A NOTICE file is a plain text file included with some software distributions to record required copyright, licence and attribution notices. It usually accompanies open source components and lists the third-party notices that must be preserved when the software is copied, modified or redistributed.
What a NOTICE file is for
A NOTICE file exists to preserve attribution obligations that travel with redistributed software. It is not the licence text itself, but a companion record that tells downstream recipients which copyright, licence and notice statements must remain intact when components are copied, modified or repackaged.
In practice, a NOTICE file helps keep attribution requirements visible even when software is bundled into a larger product, container image or service release. That matters because notice obligations can be easy to lose during build, packaging or rebranding steps, especially when multiple third-party components are involved.
How NOTICE files fit into software distribution
A NOTICE file usually sits alongside licence files, source archives, release bundles or installation media. Its role is to centralise third-party notices so that redistributors can satisfy attribution duties without scattering acknowledgements across documentation, headers and package metadata.
For open source software, the file often reflects a practical compliance pattern: licence terms define permissions and conditions, while the NOTICE file records the attributions that must still be preserved. That makes it useful for vendors, integrators and downstream distributors who need a single place to manage notice preservation across releases.
What the file commonly contains
The contents vary by project and by dependency set, but a NOTICE file commonly includes copyright statements, licence names, attribution text, trademark notices and short explanatory notes from upstream authors. Some projects also use it to preserve bundled third-party acknowledgements that would otherwise be easy to miss.
Because the format is plain text, it is intentionally simple to review, diff and carry forward through release pipelines. That simplicity is part of its value: it reduces ambiguity about what must be copied, while leaving the original legal terms to the associated licence materials.
Why NOTICE files matter for compliance and reuse
A NOTICE file reduces the chance that attribution obligations are dropped when software is redistributed, modified or incorporated into a derivative product. It also gives legal and engineering teams a clear artefact to inspect during release review, which is especially useful when dependency chains are long or packaging is automated.
When a NOTICE file is missing, incomplete or not updated, the result is usually not a technical failure but a distribution risk: users may receive software without the required acknowledgements, and the organisation may have to unwind a release or correct the record after publication.
Risk and Threat Considerations
NOTICE files create legal and operational risk when teams treat them as optional documentation rather than part of the distribution payload. The main exposure is compliance drift: a product can be functionally correct while still failing to carry forward required attribution, which becomes harder to remediate after the release is in the wild.
Failure mechanism: A build, packaging or republishing step omits, truncates or overwrites the notice content, so downstream users no longer receive the attributions that the software distribution requires.
Impact: The organisation may face licence non-compliance, re-release work, customer questions, and avoidable friction in audits or third-party reviews.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.31 — Intellectual property rights | NOTICE files preserve required copyright and licence attribution notices. |
| A.5.34 — Privacy and protection of PII | Notice handling often sits inside broader third-party disclosure and publication controls. | |
| Recommendation — Track third-party notice obligations and retain them in release artefacts. Review published artefacts so required notices and disclosures are not lost. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Software releases need controlled handling of third-party components and accompanying notices. |
| Recommendation — Embed notice preservation into software release and packaging workflows. | ||
| NIST SP 800-53 Rev 5 | CM-10 — Software Usage Restrictions | Redistribution of software components requires managing third-party usage and attribution conditions. |
| Recommendation — Verify distribution artefacts carry the required third-party notices. | ||
Practitioner Guidance
Why practitioners should care: Treat the NOTICE file as a release artefact, not a filing cabinet for legal afterthoughts. Its value is highest when ownership is clear, because notice preservation often depends on the same build and packaging workflows that move code into production.
Governance implication: Assign explicit responsibility for collecting, reviewing and updating notices whenever dependencies change, components are removed, or redistributed packages are rebuilt. If the file is maintained informally, it tends to lag behind the actual software bill of materials.
Practitioner takeaway: The safest pattern is to review notice content at release time, alongside licence and dependency checks, so attribution survives every packaging path.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org