The Debian Project has settled the question of AI-assisted contributions through a General Resolution. Voting closed on August 28, and of the nine choices on the ballot, Responsible Use of Generative AI came out on top, with the result confirmed on August 29. The text neither endorses nor prohibits the tools, places responsibility squarely on the contributor who submits the work, and stops short of requiring anyone to disclose that AI was involved.
A nine-way ballot that landed in the middle
The resolution, titled LLM usage in Debian, entered its discussion period on July 23. That period, originally scheduled to end on August 13, was extended, and voting ran from 00:00 UTC on August 15 to 23:59:59 UTC on August 28.
The ballot listed nine choices: eight proposals plus None of the above. The range was wide. One proposal would have amended the Social Contract to ban LLM-assisted contributions outright. Others would have allowed them under explicit conditions, updated the Code of Conduct to reject LLMs as far as practical, accepted AI contributions only for Debian-specific work, declared that direct contributions must be created by humans, or asked contributors to avoid LLMs on climate grounds.
The winner was Option 5, Responsible Use of Generative AI, proposed by Marc Haber. Debian uses the Condorcet method for its votes, and Option 5 was the only choice left in the Schwartz set.
What the resolution asks of developers
The core idea is that generative AI gets no special treatment in either direction. Debian neither endorses nor prohibits the tools, but every contribution has to meet the same standards of quality, correctness, maintainability, and legal compliance regardless of how it was produced.
Contributors are expected to understand, review, test, and where appropriate modify AI-assisted output before it goes into Debian. Blindly accepting or uploading AI-generated material without human review is stated outright to be inconsistent with the project's established development practices.
The security boundary is drawn in concrete terms. Embargoed security information, cryptographic keys, credentials, and private communications must not be handed to third-party AI services without explicit authorization. Bulk bug filings and large-scale code changes still require prior discussion and consensus, and any automated process needs a human who remains accountable for its behavior and output.
At the same time, the resolution deliberately avoids the legal questions around copyright, authorship, and licensing of AI-generated material. Those debates are still open in many jurisdictions, and the project states plainly that it is not trying to settle them here, leaving the judgment to individual contributors.
The ban failed to clear a 3:1 bar
Debian had 1,045 voting developers, which put the quorum at 48.49. All eight proposals cleared quorum, and the differences showed up after that.
Option 1, which would have written the ban into the Social Contract, needed a 3:1 supermajority because it amended that document. It finished at 144 to 257 against None of the above, a ratio of 0.560, and was dropped. Option 3, which paired rejection with a Code of Conduct update, came in at 176 to 230 for a ratio of 0.765, falling short of even a simple majority.
Option 5, by contrast, took 281 to 126 for a ratio of 2.230 and beat every other choice head to head: 203 to 148 over the conditional-permission Option 2, 210 to 130 over the cautious Option 6, and 232 to 115 over Option 4, which would have limited the policy to Debian-specific work. The restrictive proposals dropped out early, the permissive ones clustered together, and the most measured wording among them prevailed.
The one line that separates it from the runner-up
In practice, the biggest gap between Option 5 and the runner-up is disclosure. Option 2 would have required contributors to disclose when a significant portion of a contribution was generated by a tool, and it even sketched out the mechanics, suggesting Git trailers such as Generated-By: or Assisted-By: for commits.
Option 5 encourages disclosure but does not require it. That means the community has no systematic way to tell whether a given contribution involved AI. What backs the policy up is the self-discipline of each contributor.
Debian has long applied strict rules to what ends up in the distribution while staying out of the question of which tools developers use on their own machines. This resolution places generative AI on that same line.
Summary
Debian chose to neither ban nor endorse generative AI and to apply its existing standards unchanged. With the outright ban falling short of the 3:1 bar and mandatory disclosure rejected along with it, the project will run on contributor judgment for the foreseeable future. A formal position from a project of this age and size carries weight, and other open source communities working through the same argument now have a reference point.
