What is the decision you need to make?

Following today's BAC meeting, the Committee is soliciting community feedback to support our recommendation that the Business develop AI policies and procedures for organisational governance. The scope includes assessing whether current OpenSSL licensing and contributor agreements adequately cover AI-related scenarios.

Why is this important?

Risk Management and Security: OpenSSL's core mission involves cryptographic security, and AI introduces new attack vectors and vulnerabilities. AI systems can potentially be used to exploit cryptographic weaknesses, generate sophisticated attacks, or compromise secure communications. Having clear policies helps the organisation understand and mitigate these risks.

Technology Integration: As AI becomes increasingly integrated into software development workflows, from code generation to automated testing and vulnerability detection, OpenSSL needs guidelines for how and when to leverage these tools safely in its development processes without compromising the integrity of its security-critical software.

Supply Chain Considerations: OpenSSL is foundational infrastructure used by countless organisations. AI policies would help establish standards for how AI-generated or AI-assisted code contributions are evaluated, ensuring the same rigorous security standards apply regardless of whether human developers or AI tools were involved in the development process.

Stakeholder Confidence: Given OpenSSL's critical role in global internet security, having transparent AI policies demonstrates responsible governance to the business community, government agencies, and other stakeholders who depend on OpenSSL's reliability and security.

Competitive Positioning: Proactive AI governance can position OpenSSL as a thought leader in secure AI adoption within the open source cryptography space, potentially attracting partnerships and funding from organisations prioritising responsible AI development.

Regulatory Preparedness: As AI regulations evolve globally, having established internal policies positions OpenSSL ahead of potential compliance requirements and demonstrates proactive responsibility to regulators and business partners.

Intellectual Property Protection and Copyright Compliance: OpenSSL must mitigate the risk of inadvertently incorporating copyrighted code through AI-assisted development tools. Many AI coding assistants are trained on vast repositories of code, including proprietary and copyrighted material, and may generate suggestions that closely resemble or directly reproduce protected code. Without clear AI policies, OpenSSL could face significant legal exposure from copyright infringement claims, which would be particularly damaging given OpenSSL's widespread use as foundational internet infrastructure.

Code Quality and Consistency Standards: OpenSSL must establish AI policies to maintain its rigorous code quality, formatting, and architectural standards. AI-generated code often lacks the nuanced understanding of OpenSSL's specific coding conventions, security requirements, and architectural patterns that have been developed over decades of cryptographic software development.

What are you asking of people in this proposal?

We are seeking your approval to recommend that the Business initiate the development of AI policies and procedures to address OpenSSL's organisational needs.

If you have an Objection, please explain why and suggest a modification to the proposal that ensures safety.

Remember, we are seeking consent for a ‘good enough’ decision that is 'safe to try', so we can make a good decision for our organisation.