[TASK] Add TYPO3 Policy on AI generated code by martin-helmich · Pull Request #47 · TYPO3-Documentation/Policy

martin-helmich · 2026-07-20T09:59:10Z

What this is

This PR introduces a draft on a TYPO3 Association Policy on AI generated code, which is open for community review.

What the draft proposes

Human responsibility stays indivisible — the contributor is accountable for every line they submit, regardless of how it was produced.
Transparency through disclosure — a lightweight AI-assisted: [tool name] tag when AI generated structural code (following the Linux kernel pattern), with clear guidance on when disclosure is and isn't expected.
License clarity and provenance certification — GPL compatibility depends on provenance, not the tool used. The draft proposes a Signed-off-by: Developer Certificate of Origin sign-off as a lightweight, auditable alternative to a CLA (which TYPO3 does not require).
Uniform quality and security standards — no reduced bar and no elevated bar; the same CI, coding guidelines, and review rigor apply.
Practical guidance for contributors, reviewers, and extension owners, plus ready-to-use CONTRIBUTING.md and commit-message templates.

This is a draft — please help shape it

Nothing here is final. The document is explicitly a living document, and this PR is opened to invite community review and discussion before anything is proposed for adoption.

How to contribute to this draft

Two easy ways to get involved:

Comment here — general feedback, questions, and discussion are very welcome in this PR. Use GitHub's "suggest edit" feature for minor edits.
Propose concrete edits — open a pull request against the task/ai-policy branch (not main). Direct edits to the wording are encouraged; it's often easier to react to a concrete suggestion than to prose in a comment thread.

Every section is open for revision. If you disagree with a principle, want to sharpen a definition, or think a whole section should change, please say so — that's exactly what this review phase is for.

Identified to-dos

Parts of this policy apply to AI-generated code as well as human-created code (and everything in between). For example, the provenance requirements apply regardless of by which tool the code was created.
Focuses too much on code contributions; documentation (and other kinds of contributions) should be considered, as well.
Needs streamlining; in parts refers only to "Code in TYPO3 extensions", on other parts to "Code in the TYPO3 ecosystem" (which is much broader, and would also include the Core).

Co-authored-by: Martin Helmich <martin.helmich@typo3.org>

Combine the "Research Notes" and "Landscape Analysis" appendices into a single "Appendix C: Landscape Analysis and Research Notes", removing the duplicated enumeration of how other projects handle AI code. Add sources for previously uncited claims: the survival-analysis and CodeRabbit code-quality studies, the DCO, and the US Copyright Office copyrightability report. Point the introduction's cross-reference at the merged appendix. Correct the Linux kernel row to match its coding-assistants guidelines: it recommends an "Assisted-by" tag (not "Co-developed-by") and keeps Signed-off-by / DCO certification human-only. Reword the SPDX monitoring item to "machine-readable conventions for disclosing AI involvement in source code"; SPDX has no specification for identifying AI-generated code (its AI profile is an AI-BOM for models). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Incorporate the TYPO3 Association Board's statement on GPL and AI-generated code (8 July 2026): GPL compatibility depends on provenance, not the tool used, and a DCO sign-off is recommended as a lightweight, auditable alternative to a CLA. - Add core principle 3.6 on DCO sign-off, complementary to the AI-assisted disclosure tag - Expand 3.5 with the provenance-not-tool stance and cite the board statement - Add a sign-off step to the contributor checklist and CONTRIBUTING.md template - Replace the stale CLA reference in the frameworks section with the DCO the policy proposes Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-20T09:59:20Z

This pull request is classified as a formal change. This means it needs an formally documented decision by the TYPO3 Association Board, which must be documented in a new file under Documentation/Association/Board/Decisions/.

❌ A formal change must add a new decision record under Documentation/Association/Board/Decisions/.

jweiland

Good work! Just a minor cosmetical correction (double space in line 80)

garvinhicking

Thanks for this draft, I think this is well-crafted and has a good focus.

Even though I have a rather special view on this topic I would be able to get behind this draft here. That's a serious achievement. ;-)

Maybe the focus currently is a lot on "code contribution" but also applies a lot to documentation too (it is named, I'm ware). Maybe we could highlight some specific areas for documentation concerns, but that could happen in a follow-up.

CybotTM · 2026-07-20T13:10:58Z

Thanks, good to start with something like this.

However, I found it too heavily framed around AI. Most of what is written applies not only to AI-generated/contributed code, but to contributions in general. In some places, it even states that a rule applies only when the code is AI-generated, which makes no sense to me.

Am I the only one?

One may even think that everything in this document applies only to AI generated/contributed code as it is named AICodePolicy.

CybotTM · 2026-07-20T13:26:17Z

+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.
+
+The recommended disclosure mechanism is a tag in the commit message or pull request description: ``AI-assisted: [tool name]`` (e.g., ``AI-assisted: Claude claude-opus-4-20250514`` or ``AI-assisted: GitHub Copilot``). This follows the pattern established by the Linux kernel community and is intentionally lightweight.


How should this be handled for coding agents or tools that use multiple LLMs?

AI-assisted: OpenHands does not reveal much about which models were actually involved. Nor does it give any valuable information IMO.

If you work on a larger change with e.g. 10 sub-agents, they can run in a lot of different models, I don't know if we should list all models.

I actually came here for the same thing. I use Claude Code, Pi and OpenCode with different models, so neither tool nor model alone give you any indication.

Maybe we should boil it down to "Development was assisted by AI"?

I wonder whether a tool like https://github.com/git-ai-project/git-ai can help us here. This would at least automate a lot of the documentation.

I am not sure if https://github.com/git-ai-project/git-ai can deliver this.

It tracks AI usage during development and adds the attribution via a git note to the commit: https://usegitai.com/docs/get-started/how-git-ai-works#2-attribution-attaches-on-commit

Might be easier for regular contributors to use something like this, instead of the attribution via the commit message as it doesn't affect their workflows so much.

DanielSiepmann · 2026-07-20T13:56:17Z

However, I found it too heavily framed around AI. Most of what is written applies not only to AI-generated/contributed code, but to contributions in general.

I feel the same. I'm not using AI, but would say most parts are true without AI as well. We could rephrase some parts, mostly by removing mentioning of AI, and would establish a more general applied rule which might survive other future changes as well. I could try to come up with a PR to rephrase those parts if you like, and already asked for. Just let me know.

In general, I highly appreciate the following things (to also provide positive feedback):

Open progress
Promoting this in the existing thread at https://talk.typo3.org/t/on-tools-and-tempests-what-typo3-might-learn-from-a-kernel-argument/6686/13
Promoting this via the protocol: https://news.typo3.com/article/typo3-association-board-meeting-protocol-8-july-2026

I love this transparency and actively asking for feedback. Thank you very much.

CybotTM · 2026-07-20T14:45:46Z

Disclosure: I used AI assistance solely to improve the English phrasing and structure of this commentary. The arguments, opinions, and underlying line of reasoning are entirely my own. Without AI, the English would simply be less polished; the text would likely be longer, harder to read, and potentially prone to misunderstandings.

AI-assisted development introduces real risks. AI can invent APIs, produce plausible but incorrect logic, generate superficial tests, and introduce architectural or security flaws. Poorly supervised coding agents may create such defects faster and at a larger scale than individual developers.

However, this does not justify different quality rules based on an AI-assisted label. We do not reliably know the competence, diligence, or sources of conventional contributors either. Human-written code may be based on outdated documentation, copied snippets, misunderstood advice, or simple overconfidence. We do not classify contributors by their presumed professionalism and then apply different standards; we assess the submitted work and its risk.

An AI-assisted label may also reinforce pre-existing attitudes in either direction. Reviewers may scrutinise labelled contributions more harshly, or trust them more because they associate AI with productivity or technical sophistication. In both cases, the label risks shifting attention from evidence to expectations.

The appropriate response is therefore universal, risk-based quality gates: meaningful tests, API verification, deeper review for security-sensitive or architectural changes, clear contributor responsibility, and provenance certification for all contributions.

We have seen a similar pattern with object-oriented programming, automated testing, static analysis, and CI/CD. Their adoption did not create poor architecture, weak tests, or inadequate review; it exposed existing weaknesses and forced engineering practices to mature. AI likewise introduces new error patterns and changes their frequency and scale, but the fundamental remedy remains the same: stronger contribution and review standards for everyone.

bmack · 2026-07-20T14:49:52Z

+
+Contributors are expected to disclose when a contribution has been substantially generated or co-developed using AI tools. This disclosure serves the community in several important ways: it provides valuable context for code reviewers, it builds a shared understanding of how AI tools perform in the TYPO3 ecosystem, and it creates an audit trail should legal questions arise in the future.
+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.


How can we measure or ask for exposure of this "requirement" as maintainers?

bmack · 2026-07-20T14:50:45Z

+
+Contributors are expected to disclose when a contribution has been substantially generated or co-developed using AI tools. This disclosure serves the community in several important ways: it provides valuable context for code reviewers, it builds a shared understanding of how AI tools perform in the TYPO3 ecosystem, and it creates an audit trail should legal questions arise in the future.
+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.


AI can be involved in drafting a sketch or plan, but not in coding. We should clarify this.

I'd be fine with not declaring it if the code was fully written by a human, but following concepts created by an AI. I would trust someone who still codes themselves to understand the concept at least to a degree that ensures they know what this is about.

bmack · 2026-07-20T14:51:11Z

+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.
+
+The recommended disclosure mechanism is a tag in the commit message or pull request description: ``AI-assisted: [tool name]`` (e.g., ``AI-assisted: Claude claude-opus-4-20250514`` or ``AI-assisted: GitHub Copilot``). This follows the pattern established by the Linux kernel community and is intentionally lightweight.


If you work on a larger change with e.g. 10 sub-agents, they can run in a lot of different models, I don't know if we should list all models.

bmack · 2026-07-20T14:52:16Z

+1. Purpose and Scope
+====================
+
+The rapid adoption of AI-assisted development tools across the software industry requires the TYPO3 ecosystem to establish clear, pragmatic guidelines for contributions to TYPO3 open source extensions. This policy aims to balance innovation and developer productivity with quality assurance, legal clarity, and community trust.


you mention "extensions" and a lot of times below as well, however, it should be "code in the TYPO3 ecosystem"

True; IIRC, the original intent of this was to explicitly scope this to extensions, but that premise softened a bit during later rounds of editing. Putting this on the todo list.

Co-authored-by: Jochen Weiland <jweiland@jweiland.net>

Co-authored-by: Garvin Hicking <blog@garv.in>

martin-helmich · 2026-07-20T17:26:35Z

However, I found it too heavily framed around AI. Most of what is written applies not only to AI-generated/contributed code, but to contributions in general. In some places, it even states that a rule applies only when the code is AI-generated, which makes no sense to me.

[...]

One may even think that everything in this document applies only to AI generated/contributed code as it is named AICodePolicy.

@CybotTM @DanielSiepmann True, because the question "What's your take on AI-generated code?" was the initial trigger for this, so the whole thing is kind-of hyperfocused on that. 😅 Upon re-reading the whole thing, I do agree that some parts of it (for example, everything regarding to code provenance and such) are applicable to any kind of contribution, regardless if AI-assisted or not.

Maybe it might make sense to split this into a general "Contribution Policy", and then a specific one (building on that) for AI-assisted contributions? 🤔

andreaswolf · 2026-07-20T17:35:07Z

+
+Contributors are expected to disclose when a contribution has been substantially generated or co-developed using AI tools. This disclosure serves the community in several important ways: it provides valuable context for code reviewers, it builds a shared understanding of how AI tools perform in the TYPO3 ecosystem, and it creates an audit trail should legal questions arise in the future.
+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.


I'd be fine with not declaring it if the code was fully written by a human, but following concepts created by an AI. I would trust someone who still codes themselves to understand the concept at least to a degree that ensures they know what this is about.

andreaswolf · 2026-07-20T17:36:47Z

+
+Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.
+
+The recommended disclosure mechanism is a tag in the commit message or pull request description: ``AI-assisted: [tool name]`` (e.g., ``AI-assisted: Claude claude-opus-4-20250514`` or ``AI-assisted: GitHub Copilot``). This follows the pattern established by the Linux kernel community and is intentionally lightweight.


I actually came here for the same thing. I use Claude Code, Pi and OpenCode with different models, so neither tool nor model alone give you any indication.

Maybe we should boil it down to "Development was assisted by AI"?

andreaswolf · 2026-07-20T17:48:48Z

+
+- An IDE’s built-in AI features provided autocompletion or syntax suggestions.
+- An AI tool was used to understand or explain existing code.
+- An AI tool assisted with formatting, linting fixes, or mechanical refactoring.


I'm a bit skeptical about "mechanical refactoring" here, since that is also prone to errors and would need more careful review IMO.

andreaswolf · 2026-07-20T17:49:12Z

+6.3 Format
+----------
+
+In commit messages, add a trailer line: `AI-assisted: [tool identifier]`


trailing line, right?

The Git docs themselves actually call these "trailers" or "trailer lines".¹

Footnotes

https://git-scm.com/docs/git-interpret-trailers ↩

DanielSiepmann · 2026-07-21T15:32:28Z

the question "What's your take on AI-generated code?" was the initial trigger for this, so the whole thing is kind-of hyperfocused on that.

Fully understandable and no complain from my side, only a suggestion :)

Maybe it might make sense to split this into a general "Contribution Policy", and then a specific one (building on that) for AI-assisted contributions? 🤔

I like the addition to split this up. That would allow people not using AI to skip the AI specific part.

Co-authored-by: Andreas Wolf <dev@a-w.io>

mabolek · 2026-07-25T20:16:24Z

Nice work. 👍

Yes to splitting: I agree this would make sense as a general Contribution Policy with an addendum concerning AI-assisted contributions.

Generalize more: It would also be great if the general contribution policy and the AI-specific could be made less specifically code-related. Contributions of articles on news.typo3.com face the same copyright infringement risks as code, but the contribution workflow isn't commit-based. AI is equally both a blessing and a curse for reviewers, depending on context.

What about verbosity? Unless I've overlooked it, the policy draft does not address a common problem with some AI-based contribution: unnecessary verbosity, for example in commit messages. Contributions should not just be quick to make, but also easy to review. (The reviewer shouldn't spend more time reviewing than the real individual behind the contribution spent creating the patch.) That's a qualitative consideration that ensures there's a human in the loop on the contributor side.

CybotTM · 2026-07-26T09:02:37Z

IMO there is no need for a "TYPO3 Policy on AI-Generated Code" (in this form and with this framing).

A general AI policy would make more sense, derived from this policy:

AI-assisted contributions are permitted.
-> IMO, this is the core of the policy.
-> But this is the easier part of this policy - everything below is more difficult to track or enforce
A human contributor remains fully responsible for every submitted change.
-> Right, but this just repeats or reminds us of a general rule. It applies to all contributions.
-> However, it should be clarified what exactly is meant by "contributor": the author, the committer, ... ?
Disclosure of AI-generated contributions: if, what, and how.
-> This can become outdated very quickly, is hard to track, and may provide little real value in the end.
-> It may just mark the contribution as AI assisted - the question remains: at what portion of AI assistance should it be added?
What exactly does this apply to?
-> Does it mean that extensions can be removed from TER if they were written fully autonomously by AI?
-> That would require a debatable justification, especially when looking at some of the human-written extensions currently available in TER.

A general Contribution Policy, AI review guidelines, and maybe even AI harness guidelines should be separate documents.

IMO much more helpful would be working on the projects' harnesses (for AI and humans). Making the rules visible where they matter and enforcing them where they count.

Strong and mechanical enforced guidelines also help new contributors (with or without AI).

Btw. Linux does apply their rules to all code generation tools, which would also apply to rector, fractor, aso in our ecosystem.

Olivier Dobberkau and others added 5 commits July 20, 2026 11:49

[TASK] Initial draft of the Policy on AI generated code

78de9ef

Co-authored-by: Martin Helmich <martin.helmich@typo3.org>

[TASK] Move landscape analysis into appendix

da141e9

[TASK] Remove references to a (non-existing) CLA

ff140f8

martin-helmich added pending formal decision Awaiting a formal decision on whether or not the change can be implemented. type: formal change Changes to the meaning of the text. Require a formal decision by the owner. labels Jul 20, 2026

jweiland previously approved these changes Jul 20, 2026

View reviewed changes

Comment thread Documentation/Project/AICodePolicy.rst Outdated

garvinhicking reviewed Jul 20, 2026

View reviewed changes

Comment thread Documentation/Project/AICodePolicy.rst Outdated

garvinhicking reviewed Jul 20, 2026

View reviewed changes

CybotTM reviewed Jul 20, 2026

View reviewed changes

bmack reviewed Jul 20, 2026

View reviewed changes

[BUGFIX] Duplicate space in section 3.6

3afbe5e

Co-authored-by: Jochen Weiland <jweiland@jweiland.net>

martin-helmich dismissed jweiland’s stale review via 3afbe5e July 20, 2026 17:01

s2b reviewed Jul 20, 2026

View reviewed changes

Comment thread Documentation/Project/AICodePolicy.rst

[BUGFIX] More neutral phrasing in CONTRIBUTING.md template

bce5880

Co-authored-by: Garvin Hicking <blog@garv.in>

andreaswolf approved these changes Jul 20, 2026

View reviewed changes

[BUGFIX] Include hint to linters + analyzers in CONTRIBUTING template

af37927

Co-authored-by: Andreas Wolf <dev@a-w.io>


		Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.

		The recommended disclosure mechanism is a tag in the commit message or pull request description: ``AI-assisted: [tool name]`` (e.g., ``AI-assisted: Claude claude-opus-4-20250514`` or ``AI-assisted: GitHub Copilot``). This follows the pattern established by the Linux kernel community and is intentionally lightweight.


		Contributors are expected to disclose when a contribution has been substantially generated or co-developed using AI tools. This disclosure serves the community in several important ways: it provides valuable context for code reviewers, it builds a shared understanding of how AI tools perform in the TYPO3 ecosystem, and it creates an audit trail should legal questions arise in the future.

		Disclosure is required when AI tools have generated the structural logic or substantial portions of the contributed code. It is not required for incidental use such as IDE autocompletion, syntax suggestions, code formatting, or using AI to understand existing code.

Uh oh!

Conversation

martin-helmich commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this is

What the draft proposes

This is a draft — please help shape it

How to contribute to this draft

Identified to-dos

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

jweiland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

garvinhicking left a comment

Choose a reason for hiding this comment

Uh oh!

CybotTM commented Jul 20, 2026

Uh oh!

CybotTM Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DanielSiepmann commented Jul 20, 2026

Uh oh!

CybotTM commented Jul 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

martin-helmich commented Jul 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Footnotes

Uh oh!

Uh oh!

DanielSiepmann commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mabolek commented Jul 25, 2026

Uh oh!

CybotTM commented Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

martin-helmich commented Jul 20, 2026 •

edited

Loading

CybotTM Jul 20, 2026 •

edited

Loading

DanielSiepmann commented Jul 21, 2026 •

edited

Loading