Conversation
nyalldawson commented Sep 24, 2026
Followup discussion at https://lists.osgeo.org/pipermail/qgis-developer/2026-September/068576.html .
This formally changes the AI policy to a strict "NOT ALLOWED" policy.
haubourg commented Sep 24, 2026
Hi, maybe this strong take deserves a bit of context of why we want to go further than the previous "Human in the loop" policy
AI use from external contributors puts a massive and unbearable pressure on the shoulders of our maintainers, who already had a though job before the era of LLM's
AI stream is a lot higher than what human review can take seriously, leading to either a longer list of un-reviewed PR's or not fully reviewed code and quality issues. Both thing we don't want in the project.
Free software communities are build on human network . QGIS is trusted by organisations because they know they can contribute back, they can hire contributors for support, training and feature. As a community project, this is something we really want to protect, and keep having enough bandwith to be welcoming to human contributions.
So, for this reason, a huge +1 for me. Thanks a lot for opening the QEP, given the pressure context you are in @nyalldawson , much appreciated.
I'd like to open another topic about the usage of LLM for review, auditing and security purposes, but I think this is a very separate thread, and we'll open discussions at the user conference before any formal discussions. Things are moving so fast, let's first tackle this QEP.
timlinux commented Sep 24, 2026
Thank you @nyalldawson - hopefully having a short paragraph like this rather than a long essay cut out any confusion!
vpicavet commented Sep 24, 2026
Does that include any contribution to issue content, comments, PRs ?
Also, we should also include the QEP repository at least.
Amalvir commented Sep 24, 2026
Hi, I am directly concerned by this new policy, and it’s also a +1 for me.
When I created my 2 AI-assisted regressions-fix PRs to investigate the cause of the bugs, suggest fixes, and review the code, I didn’t realize the harm this could cause to QGIS’s already fragile reviewer community.
I’m clearly not yet skilled enough to fix bugs in a project as complex as QGIS, but LLMs give you the illusion that it’s possible. A few tokens later, and the bug is fixed. By doing this, we’ve broken a trust contract between the reviewer and the contributor. The contract that, to contribute at such a big project, you know what you're doing.
I guess there’s a second effect but I didn't read much online: by making this kind of ease available, contributors using AI learn very little/nothing and don’t build up their skills on the project. They can never really hope to become reviewers themselves, and the community stagnates.
This is the point of view of a passionate open-source user but beginner developer, trying to find my place in today’s world, where AI doesn’t really make things easier. Let's learn to walk before running.
Uh oh!
There was an error while loading. Please reload this page .
haubourg commented Sep 24, 2026
Does that include any contribution to issue content, comments, PRs ?
I would agree with this, though 100% of the submitted security advisories are written using AI since we started with this system. ( most concern our websites, not QGIS core though)
kannes commented Sep 24, 2026
Please do not misunderstand my criticism below. I consider the current craziness around "AI" to be a huge problem in many ways, ethical, societal, economical etc. And I see the huge and unfair pressure that its abuse creates on maintainers and developers. I wish it all had never happened but here we are.
I want to highlight some technical benefits though, which this policy would disallow, at least as I understand it. I am deliberately ignoring everything else here.
I could also absolutely understand if it was more of a "political" move to ban something considered unethical. But is that the intention? Is it to reduce pressure on developers? Or to make a strong statement against "AI"? In any case, I think it could more clear and probably be stronger.
As it is written now, I would understand the policy to not allow usage of LLM for review, auditing and security purposes either. The words assisted and used are very broad and I am afraid that they might throw out the baby with the bathwater ( if the baby is AI usage that yields things that are functionally and logically fit for integration in QGIS, that are human-reviewed and that do not create more after-merge-maintenance-hassle than those 100% sourced from human brains).
As someone who sometimes feels brave enough to make tiny steps into the C++ world of QGIS core, I have found LLMs to be useful for discovering additional, non-obvious context in the code. They are often wrong, but it is my strong belief that the results can be used by humans to gain further understanding of code and actually help creating better contributions.
I also sometimes find LLMs useful to get a simulation of a reviewer. Throw your code at it for review, get some listicle back, discard some of it garbage or unrelated, look at the rest, maybe find an actual issue, fix it, then go to your co-workers with a slightly less bad PR. A "Clippy" in your IDE, that gives some - sometimes useful - feedback or criticism on your development, can also help reduce errors and improve robustness. Like a web search will yield false information alongside true information, a LLM will do the same. It is up to the human to critically verify whatever they output.
Such uses would be disallowed by my understanding of this policy.
rouault-on-strike commented Sep 24, 2026 • edited Loading Uh oh!
There was an error while loading. Please reload this page .
The words assisted and used are very broad and I am afraid that they might throw out the baby with the bathwater
yes, we are aware we might throw the baby with the bathwater, but the baby might be non-viable, so... This QEP is a stop gap measure. Two years ago the world was just fine without AI sucked less than today, so there's no reason to allow it without fully understanding the consequences. We might have to wait for the burst of the AI bubble to fully understand what a fair AI use might be.
uclaros left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more .
Can we please have some more context on this proposal?
The mailing list posts mention hurt in the community, and points being raised on different channels (eg mastodon), which is quite vague and I'm afraid interpreted differently by each one of us.
I'm mostly interested on what we're trying to protect against: is it bots? passer-bys? randoms becoming regular contributors? existing regular contributors? core developers?
I'm also interested on where the previous policy failed -- the extractive tag was never created, ~50 PRs were tagged AI Assisted , ~40 of them were closed without merging. There are several others that were simply closed but never tagged.
Uh oh!
There was an error while loading. Please reload this page .
nyalldawson commented Sep 24, 2026
The intention is not that this becomes the "written in stone, forever" policy. It's rather a "lets start with a closed door, which we can then selectively open a little if/when it's safe and proper discussion has been made on that".
So we start by being ultra-restrictive, and then, later, someone (else) argues for cases like "ai can be used as a replacement for ide autocomplete" / "ai can be used for language translations" / etc , all to be considered on a singular case-by-case basis.
nyalldawson commented Sep 24, 2026
It's intended as a correction to the earlier QEP. That clearly didn't work (as you've pointed out, the process didn't happen in reality, and we've already lost at least one extremely high value contributor as a result).
So as noted above, we correct by slamming the door shut, and then choosing later how far we want to inch it open.
nyalldawson commented Oct 5, 2026
This has now passed the discussion period and has moved to the voting stage
3nids commented Oct 5, 2026
would it be possible to keep it open by the end of the week. Reasons for this
the contributor meeting is happening now
I personnally wanted to reply (I know I'm late)
nyalldawson commented Oct 5, 2026
would it be possible to keep it open by the end of the week. Reasons for this
3nids commented Oct 6, 2026
@nyalldawson I had a discussion with Tim this morning. I'm ok with moving forward to voting and will open another QEP to raise another discussion.
elpaso commented Oct 6, 2026
Please keep in mind that this QEP is meant to establish an initial policy, it doesn't mean that AI contributions will be banned forever and in any form.
02JanDal commented Oct 6, 2026
I have a big worry with this policy; it's not particulary clear what's actually prohibited. Using Claude Code/Github Copilot CLI/etc.? Sure, that's clear that it's not allowed. But what about LLM-backed autocomplete? What about non-LLM AI (for example, Jetbrains-based IDEs have long used ML models to rank auto-completion results)? Using ChatGPT to brainstorm a design? Searching for an error message and unintentionally seeing the answer in Googles AI answer? Asking Claude for a help with an issue in some PyQGIS, realizing it's actually a QGIS Core bug and going on to fix that manually? What if I can't think of the a term in English and use Google Translate to translate from my native language and subsequently use that in code?
I realize that there's a fear that giving even a little bit of leway here will result in the problem persisting, but I think it's very important that the policy is very clear, especially considering the penality.
No code contributions written by LLM or AI-agents are allowed in the https://github.com/qgis/qgis repository.
(removes the very broad "AI" term which makes e.g. Jetbrains ranking model questionable, and explicitly spells out "written" so that e.g. searching/brainstorming/etc. is allowed)
Preferably the policy would also contain informative examples of what is/isn't allowed.
timlinux commented Oct 6, 2026
Sorry for also being late... I have a big worry with this policy; it's not particulary clear what's actually prohibited. Using Claude Code/Github Copilot CLI/etc.? Sure, that's clear that it's not allowed. But what about LLM-backed autocomplete? What about non-LLM AI (for example, Jetbrains-based IDEs have long used ML models to rank auto-completion results)? Using ChatGPT to brainstorm a design? Searching for an error message and unintentionally seeing the answer in Googles AI answer? Asking Claude for a help with an issue in some PyQGIS, realizing it's actually a QGIS Core bug and going on to fix that manually? What if I can't think of the a term in English and use Google Translate to translate from my native language and subsequently use that in code? I realize that there's a fear that giving even a little bit of leway here will result in the problem persisting, but I think it's very important that the policy is very clear, especially considering the penality. To offer a suggestion: No code contributions written by LLM or AI-agents are allowed in the https://github.com/qgis/qgis repository.
(removes the very broad "AI" term which makes e.g. Jetbrains ranking model questionable, and explicitly spells out "written" so that e.g. searching/brainstorming/etc. is allowed)
Preferably the policy would also contain informative examples of what is/isn't allowed.
I think the measure of compliance is "did you in good conscience write the code yourself" - we are not set up to peer into your computer and look at what you did. You will know if your brain made the code you want to share or someone else's brain did.
timlinux commented Oct 6, 2026
@nyalldawson and others watching this QEP - as @3nids mentioned we had some discussions about this here at UC2026 - lets go ahead with the vote as scheduled. We will surely have some new QEP's looking to crack that door open once / if this goes through....but let's tackle one use case at a time so that we can all stay in the same boat and keep it rowing in the same direction.
adamjstewart commented Oct 6, 2026
No code contributions written by LLM or AI-agents are allowed in the https://github.com/qgis/qgis repository.
I would highly recommend including documentation, bug reports, discussions, PR descriptions, comments, and basically all written interactions on GitHub. These are often even more verbose and extractive than the code itself.
alexbruy commented Oct 7, 2026
rouault-on-strike commented Oct 7, 2026
vpicavet commented Oct 7, 2026
For what it's worth, that's a +1 from me.
nyalldawson commented Oct 7, 2026
Declared as approved with votes from @rouault-on-strike @alexbruy @signedav @elpaso
gacarrillor commented Oct 8, 2026
For the record, +1 from me as well, thanks @nyalldawson
…after ebdaf93 's stated 11:10 coverage end; this session's feeds pulled 12:02-12:15 UTC across four passes - the parallel batch died at the 300s mark with 13/45 landed, an --http1.1 -4 browser-UA sequential pass recovered 11 more, a plain browser-UA pass recovered 15 more, and a googlebot-UA pass plus a final plain-UA retry recovered qbitai/solidot/swillison/webkit, 44/45 landed; missed on all attempts: rust - blog.rust-lang.org unreachable, newest stamp carried unchanged from the recordings (Oct 2 standing stale) so no in-window cost; shells this pass: mydrivers 404-1231B, oschina 404-1548B, register 404-204KB, svelte/tailwind/nextjs/vscode 404-pages, nodejs 404-98KB parse-0, anthropic 404-20KB; an unrelated untracked weibo-mss.json sat in the worktree from a concurrent session and is not part of this commit): three adds. (1) An "unprecedented" cyberattack has crippled supermarket refrigeration across Europe: hackers took control of Danfoss-made refrigeration control systems used by French supermarkets Intermarché, Leclerc and Coopérative U and set the automatic defrost function - normally two hours a day - into a continuous forced defrost cycle at 50 degrees C, disrupting deliveries and electronic-shelf-label in-store pricing; Coopérative U president Dominique Schelcher confirmed Monday morning that a cyberattack had been affecting the refrigeration production facilities of several stores in the network since the previous night, calling it extremely serious and unprecedented; separately NOS reports Albert Heijn, Etos and Gall & Gall in the Netherlands took websites down after a Sunday-afternoon cybersecurity incident with Belgium's Delhaize (also Ahold Delhaize) also disrupted; early losses approaching 300k euros, potentially several million nationwide (primary tomshardware.com/tech-industry/cyber-security/unprecedented-cyberattack-cripples-supermarket-fridges-across-europe-as-hackers-activate-automatic-defrosting-delivery-and-store-prices-also-impacted-by-incident verified via direct curl --http1.1 -4 page fetch at ~12:25 UTC Oct 12, 2007199 bytes, datePublished 2026-10-12T11:32:54+00:00, byline Stephen Warwick, citing La Dépêche and the Coop U president's X confirmation; ladepêche.fr and nos.nl not probed this session, so the verified Tom's Hardware disclosure is cited per the relay precedents). New territory - grep shows zero prior supermarket/Danfoss/refrigeration entries ( ebdaf93 recorded the related Ahold-Delhaize supermarket cybersecurity-incident newsroom statement 10:41:55Z as a corporate-PR skip - Ahold Delhaize is Albert Heijn's parent, the same arc's earlier Dutch signal). Categorized 后端 per the security-campaign precedents (CyberXero, Bricksforge, CISA KEV). (2) QGIS merged QEP428 "No AI contributions permitted" (PR #387 authored by core contributor Nyall Dawson): the proposal replaces the project's earlier QEP-408 AI tool policy (Even Rouault's human-in-the-loop policy adapted from LLVM's AI Tool Use Policy, which required reviewing all LLM output, transparency via Assisted-by trailers, and banned unreviewed agent comments) with a total ban - "No LLM, AI or agent assisted code contributions are allowed in the qgis/qgis repository. If we subsequently discover that you have used an AI, LLM, or any agent-based workflow for your contribution, you will be subject to code reversion and contributor rights sanctioning"; in the PR discussion Dawson said the intent is to start with a closed door and selectively open it case-by-case later (e.g. AI as autocomplete replacement, translations), that the earlier policy's process clearly didn't happen in reality, and that the project had already lost at least one extremely high value contributor as a result; the QEP passed its discussion period Oct 5, moved to voting, and was merged into QGIS-Enhancement-Proposals master Oct 7 (primary github.com/ qgis/QGIS-Enhancement-Proposals/pull/387 verified via direct curl --http1.1 -4 page fetch at ~12:30 UTC Oct 12, 634350 bytes, page title "Add QEP428: No ai contributions permitted by nyalldawson · Pull Request #387", plus the PR .diff fetch (160 lines) carrying the full replacement policy text; api.github.com unreachable this session so the HTML page and .diff served as verification). Gap-fill disclosure: the merge sits Oct 7, inside the 14-day window, but no feed in the standing 45 set carries QGIS QEP activity and no commit message records it; the 79-point HN submission 2026-10-12T11:22:24Z is the first in-set visibility, per the HashiCorp-Boundary/DuckDB/Genkit/AISI/Mistral gap-fill precedents; entry dated by discovery time per the AISI precedent (2026-10-12 11:22). New territory - grep shows zero prior QGIS entries. Categorized AI per the AI-coding-governance substance. (3) Alibaba Qwen released QwenGyre, an online reinforcement learning framework for long-horizon agent tasks (relay ithome.com/1/012/066.htm verified via direct curl --http1.1 -4 page fetch at ~12:28 UTC Oct 12, 24251 bytes, page stamp 2026/10/12 19:20:43 Beijing = 11:20:43Z matching the ithome feed stamp exactly, byline 潞源): agent runs routinely stretch to hours with hundreds of interdependent model-environment interactions and millions of cumulative tokens; QwenGyre splits GPUs into compute units so units freed by finished batch tasks roll into training while running tasks keep their state and caches intact without restart; Token-in Token-out records the true context of every output segment, organizes trajectories into a tree by shared prefix and expands only the selected path into training samples; Partial Scoring yields usable feedback for timed-out but partially-complete tasks; official NL2RepoBench online RL experiments with ~700k-token rollouts lifted pas