Making AI Visible, Not Vanished: How AI Policies Reshape Developer Experience on GitHub
Open accessAbstract
Generative AI is rapidly reshaping Open Source Software (OSS) software development,prompting projects to introduce policies governing AI-assisted contributions. However, little is known about how these policies differ or whether they influence developer experience. We present the first large-scale empirical study of AI governance policies in OSS. Analyzing 29,624 GitHub repositories, we identify 385 projects that adopted AI policies and derive TRACE, a framework capturing five governance dimensions: Transparency, Responsibility, Attribution, Constraints, and Enforcement. We further classify policies into five governance families and estimate their effects using propensity-score matching and longitudinal difference-in-differences analysis. Our results show that AI governance primarily regulates rather than prohibits AI-assisted development. Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow. Governance design matters: policies emphasizing transparency and responsibility produced stronger community and quality outcomes than restrictive approaches alone. Our findings show how different AI governance strategies shape developer experience and provide evidence to help OSS communities design effective AI policies.
AI snapshot
Written from the paper’s full text.
TL;DR
This paper presents a large-scale empirical study of AI governance policies in 29,624 GitHub repositories, identifying 385 projects that adopted AI policies and classifying them with the TRACE framework. Using propensity-score matching and staggered difference-in-differences, it finds that AI policies generally regulate rather than prohibit AI-assisted development, with transparency- and responsibility-oriented policies linked to stronger community and quality outcomes.
Key findings
- AI policy adoption was rare: only 1.3% (385 of 29,624) of sampled projects adopted an explicit AI policy, with adoption accelerating in 2026 (49 in January, 67 in February, 86 in March, and 87 in April 2026).
- Policies mostly made AI use visible rather than banning it: 66.0% required AI disclosure (T3–T4), 59.7% mandated human review/validation (R4), and 71.2% imposed some constraint above C1, while 67.5% did not address attribution (A1).
- Average post-adoption effects included maintainer-responded PR share +6%, core developer count +12%, LOC per reviewer −14%, AI-assisted PR throughput +10%, large-PR share −2.1%, vulnerabilities −11%, code smells −16%, cognitive complexity −17%, active contributors +13%, AI-assisted PR share +6.8%, AI-disclosure PR count +11%, non-bot comments per PR +8%, bot first-response share −3%, review turns per PR +8%, reviewers per PR +4%, and maintainer response time −8%.
- Governance design mattered: Transparency level 4 was associated with 23% higher AI-disclosure count and 41% higher AI-assisted throughput; Responsibility level 4 with 45% lower code smells and 47% lower cognitive complexity; Constraints reduced AI-assisted throughput by 16.5% to 33.0%; Enforcement reduced vulnerabilities but also active contributors. The largest policy family was Regulated & Controlled (121, 31.4%), followed by Permissive & Open (111, 28.8%), Quiet & Low-Requirement (68, 17.7%), Strict Prohibition (45, 11.7%), and Disclosed but Soft-Enforced (40, 10.4%).
Methods
- The authors mined GitHub repositories via SEART-GHS, filtering for projects created before January 2024, at least 100 stars, over 100 commits from at least 10 authors, valid license, non-forked, open issues and PRs, and activity after January 2026; the final dataset comprised 29,624 projects and 10,192,203 PRs (median 93 per project) spanning January 2025 to May 2026.
- AI policies were identified through GitHub code search, repository tree scans, text searches, and LLM classification (deepseek-v4-flash), then manually verified; 385 treatment repositories adopted policies between February 1, 2025, and April 30, 2026. Policies were coded with the TRACE framework (Transparency, Responsibility, Attribution, Constraints, Enforcement), with inter-rater reliability on a 20% sample (n = 75) showing Cohen’s Kappa of 0.79, 0.75, 0.82, 0.71, and 0.69 respectively (macro-mean κ = 0.75).
- Causal effects were estimated using staggered difference-in-differences with propensity-score matching: 379 of 385 treated repositories were matched to 887 unique controls, with 19 SPACE-framework outcomes measured from GitHub PR timelines and weekly SonarQube scans; all 19 outcomes passed pre-trend tests from week −8 to −2, and robustness checks used 4-, 6-, 10-, and 12-week windows.
Limitations
- The paper states internal-validity reliance on the parallel-trends assumption, supported by event-study tests and robustness windows; external validity is limited because AI policy adoption is recent and still accelerating, so whether early effects persist remains open; construct validity is limited because treatment is initial adoption of a human-facing AI policy, excluding agent-guidance files such as AGENTS.md, and policy evolution is not modeled; conclusion validity is limited by data sparsity at TRACE levels with fewer than 20 treated policies (T2: 4, A2: 7, E2: 8, A4: 14).
- Evident from the text: the design is observational and quasi-experimental rather than randomized, so causal claims depend on matching and parallel-trend assumptions; AI-assisted PRs are identified through structural signals, co-author trailers, or self-disclosure, with the assumption that all subsequent PRs by the same author are AI-assisted; SonarQube scanned 92% of treated repositories and 87% of matched controls, and the main post-adoption window is 8 weeks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
0 of 15 cited sources checked · 0 supported · 0 flagged
- Findingown data
Attribution levels are concentrated at the weakest level.
“We first looked at how levels were distributed in each dimension: © Attribution is concentrated at its weakest level, Responsibility is clustered around the validation requirement, and Transparency and Enforcement are bimodal distributions.”
Quote in the paperSubstantial claim - Findingown data
28.8% (111/385) of policies impose no constraints (C1).
“28.8% of policies (111/385) impose no constraints (C1).”
Quote in the paperNot a substantial claim - Findingown data
30.9% (119/385) of policies state that current submissions will be rejected or closed (E3).
“At E3, 30.9% (119/385) state that current submissions will be rejected or closed, as Apache Arrow warns:”
Quote in the paperNot a substantial claim - Findingown data
3.6% (14/385) of policies demand documented rights or provenance (A4).
“At A4, 3.6% (14/385) demand documented rights or provenance, as AxoSyslog requires, with the submitter”
Quote in the paperNot a substantial claim - Findingown data
The 385 policies spanned 135 out of the 1,024 possible TRACE level combinations.
“The coding results revealed that the 385 policies spanned 135 out of the 1,024 possible level combinations.”
Quote in the paperNot a substantial claim
- Findingown data
33.0% (127/385) of policies impose no disclosure requirement (T1).
“33.0% of policies (127/385) impose no disclosure requirement (T1).”
Quote in the paperNot a substantial claim - Findingown data
11.7% (45/385) of policies completely ban AI submission (C4).
“At C4, 11.7% (45/385) completely ban AI submission:”
Quote in the paperNot a substantial claim - Findingown data
AI governance primarily regulates rather than prohibits AI-assisted development.
“Our results show that AI governance primarily regulates rather than prohibits AI-assisted development.”
Quote in the paperSubstantial claim - Findingown data
59.7% (230/385) of policies mandate human review and validation (R4).
“At R4, 59.7% (230/385) mandate human review and validation, as vLLM insists:”
Quote in the paperNot a substantial claim - Findingown data
10.9% (42/385) of policies require contributors to understand and explain AI output (R3).
“At R3, 10.9% (42/385) require contributors to understand and explain AI output, as AnkiDroid insists:”
Quote in the paperNot a substantial claim - Findingown data
46.0% (177/385) of policies omit consequence for violation (E1).
“46.0% of policies (177/385) omit consequence for violation (E1).”
Quote in the paperSubstantial claim - Findingown data
67.5% (260/385) of policies do not address attribution (A1).
“67.5% of policies (260/385) do not address attribution (A1).”
Quote in the paperSubstantial claim - Findingown data
24.2% (93/385) of policies state no AI-specific responsibility (R1).
“24.2% of policies (93/385) state no AIspecific responsibility (R1).”
Quote in the paperNot a substantial claim - Findingown data
385 repositories adopted an AI policy within the study's adoption window of February 1, 2025 to April 30, 2026.
“Ultimately, we identified 385 treatment repositories that adopted an AI policy during this window.”
- Also stated in: § G. Outcome Variables: Developer Experience · plain
“Among the 29,624 sample projects, we discovered 385 repositories that adopted AI policy within our time window.”
Quote in the paperSubstantial claim - Also stated in: § G. Outcome Variables: Developer Experience · plain
- Findingown data
The Disclosed but Soft-Enforced policy family comprises 40 policies (10.4%).
“Disclosed but Soft-Enforced (40, 10.4%).Defined by moderate restriction (C2 or C3) with disclosure requirement (T≥3) but only mild enforcement (E<3), this family renders AI use visible without strong sanctions.”
Quote in the paperNot a substantial claim - Findingown data
30.1% (116/385) of policies restrict AI use by specific context or channel (C3).
“At C3, 30.1% (116/385) restrict AI use by specific context or channel, as Directus rules:”
Quote in the paperNot a substantial claim - Findingown data
Responsibility levels are clustered around the validation requirement.
“We first looked at how levels were distributed in each dimension: © Attribution is concentrated at its weakest level, Responsibility is clustered around the validation requirement, and Transparency and Enforcement are bimodal distributions.”
Quote in the paperSubstantial claim - Findingown data
The Quiet & Low-Requirement policy family comprises 68 policies (17.7%).
“Quiet & Low-Requirement (68, 17.7%).Defined by moderate restriction (C2 or C3) without a disclosure mandate (T<3), this family imposes constraints on how AI may be used but does not require contributors to declare AI use.”
Quote in the paperNot a substantial claim - Findingown data
5.2% (20/385) of policies demand human authorship (R2).
“At R2, 5.2% (20/385) demand human authorship, as libCEED states:”
Quote in the paperNot a substantial claim - Findingown data
29.4% (113/385) of policies decline full or bulk AI submissions (C2).
“At C2, 29.4% (113/385) decline full or bulk AI submissions, as detekt notes”
Quote in the paperNot a substantial claim - Findingown data
The automatic clustering approach was flawed because its groups were driven almost entirely by a single dimension.
“The automatic clustering was flawed because its groups were driven almost entirely by a single dimension.”
Quote in the paperSubstantial claim - Findingown data
1.0% (4/385) of policies encourage or make optional AI disclosure (T2).
“At T2, 1.0% (4/385) encourage disclosure or optional, as in Promptfoo (”
Quote in the paperNot a substantial claim - Findingown data
1.8% (7/385) of policies assert general IP responsibility (A2).
“At A2, 1.8% (7/385) assert general IP responsibility, as DSharpPlus states:”
Quote in the paperNot a substantial claim - Findingown data
The Permissive & Open policy family comprises 111 policies (28.8%).
“Permissive & Open (111, 28.8%).Defined by C1 (no restriction), this family imposes little to no AI-specific governance.”
Quote in the paperNot a substantial claim - Findingown data
27.0% (104/385) of policies require license or source compatibility (A3).
“At A3, 27.0% (104/385) require license or source compatibility, as Envoy rules:”
Quote in the paperNot a substantial claim - Findingown data
Policy adoption brings maintainer engagement.
“Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow.”
Quote in the paperSubstantial claim - Findingown data
2.1% (8/385) of policies specify remediation or review limitation (E2).
“At E2, 2.1% (8/385) specify remediation or review limitation,as openEMS warns:”
Quote in the paperNot a substantial claim - Findingown data
30.1% (116/385) of policies require basic AI usage disclosure (T3).
“At T3, 30.1% (116/385) require basic AI usage disclosure like Coder stating:”
Quote in the paperNot a substantial claim - Findingown data
35.8% (138/385) of policies demand detailed traceability (T4).
“At T4, 35.8% (138/385) demand detailed traceability, such as Ghostty's requirement:”
Quote in the paperNot a substantial claim - Findingown data
Constraints is the only TRACE dimension with a clear spread across all four levels.
“Only Constraints has a clear spread across all four levels, making it the best indicator of a project's governance stance toward AI.”
Quote in the paperSubstantial claim - Findingown data
21.0% (81/385) of policies restrict future participation (E4).
“At E4, 21.0% (81/385) restrict future participation, as Open Shading Language warns that”
Quote in the paperSubstantial claim - Findingown data
The distribution of TRACE levels is uneven across the five dimensions.
“The distribution of TRACE levels is uneven across five dimensions (see Fig. 4(a)), indicating that OSS AI governance does not align along a single permissive-to-restrictive axis.”
Quote in the paperSubstantial claim - Findingown data
Strict Prohibition policies are 45 (11.7%).
“Disclosed but Soft-Enforced (40, 10.4%) and Strict Prohibition policies are minority (45, 11.7%).”
Quote in the paperNot a substantial claim - Findingown data
Lines of code fall 20% (β = -.22***).
“Lines of code fall 20% (β = -.22 * * * ).”
Quote in the paperSubstantial claim - Findingown data
Cognitive complexity falls 17% (β = -.18***).
“cognitive complexity falls 17% (β = -.18* * * )”
Quote in the paperSubstantial claim - Findingown data
Duplicated-line density declines about 1.69 (β = -1.69***) from 5.7 to about 4.0.
“duplicated-line density declines about 1.69 (β = -1.69* * * ) from 5.7 to about 4.0”
Quote in the paperSubstantial claim - Findingown data
Review turns per PR increase about 8% (β = .08***).
“Review turns per PR increase about 8% (β = .08* * * )”
Quote in the paperSubstantial claim - Findingown data
Policy adoption brings richer review interactions.
“Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow.”
Quote in the paperSubstantial claim - Findingown data
Constraint levels 2-4 are associated with 16.5% (β = -.18***) to 33.0% (β = -.40***) lower AI-assisted throughput.
“Constraint levels 2-4 are associated with 16.5% (β = -.18* * * ) to 33.0% (β = -.40 * * * ) lower AI-assisted throughput”
Quote in the paperSubstantial claim - Findingown data
Code smells fall 16% (β = -.17***).
“code smells fall 16% (β = -.17* * * )”
Quote in the paperSubstantial claim - Findingown data
Policy adoption brings improved code quality.
“Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow.”
Quote in the paperSubstantial claim - Findingown data
Under Disclosed but Soft-Enforced, vulnerabilities are 21% higher (β = .19*).
“Vulnerabilities are, however, 21% higher (β = .19* ).”
Quote in the paperSubstantial claim - Findingown data
Disclosure share rises 4.2% (β = .04***), from below 1% to about 5% average per repository.
“disclosure share rises 4.2% (β = .04* * * ), from below 1% to about 5% average per repository.”
Quote in the paperSubstantial claim - Findingown data
Quiet & Low-Requirement policies form a middle category (68, 17.7%).
“Quiet & Low-Requirement policies form a middle category (68, 17.7%).”
Quote in the paperNot a substantial claim - Findingown data
AI-assisted PR throughput rises 10% (β = .10***).
“AI-assisted PR throughput rises 10% (β = .10* * * ), while the large-PR ratio (> 1000 LOC) falls 2.1% (β = -.02* * * ), from 10.3% to about 8.1%.”
Quote in the paperSubstantial claim - Findingown data
Regulated & Controlled is the largest policy family (121, 31.4%).
“Regulated & Controlled is the largest family (121, 31.4%),followed by Permissive & Open (111, 28.8%).”
Quote in the paperNot a substantial claim - Findingown data
At Enforcement level 3, bot first-response share decreases 12%.
“and bot first-response share decreases 12% at level 3.”
Quote in the paperNot a substantial claim - Findingown data
Policies emphasizing transparency and responsibility produced stronger community and quality outcomes than restrictive approaches alone.
“Governance design matters: policies emphasizing transparency and responsibility produced stronger community and quality outcomes than restrictive approaches alone.”
Quote in the paperSubstantial claim - Findingown data
Non-bot comments per PR rise about 8% (β = .08***).
“Non-bot comments per PR rise about 8% (β = .08* * * )”
Quote in the paperSubstantial claim - Findingown data
Maintainer responded ratio rises 6% (β = .06***) from 44% to about half of pull requests.
“Maintainer responded ratio rises 6% (β = .06* * * ) from 44% to about half of pull requests.”
Quote in the paperSubstantial claim - Findingown data
LOC per reviewer decreases 14% (β = -.16***), from about 495 to about 425 lines per reviewer.
“LOC per reviewer decreases 14% (β = -.16 * * * ), from about 495 to about 425 lines per reviewer.”
Quote in the paperSubstantial claim - Findingown data
Constraint level 3 is associated with 14.8% lower core-developer count (β = -.16***).
“and 14.8% lower core-developer count (β = -.16 * * * ) at level 3.”
Quote in the paperSubstantial claim - Findingown data
AI-assisted contributions continue to grow after policy adoption.
“Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow.”
Quote in the paperSubstantial claim - Findingown data
Opaque restriction is the only configuration in our data associated with net reductions in AI activity and engagement.
“Opaque restriction is the only configuration in our data associated with net reductions in AI activity and engagement.”
Quote in the paperSubstantial claim - Findingown data
Only 1.3% (385 of 29,624) sampled projects adopted an explicit AI policy.
“Only 1.3% (385 of 29,624) sampled projects adopted an explicit AI policy.”
Quote in the paperSubstantial claim - Findingown data
Disclosed but Soft-Enforced policies are 40 (10.4%).
“Disclosed but Soft-Enforced (40, 10.4%) and Strict Prohibition policies are minority (45, 11.7%).”
Quote in the paperNot a substantial claim - Findingown data
Permissive & Open is the second largest policy family (111, 28.8%).
“Regulated & Controlled is the largest family (121, 31.4%),followed by Permissive & Open (111, 28.8%).”
Quote in the paperNot a substantial claim - Findingown data
Reviewers per PR rise 4% (β = .04***).
“reviewers per PR rise 4% (β = .04* * * )”
Quote in the paperNot a substantial claim - Findingown data
Core developer count rises 12% (β = .11***), from about 6 to 7.
“Core developer count rises 12% (β = .11* * * ), from about 6 to 7.”
Quote in the paperSubstantial claim - Findingown data
Maintainer response time falls about 8% (β = -.08*) from about 18 to about 17 hours.
“maintainer response time falls about 8% (β = -.08 * ) from about 18 to about 17 hours.”
Quote in the paperNot a substantial claim - Findingown data
Policy adoption brings increased AI disclosure.
“Policy adoption brings maintainer engagement, increased AI disclosure, richer review interactions, and improved code quality while AI-assisted contributions continue to grow.”
Quote in the paperSubstantial claim - Findingown data
PRs disclosing AI use rise 11% (β = .11***).
“PRs disclosing AI use rise 11% (β = .11* * * )”
Quote in the paperSubstantial claim - Findingown data
The 11% count gain is about 1 extra disclosure PR every 10 repo-weeks.
“The 11% count gain is about 1 extra disclosure PR every 10 repo-weeks.”
Quote in the paperNot a substantial claim - Findingown data
Bot first-response share decreases 3% (β = -.04***) from a baseline of 37%.
“bot first-response share decreases 3% (β = -.04 * * * )from a baseline of 37%.”
Quote in the paperNot a substantial claim - Findingown data
Vulnerabilities decline 11% (β = -.11***) from about 3.7 to about 3.3 per repository.
“vulnerabilities decline 11% (β = -.11* * * ) from about 3.7 to about 3.3 per repository”
Quote in the paperSubstantial claim - Findingown data
Large-PR ratio (>1000 LOC) falls 2.1% (β = -.02***), from 10.3% to about 8.1%.
“AI-assisted PR throughput rises 10% (β = .10* * * ), while the large-PR ratio (> 1000 LOC) falls 2.1% (β = -.02* * * ), from 10.3% to about 8.1%.”
Quote in the paperSubstantial claim - Study design and conductown data
Robustness checks using alternative post-treatment windows of 4, 6, 10, and 12 weeks yielded consistent directional results.
“Robustness checks using alternative windows of 4, 6, 10, and 12 weeks yielded consistent directional results.”
Quote in the paperNot a substantial claim - Interpretationown data
OSS AI governance does not align along a single permissive-to-restrictive axis.
“The distribution of TRACE levels is uneven across five dimensions (see Fig. 4(a)), indicating that OSS AI governance does not align along a single permissive-to-restrictive axis.”
Quote in the paperSubstantial claim - Study design and conductown data
379 of the 385 treated repositories were matched to 887 unique never-treated controls via propensity score matching.
“Finally, we matched 379 of the 385 treated repositories to 887 unique controls.”
Quote in the paperSubstantial claim - Interpretationown data
Constraints is the best indicator of a project's governance stance toward AI.
“Only Constraints has a clear spread across all four levels, making it the best indicator of a project's governance stance toward AI.”
Quote in the paperSubstantial claim - Study design and conductown data
All 19 outcomes successfully passed the parallel trends test within the pre-trend window (week -8 to -2).
“All 19 outcomes successfully passed this parallel trends test within the pre-trend window, as shown in Fig. 2.”
Quote in the paperSubstantial claim- The authors state this as an assumption: Without the policy, treated and control repositories would have followed similar outcome trends over time (parallel trends).
- Interpretationreasoning
Bans raise the entry bar for contributions rather than eliminate AI.
“Bans raise the entry bar for contributions rather than eliminate AI.”
Quote in the paperSubstantial claim - Interpretationreasoning
Policies reshape the code review process toward lighter, more interactive cycles.
“Policies reshape the code review process toward lighter, more interactive cycles.”
Quote in the paperSubstantial claim - Study design and conductown data
The LLM coding of policies was validated through an iterative process of manual checking and codebook updating until all level coding results matched human judgment.
“We followed an iterative process starting with a codebook.In each iteration, we manually checked the LLM's coding results, updated the descriptions and boundary rules, and re-coded the sample cohort.We repeated this process until all level coding results matched our human judgment.”
Quote in the paperSubstantial claim - Premisecitation
Emerging evidence suggests that AI-assisted contributions may introduce quality risks, including increased complexity, technical debt, and verification burden, even when short-term output rises.
“Emerging evidence further suggests that AI-assisted contributions may introduce quality risks, including increased complexity, technical debt, and verification burden, even when short-term output rises [7].”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [7]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationreasoning
Prohibition filters rather than forbids.
“Prohibition filters rather than forbids.”
Quote in the paperNot a substantial claim - Interpretationreasoning
Responsibility and Enforcement dimensions drive code review to a frequent, iterative human verification process.
“The Responsibility and Enforcement dimensions drive code review to a frequent, iterative human verification process.”
Quote in the paperSubstantial claim - Study design and conductown data
Data sparsity limits statistical power at certain TRACE levels containing fewer than 20 treated policies (T2: 4, A2: 7, E2: 8, A4: 14).
“Data sparsity limits statistical power at certain TRACE levels containing fewer than 20 treated policies (T2: 4, A2: 7, E2: 8, A4: 14).”
Quote in the paperSubstantial claim - Premiseown data
This study provides the first causal evidence on the effects of AI governance policies on developer experience.
“2) The first causal evidence on the effects of AI governance policies on developer experience, using longitudinal data and quasi-experimental methods (Section V).”
Quote in the paperSubstantial claim - Interpretationown data
Quiet & Low-Requirement policies are the only family with a net reduction in AI-assisted activity.
“Quiet & Low-Requirement policies are the only family with a net reduction in AI-assisted activity:”
Quote in the paperSubstantial claim - Premisecitation
OSS projects have begun establishing explicit policies governing AI-assisted contributions.
“In response, OSS projects have begun establishing explicit policies governing AI-assisted contributions [8].”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [8]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationown data
OSS policy families show governed permission rather than prohibition-centered.
“Observation 2. OSS Policy families show governed permission rather than prohibition-centered.”
Quote in the paperSubstantial claim - Interpretationreasoning
Pairing Transparency with Enforcement can lower vulnerabilities while sustaining throughput.
“Pairing Transparency with Enforcement can lower vulnerabilities while sustaining throughput.”
Quote in the paperSubstantial claim - Interpretationown data
Constraints curbs AI-assisted throughput and disclosure in proportion to restriction severity.
“Constraints curbs AI-assisted throughput and disclosure in proportion to restriction severity:”
Quote in the paperSubstantial claim - Premisereasoning
Little is known about the prevalence, diversity, and structure of policy approaches across the broader OSS ecosystem.
“First, while qualitative analyses have documented isolated examples of AI governance practices, little is known about the prevalence, diversity, and structure of policy approaches across the broader OSS ecosystem.”
Quote in the paperNot a substantial claim - Premisereasoning
AI governance policies in OSS remain poorly understood: their prevalence, diversity, and consequences have not been examined at scale.
“Yet, despite their growing prominence in practice, AI governance policies in OSS remain poorly understood: their prevalence, diversity, and consequences have not been examined at scale.”
Quote in the paperNot a substantial claim - Premisecitation
OSS projects depend on decentralized governance, volunteer contributions, and community-driven review processes to sustain software quality and project health.
“Unlike traditional software organizations, OSS projects depend on decentralized governance, volunteer contributions, and community-driven review processes to sustain software quality and project health [4].”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationown data
Permissive & Open policies yield the largest AI-assisted activity gains.
“Permissive & Open policies yield the largest AI-assisted activity gains:”
Quote in the paperSubstantial claim - Premisenone given
This is the first large-scale empirical study of AI governance policies in OSS.
“We present the first large-scale empirical study of AI governance policies in OSS.”
Quote in the paperSubstantial claim - Interpretationreasoning
Strict rules raise internal quality standards rather than deterring participation.
“Strict rules raise internal quality standards rather than deterring participation.”
Quote in the paperSubstantial claim - Interpretationcitation
Higher Transparency levels reinforce this, matching prior evidence that explicit norms reduce friction in OSS.
“Higher Transparency levels reinforce this, matching prior evidence that explicit norms reduce friction in OSS [24], [25].”
Quote in the paperNot a substantial claim0 of 2 sources checked- cites [24]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [25]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- May combine two claims. 43
- Classified as probably not a substantial claim. 11
May combine two claims.
Findingown dataTransparency and Enforcement levels are bimodally distributed.
“We first looked at how levels were distributed in each dimension: © Attribution is concentrated at its weakest level, Responsibility is clustered around the validation requirement, and Transparency and Enforcement are bimodal distributions.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataAI policy adoption was sparse through 2025 and accelerated in 2026, with only one policy adopted in February 2025 compared to 49 in January, 67 in February, 86 in March, and 87 in April 2026.
“As shown in Fig. 3, the adoption was sparse through 2025 and accelerated in 2026.Only one policy was adopted in February 2025, compared to 49 in January, 67 in February, 86 in March, and 87 in April 2026.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataThe dataset comprised 29,624 GitHub projects containing 10,192,203 pull requests (median 93 per project), spanning January 2025 to May 2026.
“Overall, the dataset comprised 29,624 projects, containing 10,192,203 PRs (median per project: 93), spanning from Jan 2025 to May 2026.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataThe Regulated & Controlled policy family comprises 121 policies (31.4%) and is the largest family.
“Regulated & Controlled (121, 31.4%).The largest family, defined by moderate restriction (C2 or C3), disclosure requirement (T≥3), and strong enforcement (E≥3, it mandates visibility and backs it with explicit consequences.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataUnder Regulated & Controlled, AI-assisted share is 9.0% higher and throughput 11% higher (β = .10***).
“AIassisted share (9.0%higher) and throughput (11% higher, β = .10* * * ) also increase.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Transparency level 4, active contributors are 19% higher (β = .17***), core developers 17% higher (β = .16**), and maintainer-responded share 8.0% higher.
“Participation metrics also strengthen, with active contributors 19% higher (β = .17* * * ), core developers 17% higher (β = .16* * ), and the maintainer-responded share 8.0% higher.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAI-assisted merged throughput rises 10% (β = .10***), though the absolute gain is modest (1.9 to 2.1).
“AIassisted merged throughput rises 10% (β = .10* * * ), though the absolute gain is modest (1.9 to 2.1).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Attribution level 3, active contributors are 8% lower (β = -.09***), code smells 46% lower, cognitive complexity 53% lower, ncloc 44% lower, yet vulnerabilities 22% higher (β = .20**).
“At this level, contributor counts are lower (active contributors -8%, β = -.09* * * ) and several quality metrics are better (code smells -46%, cognitive complexity -53%, ncloc -44%), yet vulnerabilities are 22% higher (β = .20* * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Permissive & Open, AI-assisted share is 13% higher and AI-assisted throughput 40% higher (β = .34***).
“AI-assisted share is 13% higher and AI-assisted throughput 40% higher (β = .34* * * )”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAI policy adoption is recent and still accelerating (Fig. 3).
“AI policy adoption is recent and still accelerating (Fig. 3).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataHigher enforcement is associated with fewer active contributors (9.5% at level 4, β = -.10**) and with a 9.0% higher maintainer-responded share at level 4.
“Higher enforcement is also associated with fewer active contributors (9.5% at level 4, β = -.10 * * ) and with a 9.0% higher maintainer-responded share at level 4.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Permissive & Open, disclosure count is 18% higher (β = .17***), active contributors 15% higher (β = .14***), and core developers 16% higher (β = .15***).
“while disclosure count is 18% higher (β = .17* * * ), active contributors 15% higher (β = .14* * * ), and core developers 16% higher (β = .15* * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Regulated & Controlled, disclosure share is 7.0% higher and reviewers 7.3% higher (β = .07*), while vulnerabilities are 28% lower (β = -.33***).
“Disclosure share is 7.0% higher and reviewers 7.3% higher (β = .07* ), while vulnerabilities are 28% lower (β = -.33 * * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Quiet & Low-Requirement, AI-assisted merged throughput is 12% lower and AI-assisted share 3.0% lower, with disclosure count also 3.0% lower (β = -.03***).
“AI-assisted merged throughput is 12% lower and AI-assisted share 3.0% lower, with disclosure count also 3.0% lower (β = -.03* * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Transparency level 4, AI-assisted share is 15% higher and AI-assisted throughput 41% higher (β = .34***).
“while AI-assisted share is 15% higher and AI-assisted throughput 41% higher (β = .34* * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Responsibility level 4, throughput is 28% higher (β = .25**), disclosure count 7% higher (β = .07***), reviewers per PR 5% more (β = .05***), and bot first-response share 9.0% higher.
“level 4 is associated with 28% higher throughput (β = .25* * ), 7% higher disclosure count (β = .07* * * ), 5% more reviewers per PR (β = .05* * * ) , and 9.0% higher bot first-response share.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Disclosed but Soft-Enforced, active contributors are 34% higher (β = .30***) and disclosure count 11% higher (β = .10**).
“Active contributors are 34% higher (β = .30* * * ) and disclosure count 11% higher (β = .10* * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Transparency level 3, disclosure count is 13% higher (β = .12***) and active contributors 17% higher (β = .15***).
“Level 3 show the same direction, with disclosure count 13% higher (β = .12* * * ) and active contributors 17% higher (β = .15* * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Transparency level 4, AI-disclosure count is 23% higher (β = .21***) and disclosure share 4.0% higher.
“At level 4, AI-disclosure count is 23% higher (β = .21* * * ) and disclosure share 4.0% higher”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataUnder Strict Prohibition, code smells are 34% lower, ncloc 36% lower, and maintainer-responded share 9.0% higher.
“The strongest effects appear in quality and engagement as code smells are 34% lower, ncloc 36% lower, and the maintainer-responded share 9.0% higher.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Responsibility level 4, code smells decline 45% (β = -.61**), cognitive complexity 47% (β = -.64*), and ncloc 37% (β = -.47**).
“code smells decline 45% (β = -.61 * * ), cognitive complexity 47% (β = -.64 * ), and ncloc 37% (β = -.47 * * ).”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataAt Enforcement levels 3 and 4, vulnerabilities are 8.6% (β = -.09*) and 14.8% lower (β = -.16*), respectively.
“At levels 3 and 4, vulnerabilities are 8.6% (β = -.09* ) and 14.8% lower (β = -.16 * ), respectively”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataActive contributors increase 13% (β = .12***), meaning 2 additional contributors per week.
“Active contributors increase 13% (β = .12* * * ), meaning 2 additional contributors per week.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Study design and conductown dataSonarQube successfully scanned 92% (347 of 379) treated repositories and 87% (768 of 887) matched controls.
“SonarQube successfully scanned 92% (347 of 379) treated repositories and 87% (768 of 887) of the matched controls, as the remaining failed to scan.”
Quote in the paperNot a substantial claimMay combine two claims.
InterpretationreasoningThe rule-based method aligned directly with governance logic and created more balanced groups than the clustering approach.
“In contrast, the rule-based method aligned directly with governance logic and created more balanced groups.”
Quote in the paperSubstantial claimMay combine two claims.
Study design and conductown dataInter-rater reliability between one author and the LLM on a random 20% sample (n=75) of the 385-policy coding frame was substantial across the five TRACE dimensions (Transparency κ=0.79, Responsibility κ=0.75, Attribution κ=0.82, Constraints κ=0.71, Enforcement κ=0.69; macro-mean κ=0.75).
“Inter-rater reliability between one author and the LLM was assessed on a random 20% sample (n = 75) of the 385policy coding frame, reported by Cohen's Kappa value [32].Agreement was substantial across five TRACE dimensions: Transparency κ = 0.79, Responsibility κ = 0.75, Attribution κ = 0.82, Constraints κ = 0.71, and Enforcement κ = 0.69 (macro-mean κ = 0.75).”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [32]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Classified as probably not a substantial claim. May combine two claims.
PremisecitationDifference-in-differences is a causal-inference method well-established in econometrics and increasingly applied in software engineering.
“we used difference-in-differences (DiD), a causal-inference method well-established in econometrics [33], [34] and increasingly being applied in software engineering [7], [20], [24], [35], [36].”
Quote in the paperSubstantial claim0 of 2 sources checked- cites [33]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [34]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationMaintainers increasingly report being overwhelmed by a surge of low-quality AI-generated submissions, often described as 'AI slop'.
“Maintainers increasingly report overwhelmed by a surge of low-quality AI-generated submissions, often described in community discourse as”
Quote in the paperNot a substantial claim0 of 2 sources checked- cites [21]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [22]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
Interpretationown dataTransparency amplifies disclosure, AI-assisted activity, and community participation.
“Transparency amplifies disclosure, AI-assisted activity, and community participation: Higher Transparency levels correspond to larger gains in disclosure and AI-assisted activity.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataFor adopters, formal rules legitimize AI use rather than suppress it as AI-assisted activity, disclosure, and contributor counts all rise together.
“Yet for adopters, formal rules legitimize AI use rather than suppress it as AI-assisted activity, disclosure, and contributor counts all rise together.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataEnforcement reduces vulnerabilities and accelerates maintainer response, at the cost of fewer active contributors.
“Enforcement reduces vulnerabilities and accelerates maintainer response, at the cost of fewer active contributors.:”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataRegulated & Controlled policies combine disclosure with stronger review and lower vulnerabilities.
“Regulated & Controlled policies combine disclosure with stronger review and lower vulnerabilities:”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataEven under Strict Prohibition, AI use persists while quality improves most.
“Even under Strict Prohibition, AI use persists while quality improves most.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Study design and conductown dataCells with fewer than 20 treated policies are left unmarked as unreported, leaving the impact of underrepresented configurations unknown.
“We leave these cells unmarked as unreported, leaving the impact of underrepresented configurations unknown.”
Quote in the paperNot a substantial claimMay combine two claims.
Interpretationown dataResponsibility strengthens both review engagement and code quality at level 4.
“Responsibility strengthens both review engagement and code quality at level 4:”
Quote in the paperSubstantial claimMay combine two claims.
InterpretationreasoningPolicies function as signals that reduce uncertainty and encourage participation.
“Policies function as signals that reduce uncertainty and encourage participation.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataStrict Prohibition policies reduce AI throughput but do not eliminate observed AI-assisted activity.
“Strict Prohibition policies reduce AI throughput but do not eliminate observed AI-assisted activity:”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S2 (checkable).
InterpretationreasoningThis distinctness lets TRACE serve as a reusable tool for future OSS AI governance research.
“This distinctness lets TRACE serve as a reusable tool for future OSS AI governance research.”
Quote in the paperNot a substantial claimMay combine two claims.
Study design and conductown dataRobustness checks covering 4, 6, 10, and 12-week windows yielded directionally consistent results, suggesting reported short-term effects are not artifacts of window choice.
“Robustness checks covering 4, 6, 10, and 12-week windows yielded directionally consistent results, suggesting reported short-term effects are not artifacts of window choice.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationTraditionally, OSS communities govern development through Codes of Conduct, contribution guidelines, and pull request workflows.
“Traditionally, OSS communities govern development through Codes of Conduct [24], contribution guidelines [25], and pull request workflows [5].”
Quote in the paperNot a substantial claim0 of 3 sources checked- cites [24]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [25]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [5]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Classified as probably not a substantial claim.
PremisecitationDifference-in-differences evaluates the effect of an intervention from observational data by comparing a treatment group with a control group.
“DiD evaluates the effect of an intervention from observational data by comparing a treatment group (repositories that adopted an AI policy) with a control group (matched repositories that did not) [37].”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [37]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
Interpretationown dataAttribution shows mixed signals, with quality gains offset by higher vulnerabilities.
“© Attribution show mixed signals, with quality gains offset by higher vulnerabilities:”
Quote in the paperSubstantial claimMay combine two claims.
Study design and conductown dataDID validity relies on the parallel-trend assumption, which was supported by event-study regressions where all 19 outcomes passed the pre-trend test (weeks -8 to -2).
“DID validity relies on the parallel-trend assumption, which we supported by event-study regressions where all 19 outcomes passed the pre-trend test (weeks -8 to -2).”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataDisclosed but Soft-Enforced policies produce the largest active-contributor gains, but also higher vulnerabilities.
“Disclosed but Soft-Enforced policies produce the largest active-contributor gains, but also higher vulnerabilities:”
Quote in the paperSubstantial claimClassified as probably not a substantial claim.
Study design and conductreasoningAgent-guidance configurations (AGENTS.md) were excluded to avoid unmodeled, entangled effects.
“we excluded agent-guidance configurations (AGENTS.md) to avoid unmodeled, entangled effects.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S4 (based). May combine two claims.
Interpretationnone givenEach TRACE dimension captures a distinct mechanism (Transparency drives disclosure, Responsibility activates review quality, Constraints modulates AI volume, Enforcement shapes security outcomes).
“Each TRACE dimension captures a distinct mechanism ( Transparency drives disclosure, Responsibility activates review quality, Constraints modulates AI volume, Enforcement shapes security outcomes).”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
Study design and conductnone givenAll candidate AI policies were manually verified.
“We manually verified all candidate policies.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationIn academia, journals and conferences have adopted AI disclosure rules, though detected AI use exceeds disclosed use by roughly 40 to 1.
“Similar shifts have occurred in academia, where journals and conferences have adopted AI disclosure rules, though detected AI use there exceeds disclosed use by roughly 40 to 1 [23].”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [23]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
InterpretationreasoningPost-adoption, contributions become more modular and reviews shift into a more dialogic loop.
“Post-adoption, contributions become more modular and reviews shift into a more dialogic loop.”
Quote in the paperSubstantial claim
The authors state this as an assumption.
Developers continue to use AI tools after initial adoption.
“Assuming developers continue to use AI tools after initial adoption, we labeled all subsequent PRs by the same author as AI-assisted.”
The authors state this as an assumption.
Without the policy, treated and control repositories would have followed similar outcome trends over time (parallel trends).
“The validity for DiD relies on the parallel trends assumption, namely that, without the policy, treated and control repositories would have followed similar outcome trends over time.”
The authors state this as an assumption.
DID validity relies on the parallel-trend assumption.
“DID validity relies on the parallel-trend assumption, which we supported by event-study regressions where all 19 outcomes passed the pre-trend test (weeks -8 to -2).”
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 1
- P. C. D. Johnson, "Extension of Nakagawa & Schielzeth's R 2 to random slopes models," Methods in Ecology and Evolution, vol. 5, no. 9, pp. 944-946, 2014.
Cited by
Sorted by citations
Who Pays the Review Cost? Triage, Fairness, and Accountability in AI-authored Pull Requests
Rahman, M. S., Alam, K., Roy, B., & Roy, C. K. (2026) · arXiv · doi:10.48550/arxiv.2610.11179
"We Permit the Use of AI, but [...]": The Landscape of AI Policies in Popular Open Source Projects
Hora, A., Robbes, R., & Zacchiroli, S. (2026) · arXiv · doi:10.48550/arxiv.2609.07542
Plausible Is Not Enough: Trust and Evidence in AI-Authored Pull Request Review
Rahman, M. S., Alam, K., Roy, B., & Roy, C. K. (2026) · arXiv · doi:10.48550/arxiv.2610.21144
- Authors
- Chen, Y., Zimmermann, T., & Trinkenreich, B.
- Affiliations
- University of California, Irvine (US)
- Colorado State University (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2608.03329
- OpenAlex
- W7172533516
- Semantic Scholar
- 0ff78eba0ce9030bb796a8d4010569da143cdc48
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Keywords
- AI governance policy, generative AI, open source software, developer experience, GitHub repositories, AI-assisted development, transparency, attribution, code review, code quality, community participation, policy enforcement
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-11-02.
Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-11-02.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review