Anthropic Indemnity and GPL-Licensed Code Generated by Claude Code

An indemnity is risk transfer, not a technical control

A vendor indemnity is a contractual promise to defend or compensate a customer for defined losses under defined conditions. It does not change what a coding assistant produces, and it does not tell you what is in your repository. For a regulated enterprise, that distinction matters: the indemnity may reduce the financial exposure from certain claims, but it leaves the engineering and compliance questions untouched.

The scope of Anthropic's indemnity for Claude Code is a matter of contract text, and it can vary with the agreement that governs your access, such as a direct commercial agreement or a cloud marketplace arrangement, and with the version of the terms in force. Four elements determine whether a GPL-related scenario is covered: which services are covered, whether the generated output is covered, which claim types are addressed, and which conditions and exclusions apply. Read those elements as a set. A broad covered-service list can be narrowed by an exclusion, and a covered claim type can be conditioned on how the output was used.

Regulators also treat liability for generative AI output as an open question. The FTC, for example, has said it is concerned about liability issues arising from the development and deployment of generative AI. That is a reason not to treat any vendor indemnity as settled or sufficient protection.

Infringement claim versus copyleft compliance obligation

Compliance and legal teams often group these together as GPL risk. They are different in kind, and that difference bears on what an indemnity can reach. The summary below is a general technical explanation and should be validated by counsel against the licence and the contract.

• Who acts: Infringement claim: a third-party rights holder asserts a claim against you. Copyleft obligation: no claimant is needed; the licence terms apply to you as a user of the code.
• Nature of the issue: Infringement claim: an alleged violation of exclusive rights, typically resolved by defence, settlement or damages. Copyleft obligation: a condition of the licence, such as making source available under the same licence when distributing.
• Typical remedy: Infringement claim: money, injunction or removal of the code. Copyleft obligation: compliance, such as disclosure, relicensing or replacing the code.
• Fit with an indemnity: Infringement claim: the usual subject of an IP indemnity, subject to its terms. Copyleft obligation: may sit outside an infringement-focused indemnity unless the contract says otherwise.
• Who holds the evidence: Infringement claim: shared, with the vendor often asking for notice and cooperation. Copyleft obligation: the enterprise, because it controls the repository and the release.

What stays with the enterprise

Even a broad indemnity leaves several responsibilities with the enterprise. First, licence compliance in your own codebase. If generated code resembles or reproduces GPL-licensed code and is distributed, the licence conditions attach to what you ship. Whether the vendor contract compensates for a third-party claim is a separate question from whether your release meets those conditions.

Second, conditions of the indemnity itself. Conditions commonly tie coverage to how the customer uses the service. Anthropic maintains a Usage Policy that restricts certain high-risk uses, so counsel should check whether adherence is a condition of coverage. Conditions on unmodified output, notice timing and cooperation can also become hard to satisfy if the enterprise cannot reconstruct what was generated.

Third, vendor-side controls. Ask whether Anthropic documentation describes any matching, duplication or public-code controls for Claude Code, and whether any such control is a condition of coverage. Do not assume that such a control exists or that it removes the need for your own review.

Fourth, the evidence gap. Without records tying generated code to commits, a licence review or an indemnity claim rests on recollection. The enterprise is the only party able to produce that record.

Provenance and licence evidence to retain

Engineering, legal and compliance should agree on a minimum record for each AI-generated code contribution. The aim is to answer three questions later: what entered the repository, which licence applied, and what was done about it.

• Origin: the tool, version, user and session that produced the code.
• Repository mapping: the commit, branch and file where the generated code landed.
• Licence context: any licence identified for matching or similar code, and how it was identified.
• Review record: who reviewed the code, when, and against which policy.
• Disposition: accepted, modified, replaced, removed or escalated, with the reason.
• Contract basis: the agreement and terms version in force when the code was generated.

Producing this evidence in the execution path

Records assembled after the fact from commit history and developer recollection are weak evidence. Records produced as the code is generated and handled are stronger, because they reflect what was actually decided at the time.

Trussed enforces policy in the execution path of coding assistants, including Claude Code, at the level of individual interactions and tool calls. Policy actions are allow, redact, block, or escalate for human approval, and they are enforced at runtime, not reviewed after the fact. Trussed also provides code provenance: the origin, licence and security context of code. Each enforcement decision generates audit-ready evidence, so a compliance team can show what was generated, which licence context applied, and how it was handled.

This does not replace the indemnity or counsel's review. The indemnity is the contractual layer, and provenance and policy enforcement are the operational layer that lets a regulated enterprise support a licence review or a claim with records. Trussed can be deployed self-managed in the customer cloud, with configurable retention and data residency. Contract analysis in this guide is general and is not legal advice; have counsel review the agreement that applies to your organisation.