先從最嚴格的 QEMU 講起。QEMU 在 2025 年 6 月訂下規定，只要認為貢獻裡含有 AI 生成的內容，就不收，理由跟 DCO 有關。DCO 全名是 Developer Certificate of Origin，很多開源專案都在用，這個做法很簡單，貢獻者在 patch 最後加一行 Signed-off-by，後面寫上自己的名字，表示這段程式碼的來源沒問題，可以照專案的授權釋出。QEMU 的規定寫到，要簽下這行名字，簽名的人得完全清楚自己交出去的東西在著作權和授權上是什麼狀況，而 AI 產出的東西在這方面目前還沒有定論。所以在這步驟就是很大的問題，簽的人要替來源擔保，但 AI 的產出偏偏說不清來源，因此這關看起來是無法通過的。

Linux 核心走的是另一條路。2026 年初，核心加進兩份跟 AI 工具有關的文件，允許開發者用 AI 幫忙，不過 Signed-off-by 只能由人來加（“Only humans can legally certify the Developer Certificate of Origin (DCO)."）。這裡的 DCO 就是剛剛 QEMU 說的簽名，而 DCO 本來就是從 Linux 核心開始用的。另一份文件也寫了訂下指引的重要原因之一：工具會讓送進來的貢獻變多，而審查和維護的人力有限。

Debian 的做法又不太一樣。2026 年 8 月，Debian 開發者投票通過一份決議，寫明 Debian 既不背書、也不禁止生成式 AI 工具，要不要用、該怎麼用，全由貢獻者自己決定。乍看像是沒有選邊，好像模模糊糊，不過同一份資料也提到，沒有經過適當的人工審查，就直接接受或上傳 AI 產出的東西，不符合 Debian 一直以來的開發方式。

剛剛提到三家的做法和理念各不相同，但仔細看看可以發現，其實重要的、在乎的都是同樣的事情：不管收不收 AI 寫的 code，最後負責的都必須是人。QEMU 認為 AI 的產出現在還沒辦法讓人放心簽名，Linux 則把這個判斷交給簽名的人。但現今的 AI 發展很快，也越來越多產品都是用 AI 開發、維護，因此未來會有甚麼變化也不得而知，畢竟最後還是要做出好的、安全的工具和產品。

The tag GCC requires

The GCC Steering Committee accepted its AI policy on 29 July 2026, and it went up on the GCC website the same day. GCC declines legally significant “contributions which include LLM-generated content or are derived from LLM-generated content”, test cases excepted. Any contribution of LLM-generated content must carry an Assisted-by: tag in its commit message. GCC also says that “All contributions must be submitted by a human who understands the changes and is prepared to answer questions about them.” Only a human may give the Signed-off-by: that certifies the Developer Certificate of Origin, and an LLM may not commit code to the project repository.

The kernel’s two files

The kernel’s guidance is in Documentation/process/coding-assistants.rst, which reached the tree in January 2026. It gives the format as Assisted-by: LLM [TOOL1] [TOOL2], where the bracketed slots hold optional analysis tools (coccinelle, sparse, smatch, clang-tidy), and the worked example reads Assisted-by: LLM coccinelle sparse.

Until August that example read Assisted-by: Claude:claude-3-opus coccinelle sparse, because the format asked for an agent name and a model version. Christian Brauner’s patch, merged on 3 August 2026, deleted both fields. The reason, from the commit message: the requirement “provides free advertising to proprietary software companies while adding little or no useful information”.

The obligation to use the tag is in a different file. submitting-patches.rst has said since April that “If you used any sort of advanced coding tool in the creation of your patch, you need to acknowledge that use by adding an Assisted-by tag. Failure to do so may impede the acceptance of your work.” That wording covers any advanced coding tool, not language models specifically. On the other trailer, coding-assistants.rst says: “AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the Developer Certificate of Origin (DCO).”

QEMU’s checkpatch rule

QEMU’s published policy has not moved. docs/devel/code-provenance.rst on master still carries the line it has had since June 2025, that the project will “DECLINE any contributions which are believed to include or derive from AI generated content.”

What moved is where a contributor runs into it. Paolo Bonzini’s patch of 3 September, merged on the 7th, added twelve lines to scripts/checkpatch.pl, the style checker QEMU asks contributors to run before submitting:

# Reject trailers that credit an AI agent.
		if ($realfile =~ /^$/ &&
		    ($line =~ /🤖/ ||
		     $line =~ /^\s*(?:Assisted|Generated)-by:/i ||
		     ($line =~ /^\s*Co-authored-by:\s*(.*?)\s*$/i &&
		      $1 =~ /\bcopilot\b | \bchatgpt\b | \bcodex\b | \bcursor\b |
			     \bgemini\b | \bllama\b | \bnoreply\b | \[bot\] |
			     \bclaude\b.*(?:opus|sonnet|fable|haiku|anthropic\.com)/xi))) {
			ERROR("QEMU does not allow using AI for contributions, " .
				"see docs/devel/code-provenance.rst\n" . $herecurr);
		}

The patterns cover a robot emoji, the Assisted-by: and Generated-by: trailers, and a Co-authored-by: naming a known AI tool, a [bot] handle or a noreply address.

The commit message says the community has “broad consensus to not accept assisted-by and similar trailers, and much less fake co-authored-bys, independent of any AI policy”, and that the script is there “so that there is another way for contributors to discover the AI policy.”

A second patch written the same day, merged on the 8th, added an AGENTS.md to the tree, and that one is addressed to the tool. An agent may help with researching APIs, static analysis, debugging, local experiments “not intended to be upstreamed” and trivial non-copyrightable changes, but “agent output can not be included in any upstream contributions”, and for anything outside those categories it “MUST decline the request and refer the user to the project’s policy”. Alex Bennée’s commit message: “people often don’t read the docs. However AI Agents do tend to try and follow instructions so lets help them out.”

On 21 September Bonzini posted an RFC series titled “docs/devel, AGENTS.md: a completely new policy on AI-generated contributions”, which opens “WARNING: this is intentionally a full U-turn from the previous policy”. It is at version three and it is not merged; master still declines.

Whatever each project decides about the trailer, all it does is record that a model was involved. The responsibility does not move with it. GCC asks that the submitter be ready to answer questions about the change, and the kernel’s list for the human submitter includes “Taking full responsibility for the contribution”. QEMU, which will not take the trailer at all, says the same in the paragraph covering exceptions to its policy, where the Signed-off-by: label “is a statement that the author takes responsibility for the entire contents of the patch, including any parts that were generated or assisted by AI tools or other tools”.

So before sending an AI-assisted patch somewhere, open that project’s own contribution file and read the paragraph on trailers. They run from a few hundred words to a couple of thousand, and they do not agree with one another.

This was put together from the policy files, commits and mailing-list messages themselves, read on 23 September 2026. QEMU’s is the one under active revision, so that part may not hold for long.