It cannot be the individual dev's sole responsibility. There must be a clear policy and hoops to go through (decision on choice of library, reviews before inte

It cannot be the individual dev's sole responsibility. There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game. By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.