On October 7, 2026, QGIS banned AI-generated contributions. The new policy is literally "NOT ALLOWED", and it went from vote to merge in two days. The project already had a friendlier policy, and the developer who proposed the ban said plainly that it "clearly didn't work."
If you maintain anything with more than a handful of outside contributors, treat this as a preview of where your project could end up. I'll cover what QGIS did, compare the AI contribution policies of nine open source projects, and end with a policy file you can copy.
What QGIS actually changed
The proposal is QEP 428, "No ai contributions permitted", opened by core developer Nyall Dawson on September 24. It went to a vote on October 5 and was approved and merged on October 7. The PR description is blunt: "This formally changes the AI policy to a strict "NOT ALLOWED" policy." The merged text covers the main qgis/QGIS repo and reads "No LLM, AI or agent assisted code contributions are allowed", with code reversion and sanctions for anyone caught.
QGIS didn't start out anti-AI. Its previous policy, QEP 408, was a "human in the loop" rule modelled on LLVM's, and Dawson called it "quite permissive" when he raised tightening it on the qgis-developer list in June. That thread also cited a conflict inside the PostGIS community that QGIS wanted to avoid repeating.
The numbers in the PR thread explain the mood. By one reviewer's count, around 50 PRs had been tagged "AI Assisted" under the old policy, and about 40 of them were closed without merging. Another QGIS member put the reasoning in one sentence: "AI use from external contributors puts a massive and unbearable pressure on the shoulders of our maintainers."
Dawson also said the ban isn't meant to be "written in stone, forever", and that things like IDE autocomplete or translations might be allowed later, case by case. The PR reactions came out 92 thumbs up to 27 thumbs down.
Who bans AI code, and who allows it with disclosure
QGIS has company. I went through the primary policy docs, and this is where nine projects stand:
| Project | Stance | Key rule | Since |
|---|---|---|---|
| QGIS | Ban | Strict "NOT ALLOWED" (QEP 428) | Oct 2026 |
| Gentoo | Ban | "expressly forbidden" to contribute content created with NLP AI tools | Apr 2024 |
| NetBSD | Ban unless core approves | LLM code "is presumed to be tainted code" and needs prior written approval by core | 2024 |
| QEMU | Ban (output only) | Will "DECLINE any contributions which are believed to include or derive from AI generated content". Research, static analysis and debugging are fine if the output stays out | 2025 |
| Godot | Near-ban | No substantial AI-generated code. AI only for "menial things" like completion or regex, disclosed in the PR. Agents and vibe coding get you banned | Jun 2026 |
| Linux kernel | Allowed, disclosed | Assisted-by: trailer. "AI agents MUST NOT add Signed-off-by tags" | 2026 |
| LLVM | Allowed, human in the loop | A human reviews everything before maintainers see it. No AI on "good first issue" tickets | Jan 2026 |
| Fedora | Allowed, disclosed | MUST disclose when a significant part is taken from a tool unchanged. Assisted-by: trailer recommended | Oct 2025 |
| Ghostty | Allowed, disclosed | "All AI usage in any form must be disclosed". Bad AI drivers get publicly denounced | 2025 |
The bans give two different reasons. Gentoo, NetBSD and QEMU worry about copyright: you can't sign a Developer Certificate of Origin for code whose license status QEMU calls "ill-defined." QGIS and Godot worry about reviewers: the Godot Foundation said AI submissions made a backlog of PRs waiting for too few qualified reviewers even worse. Those two problems need different fixes, and most of the shouting online mixes them up.
Can an AI code ban even be enforced?
A recurring objection on Hacker News is that you can't detect AI code, so the ban "will age like milk." Even QGIS's own people admitted it: Tim Sutton said in the PR thread that the only real test is "did you in good conscience write the code yourself," since nobody can inspect a contributor's laptop.
I think that misreads what these policies are for. A ban moves the burden of proof. Without it, a maintainer who closes a 2,000-line PR that is plausible but wrong has to justify it line by line. With it, they write "this looks generated, see QEP 428" and move on. One HN commenter put it well: "it's not about detecting AI, it's about reducing the amount of code to review."
Still, I don't think the QGIS approach is the best version. It also punishes the contributor who used Copilot for a regex and then read every line. Commenters on the PR asked whether ML-ranked autocomplete, search engines and AI-assisted review are covered, and the visible thread has no clear answer. Honest contributors can't tell what's covered, dishonest ones will ignore it anyway, and I think that's a bad trade.
The rules that work are the boring structural ones. LLVM keeps AI off "good first issue" tickets. Godot's June 30 policy update requires maintainer approval for new features or big refactors from anyone with three or fewer merged PRs. These cut review load without anyone having to guess how a patch was written.
Rich Hickey's "AI is not a tool" and the reviewer's problem
This week Rich Hickey published "'AI' Is Not a Tool", and it fits the QGIS fight surprisingly well. His line: "Tools are implements with which you do something, they do not do things for you." LLMs, he says, "are automation."
You can argue about the definition, and Lobsters did. joelgrus called the claim that users don't steer LLMs "just not true?" But for maintainers, Hickey's framing is the useful one. A contributor who used a tool understands the patch. A contributor who ran automation may not, and the reviewer ends up doing the understanding for them. That is exactly the cost QGIS says it can no longer absorb. It's also why so many of the "allowed" policies above include some version of "you must be able to explain this without the AI."
A template AI contribution policy you can copy
If you don't want a total ban but want something better than "please be nice," drop this in AI_POLICY.md and link it from CONTRIBUTING.md:
# AI contribution policy
1. You are the author. You must understand every line you submit and be
able to explain and fix it without an AI tool. "The model wrote it"
is not an answer in review.
2. Disclose. If a significant part of a commit came from an AI tool
without substantial changes, add a trailer:
Assisted-by: <tool and model>
Autocomplete of a single line, grammar fixes and spell checking do
not need disclosure.
3. Only humans sign off. Agents must not add Signed-off-by or open PRs,
issues or comments on their own.
4. No AI on issues labelled "good first issue". Those exist so people
can learn the codebase.
5. Contributors with 3 or fewer merged PRs need a maintainer's OK in an
issue before opening a PR for a new feature or a large refactor.
6. Maintainers may close any contribution that appears to violate this
policy without a detailed review. Repeat violations lead to a ban.
7. This policy will be revisited every 6 months.Rules 1 to 3 follow the kernel, Fedora and Ghostty. Rule 4 is from LLVM, rule 5 from Godot's newcomer rule, and rule 6 is what QGIS actually needed.
For the disclosure part, git can do the work. Since git 2.32 you can add trailers without editing the message by hand:
git commit -s --trailer "Assisted-by: Copilot" -m "Fix CRS lookup for EPSG:3857"And to see how much disclosed AI code you've actually merged:
git log --format='%h %(trailers:key=Assisted-by,valueonly,separator=%x2C )' | awk 'NF>1'Add a checkbox to .github/pull_request_template.md ("I have read AI_POLICY.md and disclosed any AI assistance") so nobody can say they missed it.
My take: Godot's middle ground wins
QGIS made the right call for QGIS. If 40 of 50 tagged PRs are getting closed, your "human in the loop" policy has turned into a free code review service. But I'd bet that in a year more projects end up at Godot's middle ground than at a full ban, because that's the version maintainers can enforce without running a lie detector.
Would you merge a good PR if you knew an AI wrote it? And should a project even be allowed to ask, when it has no way to check the answer?
Sources
- QGIS QEP 428 PR: https://github.com/qgis/QGIS-Enhancement-Proposals/pull/387
- HN discussion: https://news.ycombinator.com/item?id=50054751
- Rich Hickey, "'AI' Is Not a Tool": https://www.linkedin.com/pulse/ai-tool-rich-hickey-kjl8e
- Lobsters discussion: https://lobste.rs/s/ikk8ie/ai_is_not_tool
- Gentoo AI policy: https://wiki.gentoo.org/wiki/Project:Council/AI_policy
- NetBSD commit guidelines: https://www.netbsd.org/developers/commit-guidelines.html
- QEMU code provenance: https://www.qemu.org/docs/master/devel/code-provenance.html
- Linux kernel coding assistants doc: https://docs.kernel.org/process/coding-assistants.html
- LLVM AI tool use policy: https://llvm.org/docs/AIToolPolicy.html
- Fedora AI-assisted contributions policy: https://forge.fedoraproject.org/council/docs/commit/823e93b640dea2205d6df2bc51586552a52898d7
- Godot Foundation, "Changes to our Contribution Policies": https://godotengine.org/article/contribution-policy-2026/
- Ghostty AI_POLICY.md: https://next.tangled.org/ptr.pet/ghostty/blob/main/AI_POLICY.md
- qgis-developer thread on tightening QEP 408: https://lists.osgeo.org/pipermail/qgis-developer/2026-June/068375.html