What happened
NLnet Labs revised its LLM policy on 26 June 2026, publishing rules that limit how large language models (LLMs) can be used in interactions and contributions to the organisation and its projects, per the policy page. The policy states, "We require all code and documentation contributions to be authored by a human," and it requires contributors to disclose LLM use when opening issues, filing vulnerability reports, or posting on community forums. The policy allows an exception for including an LLM-suggested fix as part of a vulnerability or bug report, and permits LLM-assisted linting, analysis, or review provided the human contributor verifies and remains responsible for the output. The page also warns non-compliant submissions "may be closed or deleted without prior notice."
Technical context
The policy draws a clear line between authored source material and machine-generated text for code and documentation. From a practitioner perspective, rules that ban LLM-generated code in repositories increase emphasis on provenance, reproducibility, and human review in CI/CD and code review workflows. Allowing LLM output for analysis and linting but not for authored content follows a conservative risk model that separates assistance from final authorship.
Context and significance
Public-facing LLM policies are becoming more common among open-source infrastructure and security-sensitive projects. NLnet Labs builds widely deployed Internet infrastructure tools including the Unbound recursive DNS resolver and the Routinator RPKI validator - projects where security provenance and contributor accountability carry real downstream risk. Disclosure requirements for LLM use aim to preserve trust in vulnerability triage and maintain clear accountability over fixes and patches. For contributors and maintainers, these policies shift part of the responsibility onto humans to verify model outputs and to document tool-assisted steps when interacting with project governance channels.
What to watch
For repository maintainers and downstream integrators, indicators to monitor include how strictly projects enforce human-authorship clauses in pull requests, whether automated CI flags LLM-origin metadata, and how vulnerability reporting workflows evolve to accept machine-suggested fixes while preserving verification steps. Observers should also watch for similar formal policies from other critical open-source infrastructure projects, which would indicate a broader standardization of LLM provenance practices.
Key Points
- 1NLnet Labs mandates human-authored code and documentation, while allowing LLM-suggested fixes within vulnerability reports for triage.
- 2Mandatory disclosure of LLM use in issues and reports raises provenance and accountability requirements for contributors and security reporters.
- 3Projects adopting human-authorship rules typically increase verification burden for contributors and encourage explicit documentation of tool-assisted steps.
Scoring Rationale
The policy matters to contributors and maintainers of NLnet Labs projects and signals a wider trend in open-source infrastructure toward stricter LLM provenance and verification. It is notable for practitioners but not a sector-wide inflection on its own.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
