Apache License 2.0 is a permissive open source software licence that allows use, modification and redistribution under stated conditions. It requires preservation of licence text, copyright notices and a NOTICE file when one is supplied, and it includes an express patent grant with termination terms for patent litigation.
What Apache License 2.0 Means in Practice
Apache License 2.0 is a permissive software licence, so it is designed to encourage reuse while setting a few clear conditions. The practical significance is that downstream users can incorporate the code into proprietary or open source projects, but they must still preserve the required notices and comply with the licence terms that travel with the software.
Core Obligations and Redistribution Rules
The licence is often chosen because it is straightforward for redistribution and integration, but it is not “no strings attached”. If a project supplies a NOTICE file, that file must be retained where required, along with the licence text and copyright notices. Those obligations matter most when software is repackaged, embedded in a platform, or redistributed to customers and partners.
Patent Grant and Termination Terms
Apache License 2.0 is also notable for its express patent grant. That matters because it gives recipients more certainty that contributors are licensing relevant patent rights for use of the covered work, rather than leaving patent questions implied or ambiguous. The termination clause is equally important, because patent litigation by a licensee can end those patent rights under the licence.
Compliance, Provenance and Supply-Chain Impact
In security and engineering practice, licence compliance is part of software supply-chain hygiene. Teams need to know where Apache-licensed components are used, what notices must follow them, and whether mixed-licence distributions preserve the required attribution material. This is especially important in build artefacts, container images, SDKs and bundled libraries where licence text can be lost if inventories are weak.
Well-run inventory and release processes help prevent accidental non-compliance, preserve provenance, and avoid downstream disputes about redistribution rights. For broader supply-chain control maturity, teams often map these obligations to their software assurance and build-integrity practices, including the expectations captured in SLSA, OWASP SAMM, and the hardening discipline expressed in CIS Benchmarks.
Risk and Threat Considerations
Most Apache License 2.0 risk is not about the licence being dangerous in itself, but about organisations mishandling the obligations that come with redistribution and component reuse. The practical exposure is legal and operational: notices can be dropped, NOTICE files can be omitted, and component provenance can become unclear as software moves through builds, packaging and resale.
Failure mechanism: weak software inventory and release controls fail to carry forward the licence text, copyright notices and any required NOTICE file, especially when components are repackaged into images or managed services.
Impact: the organisation can create licence non-compliance, lose auditability over third-party code provenance, and create avoidable contractual or legal friction during distribution or acquisition reviews.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA, OWASP SAMM and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply chain integrity | Apache-licensed code must preserve provenance through build and release flows. |
| Recommendation — Track licence notices and provenance through your build pipeline before publishing artefacts. | ||
| OWASP SAMM | Software assurance maturity | Licence compliance is part of repeatable software governance and delivery practice. |
| Recommendation — Embed third-party licence checks into your software delivery governance. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Open source component handling is part of secure software management and release control. |
| Recommendation — Inventory third-party components and verify their licence obligations before release. | ||
Practitioner Guidance
Why practitioners should care: Apache License 2.0 is permissive, but permissive does not mean unmanaged. Product and platform teams should treat notice preservation and third-party component tracking as release requirements, not as legal afterthoughts, because those details are easy to lose during automation and bundling.
Governance implication: ownership should sit with the software delivery or open source governance process, so licence obligations are checked before release artefacts ship. Where a project mixes permissive and more restrictive dependencies, the distribution decision should be made with a clear inventory of what must be preserved and where it must appear.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org