You are viewing a plain text version of this content. The canonical link for it is here.
Posted to site-notify@rai.apache.org by jg...@apache.org on 2026/08/20 02:18:25 UTC
(rai-site) branch main updated: Adding Best Practices. Basic editorial review by gstein. Under principles of CTR for rai-site, I'm directly committing this. Please review and edit at will.
This is an automated email from the ASF dual-hosted git repository.
jgenender pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/rai-site.git
The following commit(s) were added to refs/heads/main by this push:
new ca814cc Adding Best Practices. Basic editorial review by gstein. Under principles of CTR for rai-site, I'm directly committing this. Please review and edit at will.
ca814cc is described below
commit ca814cc144fdea04afd30efc028563b3237ef7af
Author: Jeff Genender <jg...@savoirtech.com>
AuthorDate: Wed Aug 19 20:16:48 2026 -0600
Adding Best Practices. Basic editorial review by gstein. Under principles of CTR for rai-site, I'm directly committing this. Please review and edit at will.
---
content/pages/ai-generated-code.md | 106 ++++++++++++++++++++
content/pages/authored-by-tags.md | 102 +++++++++++++++++++
content/pages/best-practices.md | 28 ++++++
content/pages/commit-messages.md | 115 ++++++++++++++++++++++
content/pages/eu-ai-act.md | 168 ++++++++++++++++++++++++++++++++
content/pages/policy-recommendations.md | 97 ++++++++++++++++++
content/pages/us-copyright-law.md | 110 +++++++++++++++++++++
content/theme/templates/menu.html | 16 ++-
8 files changed, 740 insertions(+), 2 deletions(-)
diff --git a/content/pages/ai-generated-code.md b/content/pages/ai-generated-code.md
new file mode 100644
index 0000000..9e23d0f
--- /dev/null
+++ b/content/pages/ai-generated-code.md
@@ -0,0 +1,106 @@
+Title: AI-Generated Code in Apache Projects
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## Contributing AI-Generated Code to Apache Projects
+
+Apache contributors increasingly use AI tools — such as GitHub Copilot, Claude,
+Cursor, and other large language model (LLM) assistants — to help generate code,
+fix bugs, write documentation, and review pull requests. When the code you
+contribute to an Apache project has been significantly generated or modified by
+an AI tool, there are practical and legal considerations to keep in mind.
+
+## Your Obligations as a Contributor
+
+Under the Apache Contributor License Agreement (CLA), you represent that your
+contribution is your **original creation** or that you have the right to submit
+it under the applicable license. Specifically, Section 7 of the CLA states:
+
+> *Except as expressly provided in your Contribution, You disclaim all warranties
+> any express or implied, including, without limitation, any warranties of title.*
+
+This means you are responsible for the code you contribute — you should understand
+it, be able to explain it, and have the right to license it under the Apache
+License 2.0.
+
+## How the US Copyright Office Views AI-Generated Material
+
+The US Copyright Office's guidance on AI-generated works distinguishes between
+three scenarios:
+
+### Scenario 1: Purely AI-Generated
+
+If a work is generated entirely by an AI without any human creative input, it
+receives **no copyright protection**. The US Court of Appeals held in _Thaler
+v. Perlmutter_, 49 F.4th 611 (D.C. Cir. 2023) that only natural persons can be
+authors under the Copyright Act.
+
+**What this means for you:** You can still contribute purely AI-generated code
+to an Apache project — there is no legal barrier to contributing material that
+is not copyrightable. The distinction matters mainly for downstream users who
+want to know what is protected.
+
+### Scenario 2: Human-Authored Work with Embedded AI Material
+
+If you wrote a substantial amount of code and the AI contributed some portions
+(e.g., you used it to generate a function but then edited, reorganized, and
+integrated it into a larger module), the **human-authored portions** are
+copyrightable, while the AI-generated portions are not.
+
+**What this means for you:** If you curate, edit, or substantially modify
+AI-generated code, the human contribution is protectable. Document what you
+did to make it your own creation.
+
+### Scenario 3: AI-Assisted (Human Uses AI as a Tool)
+
+If you use AI as an assistive tool — much like using a compiler, a linter, or
+an IDE autocomplete — and you exercise creative control over the result, the
+work as a whole is copyrightable, and **you** are the author.
+
+**What this means for you:** This is the most common scenario for Apache
+contributors. Using AI to suggest code, identify bugs, or generate a draft that
+you then review and integrate is generally safe.
+
+## Conditions for Contributing AI-Generated Code
+
+Before contributing code that was significantly generated or modified by an AI
+tool, consider the following:
+
+1. **Verify the tool's terms of service.** Some AI tools grant the provider broad
+ rights over your input (your code) and output (the generated code). Make sure
+ these terms are compatible with contributing under the Apache License 2.0.
+
+2. **Check for third-party material.** AI models are trained on vast corpora
+ that may include open source code from other projects. If the AI generates
+ code that closely resembles a file from a copyrighted project, there is a
+ (currently small) risk that the output could be a derivative work. This risk
+ is low for typical use but something to be aware of.
+
+3. **Review and understand the output.** You are responsible for what you commit.
+ Read the AI-generated code, verify it is correct, and be able to explain what
+ it does.
+
+4. **Disclose AI use.** Apply the `Apache-ai` tag to your commit if AI played a
+ significant role. See [Policy Recommendations](policy-recommendations.html)
+ for details.
+
+## When to Use the Apache-ai Tag
+
+- **Use it** when a significant portion of your contribution was generated by AI
+ and you want to signal transparency to downstream users and the community.
+
+- **You may skip it** when AI was used only incidentally (e.g., it suggested a
+ single function that you heavily edited, or you used it only for documentation
+ prose).
+
+- **When in doubt, use it.** The tag is a disclosure, not a warranty. It tells
+ readers the story without imposing any additional obligations.
+
+## Further Reading
+
+- See [US Copyright Law and AI](us-copyright-law.html) for the full legal context.
+- See [Policy Recommendations](policy-recommendations.html) for a summary of
+ the Apache-ai tag and key recommendations.
+- See [Commit Messages for AI-Assisted Code](commit-messages.html) for conventions
+ on documenting AI use in commits.
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/pages/authored-by-tags.md b/content/pages/authored-by-tags.md
new file mode 100644
index 0000000..5b23d0f
--- /dev/null
+++ b/content/pages/authored-by-tags.md
@@ -0,0 +1,102 @@
+Title: "Authored by" and "Co-authored" Tags
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## Attribution Tags When AI Assists in Creating Content
+
+Git commit messages support trailer tags that record who contributed to a piece of
+code. The two most common are:
+
+- **`Author:`** — the person who created the work
+- **`Co-authored-by:`** — another person who contributed meaningfully to the work
+
+When AI tools have assisted in creating or modifying code, contributors have
+asked: *How should I record that?*
+
+This page provides practical guidance for Apache contributors.
+
+## Understanding the Tags
+
+### `authored-by: Person Name`
+
+Use this when **the human made the substantive creative choices** for the
+contribution. Even if AI helped generate parts of the code (e.g., a function was
+drafted by an AI tool but the human selected, edited, reviewed, and integrated
+it), the human is the author.
+
+This is the standard and safe approach. It is consistent with US copyright law
+(_Thaler v. Perlmutter_, 49 F.4th 611 (D.C. Cir. 2023)), which holds that only
+natural persons can be authors.
+
+**Example:**
+
+```
+authored-by: Jane Doe <ja...@example.com>
+```
+
+### `co-authored-by: Person Name`
+
+Use this when **another person** contributed meaningfully to the work — for
+example, they reviewed, provided the design, or wrote a section of code that you
+integrated. The `co-authored-by` trailer is a convention originated by GitHub and
+is widely supported by project management tools.
+
+What about using `co-authored-by` for the AI tool itself? This is a developing
+area. Legally, AI cannot be an author under US law. But conventionally, some
+projects use this tag as a **provenance record** rather than a legal assertion.
+
+**Examples:**
+
+```
+# As a provenance record (not a legal assertion):
+co-authored-by: Claude <no...@anthropic.com>
+
+# When another person also contributed:
+co-authored-by: Jane Doe <ja...@example.com>
+co-authored-by: Claude <no...@anthropic.com>
+```
+
+Both are acceptable conventions — choose what your project prefers.
+
+### A Proposed Convention: `ai-assisted-by`
+
+Some contributors have suggested a new trailer tag specifically for AI tools:
+
+```
+ai-assisted-by: Claude-3.5-Sonnet
+```
+
+This tag is not yet a standard, but it has the advantage of being unambiguous:
+it clearly indicates that an AI tool assisted in creating the work, without
+implying that the AI is a legal author or a human co-author.
+
+## Best Practices
+
+1. **Be transparent.** If AI assisted in creating a contribution, document it.
+ This helps downstream users understand the provenance of the code.
+
+2. **Use `authored-by` for the human.** The human who exercised creative control
+ over the contribution is the author, regardless of whether AI helped generate
+ parts of the code.
+
+3. **Use `co-authored-by` for people.** If another person contributed, use the
+ standard `co-authored-by` trailer.
+
+4. **Consider `ai-assisted-by` for AI tools.** If your project adopts this
+ convention, it provides clear, unambiguous attribution for AI assistance.
+
+5. **Use the `Apache-ai` commit tag** if AI played a significant role. See
+ [Policy Recommendations](policy-recommendations.html) for details on the
+ Apache-ai tag.
+
+6. **These are conventions, not legal requirements.** Individual projects may
+ adopt whatever attribution practices they find useful. The ASF does not
+ mandate a specific convention.
+
+## Relationship to Other Pages
+
+- See [Commit Messages for AI-Assisted Code](commit-messages.html) for conventions
+ on documenting AI use in commit messages.
+- See [AI-Generated Code in Apache Projects](ai-generated-code.html) for broader
+ guidance on contributing AI-generated code.
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/pages/best-practices.md b/content/pages/best-practices.md
new file mode 100644
index 0000000..3810153
--- /dev/null
+++ b/content/pages/best-practices.md
@@ -0,0 +1,28 @@
+Title: Best Practices
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## Guidance
+
+The following pages provide guidance on using AI in Apache projects. They cover
+copyright law, practical attribution conventions, commit message practices, and
+the Apache-ai tag policy.
+
+| Page | Description |
+|---|---|
+| [AI-Generated Code in Apache Projects](ai-generated-code.html) | Guidelines for contributing code generated with AI tools to an Apache project |
+| [US Copyright Law and AI](us-copyright-law.html) | Thaler v. Perlmutter, US Copyright Office guidance, and what they mean for Apache contributors |
+| [EU AI Act and Copyright](eu-ai-act.html) | EU AI Act timelines, transparency rules, and implications for ASF projects |
+| ["Authored by" and "Co-authored" Tags](authored-by-tags.html) | Best practices for attribution when AI assisted in creating content |
+| [Commit Messages for AI-Assisted Code](commit-messages.html) | Conventions for documenting AI use in commit messages |
+| [Policy Recommendations](policy-recommendations.html) | The Apache-ai tag and key recommendations for AI-assisted contributions |
+
+## Related
+
+| Page | Description |
+|---|---|
+| [FAQ](faq.html) | Common questions about the Responsible AI initiative |
+| [What We Do](what-we-do.html) | Our activities and guiding principles |
+| [Get Involved](get-involved.html) | Join the discussion and contribute |
+
+*These pages are guidance, not binding policy. Individual Apache projects
+remain self-governing and may adopt what is useful to them.*
diff --git a/content/pages/commit-messages.md b/content/pages/commit-messages.md
new file mode 100644
index 0000000..ff47faa
--- /dev/null
+++ b/content/pages/commit-messages.md
@@ -0,0 +1,115 @@
+Title: Commit Messages for AI-Assisted Code
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## Documenting AI Use in Commit Messages
+
+When AI tools assist in generating code for an Apache project, commit messages
+serve as the primary record of provenance. Good commit messages help future
+contributors understand what happened, and they provide the metadata that
+provenance-tracking tools need.
+
+## The `Generated-by:` Token Convention
+
+The ASF's generative tooling guidance recommends the use of a `Generated-by:`
+token in commit messages to document AI-assisted code generation.
+
+**Format:**
+
+```
+Generated-by: <tool-name>
+```
+
+**Examples:**
+
+```
+Generated-by: Claude-3.5-Sonnet
+Generated-by: GitHub Copilot
+Generated-by: Cursor
+Generated-by: Gemini-2.0
+```
+
+This token is a **convention** — it is not yet a formal, Foundation-wide
+requirement. Individual projects may adopt it, modify it, or create their own
+variants.
+
+## Example Commit Messages
+
+### Simple: AI Generated a Function
+
+```
+feat(auth): add JWT token validation middleware
+
+Generated-by: Claude-3.5-Sonnet
+
+Added a middleware function that validates JSON Web Tokens in the
+authentication pipeline. The function checks the token signature,
+extracts the subject claim, and attaches it to the request context.
+```
+
+### Mixed: AI Drafted Code, Human Edited Heavily
+
+```
+fix(parser): correct handling of malformed JSON payloads
+
+Reviewed and edited code generated with GitHub Copilot.
+Manually added error cases for null inputs and truncated buffers.
+
+Fixes #1234.
+```
+
+### Fully Human, AI Aided Review
+
+```
+docs: update contributing guide with AI tooling notes
+
+Reviewed the draft using an AI assistant for clarity suggestions.
+All content written by the author.
+```
+
+## Best Practices
+
+1. **Be specific.** When using `Generated-by:`, name the actual tool you used
+ (e.g., `Claude-3.5-Sonnet`, `GitHub Copilot`) rather than a generic label.
+ This helps future tooling and provenance analysis.
+
+2. **Explain what AI did and what you did.** If AI generated the code but you
+ reviewed and edited it, say so. This provides context for reviewers and
+ downstream users.
+
+3. **The commit message is your representation.** Even if AI helped write the
+ code, the commit message is your word as the committer. You are responsible
+ for what you commit, regardless of whether AI generated any part of it.
+
+4. **Use the Apache-ai tag alongside `Generated-by:`.** If AI played a
+ significant role, add both the `Apache-ai` tag (for policy transparency)
+ and the `Generated-by:` token (for provenance tracking).
+
+5. **Keep it readable.** Don't over-annotate. A single `Generated-by:` line
+ and a brief description of what the AI produced and how you edited it is
+ sufficient.
+
+## Sample Commit with Both Tags
+
+```
+feat(config): add database connection pooling
+
+Generated-by: Cursor
+Apache-ai: This contribution contains code significantly generated
+by an AI tool. The function signature and connection logic were
+drafted by the AI; error handling and integration were written
+manually.
+
+Added configurable connection pooling to the database client.
+Supports connection limits, idle timeouts, and health checks.
+```
+
+## Relationship to Other Pages
+
+- See [Policy Recommendations](policy-recommendations.html) for the full
+ Apache-ai tag guidance.
+- See ["Authored by" and "Co-authored" Tags](authored-by-tags.html) for
+ attribution conventions.
+- See [AI-Generated Code in Apache Projects](ai-generated-code.html) for
+ broader guidance on contributing AI-generated code.
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/pages/eu-ai-act.md b/content/pages/eu-ai-act.md
new file mode 100644
index 0000000..00b87a5
--- /dev/null
+++ b/content/pages/eu-ai-act.md
@@ -0,0 +1,168 @@
+Title: EU AI Act and Copyright
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## The EU AI Act and Its Impact on Apache Projects
+
+The European Union's **Artificial Intelligence Act** (Regulation (EU) 2024/1689)
+is the first comprehensive AI law in the world. It has phased into effect over
+time, and as of August 2026, several key provisions are already in force.
+
+This page summarizes the Act's relevance to the Apache Software Foundation and
+to Apache contributors who use AI tools.
+
+## The AI Act Timeline
+
+The Act entered into force on **1 August 2024**. Obligations apply in phases:
+
+| Date | Provision | Status |
+|---|---|---|
+| **February 2025** | Prohibited AI practices (Article 5) and AI literacy requirements (Article 4) | In force |
+| **August 2025** | General-purpose AI (GPAI) model rules (Articles 51–56) | In force |
+| **2 August 2026** | Transparency obligations (Article 50) | **In force** |
+| **2 December 2027** | High-risk system rules (standalone Annex III systems), deferred by the Digital Omnibus Regulation | Deferred |
+| **2 August 2028** | High-risk systems embedded in regulated products (Annex I), deferred | Deferred |
+
+The Act also established enforcement powers for the AI Office as of 2 August
+2026.
+
+## Key Transparency Rules: Article 50
+
+Article 50 is the most relevant provision for Apache contributors. It contains
+transparency obligations for both **providers** (those who build and distribute
+AI systems) and **deployers** (those who use AI systems).
+
+### What Providers Must Do
+
+Providers of generative AI systems must ensure that their outputs (synthetic text,
+images, audio, video) carry effective, **machine-readable marks** so they can be
+detected as AI-generated. There is a transition period until 2 December 2026 for
+systems that were already on the market before 2 August 2026.
+
+### What Deployers Must Do
+
+Deployers (such as an organization that uses a third-party AI service) must:
+
+- Clearly label **deepfakes** — AI-generated or manipulated images, audio, or
+ video that resemble real persons, objects, or events and could appear authentic.
+- Label **AI-generated or manipulated text** that is published to inform the
+ public on matters of public interest (e.g., topics related to politics,
+ democracy, public administration, public health), **but only if** the text has
+ **not** undergone genuine human review or editorial control, and no natural or
+ legal person assumes editorial responsibility for the publication.
+
+### The Human-Review Exception
+
+This is an important exception: if the AI-generated text has gone through genuine
+human review and someone takes editorial responsibility for it, the labeling duty
+does not apply. This exception is central to the Act's design — it targets
+unreviewed AI-generated content that could mislead the public, not every piece of
+AI-assisted writing.
+
+Artistic, creative, satirical, and fictional works also receive lighter or
+different treatment.
+
+## Article 50(4): The "Public Interest Text" Labeling Duty
+
+Article 50(4) is the specific paragraph that obligates deployers to label
+AI-generated or manipulated text. The labeling duty applies when **all three**
+of the following conditions are met:
+
+1. **Published** — the text is made available to the public.
+2. **To inform the public** — the purpose is to inform, not merely to share
+ or entertain.
+3. **On a matter of public interest** — this covers politics and democratic
+ processes, public administration, justice, fundamental rights, public
+ security and health, environment, consumer safety, and economic, financial,
+ scientific, or cultural developments that are subjects of public debate.
+
+These three conditions must **all** be satisfied for the duty to trigger.
+
+**Exception:** The duty does **not** apply if the text has undergone genuine
+human review or editorial control, and a natural or legal person has assumed
+editorial responsibility for the publication.
+
+### What this means for ASF projects
+
+- **Code, commit messages, PR discussions, issue trackers, technical READMEs,
+ API docs, and design docs** are not "informing the public on matters of
+ public interest" — they are technical materials, not news-like content on
+ politics, democracy, public administration, or similar topics.
+- **Release notes** about a software release are also not "public interest
+ text" in the sense targeted by the Act.
+- **Blog posts or press releases** on technology policy topics could fall
+ closer to the line — but the ASF's normal review process (PMC review,
+ committer oversight) would normally satisfy the human-review exception.
+- **Deepfakes** (AI-generated/manipulated images, audio, or video of real
+ persons, objects, or events) require disclosure regardless of whether
+ they relate to a public-interest topic.
+
+## How This Applies to the Apache Software Foundation
+
+The AI Act has **extraterritorial reach** (Article 2): it applies to non-EU
+providers and deployers if their AI output is used in the EU. Because the ASF is
+a US-based nonprofit with European participants, websites, mailing lists, and
+tools accessed from the EU, some provisions can apply.
+
+However, for most ordinary ASF activities, the direct compliance burden under the
+transparency provisions is expected to be **low to negligible** for several reasons:
+
+- **Most ASF output is software and technical documentation**, not "text published
+ to inform the public on matters of public interest" as defined by the Act.
+- **Source code is explicitly carved out** from the labeling requirements. The
+ Commission's guidance on Article 50(2) states that source code (and by extension
+ typical code comments and docstrings) is a technical output, not human-facing
+ content that risks misleading the public.
+- **ASF processes involve human review and editorial control** — PMC review,
+ committer oversight, and the contribution review process — which normally satisfy
+ the human-review exception.
+- **ASF is a deployer, not a provider** — when ASF or its contributors use
+ third-party LLM APIs, the third-party company is the provider of the model.
+ ASF is deploying those services, not selling them.
+
+### Where the AI Act Could Matter for ASF
+
+There are limited scenarios where the AI Act could create obligations:
+
+1. **AI-assisted public-facing text** on topics of public interest (e.g.,
+ an AI-drafted blog post about technology policy that is lightly or not
+ reviewed) could trigger the labeling duty.
+
+2. **Public-facing chatbots or interactive AI assistants** on ASF sites would
+ need to disclose when users are interacting with an AI system.
+
+3. **Releasing generative AI systems** (not just using one) — if a project
+ releases a generative AI model or tool that is made available in the EU,
+ provider-side rules could apply.
+
+## The EU AI Act and Copyright for Contributors
+
+For individual Apache contributors using AI tools, the most relevant provisions
+are:
+
+- **Article 4 (AI literacy):** Organizations deploying AI should ensure their
+ staff understand how those systems work. This is a soft obligation — take
+ reasonable measures so that people using AI tools understand their capabilities
+ and limitations.
+
+- **Article 5 (Prohibited practices):** Already in force. These include practices
+ like manipulative or deceptive techniques, exploitative behavior toward
+ vulnerable groups, and social scoring. These are unlikely to affect typical
+ AI-assisted code contributions but are worth knowing.
+
+- **Source code carve-out:** As noted above, source code is not subject to the
+ AI Act's transparency labeling requirements. This means AI-generated code in
+ an Apache project is not treated the same way as AI-generated blog posts or
+ news articles.
+
+## Bottom Line
+
+The EU AI Act has partially entered into force. The transparency rules that are
+live (Article 50) have a broad scope but important exceptions — particularly the
+human-review exception and the source-code carve-out — that shield most ordinary
+Apache activities from direct compliance obligations.
+
+If your project uses AI in a novel way (e.g., a public chatbot, a generative
+AI tool, or AI-drafted public-interest content), those use cases should be
+reviewed against the specific Article 50 criteria.
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/pages/policy-recommendations.md b/content/pages/policy-recommendations.md
new file mode 100644
index 0000000..86d978d
--- /dev/null
+++ b/content/pages/policy-recommendations.md
@@ -0,0 +1,97 @@
+Title: Policy Recommendations
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## Policy Recommendations for AI-Assisted Contributions
+
+This page summarizes the Apache Software Foundation's guidance and key
+recommendations for contributors who use AI tools when contributing code,
+documentation, or other material to Apache projects.
+
+## The Apache-ai Commit Tag
+
+The **Apache-ai** tag is a voluntary disclosure mechanism. When added to a
+commit, it signals that AI played a significant role in generating the
+contribution.
+
+### What It Is
+
+- A tag in the commit message body, following the conventional `key: value`
+ format used by Git trailer tags.
+- A **disclosure**, not a warranty or a restriction. It tells downstream users
+ the story without imposing additional legal obligations.
+- Recognized by the ASF as a best practice for transparency, but it is not yet
+ a mandatory requirement across all projects.
+
+### When to Use It
+
+| Situation | Recommendation |
+|---|---|
+| AI generated significant portions of code (core logic, large functions) | **Use the tag** — it is strongly recommended |
+| AI helped generate documentation or prose | **Consider the tag** — use it if the AI substantially rewrote the text |
+| AI assisted incidentally (suggested a single fix you heavily edited) | **Optional** — use it if you want to be thorough |
+| You are unsure | **Use it** — it is a disclosure, not a liability |
+
+### Example
+
+```
+Apache-ai: This contribution contains code significantly generated
+by an AI tool. See AI tagging policy for details.
+```
+
+## Key Recommendations
+
+1. **Be transparent about AI tooling used.** Name the tool in your commit
+ message using the `Generated-by:` token (e.g., `Generated-by:
+ Claude-3.5-Sonnet`). This helps future provenance-tracking tools.
+
+2. **Verify tool terms are compatible with Apache License 2.0.** Check the
+ terms of service for your AI tool. Some tools grant the provider broad
+ rights over your input (your code) and output (the generated code). Make
+ sure these terms do not conflict with contributing under the Apache License
+ 2.0.
+
+3. **Understand that AI-generated-only content may not be copyrightable.**
+ Under US law, only natural persons can be authors. Purely AI-generated
+ material may not receive copyright protection. This does not prevent you
+ from contributing it — but it is important for downstream users to know
+ what is protected.
+
+4. **Maintain human oversight and editorial control.** You are responsible
+ for what you commit. Review AI-generated code, understand it, and be able
+ to explain what it does. The `authored-by:` tag for the human who made
+ the creative decisions is the standard and safe approach.
+
+5. **Use attribution tags consistently.** Use `authored-by:` for the human
+ author, `co-authored-by:` for other humans, and consider `ai-assisted-by:`
+ for AI tools. Consistency helps the community understand how AI is being
+ used.
+
+6. **Document AI use in commit messages.** Use the `Generated-by:` token and
+ describe what the AI produced and how you reviewed or edited it. This
+ provides the provenance record that future tooling and reviewers need.
+
+7. **Be aware of the EU AI Act.** If you or your project uses AI in ways
+ that reach EU audiences (e.g., public-facing chatbots, AI-drafted
+ public-interest content), review the transparency obligations under
+ Article 50 of Regulation (EU) 2024/1689. See
+ [EU AI Act and Copyright](eu-ai-act.html) for details.
+
+## This Is Guidance, Not Binding Policy
+
+The recommendations on this page are **guidance**, not binding policy.
+Individual Apache projects remain self-governing under the Apache Way and may
+adopt, adapt, or ignore these recommendations as they see fit. The initiative
+offers these as shared good practices, and projects are encouraged to discuss
+them on the [mailing list](get-involved.html).
+
+## Cross-Reference: All Best Practices Pages
+
+| Topic | Page |
+|---|---|
+| Guidelines for contributing AI-generated code | [AI-Generated Code in Apache Projects](ai-generated-code.html) |
+| US copyright law and AI | [US Copyright Law and AI](us-copyright-law.html) |
+| EU AI Act and copyright | [EU AI Act and Copyright](eu-ai-act.html) |
+| Attribution tags | ["Authored by" and "Co-authored" Tags](authored-by-tags.html) |
+| Commit message conventions | [Commit Messages for AI-Assisted Code](commit-messages.html) |
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/pages/us-copyright-law.md b/content/pages/us-copyright-law.md
new file mode 100644
index 0000000..7f21a6c
--- /dev/null
+++ b/content/pages/us-copyright-law.md
@@ -0,0 +1,110 @@
+Title: US Copyright Law and AI
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+## US Copyright Law and Artificial Intelligence
+
+A growing number of Apache contributors use AI tools to write, edit, and review
+code. The question arises: **who owns the copyright in that code, and what does
+that mean for the Apache community and downstream users?**
+
+This page summarizes the current state of US copyright law as it applies to
+AI-generated and AI-assisted software.
+
+## The Key Court Case: _Thaler v. Perlmutter_
+
+The controlling US authority is the decision of the US Court of Appeals for the
+DC Circuit in **_Thaler v. Perlmutter_, 49 F.4th 611 (2023)**.
+
+The case was brought by Dr. Stephen Thaler, who created an AI system called
+DABUS that generated artwork and patents. Thaler registered the copyright in
+works that the AI produced **without any human author listed**. The US Copyright
+Office refused registration, and the courts agreed: the Copyright Act requires a
+**human author**.
+
+The court held that the Copyright Act's reference to "author" means **only
+natural persons** (i.e., human beings) can be authors of copyrighted works. This
+is the current legal standard.
+
+## The US Copyright Office's Guidance
+
+Following this ruling, the US Copyright Office issued guidance on "Generation
+and Recognition of AI" (2023–2025) that applies this principle to three distinct
+scenarios:
+
+### Scenario 1: Purely AI-Generated
+
+A work is entirely generated by an AI system without any human creative input.
+
+**Copyright status:** No copyright protection. The work is in the public domain
+because there is no human author.
+
+**Example:** You type a prompt into an AI code generator, it produces a file of
+code, and you copy-paste it into your project without any editing or selection.
+
+### Scenario 2: Human-Authored with Embedded AI Material
+
+A work contains both human-authored elements and AI-generated material.
+
+**Copyright status:** Only the **human-authored portions** are protected. The
+AI-generated portions are not. If the work cannot be separated into distinct
+human and AI portions, the protection is limited.
+
+**Example:** You write a module, use AI to generate a helper function, and then
+edit that function to fit the module's design. The module structure and your
+edits are protected; the raw AI output is not.
+
+### Scenario 3: AI-Assisted (Human Uses AI as a Tool)
+
+The human uses an AI tool in a way that is analogous to using a camera, a
+synthesizer, or an IDE — the tool assists, but the human makes the creative
+decisions.
+
+**Copyright status:** The work as a whole is copyrightable. The human is the
+author.
+
+**Example:** You write code, ask an AI to suggest a refactor, review the
+suggestion, choose which changes to apply, and integrate them into your code.
+
+## What "Creative Control" Means
+
+The key factor distinguishing Scenario 2 from Scenario 3 is **human creative
+control** — did the human make substantive creative choices about the expression
+of the work?
+
+Factors that suggest creative control:
+- You reviewed the AI output and selected, edited, or arranged it
+- You exercised judgment about which AI suggestions to accept
+- You integrated the AI material into a larger work with your own structure
+
+Factors that suggest limited control:
+- You accepted the AI output as-is without review
+- You used a single prompt and copied the result without modification
+- You could not explain or describe what the AI produced
+
+## Implications for Apache Contributors
+
+1. **You can contribute AI-generated code.** There is no legal barrier to
+ contributing material that may not be fully copyrightable. The Apache License
+ 2.0 does not require the contributor to hold copyright — it only requires that
+ you have the right to contribute it.
+
+2. **Be transparent.** Use the `Apache-ai` commit tag when AI played a
+ significant role in generating the code. See
+ [Policy Recommendations](policy-recommendations.html).
+
+3. **Document your process.** If you used AI to generate code, note what you did
+ to review, edit, and integrate it. This helps downstream users understand the
+ provenance of the code.
+
+4. **Your representation and warranty still apply.** Under Section 4 of the
+ Apache License 2.0, you represent that your contribution is your original
+ work or that you have the right to submit it. Using AI does not change this
+ obligation — you are still responsible for what you commit.
+
+## Further Reading
+
+- [_Thaler v. Perlmutter_, 49 F.4th 611 (D.C. Cir. 2023)](https://cavc.appclmr.com/opinions/2023-1566)
+- [US Copyright Office, "Generation and Recognition of AI"](https://www.copyright.gov/rulings-filings/review-board/docs/ai-final-refusal-2023/)
+- See [AI-Generated Code in Apache Projects](ai-generated-code.html) for practical guidance on contributing.
+
+*Back to [Best Practices](best-practices.html).*
diff --git a/content/theme/templates/menu.html b/content/theme/templates/menu.html
index fac8b32..9ba98e2 100644
--- a/content/theme/templates/menu.html
+++ b/content/theme/templates/menu.html
@@ -15,14 +15,26 @@
<li class="nav-item"><a class="nav-link" href="get-involved.html">Get Involved</a></li>
<li class="nav-item"><a class="nav-link" href="faq.html">FAQ</a></li>
<li class="nav-item dropdown">
- <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" aria-expanded="false">Source</a>
+ <a class="nav-link dropdown-toggle" href="javascript:void(0)" role="button" data-bs-toggle="dropdown" aria-expanded="false">Best Practices</a>
+ <ul class="dropdown-menu">
+ <li><a class="dropdown-item" href="best-practices.html">Overview</a></li>
+ <li><a class="dropdown-item" href="ai-generated-code.html">AI-Generated Code</a></li>
+ <li><a class="dropdown-item" href="us-copyright-law.html">US Copyright Law</a></li>
+ <li><a class="dropdown-item" href="eu-ai-act.html">EU AI Act</a></li>
+ <li><a class="dropdown-item" href="authored-by-tags.html">Authored-by Tags</a></li>
+ <li><a class="dropdown-item" href="commit-messages.html">Commit Messages</a></li>
+ <li><a class="dropdown-item" href="policy-recommendations.html">Policy Recommendations</a></li>
+ </ul>
+ </li>
+ <li class="nav-item dropdown">
+ <a class="nav-link dropdown-toggle" href="javascript:void(0)" role="button" data-bs-toggle="dropdown" aria-expanded="false">Source</a>
<ul class="dropdown-menu">
<li><a class="dropdown-item" href="https://github.com/apache/rai-site/">Website repository</a></li>
<li><a class="dropdown-item" href="https://lists.apache.org/list.html?discuss@rai.apache.org">Mailing list archive</a></li>
</ul>
</li>
<li class="nav-item dropdown">
- <a href="#" class="nav-link dropdown-toggle hidden-xs" data-bs-toggle="dropdown"><span class="fa-solid fa-magnifying-glass" aria-hidden="true"></span> Search</a>
+ <a href="javascript:void(0)" class="nav-link dropdown-toggle hidden-xs" role="button" data-bs-toggle="dropdown"><span class="fa-solid fa-magnifying-glass" aria-hidden="true"></span> Search</a>
<ul class="search-form dropdown-menu">
<li>
<div id="pagefind-search" class="input-group" style="width: 100%; padding: 0 5px;"></div>