QGIS bans AI-assisted contributions, but enforcement rests on contributor honesty

QGIS has become one of the first major open-source projects to prohibit AI-assisted contributions outright. According to a dev.to post examining the change, the project's enhancement proposal QEP #387, which passed a project vote and reached the master branch as of October 7, bars code contributions assisted by LLMs, AI tools or autonomous agents in the main qgis/qgis repository. Contributors who break the rule face having their code reverted and their contributor privileges sanctioned. The new policy replaces an earlier regime that allowed AI-assisted work under human review.

A ban driven by review overload

As the dev.to post recounts, the proposal's justification is workload: maintainers said the flood of machine-generated submissions had grown beyond what human reviewers could meaningfully evaluate. QGIS had already tried a lighter remedy, tagging AI-assisted pull requests so reviewers could filter them, but that process quietly fizzled, with only around fifty PRs ever tagged and roughly forty of them closed. Developer Nyall Dawson's position, as characterised in the post, was to close the door by default and reopen it selectively, an approach one voter reportedly described as a stopgap that might not survive. A blanket ban is presented as the rational answer to the immediate question of how the project gets through the current pressure.

Enforcement comes down to conscience

The dev.to analysis centres on how the ban will actually be policed. Asked how compliance would work, a core contributor's answer, quoted in the post, was essentially that a contributor must have written the code themselves, in good conscience. The author grades this as policy with no executable enforcement: the trigger condition, whether a given piece of code was AI-assisted, cannot be evaluated by any tool, only by the contributor's own honesty. Edge cases such as autocomplete, translation aids or a model that reorders imports make the scope undecidable. A Hacker News thread on the proposal had drawn roughly three hundred comments, splitting between readers who saw protecting reviewer attention as fair and those predicting the ban would eventually look foolish.

Most large projects have no policy at all

To place QGIS's move in context, the dev.to author audited the twenty most-starred repositories on GitHub, reading every AI policy in their contributing documents and checking workflow names for any AI-related automation. Fourteen of the twenty, including several that receive AI-generated PRs by the hundred, have no AI policy anywhere in their contributing docs. The six that do, Deno, PyTorch, Node.js, Home Assistant, Flutter and Rust, all stop short of machine enforcement. Deno, Node and PyTorch converge on disclosure, with PyTorch going furthest by requiring AI content to sit in a labelled PR section with human commentary attached. Home Assistant bans autonomous agents and closes PRs it believes were generated autonomously, relying purely on reviewer judgement. Rust is the outlier in honesty: its policy openly states that many clauses are unenforceable and that the goal is to remove plausible deniability rather than catch every violation. The QGIS ban, by contrast, threatens sanctions from the same prose-only footing while claiming more teeth.

The enforceable alternative is provenance, not detection

The post argues that detecting AI-written code is an unwinnable adversarial game, since simple code will never be reliably detectable, while binding process to a signed identity is both boring and winnable. It points approvingly to the Linux kernel stance cited in the Hacker News thread: LLM use is permitted, but the contributor is fully responsible for the code it produces. The proposed direction is CI-enforced provenance, such as Authored-by commit trailers declaring whether a tool assisted, plus logged reasons attached to any reversion, so that a false declaration at least arrives signed rather than invisible.

Why it matters

QGIS's shift from disclosure to outright prohibition is a signal of how maintainer teams under AI-generated submission volume may respond, and other projects will watch whether it holds or collapses the way the tagging experiment did. The deeper finding is the gap between policy text and enforcement: nearly every major open-source project's AI rules are prose with no gate behind them, and most have no rules at all. If the ecosystem settles on signed provenance rather than detection or bans, QEP #387 may be remembered as much for what it lacked, a mechanism, as for what it forbade.