The Vendor SDK With No License Text: A Contract Problem, Not a Gray Zone

The Vendor SDK With No License Text: A Contract Problem, Not a Gray Zone

Hardware SDKs rarely arrive the way open-source packages do. There's no repository, no LICENSE file, no EULA. An engineer at the vendor sends an .aar or a zip of DLLs over a chat app, the demo works, and integration starts.

This pattern shows up across vending controllers, access control panels, camera SDKs, and biometric readers. The more physical the hardware, the more likely the SDK arrives legally naked. Teams file this under "gray zone" and move on.

It isn't a gray zone. It's a well-defined situation that happens to be defined against you. (Usual note: engineering guidance, not legal advice.)

No license means all rights reserved

Copyright doesn't need a notice to apply. The moment the vendor's developers wrote that SDK, it was protected. The default position: nobody else may copy or redistribute it.

Think of borrowing a neighbor's car with no agreement in writing. Driving it yourself is probably fine as long as they don't mind. Renting it out to someone else is a different line entirely, no matter how friendly the neighbor is.

A license is the instrument that grants you rights; no license text means no granted rights. At best you can argue an implied license to use the SDK for evaluation — the vendor did send it to you. But your actual plan is different: you will copy the SDK into your product and distribute it onto dozens or hundreds of machines operated by your client. That's redistribution, and your right to do it is, on paper, nonexistent.

Goodwill is not a legal basis

"The vendor obviously wants us to use it — they sell us the machines." Today, with today's account manager, probably true. But an implied license is an argument you make in a dispute, not a right you hold.

The vendor gets acquired and the new owner audits licensing. The relationship sours over a hardware warranty claim. Your client goes through due diligence and an acquirer's lawyer asks for the paper trail on every binary in the product — and one binary has none.

None of these are exotic scenarios; they're the normal life events of companies. You cannot patch a legal gap with an assumption about someone's mood staying constant.

The fix is the supply agreement

Here's the leverage most integrators forget they have: you're not downloading this SDK from the internet — you're buying machines from this vendor, and purchases have contracts. The SDK terms belong in that contract. What goes in:

• Redistribution rights. Explicit permission to embed the SDK in your software and distribute it on devices, with no per-unit ambiguity.
• Sublicensing to your client. You're an integrator; the fleet will be operated by your client. The rights must flow through to them, named or as a class, or your delivery transfers software your client can't legally run.
• Update and support terms. Which SDK versions are covered, how bug fixes are delivered, and a response commitment for the faults that block vending.
• Continuity. Vendors of cheap hardware disappear. An escrow arrangement, or at minimum a clause granting continued use and redistribution of the last delivered version if the vendor discontinues the product or folds.
• A warranty that the vendor can license what it's licensing. Vendor SDKs routinely bundle third-party and open-source components; you want the vendor on record that the package is theirs to grant — their compliance gaps otherwise become yours, a pattern covered in open-source licenses in commercial software.

The pre-integration checklist

In checklist form, what I run before any vendor SDK touches a product:

1. Is there license text anywhere — in the archive, the docs, the purchase agreement? If not, stop treating this as an engineering task.
2. Who actually owns the SDK — the manufacturer or a distributor reselling it? Sign with the entity that holds the rights.
3. Do the granted rights cover use, redistribution on devices, and sublicensing to the client who operates them?
4. What's inside the binary? Bundled open-source components carry their own obligations regardless of what the vendor signed.
5. Is there a continuity clause for the day the vendor stops answering?

Only after those five does integration start. The negotiation takes a fraction of the effort while the purchase order is still open, and nearly infinite effort after the fleet is deployed.

The takeaway

An SDK without license text isn't a risk you accept; it's a contract term nobody wrote yet. Write it.

The engineering side of these integrations — what the SDK actually does once you're allowed to ship it — is covered in talking to vending machine controllers.