A developer using a generative AI coding assistant can produce code resembling licensed open-source repositories without realizing it, raising questions about whether traditional Free and Open-Source Software (FOSS) governance can cope with AI-generated code. For over two decades, enterprises built governance around FOSS through software composition analysis, licence reviews, Open-Source Review Boards, and developer education to comply with licences such as GPL, Apache, MIT, and BSD. Traditional compliance involves known components, licences, and sources, but GenAI introduces software that writes software, creating a provenance problem. While better AI tools are engineered to avoid reproducing code word for word, and courts have been unconvinced that assistants routinely emit identical copies of protected code, “less likely” is not “never.” In Doe v. GitHub, developers alleged AI coding tools were trained on their open-source repositories without regard for licences; a US district court threw out most claims because plaintiffs could not point to a specific work specifically copied, but breach-of-licence and DMCA theories survived, and the case is before the Ninth Circuit. This turned AI-assisted coding into a governance issue. New questions include which model wrote the code, whether training data was licensed, whether output is substantially similar to existing open-source code, how to show how AI-assisted code came to be, and who holds liability when an infringement claim lands.