Debian's AI Ban Lost to 'None of the Above,' 257 to 144

TL;DR

Debian just closed a two-week vote on whether large language models belong in its development process. Eight proposals were on the ballot, from a hard ban welded into the Social Contract to a position statement that amounts to "use what you like, you are still on the hook." Option 5, Responsible Use of Generative AI, won outright as the only option left in the Schwartz set. The two strictest ban proposals did not merely lose to the winner: they lost to None of the Above. Debian now neither endorses nor prohibits generative AI, encourages disclosure without requiring it, and hangs every consequence on the human who hits send.

What was on the ballot

General Resolution 2026-002, "LLM usage in Debian," ran from 00:00 UTC on August 15 to 23:59:59 UTC on August 28. Nine choices: eight proposals plus None of the Above. The spread was wide. Proposal A, from Matthias Geiger, would have written an outright prohibition into the Social Contract, which is a foundation document and therefore needed a 3:1 supermajority. Proposal G argued that "Debian is created by humans." Proposal H objected on the grounds of climate destruction. At the other end, Marc Haber's Proposal E asked the project to issue a position statement under Constitution section 4.1(5) and otherwise get out of the way.

Debian does not count first-place votes. It runs a round robin: every option plays every other option head to head, and a winner has to beat all comers. The Schwartz set is the group of teams nobody knocked out. This time it had exactly one member.

The bans lost to nobody

The automated tally ran at 00:01:41 UTC on August 29. All eight proposals cleared the quorum of 47.24. What separated them was the ratio against None of the Above.

The Social Contract ban drew 144 votes against 257 for None of the Above, a ratio of 0.560. It needed 3:1 and finished closer to one to two. "Reject LLMs as far as practical," which also proposed a Code of Conduct change, took 176 to 230, a ratio of 0.765, and it only needed a simple majority. Both were dropped before the pairwise stage even mattered.

The winner beat every rival head to head: 203 to 148 over "Allow AI-Assisted Contributions with conditions," 210 to 130 over "A cautious approach," 232 to 115 over "Accept AI contributions for Debian specific work," 251 to 139 over "Debian is created by humans," and 281 to 126 over None of the Above. That last pairing, the most popular ban option against the winner, splits the electorate 64% to 36%. This is not a project that agrees with itself. It is a project that agreed on one thing more than it agreed on anything else.

"The voters have spoken, the bastards." Debian's vote engine has signed off every result this way for years, and it has rarely been more on the nose.

What the text actually obligates you to do

The winning statement is short and worth reading in full, because four of its clauses are operational rather than philosophical.

• Same bar, no exceptions. Every contribution must meet the same standards of quality, correctness, maintainability, and legal compliance "regardless of how and with which tools they were produced."
• You review it, not the model. Contributors are expected to understand, review, test, and where appropriate modify AI-assisted output. Blindly uploading generated material is called out by name as inconsistent with Debian practice.
• Disclosure is encouraged, not required. The text says contributors are encouraged to say when AI helped, and explicitly declines to mandate it.
• Do not feed the models your secrets. This is the sleeper clause. Embargoed security bug information, cryptographic keys, credentials, private communications, and non-public infrastructure material must not go to third-party AI services without explicit authorization. That is a real constraint on how a Debian security team member can use a hosted assistant, and it is now written down.
• Mass automation still needs consensus first. Mass bug filing, large-scale code modification, and automated changes touching many packages require prior discussion through project channels, with a named human accountable for the behavior of the process. Point your agent at the whole archive at your peril.

The statement also refuses, in as many words, to decide whether AI output is copyrightable or derived from copyrighted works. Debian is not going to litigate that on a mailing list, and says so.

Debian picked the same side as CPython, not GCC

A month earlier, on July 29, the GCC steering committee went the other way. Per LWN's report, GCC declines any legally significant contribution that includes or is derived from LLM-generated content, with "legally significant" pinned to the GNU maintainer guideline of roughly fifteen lines. You may still point a model at GCC for research, analysis, bug hunting, and patch review. You just cannot ship its prose or its code, with a maintainer-discretion carve-out for test cases.

The Linux kernel took a third position: AI agents must not add a Signed-off-by, because only a human can certify the Developer Certificate of Origin, and assisted work should carry an Assisted-by: AGENT_NAME:MODEL_VERSION tag naming the model and any analysis tools used. CPython is closest to where Debian landed: allowed, disclosure "appreciated, while not required," and the submitter owns the result.

Zoom out and Debian is joining the smaller camp. A community-maintained tracker of published open-source AI policies listed 182 projects as of August 30. Reading its own columns, 100 reject AI-written contributions outright and 82 permit them.

Treat that tally as directional. The tracker's own README warns that its classification "is, in many cases, inadequate" and should not be taken as a source of truth. The shape is what matters: refusing AI is still the modal open-source policy, and requiring a human in the loop is nearly universal among the projects that say yes.

What changes for you on Monday

If you maintain a Debian package, your review workload does not change, and that is the point. The GR hands you no new grounds to reject a patch, and it hands a contributor no cover for a bad one. The argument goes back to being about the diff.

If you run agents across package trees, read the mass-change clause before your next batch. "I automated it" is not a defense in Debian, and it never was.

If you are drafting a policy for your own project, Debian's text is a usable template precisely because of what it refuses to do. It does not try to settle copyright. It does not invent a tagging scheme. It writes down the secrets rule that most policies forget. And because it is a position statement under Constitution 4.1(5) rather than a Social Contract amendment, it can be revised as the tooling changes without dragging 400 developers through another two-week ballot.

Key Takeaways

• Debian GR 2026-002 ended August 28 with "Responsible Use of Generative AI" the sole option in the Schwartz set, beating None of the Above 281 to 126.
• The Social Contract ban needed a 3:1 supermajority and managed 0.560, losing to None of the Above 257 to 144; the softer "reject as far as practical" option lost to it too, 230 to 176.
• The winning text requires no disclosure, requires human review and testing, and bars sending embargoed security data, keys, and credentials to third-party AI services.
• Mass bug filing and large-scale automated changes still need prior project consensus and a named accountable human, AI or not.
• Debian now sits with CPython and the Linux kernel rather than GCC, which since July 29 declines any legally significant contribution derived from LLM output.
• Across 182 tracked open-source AI policies, outright rejection is still the most common stance at 100 projects to 82.

Sources: Debian General Resolution: LLM usage in Debian, Results for LLM usage in Debian (devotee tally), LWN: Debian votes to allow "responsible use of generative AI", LWN: GCC steering committee announces AI policy, Linux kernel: AI Coding Assistants, CPython Developer's Guide: AI tools, open-source-ai-contribution-policies tracker