QGIS pauses AI contributions: what it means for you

QGIS, the biggest open source GIS software on the planet, has decided that for now it won't accept AI contributions to its code. The decision came through one of the project's enhancement proposals, QEP #387 on GitHub. It's a moratorium. A pause that basically says "let's stop and think before this turns into a mess". If you maintain a project, contribute to open source or just use Copilot and Claude every day, it's worth understanding why. The same question will reach your repository sooner or later.

What QGIS decided about AI contributions

If you've never opened it: QGIS is a desktop app for maps and geoprocessing. It's built in C++ with Qt, has a huge Python layer and is licensed under the GPL. City governments, NGOs, universities and agribusiness companies use it all over the world. It's an old, large project, and volunteers do a lot of the maintenance.

In short, the moratorium says that code generated by generative AI tools won't enter the codebase until the project has a final policy. The word "moratorium" matters. Nobody is saying AI is evil. The message is different: the project doesn't yet know how to handle this safely, so it would rather hit the brakes.

The discussion around it has three main threads:

• License and authorship. QGIS is GPL. Contributors need to own the rights to what they submit. With code generated by a model trained on who knows what, that guarantee gets blurry.
• Review cost. Generating an 800-line PR takes minutes. Reviewing it takes hours, and the reviewers are volunteers.
• Understanding. A PR whose author can't explain their own change is a problem, no matter where the code came from.

Why an open source project would do this

QGIS isn't alone. Gentoo approved a similar ban in 2024. NetBSD started treating LLM-generated code as "presumed tainted" from a licensing point of view. QEMU adopted a rule rejecting AI-generated code, citing the DCO. That's the Signed-off-by line where you declare you have the right to submit what you're submitting. And Daniel Stenberg, from curl, has complained publicly many times about the flood of AI-generated security reports that make no sense at all.

The pattern is clear. Projects with copyleft licenses, old codebases and small maintainer teams are the first to pull the brake. This has little to do with fear of technology. What matters is the math: AI pushed the cost of opening a PR close to zero, and the cost of reviewing it hasn't changed.

Generating code got cheap. Reviewing it is still expensive, and the maintainer pays the bill.

Think about a maintainer's workflow on a big project. Before, a bad PR took effort from the person sending it. That filtered things out on its own. Today someone asks the agent to "fix issue #12345", gets a diff that compiles and opens the PR. The maintainer spends an afternoon finding out the fix treats the symptom and quietly breaks something else. Multiply that by ten PRs a week and the moratorium makes sense.

The other extreme: Bun is built with AI

The contrast gets interesting when you look at Bun. Anthropic bought Bun at the end of 2025, and the team doesn't hide that it uses Claude heavily in development. There are PRs in the Bun repository opened by an agent, reviewed by people and merged. The runtime a lot of people use in production today is partly written with AI help.

So who's right? Both of them, and that's the point. The situations are very different:

• Bun has a paid, full-time team that knows every corner of the code and has the tooling to validate what the AI produces.
• QGIS relies on volunteers, carries decades of code and has a license that demands clear authorship.

AI with strong review and a responsible owner works. AI as a shortcut for people who don't know the project turns into noise. The tool is the same in both cases. What changes is who takes responsibility for the result.

My opinion, no hedging: the QGIS moratorium is sensible. Maybe even late. A clear policy, even a restrictive one, protects the project better than letting each reviewer decide alone based on their mood that day.

How to apply an AI policy to your repository

You don't need to ban anything to learn from QGIS. You need to decide and write it down. Most repositories today have no rule at all, and that's where the problem lives.

A good start is a section in CONTRIBUTING.md:

## AI usage

- You may use AI tools, but you are responsible for every line.
- State in the PR if significant parts were generated by AI.
- You must be able to explain any part of the code during review.
- PRs the author can't defend will be closed.

And if you at least want to know what's coming in, you can automate a warning in CI. Many AI tools leave traces in commits, like Co-authored-by: Claude or "Generated with". A Bun script handles it in a few lines:

// scripts/check-ai-trailers.ts
const base = Bun.argv[2] ?? "origin/main";

const log = await Bun.$`git log ${base}..HEAD --format=%H%n%B%n--END--`.text();

const suspect = /co-authored-by:.*(claude|copilot|cursor|codex|devin)|generated with/i;

const flagged = log
  .split("--END--")
  .map((c) => c.trim())
  .filter((c) => c && suspect.test(c));

if (flagged.length > 0) {
  console.error(`${flagged.length} commit(s) with AI markers:`);
  for (const c of flagged) console.error("-", c.split("\n")[0]);
  process.exit(1);
}

console.log("No AI markers found.");

In your workflow, just run bun scripts/check-ai-trailers.ts origin/main. Bun.$ already escapes the interpolated variable, so you don't build shell strings by hand.

Now, to be honest: this only catches honest people. Delete the trailer and the script goes blind. AI text detectors are no good either. The false positive rate is ridiculous. So don't treat the script as enforcement. It's there to make your policy visible. If the project requires a disclosure, CI can ask for the disclosure, and then exit(1) becomes a polite reminder instead of an accusation.

What changes in your workflow as a contributor

If you contribute to open source, the practical rule is now this: read the policy before opening the PR. If there isn't one, ask in an issue. Sending generated code to a project that bans it burns your reputation there, and maintainers have long memories.

Even where it's allowed, a few habits separate people who use AI well from people who just dump diffs:

1. Small PRs. If the AI generated 600 lines, break them into pieces someone can review over a coffee.
2. Tests written, or at least run, by you. Not just "the agent said they passed".
3. A description of why the change exists, in your own words.
4. Quick, meaningful answers when the reviewer asks something. "I don't know, the AI did it" ends the conversation.

At work, on closed code, the same logic applies with less ceremony. The colleague reviewing your PR is also a tired maintainer. The difference is they can't just close the PR and walk away (even if they'd like to).

A moratorium isn't the end of the story

Moratoriums end. QGIS will probably come out of this with disclosure rules, PR size limits and some explicit accountability requirement. That's the path several projects took after the initial scare. The legal and technical tools for handling authorship of generated code are still maturing, and slowing down until they arrive is just prudence.

The message for developers is simple. Using AI is now the norm, and that's fine. You're still responsible for the code, line by line. QGIS just put that in an official document before most others did.

I use AI every day in my projects, and my rule is the same as QGIS's, in a relaxed version: if I can't explain it, it doesn't get in. If you want to see how that looks in practice, take a look at my projects.

QGIS, the biggest open source GIS software in the world, has stopped accepting AI-generated code.

This isn't fear of technology. The math is simple. Opening a PR is now almost free. Reviewing it still costs hours of volunteer time.

On the other side there's Bun. A good part of it is written with Claude and reviewed by a full-time paid team. Same tool. What changes is who answers for the result.

My rule is a relaxed version of theirs: if I can't explain it, it doesn't get in.

Does your repository have a written AI policy, or does each reviewer decide based on their mood that day? I left a CONTRIBUTING.md template and a Bun script in the article to get you started.

#OpenSource #ArtificialIntelligence #CodeReview #SoftwareDevelopment #QGIS