Open-source licences are copyright licences, and software is protected by copyright in Bangladesh under the Copyright Act 2023 and through Bangladesh's international copyright obligations. A user who copies, modifies or distributes code outside the licence conditions risks infringing the author's copyright, wherever the licence was drafted. Some licences contain no choice of law clause, so a Bangladeshi court would apply its own principles to interpret them. In practice, enforcement against Bangladeshi companies more often comes through foreign customers, acquirers and platform providers who require compliance in their contracts and diligence. Compliance is therefore a commercial necessity.

Not always. The GPL's source code obligation is generally triggered by distributing the software, for example by shipping an app, firmware or an installer to customers. Running GPL code only on your own servers usually does not trigger it, but the AGPL extends obligations to users interacting with the software over a network. Whether your own code must be released also depends on how it is combined with the GPL component. We review the architecture and the distribution model with your engineers before reaching a view, because small technical changes can alter the legal position significantly.

A blanket warranty of that kind is rarely accurate, since almost all modern development relies on open-source software components. Signing it creates breach and indemnity exposure from the first day. A better approach is to agree a list of approved licences, a disclosure process for components used, an SBOM on delivery and a warranty that disclosed components are used in compliance with their licences. We regularly negotiate this wording for Bangladeshi software exporters and explain to foreign clients why it gives them better protection than an absolute promise that cannot be kept. Liability caps should also apply.

Buyers and investors usually ask for a component inventory or run a code scan through a specialist provider. The results are then reviewed to identify copyleft licences in distributed products, missing attribution, licence conflicts, components with known vulnerabilities and code of unclear origin. We translate those findings into legal risk, propose remediation before closing where possible, and draft disclosure, specific indemnities or price adjustments. For sellers, we recommend a pre-sale audit, because fixing issues in advance is cheaper and less disruptive than negotiating them under deal pressure. Clear explanations help preserve value and trust.

Ownership depends on the employment or engagement terms and on copyright law. Under the Copyright Act 2023, works created by employees in the course of employment generally belong to the employer unless agreed otherwise, but the position for freelancers and contractors is less certain without a written assignment. When staff contribute to external open-source projects, contributor licence agreements may grant rights to the project. We review your contracts, add clear IP assignment and contribution clauses, and set approval rules so that contributions do not unintentionally give away proprietary code or create obligations. Freelancer agreements deserve particular attention.

There is currently no general Bangladeshi statute requiring every software supplier to produce an SBOM. However, SBOMs are increasingly demanded by foreign customers, by regulators in export markets such as the European Union, and by banks and other regulated institutions in Bangladesh as part of IT risk and vendor management. Producing one also makes licence compliance and vulnerability management far easier. We help businesses decide what format and level of detail is appropriate, how often it should be updated and what contractual commitments to give about its accuracy. It can also speed up security reviews.

An unpatched or abandoned open-source software component is a common route for attackers to reach systems that hold personal data. Under the Personal Data Protection Act 2026, organisations processing personal data are expected to adopt appropriate security safeguards, and a breach traced to a known vulnerability that was never fixed would be difficult to defend. Regulated institutions also face sector rules on IT security and incident reporting. We help align open-source software governance with security policies, vendor contracts and incident response plans, so that responsibilities for monitoring and patching are clear. Documentation of those steps matters as well.

Most open-source software enforcement aims at compliance rather than damages, and prompt, cooperative remediation usually resolves matters. The first steps are to preserve records, identify the component and the products affected, check the licence terms and distribution history, and avoid admissions before the facts are clear. We then help prepare a response and a remediation plan, such as releasing source code, correcting notices or replacing the component. If the rights holder seeks more, we advise on negotiating a settlement or defending proceedings in Bangladesh or abroad with counsel in the relevant jurisdiction.