When AI Makes Sharing Expensive: Rebuilding the Digital Commons

Years ago, learning to program could begin with a magazine, a borrowed manual, and a listing you typed character by character. The code might have been clumsy, but it was visible. You could run it, break it, change one line, and start to understand. That small act depended on a larger bargain: people shared knowledge, and the next person treated the sharing as something to preserve rather than strip-mine.

Generative AI is testing that bargain. It can make the commons—shared code, documentation, images, essays, and datasets—far easier to copy and remix. The danger is not that every model training run is automatically unlawful. The danger is that our old tools for attribution, licensing, and trust were designed for people moving files around, not machines processing billions of works and returning a polished answer with its history hidden.

The commons was more than a pile of files

A commons is a shared resource that many people can use and improve. Creative Commons, usually shortened to CC, is a family of standardized copyright licenses that tells others what they may do with creative work. Open-source software uses related ideas, but its licenses govern source code and redistribution. The distinction matters: a CC license on a photograph is not the same legal tool as an Apache or GNU General Public License on a program. (opensource.org)

These licenses turned sharing into a readable social contract. Attribution means giving credit. Share-alike means distributing certain adaptations under the same license. A maintainer could publish a library without negotiating with every future user, while a learner could inspect the source and build on it. The commons worked because the permission traveled with the work often enough to make reuse feel safe.

Training erases the label

A large language model, or LLM, is a machine-learning system trained to predict useful continuations of text, code, images, or other media. During training, it processes enormous collections and adjusts internal numerical parameters, often called weights, so it can reproduce patterns later. During inference—the stage where the model answers a prompt—it usually gives you an output, not a neat list of the works and licenses that influenced it. (creativecommons.org)

That gap creates a provenance problem. Provenance means the record of where something came from and how it changed. Creative Commons’ current guidance emphasizes that CC licenses are copyright licenses, and that their application to AI training depends on the legal circumstances; using a more restrictive license may limit ordinary human reuse without reliably preventing machine training. That is a far more careful position than saying all training is theft, but it still leaves creators asking how a contribution can remain visible and reciprocal once it enters a model.

Law is beginning to demand more disclosure, but disclosure is not the same as attribution. The European Union’s Artificial Intelligence Act requires providers of general-purpose AI—models that can support many downstream tasks—to maintain a copyright policy and publish a sufficiently detailed summary of training content. Those obligations have applied since August 2, 2025, and the European Commission began enforcing the rules on August 2, 2026. The summary is a meaningful baseline, yet it is not a work-by-work ledger that follows an individual paragraph or function into an output. (digital-strategy.ec.europa.eu)

Code turns the abstract problem into a maintenance bill

With software, the missing trail becomes practical. GitHub’s Copilot documentation describes a code-reference feature that can identify public code resembling a suggestion and show the detected license—or NOASSERTION when no license was found. That label does not mean free to use; it means the tool did not find a license assertion. A developer still has to inspect the match, check compatibility, preserve notices, and decide whether the code belongs in the project. (docs.github.com)

The workload grows again when an AI coding agent can take an issue, create a branch, and open a pull request. A pull request is a proposed change that a maintainer reviews before merging. More automated contributions can be useful, but they also create a new queue of code to test, license, secure, and explain. The maintainer’s scarce resource is not typing speed. It is attention.

A small provenance record can make that attention count:

artifact: src/parser.py
declared_license: Apache-2.0
assistance:
 mode: ai-assisted
 human_reviewed: true
matches:
 - kind: public-code
 detected_license: MIT
 compatibility_review: pending
dependencies:
 - name: example-package
 version: 4.2.1

This is an illustrative manifest, not a universal standard. Its value is cultural as much as technical: it tells the next maintainer that generated is not the end of the story. Someone checked the origin, the license, the dependencies, and the behavior.

Openness needs a stronger metadata layer

The practical repair is not to hide every repository. It is to make provenance part of the build, the way tests and version numbers already are. Keep copyright notices, use machine-readable license identifiers such as SPDX IDs—standard identifiers from the Software Package Data Exchange project—record public-code matches, and disclose substantial AI assistance. For dependencies, meaning external packages a project imports, run license and vulnerability checks before merging.

A software bill of materials, or SBOM, is an inventory of the components inside a software product. It can connect package names and versions to licenses, copyright information, and dependency paths. GitHub’s dependency-review tooling can inspect changes in a pull request and enforce license policies, while its SBOM export provides a machine-readable inventory. These tools do not judge authorship, but they prevent “we lost the paperwork” from becoming a permanent excuse. (docs.github.com)

The same principle applies to AI models. The Open Source Initiative’s Open Source AI Definition says genuine openness should provide the freedoms to use, study, modify, and share an AI system. It also treats the preferred form for modification as more than downloadable weights: it includes information about training data, the code used to build and run the system, and the parameters themselves. An impressive model with opaque origins may be accessible, but accessibility alone is not the same as openness. (opensource.org)

Keep the door open, but make sharing reciprocal

How can we use AI-generated code without losing the license trail? The answer is a set of habits and incentives rather than one magic license.

1. Treat provenance as an artifact. Store license data, source commits, model assistance, and review decisions beside the code.
2. Make bots prove their work. Require tests, dependency scans, and a human explanation of the change before an automated pull request reaches the main branch.
3. Publish machine-readable preferences. Creative Commons is developing CC Signals, a framework intended to express how stewards want their works used by AI and to encourage reciprocity. A preference signal is not a new copyright right, but it can make expectations legible to software that cannot read a social norm. (creativecommons.org)
4. Return value to the commons. That can mean attribution, funding, improved documentation, security fixes, or releasing useful tools and datasets back under clear terms.

The goal is not a locked internet where beginners can learn only after paying an intermediary. It is an internet where machines can learn from shared work without making the people who shared it invisible. A future programmer should still be able to open a repository, understand its license, trust its dependencies, and change a line without stepping into an unmarked legal or security trap.

The creative commons is not doomed, but its old trust layer is too thin for machine-scale reuse. The next version of openness will need both generous permissions and durable records of origin. Sharing can survive AI, but only if the systems built to consume the commons also learn how to acknowledge, protect, and replenish it.