Open-Source AI Models: What the Licence Lets You Do

Ask whether a business can use an open-source AI model and the honest answer is that it depends on which model, and on which version of it. There are more than 3 million models on the Hugging Face Hub as of October 2026, and the licences attached to the ones worth using differ more than the shared label suggests. Some let you do almost anything, others allow a great deal on conditions, and a few allow research and nothing else.

The timing is why those licences are worth reading now. Epoch AI, which tracks model capability, found that since January 2026 the most capable open-weight models have lagged frontier closed models by an average of four months. For most of the work a mid-market business does, today's frontier models are already more than capable enough. If the open models are only a few months behind, running one becomes a serious option for many businesses within the next 6 months or so, and the licence is the first thing to understand.

Plenty of businesses are already there. In a 2025 survey by McKinsey, the Mozilla Foundation and the Patrick J. McGovern Foundation of more than 700 technology leaders and senior developers across 41 countries, over 50 percent said their organisations were using open source AI, and 76 percent expected that use to grow. Half of the same respondents named intellectual property infringement as a concern, behind cybersecurity and regulatory compliance. The licence is where that concern gets answered.

This post sets out what you actually get with an open model compared with a frontier model behind an API, the three kinds of deal that sit behind the word open, and how to judge a model before the business relies on it.

Renting a service, or holding a copy

With a frontier model from OpenAI, Anthropic or Google, you rent a service. The terms are generous about what comes out of it. OpenAI's Services Agreement says the customer owns all Output, and Anthropic's Commercial Terms say the customer owns its Outputs. They are equally clear about the model itself. OpenAI's agreement says no ownership rights are transferred to Customer, and Anthropic's says its terms do not grant either party any rights to the other's content or intellectual property. You use the model on the provider's terms, on the provider's servers, for as long as the provider keeps offering it. We covered what to ask about that arrangement in the AI vendor lock-in questions, including the routine retirement of models.

With an open-weight model you download a copy of the trained parameters and run them yourself, on your own hardware or a host you choose. Nobody can retire your copy, and you decide which country it runs in, which is most of the answer to whose law reaches your data. In the terms of the three legs of AI sovereignty, an open model can settle where the model runs and remove a supplier from the continuity question.

What it does not do is free you from terms. You hold the copy on the licence's conditions instead of a service agreement's, and those conditions vary a long way.

Open source or open weight?

The Open Source Initiative, which maintains the definition of open-source software, published its Open Source AI Definition 1.0 on 28 October 2024. It asks for four freedoms, to use, study, modify and share the system for any purpose without asking permission. It also asks for more than the weights. A model qualifies only if it comes with sufficiently detailed information about the data used to train the system so that a skilled person can build a substantially equivalent system, together with the complete code used to train and run it.

Very few popular models publish all of that. Most release the weights and the code to run them, and the OSI's name for this is open weights. That is not a criticism of the models, and for a business that wants to run one, the weights are usually what matters. But it means "open source" in a press release is a loose term, and two serious sources can use it in opposite ways. The McKinsey survey above counts Meta's Llama and Google's Gemma families as open source. The OSI's view, in February 2025, was that Llama 3.x is still not Open Source by any stretch of the imagination.

Neither label tells you what you can do with the model. The licence does.

Three deals behind one label

Permissive licences, Apache 2.0 and MIT

These are the licences long used for open-source software, now applied to model weights. MIT lets you deal in the software without restriction, subject only to keeping the copyright notice. Apache 2.0 goes further for a business, because it includes a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent licence from every contributor. That licence ends if you sue a contributor claiming the work infringes your patents, in which case your patent rights shall terminate as of the date such litigation is filed.

A good share of capable models now sit here. OpenAI's gpt-oss models are Apache 2.0 with a one-line usage policy, which says only that you agree to comply with all applicable law. The Qwen3 family is Apache 2.0, DeepSeek's R1 is MIT, and Mistral's current open models are Apache 2.0.

Community licences with conditions, such as Llama

Meta's Llama licence allows commercial use, and for most businesses it will feel permissive in practice. It still carries conditions a permissive licence does not. A company with greater than 700 million monthly active users needs a separate licence from Meta, which will not affect a UK mid-market firm. The rest can. A product built on the model must display "Built with Llama", and any model built with Llama or its outputs must begin its name with "Llama" if you distribute it. Meta's acceptable use policy is incorporated into the licence, so a breach of the policy is a breach of the contract, and Meta may terminate this Agreement if you are in breach of any term or condition of this Agreement, after which you shall delete and cease use of the Llama Materials.

The policy for the recent multimodal Llama models also withholds the rights to them from companies with their principal place of business in the EU. A UK-headquartered company falls outside that wording, though an EU subsidiary would not, and the policy adds that this restriction does not apply to end users of a product or service that incorporates any such multimodal models.

Custom terms that keep the publisher involved

Google's Gemma Terms of Use, which still govern the earlier Gemma releases, go a step further. They say Google reserves the right to restrict (remotely or otherwise) usage that it believes breaches its prohibited use policy, and they follow the model downstream. A "Model Derivative" includes any model created by transfer of patterns of the weights, parameters, operations, or Output of Gemma, which covers distillation, and anyone you pass a derivative to takes on the same restrictions. The terms are generous on outputs, though, saying Google claims no rights in Outputs you generate using Gemma.

Then Google changed the deal, and in April 2026 released its latest Gemma generation under Apache 2.0. Mistral has moved the same way, from some earlier releases under a research licence that excludes use directly or indirectly connected to any commercial activities or business operations to Apache 2.0 for its current models. Within one family, the deal you get depends on the version you download. New versions arrive every few months, so the model names in any article like this one date quickly. The questions to ask of the licence do not.

Can you use open-source AI models commercially?

Usually, yes. Whether a given model comes with a commercial licence you can live with comes down to four conditions, and the version matters for all of them.

The first is whether commercial use is allowed at all, since research-only licences still turn up on otherwise well-known models. The second is the acceptable use policy, because where a licence incorporates one, the policy's restrictions on how and where you use the model become contract terms. The third is attribution and naming, which matter once you put the model in a product or distribute something built on it. The fourth is inheritance, and it is the one most often missed. A model fine-tuned or distilled from another carries the original's terms with it. DeepSeek's R1 is MIT, but the smaller versions it distilled onto Llama base models stay under the Llama licence. A permissive name on the model card can sit on top of conditional terms underneath.

For most UK mid-market uses, an Apache 2.0 or MIT model raises no licence question beyond keeping the notices, and a Llama model raises a handful that are easy to meet. The work is in writing down which licence applies to which model in use, the same way you would record any other supplier's terms, and in checking again when you change versions.

Who carries the risk when it gets something wrong

Every one of these licences provides the model as is. Apache 2.0 says You are solely responsible for determining the appropriateness of using or redistributing the Work, MIT disclaims any warranty, and the Llama licence excludes Meta's liability in capitals. If an open model gives a wrong answer that costs the business money, there is no supplier to claim against. That is the trade for holding your own copy, and it should be a deliberate one. A frontier provider at least gives you a counterparty and a contract, which is where the vendor questions come in.

European law adds two wrinkles for a business that works in the EU. The EU AI Act gives lighter documentation duties to providers who release a general-purpose model under a genuinely free and open-source licence, though not for the largest models, since this exception shall not apply to general-purpose AI models with systemic risks, and not for models provided against a price or otherwise monetised. That mostly concerns a UK business that fine-tunes a model and makes it available in the EU. The EU's new Product Liability Directive matters more to a business that builds AI into something it sells there. It treats software as a product, says it does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity, and in its recitals points liability at the manufacturer that builds such software into a product. It applies to products placed on the market after 9 December 2026.

The practical response is unglamorous. Test the model on the decisions it will make, log what it does, and keep a person on anything where a wrong answer is expensive. Take legal advice before an open model goes into something high-stakes or into a product sold in the EU.

How to judge an open-weight model

Four checks cover most of what a business needs to know before relying on an open model.

Read the licence for the exact version. Note whether commercial use is allowed, what the acceptable use policy says, what follows derivatives and what triggers termination. Record it alongside the model's name and version number.

Decide where it runs and what can leave. The weights are a file of numbers. Run on your own infrastructure, or on a host you have chosen, the model itself sends nothing anywhere. Only the software around it can, and that software's network traffic can be watched and restricted. This is where an open model can settle the jurisdiction question in a way a rented service cannot.

Check the file format. Hugging Face's own documentation warns that there are dangerous arbitrary code execution attacks that can be perpetrated when you load a pickle file, and pickle is a common format for model weights. Prefer the safetensors format, which stores the weights without executable code.

Test its behaviour on your own work. Benchmarks describe someone else's tasks. Run the model on a sample of the decisions you want it to make, with known good answers, and look at where it goes wrong as well as how often. The UK government's Code of Practice for the Cyber Security of AI, which applies to proprietary and open-source models alike, says organisations shall re-run evaluations on released models that they intend on using, and that anyone using a model that is not well documented or secured should be able to justify the choice in writing.

Where a model was made is not on that list, and it does not need to be. A licence can be read, a file format checked, network traffic watched and behaviour tested, and those four answer the questions people usually mean when they ask whether a model can be trusted. Judge the model on what it does under the terms you hold it on.

Testing is also easier when the model is replaceable. If what the business knows lives in a maintained knowledge layer the system retrieves from rather than inside one model's weights, trying a second model is a configuration change, and so is switching when a licence changes under you.

Practical takeaways

1. Ignore the label and read the licence. "Open source" covers permissive, conditional and research-only terms, and the same family can move between them.
2. Record the licence for every model version in use, with its acceptable use policy and what it says about derivatives.
3. Check what a fine-tune inherits. A model built on another carries the original's terms.
4. Treat the as-is clause as a design input. Nobody stands behind an open model's answers, so testing, logging and human review carry that weight.
5. Judge a model on its licence and its tested behaviour, not on where it was made.

Frequently asked questions

Can you use open-source AI models commercially?

Usually yes, but the licence decides, and it can change between versions of the same model family. Models under Apache 2.0 or MIT can be used, changed and sold on with very few conditions. Community licences such as Meta's Llama licence allow commercial use but add an acceptable use policy, attribution and naming rules. Some releases carry research-only terms that exclude business use altogether. Check the licence attached to the exact version you download, and remember that a model fine-tuned from another one inherits its terms.

What is the difference between open-source and open-weight?

An open-weight model publishes its trained parameters, so you can download and run it. An open-source model, on the Open Source Initiative's definition, also publishes enough information about the training data for a skilled person to build a substantially equivalent system, plus the complete code used to train and run it, all on terms that let anyone use, study, modify and share it. Most models described as open source are open-weight by that standard. That does not make them worse to use, but it means the label tells you little about what you are allowed to do.

Is the Llama licence open source?

Not by the Open Source Initiative's definition. The OSI has said the Llama licence restricts fields of endeavour, which its definition does not allow, and it has said so of successive versions. The licence does allow commercial use, but it comes with conditions an open-source licence would not carry, including an acceptable use policy, a 700 million monthly active user threshold, attribution and naming rules, and termination if you breach it. Treat it as a community licence with conditions and read those conditions.

How do you judge whether an open-weight model is safe to use?

Run four checks. Read the licence for the exact version, including what it says about commercial use, derivatives and acceptable use. Decide where the model runs and confirm what the surrounding software can send, since the weights themselves are a file. Prefer the safetensors format, because a pickled weights file can execute code when it loads. Then test its behaviour on your own work before you rely on it, and again after each update. Those four answer most of what people mean when they ask whether a model can be trusted.

Who is liable when an open model gets something wrong?

In practice, the business that deploys it. Apache 2.0, MIT and the Llama licence all provide the model as is, without warranty, and exclude the publisher's liability, so there is no supplier to claim against. That is the trade for holding your own copy. In the EU, the new Product Liability Directive excludes open-source software supplied outside a commercial activity and points liability at the manufacturer that builds it into a product. Plan for that by testing, logging and keeping a person on decisions that matter, and take legal advice on anything high-stakes.