AI use policy and guidelines

• Node.js AI use policy
• Practical guidelines
  • Naming AI tools in disclosures
  • When AI is used in code contributions
  • When AI is used in communications

This document aligns with the OpenJS Foundation AI Coding Assistants Policy.

Node.js AI use policy

In the Node.js project, decision making should always be based on human judgement instead of machine automation, regardless of whether the automation is powered by AI. Contributors must take full responsibility for their actions in the Node.js project.

The Node.js project does not prohibit the use of AI tools in contributions, but when the contribution is generated with AI, the contributor should disclose the use of such tools, and what the contributor does to personally verify the generated output. The changes submitted to the Node.js code base must still satisfy the project’s Developer’s Certificate of Origin and licensing requirements.

Contributors who choose to submit changes generated with AI must be able to explain the value proposition and the implementation of their contributions during the review process. Disclosure about the use of AI does not serve as a disclaimer of this responsibility. Pull requests with AI-generated code that the contributor has not personally understood, tested, and verified waste collaborator time and will be subject to closure without additional review. Contributors who repeatedly submit such changes, show no understanding of the project or its processes, or are dishonest about the use of automated assistance may be blocked from further contributions.

Pull requests must not be opened by automated tooling, unless specifically approved in advance by the project. To request approval, either open an issue in nodejs/admin, or if the automation can be done in the form of a GitHub workflow, submit a pull request to add the workflow and use the usual pull request review process to seek consensus.

It’s prohibited to use AI to automate fixes to issues marked as “good first issue”. These issues are meant to help new human contributors, not an AI, learn about the code base and the contribution processes.

Practical guidelines

Naming AI tools in disclosures

Be aware that the mention of for-profit trademarks or commercial brands in commit messages, which are part of the code base, can be abused for profit-driven marketing. If the disclosure involves for-profit trademarks or commercial brands, it’s recommended to either anonymize the branding (e.g. say a frontier reasoning model, a closed-source coding agent instead of <brand>), or only mention the for-profit brand/trademark in the PR description, but not in the commit message, unless the message would not have made sense without mentioning the specific brand/trademark. These recommendations only apply to for-profit tools/models, not any non-profit ones.

When AI is used in code contributions

• Contributors should treat the analysis generated by AI tools as a hypothesis instead of a fact, and verify the output against the actual source code before making any decisions.
• Commits must still follow the commit message guidelines and commit squashing guidelines, even if they are organized with the help of AI tools.
• Existing tests should not be removed or modified without human verification. When new tests are added with the help of AI, contributors should personally verify that the new tests are necessary and test the intended behavior instead of merely reflecting how the implementation happens to behave.
• If the comments are generated by AI, contributors should personally verify that the comments are accurate. The comments should not restate what the code does but instead should provide additional context that’s not obvious from the code itself, such as the history or motivation behind the choices.
• During the review process, responses to feedback should be made by contributors based on their own judgement and must not be automated by AI tools. Contributors are expected to iterate in this manner until the work lands or is explicitly closed. If they are unable to follow the review process personally, they should close the PR so that someone else can take over the work.

When AI is used in communications

In the Node.js project, if a contributor chooses to use AI for assistance in communications, they should respect the time spent by other contributors reading and responding to their communication, and avoid increasing the cognitive load of others with their own use of AI.

• Do not paste messages generated entirely by AI in pull requests, issues, or the project’s communication channels. Such communication may be removed in accordance with the Node.js moderation policygithub.
• When making a claim based on AI output in discussions, contributors should personally verify the claim. Contributors are expected to provide a link to actual code, documentation or specifications, instead of an AI summary of them, as source of truth during discussions.
• Grammar and spell-check tools are acceptable when they improve clarity and conciseness.