Does rewriting an AI-suggested GPL snippet remove the copyleft obligation?

What the GPL attaches to

NIST describes the GNU GPL as the canonical example of a copyleft licence: any derivative works must also be licensed under the GPL. Permissive licences, by contrast, contain no clause requiring the licence to apply to derivative works. The practical consequence is that the question is never whether a snippet was edited. It is whether what remains is still a derivative or copy of the original work.

That framing matters for AI-suggested code. A developer who receives a suggestion has no inherent knowledge of where it came from. If the suggestion reproduces GPL-licensed source, the obligation question exists from the moment it is accepted, regardless of how the text is later changed.

Ideas, expression, and the limits of mechanical changes

Copyright law distinguishes between ideas, which are not protected, and the particular expression of those ideas, which can be. This distinction is the core of any analysis of a rewritten snippet. Reimplementing a general approach or algorithm from your own understanding is different from reproducing another author's specific code with surface edits.

Several kinds of change are cosmetic from a technical standpoint: renaming variables, reformatting, reordering independent statements, swapping equivalent loop constructs, or splitting a function into helpers. Each leaves the underlying structure, sequence, and choices of the original intact. A reviewer comparing the two would still see the same code in different clothing. Whether that is enough to remain a derivative work is a legal judgment, and this guide does not make it.

Counsel will typically look at factors such as how much of the original's expression survives, whether the similarity is explained by functional constraints that leave few ways to write the code, and how significant the copied portion is. Small size and functional necessity can matter, but they are fact-specific, and engineers should not treat them as a safe harbour.

What is settled and what is not

Some points are firm. The GPL is a copyleft licence that reaches derivative works. Under US Copyright Office registration guidance, material whose expressive elements are determined by AI is not human authorship and must be disclaimed in a registration application, while sufficiently creative human selection, arrangement, or modification can support a claim covering only the human-authored aspects. NIST AI 600-1 also notes that outputs reflecting memorization of training data could infringe copyright.

Other points are open. NIST states that how generative AI relates to copyright, including the status of generated content that is similar to but does not strictly copy protected work, is currently being debated in legal fora. As of November 2026, no supplied guidance resolves that.

It is also worth keeping two questions apart. Whether AI output can be registered for copyright is a different question from whether a suggestion that reproduces GPL code carries GPL obligations. The registration guidance addresses the first. Teams should not infer an answer to the second from it.

Why manual rewriting is a weak control

Even if a rewrite could in principle remove an obligation, relying on developers to perform it fails as a control for several reasons.

First, the developer must recognise that a suggestion resembles licensed code. Without a signal about origin, there is usually nothing to prompt a rewrite. Second, the quality of a rewrite is subjective and varies by person. Two engineers will make different changes and reach different conclusions about whether the result is safe. Third, a rewrite leaves no record. The organisation cannot later show what the original suggestion was, what licence context applied, or why the change was considered sufficient.

Review after the fact has the same limit. NIST SP 800-218A treats human-written and AI-generated source code alike, on the assumption that all code should be evaluated before use, and leaves the mix of code review and code analysis to the organisation under task PW.7.1. A check that runs before code enters the codebase is consistent with that stance. A check that depends on someone noticing a problem in a pull request is not consistent in the same way.

Where Trussed fits

Trussed enforces policy in the execution path of coding assistants, so decisions are enforced at runtime, not reviewed after the fact. For an individual interaction, policy can allow, redact, or block a suggestion, or escalate it for human approval. Trussed also provides code provenance: the origin, licence, and security context of code. Scope is individual interactions and tool calls.

This maps to the control point described above. Origin and licence context are established when the suggestion is made, and the policy decision is applied before the code is accepted.

Enforcement also generates audit-ready evidence of what was allowed, flagged, and accepted, which a regulated enterprise can use when legal or audit teams ask how AI-suggested code was handled. Trussed is deployed self-managed in the customer cloud, with configurable retention and data residency.

None of this replaces counsel. Whether a specific snippet is a derivative work remains a legal determination. What the control provides is a consistent, recorded basis for deciding which suggestions proceed and which are escalated.