On 7 October 2026 the QGIS project merged a one-paragraph change to its AI tool use policy. The new text reads: "No LLM, AI or agent assisted code contributions are allowed in the https://github.com/qgis/qgis repository."
A ban on its own would be a small story; projects set contribution rules all the time. What makes this one worth reading if you commission software is what it replaced, and the reason given for replacing it.
What the earlier policy said
The earlier version of the policy, QEP-408, was dated 31 January 2026. It allowed contributors to use whatever tools they liked, with one condition: "there must be a human in the loop." Contributors had to read and review any LLM-generated code before asking anyone else to review it. They had to be able to answer questions about their work, and they were expected to label substantial tool-generated content, for example with an Assisted-by: trailer in the commit message.
If you have ever asked a software vendor about AI, that may sound familiar: we use the tools, and a person reviews everything.
What changed, and why
The change arrived as pull request #387 in the QGIS-Enhancement-Proposals repository, titled "Add QEP428". It was opened on 24 September 2026 and merged on 7 October 2026 after a discussion period and a voting stage. It does not add a new document. It rewrites QEP-408 in place as version 2.0. The human-in-the-loop policy, the labelling guidance and the review etiquette are removed, and the paragraph quoted above takes their place, followed by the consequence: "If we subsequently discover that you have used an AI, LLM, or any agent-based workflow for your contribution, you will be subject to code reversion and contributor rights sanctioning."
The author, Nyall Dawson, explained the reason in the pull request thread. He said it was intended as a correction to the earlier QEP:
"That clearly didn't work (as you've pointed out, the process didn't happen in reality, and we've already lost at least one extremely high value contributor as a result)."
He also said the ban is not meant to be permanent as written. He described it as a starting position, a closed door that later, separate discussion could open selectively. The merged text itself contains no exceptions.
The part that matters to a buyer
Read the two versions side by side and something stands out. Neither one can detect AI use from the code. The first relied on contributors to review their own AI output and to label it honestly. By its author's account, that process did not happen in reality. The second also depends on a contributor's own conduct, and its enforcement clause begins "if we subsequently discover". The ban changes the consequence. It does not add a way of knowing.
That is the same position a client is in when they ask a software vendor for an assurance about AI. "We review everything" describes a process. Whether the process happened, on which change, and who did it, is a separate question. It can only be answered by records made at the time.
Questions worth asking whoever builds your software
- Is tool use recorded per change? The earlier QGIS policy asked for exactly this, an
Assisted-by:trailer on the commit. Ask whether your vendor's commits carry anything like it, and whether you can see it in your own repository. - Is review recorded, or only promised? A pull request approved by a named person is evidence that someone looked. A statement in a proposal is not.
- Who owns the repository? If the history lives in an account you control, you can check these answers yourself, today or in two years.
- What does the contract say? If AI use matters to you, for licensing, confidentiality or your own customers' requirements, put the rule and the record-keeping in writing. An assurance with no record behind it is what QGIS concluded it could not rely on.
QGIS's decision applies to one repository. Its maintainers decided for their own project, and this is not a verdict on AI-assisted development in general. The useful lesson travels anyway: a rule nobody can verify is only as good as the people following it. If provenance matters to you, ask for the record, not the reassurance.
Source: github.com/qgis/QGIS-Enhancement-Proposals/pull/387 and the merged qep-408-ai-tool-policy.md, read 13 October 2026.