AI & InnerSource
InnerSource's new BFF… or Secret Nemesis?
Lead Platform Engineering
2026, 3 months apart. Same need: mask personal data in the logs before the GDPR audit.
Each team asked its AI assistant to write it.
Result: two vibe-coded libraries, two lists of sensitive fields, zero shared lines.
Sound familiar?!
01
It's no longer an autocomplete gadget.
It's a "colleague" that codes, reads and writes.
You know the 4 InnerSource principles by heart. Let's hold them up against what AI can do.
Hence the question:
BFF or secret Nemesis?
02
Before contributing, you first need to know the project exists.
With an AI assistant fed by the internal catalog, you can:
We've never been short of reusable components.
We've been short of ways to find them.
Often, the main debt of an InnerSource project: documentation.
With AI, you can:
Generated docs still need reviewing.
But docs to review is better than no docs.
Mentorship is prioritized in InnerSource… but Trusted Committers' time never is.
With AI, a new contributor can:
AI absorbs the repetitive questions.
The Trusted Committer keeps their time to pass on what matters and validate contributions.
Without AI - "I don't know this code, I don't dare touch it."
With AI - a first patch that follows the project's standards, with its tests, ready to be proposed.
Without AI - review, the real bottleneck of InnerSource: maintainers have to find the time and the headspace to do the job properly.
With AI - an automated first review pass that sends a first batch of feedback to the contributor, and a merge request summary that finally explains the "why" and the points to watch.
Contributing becomes a choice again, not an act of courage.
And the maintainer finally has time to say yes… or no.
One possible future: 6 months later, a 3rd team has to pass the same GDPR audit.
Between the two columns, it's not the AI that changes. It's the quality of the context we give it.
Across the 4 pillars, AI can be the accelerator of the InnerSource loop:
But everything we've just seen assumes one thing:
that the human and the AI know what already exists.
And that's where it gets tricky… 😈
03
A generic AI assistant doesn't know your internal catalog. By default, it follows orders and makes things up.
So, naturally:
AI doesn't reduce duplication. It industrializes it.
Yesterday, we debated in the issue.
Today, we debate with our assistant - and nobody sees the discussion.
AI makes us more autonomous…
and collectively more fragile.
AI democratizes contribution and puts even more responsibility on maintainers' shoulders.
A maintainer's value is no longer measured by the contributions they accepted, but by the ones they knew to refuse.
The other future: back to our two teams, and their personal data masking.
Each one, with its own assistant and its own prompt, vibe-coded its own internal library - and even its own test suite.
… a few hours of development, twice, 3 months apart…
… then comes the audit: the same leak on both sides, IBANs typed with spaces slip through both masks. Same model, similar prompts: same bug. And it's the auditor who tells each team that the other one exists.
Two libraries: one leak, two fixes.
One shared component: one leak, one fix.
04
AI can "optimize" every team, every dev, locally, at lightning speed - while silently fragmenting the whole.
The real risk: that it's very effective in the wrong places.
AGENTS.md, a structured README, CODEOWNERS as the source of truth for ownershipOpen doesn't mean open to everyone: the agent must inherit the permissions of whoever queries it, otherwise the catalog becomes an exfiltration channel.
The code says what was done.
The versioned prompt and context say why and how.
An MR its author can't explain isn't a contribution.
It's a code drop.
CONTRIBUTING.md that requires context (need, linked issue, tests)AI can write the contribution. It can't sign it.
Signing means committing.
An AGENTS.md, read by humans and by agents:
🔓 Before generating
- Search the internal catalog first (MCP server "catalog")
- A component exists? Propose a contribution, not a new project
🪟 Decisions
- Design choices go in the issue, not in the conversation
- Version the prompt and context in prompts/, next to the code
🤝 Guidance
- Trusted Committers: @data-privacy-team, office hours on Tuesdays
- Don't know? Say so, and point to them rather than making things up
🎁 Contribution
- No merge request without a previously discussed issue
- Label the MR "AI-assisted": its author must be able to explain it
A guardrail written in the repo: every assistant reads it.
05
AI is neither InnerSource's BFF nor its nemesis. It's an amplifier, so it can tip one way or the other depending on how we use it.
Like any BFF, it'll happily help you… make bad decisions faster.
Our two scenarios are the two possible trajectories:
The question was never "BFF or Nemesis?".
It's "what do we give it to amplify?"
CODEOWNERS and agentsAGENTS.md: the 4 guardrails, in black and whiteAs long as we measure what we produce, AI will produce.
Let's measure what we reuse, and it will search first.
Matthieu VINCENT - Lead Platform Engineering, Sopra Steria