Open-Source Is Not "Free-For-All": OSS License Obligations (GPL/MIT/Apache) and Legal Risk for Vietnamese Businesses (2026)

Quick answer

"Open source" does NOT mean "free to do whatever you want." Every open-source component still has a copyright owner; you may use it only under a LICENSE with CONDITIONS. If you break those conditions — typically by stripping attribution, deleting license texts, or failing to release your source code when a copyleft license (GPL/AGPL) requires it — your permission ends, and continued use becomes copyright infringement.

In Vietnam, computer programs are protected as literary works under Điều 22, Luật Sở hữu trí tuệ 50/2005/QH11 (amended by Luật 07/2022/QH15). So an OSS license violation is, in substance, copying/using a work beyond the granted scope — subject to administrative penalties under Nghị định 341/2025/NĐ-CP (effective 15 Feb 2026, replacing Nghị định 131/2013), with a maximum fine of VND 250 million (individuals) / VND 500 million (organizations), plus civil exposure and takedown/source-disclosure orders.

Do three things now: (1) build a dependency inventory / SBOM to know which OSS you use and under which license; (2) classify permissive (MIT/BSD/Apache — light duties) vs copyleft (GPL/LGPL/AGPL — heavy duties that can "spread" to your product); (3) preserve attribution + license texts and honor source-disclosure duties.

*Disclaimer: This article is for information only and is NOT legal advice. Legal document names are kept in Vietnamese (original). Legal citations were checked against original texts at the time of writing (see sources) but law can change and facts vary. Consult an IP lawyer before acting.*

1. Three costly myths about open source

Most OSS risk in Vietnamese firms comes not from bad intent but from misunderstanding. Open source is a licensing model, not a waiver of rights. The author keeps copyright and lets you use the work only IF you meet the conditions set in the license.

A core distinction: *open source* (licensed, with conditions) is not *public domain* (truly unencumbered). The vast majority of libraries you pull from npm/PyPI/Maven/GitHub are licensed, not public domain.

• Myth 1 — "It is free, so there are no obligations." Wrong. Almost every OSS license requires you to keep the copyright notice and license text; many also require you to disclose source code.
• Myth 2 — "Internal use only, so it is fine." Partly true: GPL copyleft triggers on distribution. But AGPL triggers even when you merely provide the software over a network (run it as SaaS) — the most common trap.
• Myth 3 — "Strip the header to keep the code clean." Removing the copyright/license lines in a source file breaks the license condition → your permission to use ends.

2. Two license families: permissive vs copyleft

Hundreds of OSS licenses reduce to two families by how strict they are. Knowing the family tells you whether a library can "spread" a source-disclosure duty onto your commercial product.

Permissive (MIT, BSD-2/3, Apache-2.0): usable in proprietary products, requiring only that you keep attribution + license text; Apache-2.0 adds an explicit patent grant and a duty to state changes. This is the "safe" family for businesses.

Copyleft (GPL-2.0/3.0, LGPL, AGPL, MPL-2.0): if you distribute a product that contains/combines copyleft code, you may be required to release the source of the relevant part under the same license. LGPL relaxes this for dynamic linking; MPL is copyleft per file; AGPL extends the duty to network use.

See Table 1 for a quick comparison and Table 3 for real usage scenarios and the duties they trigger.

3. Why OSS violations are a legal matter in Vietnam

Many assume GPL/MIT are "foreign law" and therefore harmless in Vietnam. The opposite is true: an OSS license is merely the condition attached to a copyright, and copyright in computer programs is directly protected under Vietnamese law.

The legal mechanism: a computer program is subject to copyright (Điều 22, Luật SHTT). An OSS license is a conditional grant by the owner. When you fail the condition (no attribution, no source disclosure under copyleft…), the corresponding permission lapses, and continued use becomes unauthorized reproduction/use of a copy of a computer program — within the scope of Nghị định 341/2025/NĐ-CP.

Table 2 summarizes the core legal framework (checked against original texts). Note: the fine range is per act; a single case may aggregate several acts plus remedial measures but not exceed the cap of VND 250 million (individual)/500 million (organization). The specific figure is decided by the competent authority — do not infer it.

Beyond administrative penalties, copyleft enforcement has precedents worldwide (e.g., BusyBox-related cases in the US, and the work of organizations such as the Software Freedom Conservancy) — showing OSS owners have both motive and legal tools to demand compliance.

4. Which usage triggers which duty

Copyleft duties do not always trigger. What matters is whether you distribute or only use internally, and whether you modify the code. Table 3 is a quick lookup for scenarios common in Vietnamese firms.

5. The 5-step OSS compliance process

OSS compliance needs no expensive tooling, just a repeatable process. The five steps below turn license control into an operating habit instead of a one-off scramble when an incident hits.

• Step 1 — Inventory (SBOM). Generate a Software Bill of Materials per product: list every library + version + license. Dependency/SCA scanners automate this.
• Step 2 — Risk-classify. Tag each component: permissive (low), weak-copyleft/LGPL/MPL (medium), GPL/AGPL (high if distributed/SaaS).
• Step 3 — Set policy. Define which licenses are free to use and which require approval (especially AGPL inside a closed SaaS product).
• Step 4 — Fulfil obligations. Ship a NOTICE/THIRD-PARTY-LICENSES file; keep copyright headers intact; prepare a mechanism to provide source when the license requires it.
• Step 5 — Review periodically. Every added/upgraded dependency is a chance for license risk to change — put license checks into your CI/CD.

6. Marketing caution: do not disparage or falsely compare rivals

Once your firm complies well, there is a temptation to market it by tearing down rivals ("competitor X violates the GPL", "product Y stole open-source code"). This is a separate legal risk zone, apart from the copyright story.

Under the Competition Law 2018 (Luật Cạnh tranh 23/2018/QH14), Article 45(3), providing untruthful information about another enterprise that harms its reputation, finances, or business (disparagement) is prohibited. Article 45(5)(b) prohibits comparing your goods/services with like products of another enterprise without being able to substantiate the claim.

The safe message: talk about your own compliance standard (you have an SBOM, a NOTICE, a license-review process) and cite verifiable facts; do not accuse a named enterprise of violations without proof.

FAQ

1. Is open-source software really "free"? Free of charge does not mean free of obligations. You usually pay no license fee, but you must meet the conditions: keep attribution, include the license text, and — for copyleft — disclose source when distributing. Non-compliance = loss of your right to use.

2. Does using a GPL library in a product you sell force you to open your source? If you distribute (sell/release) a product that contains or derives from GPL code, the GPL requires you to release the source of the relevant part under the same license. Internal-only use (no distribution) usually does not trigger this — except AGPL.

3. How does AGPL differ from GPL, making it the "SaaS trap"? AGPL extends the copyleft duty to cases where you provide the software over a network (SaaS), not just when you ship an installable build. If your SaaS backend runs modified AGPL software, you may have to provide the source to your service users.

4. Is it fine to strip the copyright lines to keep code "clean"? No. Almost every OSS license requires keeping the copyright notice and license text. Removing them breaks the condition → your permission ends → it can be treated as copyright infringement.

5. Which law governs OSS license violations in Vietnam? Computer programs are copyright-protected (Điều 22, Luật SHTT). Breaking a license condition = use beyond the granted scope, which can draw administrative penalties under Nghị định 341/2025/NĐ-CP (up to VND 250 million for individuals / 500 million for organizations), plus civil exposure.

6. How do I know which OSS licenses I use? Build an SBOM (Software Bill of Materials) with a dependency/SCA scanner; put license checks into CI/CD so every added/upgraded library is reviewed automatically.

*This article is for reference only and does not replace legal advice. Please check original texts (cov.gov.vn, vanban.chinhphu.vn) or consult an IP lawyer before deciding.*

Conclusion

Open source is a superb lever for speed and cost — but it comes with a contract. The cost of compliance (one SBOM, one NOTICE file, one AGPL-approval policy) is tiny compared with the risk of being forced to open-source a commercial product or facing copyright penalties.

Start with the simplest thing today: do you know how many OSS libraries your product ships and under which licenses? If you cannot answer, that is the first risk to close.