Debian voted down mandatory disclosure for AI-assisted contributions, and I think they got it right for a boring reason: the rule was never about the tool. A patch has to be technically correct, maintainable and legally clean whether I typed it or Claude drafted it. If I can’t explain it, test it and defend it, it isn’t ready — same as always.
The part I’m actually changing my habits over is the confidential-data line. No private communication, credentials, keys or unpublished vulnerability details into external AI services. That’s a real constraint on how I work, and it’s an argument for keeping a local model around for anything touching secrets. Transparency stays a recommendation here, but I’ll keep tagging AI-assisted commits anyway. Cheap, and it tells future me where to look first.
The story — Debian’s general resolution “Responsible Use of Generative AI” won out over seven competing proposals, rejecting both an outright ban and mandatory labelling of AI-assisted contributions. Submitters must understand, review and take full responsibility for their work regardless of tools used; disclosure is encouraged, not required. Developers shouldn’t send non-public data to external AI services, and automated mass actions still require prior discussion. (Source)