I recently participated in a discussion where we wanted to find out what kinds of open-source software we can use in our production system. The corporate guidance is not clear, and the project members had a very different understanding on the topic. For example, the mentioned guidance stated that in most cases the license applies when one downloads an open-source project. Which is non-sense.
For me, the situation is similar to the risk management, although a risk usually harms only the project, but a law suite harms the whole company. So it is a bigger deal. This suggests that the license handling is a project manager task, however no-one can expect a project manager to know every single third party library along with their licenses, which are used the project.
I have two examples. First, a developer downloads a third party library, adds it to the build system and to the product. Second, a developer finds a great algorithm with google and adds it to the production code. In both cases the company can face serious law suites if the license agreements are not met, which must be prevented. Of course, the developer can be accounted for this action, and serious new regulations can be introduced in the process, but whose responsibility is to prevent this from happening? And, how to do it?