Debian settles AI policy with eight-option ballot, placing review burden on developers

The enforcement handle sits in one sentence about blind acceptance. Debian treats "blindly accepting or uploading AI-generated material without appropriate human review" as a violation of normal project practice, whether or not the contributor labels the work AI-assisted ^[8]. A rule written that way never has to establish which tool produced a patch. It only has to point at output nobody reviewed or tested.

That distinction is the whole reason this travels outside Linux packaging. In practice, people accept an inline completion inside the editor and keep typing. Policy authors tend to assume something different: that people consciously reach for a chatbot, notice they did it, and tick a box. According to devops.com, that is the logic the vote landed on, since banning LLMs assumes detection you mostly do not have, and mandated disclosure assumes self-reporting you will not get once assistance is baked into the editor rather than a place you visit ^[14]. So Debian encourages disclosure without requiring it, and puts the obligation on the human instead ^[7].

Turnout is the figure that decides whether any of this holds. Just over 130 ballots from roughly 1,000 eligible developers ^[4] works out to about 13 percent participation ^[15]. The same thin population now absorbs review demand from tools that produce patches faster than volunteers read them. Mitch Ashley, VP and practice lead at The Futurum Group, framed it as capacity rather than principle: "Debian put the obligation on the reviewer, the right place for it, and this is the component that runs out of capacity first." He added that every organisation borrowing the model inherits the same arithmetic, because policy language is free and reviewer hours are not ^[13].

The credentials clause is the one guardrail with a measured failure rate behind it. Confidential material, private communications, embargoed security bugs, cryptographic keys and credentials cannot go to a third-party AI service without explicit authorization ^[9]. devops.com cites research tracking 28.65 million hardcoded secrets leaked in public GitHub commits in 2025, with leaked AI service credentials up 81 percent year over year ^[12]. Debian also declined to argue about whether model output is copyrightable, applying its existing licensing rules to AI-touched contributions exactly as before ^[11], a choice that shows the document was written to be administered, not to settle the underlying question.

For anyone rewriting their own policy this quarter, the borrowable test has two parts. First, for each line, name the evidence that would prove a violation. If the evidence is "we could tell it was AI," the line is decoration, because the detection assumption is the thing that fails ^[14]. Second, name whose hours produce that evidence and how many of them exist. Debian's answer is the reviewer, and its reviewers are the scarcest thing it has ^[13].

The practical guidance comes with a cost attached. Copy the structure: governing behaviour around the tool is enforceable, while policing the tool itself rarely is ^[14]. That shift turns a detection problem into a staffing problem, and staffing problems can be funded and scheduled, which is exactly why the unenforceable ban keeps looking cheaper on paper.