, Paolo Bonzini wrote:
> > Until now QEMU's code provenance policy declined any contribution
> > believed to include or derive from AI-generated content.  A blanket ban
> > was easy to maintain while LLM output was rarely usable on its own, but
> > as the tools improved an absolute prohibition has become harder to
> > justify.
> > 
> > The concern that motivated the policy is unchanged, and it is worth
> > stating precisely: the DCO is about whether the submitter has the legal
> > right to contribute the code, not about "creative expression".  The
> > copyright and license status of LLM output remains unsettled, so that
> > question is still open.  What has shifted is the balance of risk:
> > 
> > - projects accepting AI-assisted content have not run into serious
> >  legal trouble so far, which suggests the probability of the risk
> >  materializing is not high;
> > 
> > - other organizations, such as Red Hat[1], have assessed the risk as
> >  acceptable -- though a community of individual developers does not
> >  have the legal backing of a company, and even an unfounded dispute
> >  would be a long-lasting distraction from work on QEMU.
> > 
> > Revise the policy to permit AI assistance where the ramifications of
> > copyright violations are at least easy to revert and unlikely to spread:
> > tests, documentation, mechanical changes, and small bug fixes.  Core code
> > that other things depend on, and that cannot simply be thrown away once
> > a problem is noticed long after the fact, stays off-limits without prior
> > agreement from a maintainer.
> > 
> > Related to this, and already visible in the incredible uptick in
> > security requirements, is the question of maintainer burnout and the
> > shift in effort from the author to the reviewer of the code.  AI lowers
> > the cost of producing a patch but does nothing to lower the cost of
> > understanding and reviewing one; if anything it raises it, since a
> > reviewer can no longer assume that the submitter has reasoned through
> > every line.  The limits above work just as much to keep the volume of
> > review work sustainable.
> > 
> > Furthermore, introduce "AI-used-for:" as a trailer to record where AI
> > was used, and include other suggestions that help reviewers judge
> > the result.  The standard is slightly different from the more usual
> > "Assisted-by", which doubles as a check that the author has read the
> > policy.
> > 
> > In any case, use of AI does not relax any other contribution requirement:
> > authors still comply with the DCO and take responsibility for the whole
> > patch via Signed-off-by.
> > 
> > [Commit message largely based on
> > https://lore.kernel.org/qemu-devel/ahXbxzB4C_lr6b0N@redhat.com/, by
> > Kevin Wolf. - Paolo]
> > 
> > [1] https://www.redhat.com/en/blog/ai-assisted-development-and-open-source-navigating-legal-issues
> > Cc: Alex Bennée <alex.bennee@linaro.org>
> > Cc: Alistair Francis <alistair.francis@wdc.com>
> > Cc: Daniel P. Berrangé <berrange@redhat.com>
> > Cc: Kevin Wolf <kwolf@redhat.com>
> > Cc: Michael S. Tsirkin <mst@redhat.com>
> > Cc: Peter Maydell <peter.maydell@linaro.org>
> > Cc: Warner Losh <imp@bsdimp.com>
> > Link: https://lore.kernel.org/qemu-devel/20260524083329-mutt-send-email-mst@kernel.org/T/
> > Signed-off-by: Paolo Bonzini <bonzini@gnu.org>
> > ---
> > docs/devel/code-provenance.rst | 123 ++++++++++++++++++++-------------
> > 1 file changed, 75 insertions(+), 48 deletions(-)
> > 
> > diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
> > index 65b8f232a08..84f9f4a70fb 100644
> > --- a/docs/devel/code-provenance.rst
> > +++ b/docs/devel/code-provenance.rst
> > @@ -1,7 +1,7 @@
> > .. _code-provenance:
> > 
> > -Code provenance
> > -===============
> > +Code provenance and AI usage
> > +============================
> > 
> > Certifying patch submissions
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > @@ -288,62 +288,89 @@ content generators below.
> > Use of AI-generated content
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > 
> > -TL;DR:
> > +**Please read the below policy before using AI to contribute code or
> > +documentation to QEMU.  This applies to ChatGPT, Claude, Copilot,
> > +Llama, and similar tools.**
> > 
> > -  **Current QEMU project policy is to DECLINE any contributions which are
> > -  believed to include or derive from AI generated content. This includes
> > -  ChatGPT, Claude, Copilot, Llama and similar tools.**
> > +The increasing prevalence of AI-assisted software development,
> > +and especially the use of content generated by `Large Language Models
> > +<https://en.wikipedia.org/wiki/Large_language_model>`__ (LLMs),
> > +poses a number of difficult questions.
> > 
> > -  **This policy does not apply to other uses of AI, such as researching APIs
> > -  or algorithms, static analysis, or debugging, provided their output is not
> > -  included in contributions.**
> > +Risks to open source projects include maintainer burnout from an
> > +increased number of contributions, as well as the risk to the project
> > +from unintentional inclusion of copyrighted material in the LLM's output.
> > +In order to mitigate these risks, the QEMU project currently allows
> > +using AI/LLM tools to produce patches in a limited set of scenarios:
> > 
> > -The increasing prevalence of AI-assisted software development results in a
> > -number of difficult legal questions and risks for software projects, including
> > -QEMU.  Of particular concern is content generated by `Large Language Models
> > -<https://en.wikipedia.org/wiki/Large_language_model>`__ (LLMs).
> > +**Mechanical changes**
> > +  If you can use a deterministic tool or a script, it is preferred
> 
> I think mentioning sed and coccinelle here would be a good idea assuming the
> contributor trying to use AI is not familiar with those so would not even
> know what to ask the AI to help with.


No, let's not go there please.

There is nothing so magical about coccinelle and sed, that we should be
asking people who know nothing about either to have AI generate slop
they can not read and then to run *that* themselves.
     
Nor does the assumption, that said slop will be in the commit message and
the first person to actually read it will be the maintainer, appeal.

-- 
MST