> Markdown version of [/events/world-congress-2026-europe/sessions/1193-my-lawyer-merged-my](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1193-my-lawyer-merged-my). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# My Lawyer Merged My PR: Automating OSS Compliance at Scale


- **Date:** Thursday, Jul 9, 2026
- **Time:** 17:30–18:00 (30 min)
- **Room:** Stage 12
- **Event:** World Congress 2026 Europe

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/100181-my-lawyer-merged-my-pr-automating-oss-compliance-at-scale)

## Description

Everyone agrees that OSS license compliance is critical, yet nobody enjoys the process. It usually involves spreadsheets, long email chains, and "shipping anxiety." We decided to treat (legal) license compliance not as a distinct administrative phase, but as a standard CI/CD failure state.

In this talk, I will demonstrate how we built a fully automated license defence line. We utilised package manager metadata to build a centralised "allow-list" enforced by CI checks across all repositories.

But the real innovation is the exception handling:

- **Get Blocked:** When a developer introduces a new license, the build fails with a direct link to our central license repository.
- **Review:** The developer opens a PR to add the new license to the allow list.
- **And Approved!** Our lawyer, whom we onboarded to GitHub, reviews the legal implications and merges the PR.
- **Instant Enablement:** The check turns green, and the code ships.

I will share the technical setup, how we cleaned up our metadata, and how integrating Legal into the Pull Request workflow eliminated "showstopper" risks and gave our engineers instant feedback. Additionally, I will also share how we handle the exceptional cases where we cannot add something to a global list.

## Speaker

### [Uwe Korn](https://www.wearedevelopers.com/@uwe-korn)

CTO of QuantCo


## Related talks at this congress

- [Your AI Ships Code Faster Than Anyone Can Review It](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1123-your-ai-ships-code) — Rasmus Klärck
- [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1178-one-pipeline-three) — Marcus Ross
- [Keeping Your AI Software Supply Chains Sovereign in the Age of Commercial Open Source](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1139-keeping-your-ai) — Franz Kiraly
- [Open Source Software Licenses - A short Guide for Software Developers](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/989-open-source-software) — Björn Stahl