Is an open-weight model the same thing as open source?

Usually not. Open weights means the parameters are downloadable. Open source, in the sense the term carries in software procurement, means a licence that permits use, modification and redistribution without discrimination as to field of endeavour or person. Several of the most widely deployed model families ship under bespoke community licences that restrict fields of use, impose naming duties, or condition rights on company size — all of which are incompatible with the classic definition. Some genuinely are Apache 2.0 or MIT. The only way to know which you have is to open the LICENSE file for the exact checkpoint you downloaded, because families are not internally consistent.

Does a fine-tuned model inherit the base model's licence?

Under most community licences, yes — expressly. The licence typically defines derivative or modified works to include models produced by fine-tuning, continued pretraining, merging, or applying adapters to the licensed weights, and requires you to pass the same terms down to anyone you distribute them to. Two practical consequences follow. First, a LoRA adapter you publish is normally still governed by the base terms even though the adapter file contains none of the original parameters. Second, you cannot relicense a fine-tune under your own terms and you cannot quietly drop the acceptable-use policy from it.

What is an acceptable-use policy in a model licence and why does it matter?

It is a separate document, hosted on the licensor's website and incorporated into the licence by reference, listing uses you may not put the model to. Two features make it unlike an ordinary contract schedule. It binds your downstream users as well as you, which means you must pass equivalent restrictions into your own terms of service. And because it lives at a URL rather than in the file you downloaded, the licensor can revise it, so what you may permissibly do can change without any action on your side. Snapshot the version you relied on with a date, the way you would archive any incorporated term.

Do open-weight licences say anything about who owns the outputs?

Most disclaim any ownership claim over outputs, which sounds reassuring and is not the whole picture. Whether a given output is protectable is a question of copyright law, not licence drafting, and purely machine-generated material generally is not registrable without meaningful human authorship. Separately, a licence can waive ownership while still restricting use — a clause forbidding you from using outputs to train a competing model is a use restriction that operates regardless of who owns them. Read the ownership sentence and the use-restriction sentence together, because they are frequently in different sections.

What indemnity do we get from an open-weight model provider?

As a rule, none. Community licences are provided on an as-is basis with warranties disclaimed and liability capped at or near zero, and they carry no intellectual-property indemnity for the training data or the outputs. This is the single largest commercial difference from a paid API, where an IP indemnity is now a standard part of an enterprise agreement. If your customers require you to indemnify them for AI-generated deliverables, hosting an open-weight model means you carry that exposure yourself with no upstream recourse. That is a defensible choice, but it should be made deliberately and priced rather than discovered during a customer's security review.

Open-Weight AI Model Licences and Commercial Use 2026: What Llama, Gemma, Qwen and Mistral Actually Permit

The Category Error Everyone Makes First

Open weights is a distribution fact: the parameters are downloadable. Open source is a licensing claim: use, modification and redistribution permitted without discriminating between fields of endeavour or classes of person. The two travel together in conversation and come apart in contract. A licence that forbids a field of use, or that switches off above a user count, or that requires you to put a vendor's brand in your product name, is doing something no OSI-approved licence does.

This matters beyond pedantry because your own paperwork inherits the confusion. Security questionnaires ask whether you use open-source components and your engineers answer yes. Your open-source policy, written for libraries, gets applied to a model whose terms have nothing in common with a library's. And your customer contract promises rights in the deliverable that the upstream licence does not give you the ability to grant.

The Six Clauses That Decide Whether You May Ship

Model licences differ in wording and converge on a small set of levers. Find each of these in the file for your exact checkpoint before the model reaches production:

SCOPE

The definition of derivative or modified work. Community licences typically sweep in fine-tunes, merges, adapters, continued pretraining and sometimes distilled models. If your product is a fine-tune, the base terms usually follow it everywhere it goes.

GATE

A size or user threshold. Some licences terminate or require a separate commercial agreement once a licensee exceeds a stated monthly active user count on the date of release. Growth is the trigger, so the clause fires at the least convenient moment.

AUP

An acceptable-use policy incorporated by reference from a URL, binding you and your downstream users, and revisable by the licensor after you deploy.

NAMING

Attribution and naming duties: a 'Built with X' notice in the UI or documentation, and in several licences a requirement that a derivative model's name begin with the base model's name.

OUTPUTS

Restrictions on using outputs to train, improve or distil another model. Sometimes limited to competing models, sometimes drafted more broadly. This is the clause that quietly governs synthetic-data pipelines.

RISK

Warranty disclaimer, liability cap and the absence of indemnity. Not negotiable in a community licence, and the reason open weights shift IP exposure from the provider onto you.

Families are not internally consistent. The same vendor may release one checkpoint under Apache 2.0 and the next under a research-only or non-commercial-by-default agreement, and a quantised or community-converted upload of a permissive model may carry additional terms added by whoever re-uploaded it. The unit of licensing is the checkpoint, not the brand. Record the repository, the revision hash and the licence file you actually read.

The AUP Is the Part That Reaches Your Terms of Service

An acceptable-use policy in a model licence is not a schedule you comply with privately. It is a set of restrictions you are usually required to impose on the people who use your product, which means the obligation lands in your customer-facing terms and in whatever moderation you can actually perform. Three consequences:

Your terms of service need matching language. If the licence says you must prohibit the listed uses downstream and your ToS is silent, you are in breach on the day you launch, regardless of what any user does.
A hosted policy can move. Terms incorporated by reference are updated by the party hosting them. Archive the version in force when you shipped, with the retrieval date, and re-check on a schedule rather than discovering a change during diligence.
Enforcement capability is part of compliance. Prohibiting a use you have no mechanism to detect is a defensible position only if you can describe the mechanism you do have. Write that description once, before anyone asks for it.

Distillation, Synthetic Data, and the Clause Nobody Reads Twice

Generating training data from a model's outputs is now routine practice, and it is the use most likely to be restricted in ways teams do not notice. Restrictions appear in two places with different reach. In an open-weight licence, the clause typically limits using outputs to improve another model — sometimes only a competing one, sometimes any other model at all. In a hosted API's terms, an equivalent restriction is standard and well known.

The failure pattern is a pipeline that began as an experiment on an API, moved to a local open-weight model to cut cost, and kept the same dataset lineage. The dataset now carries obligations from two different agreements, and nobody has written down which rows came from where. Provenance metadata on synthetic datasets — model, checkpoint, date, licence in force — costs nothing at generation time and is close to unreconstructable afterwards.

What You Give Up Relative to a Paid API

IP indemnity. Enterprise API agreements commonly indemnify customers against third-party IP claims arising from outputs, subject to conditions. Community model licences disclaim everything. Self-hosting moves that risk onto your balance sheet.
A counterparty. There is no one to negotiate with, no support obligation, and no contractual channel to resolve an ambiguity in the terms. The licence is take-it-or-leave-it and interpretation is yours.
Stability of terms. A signed enterprise agreement fixes its terms for the term. A licence with an incorporated hosted policy does not.
Nothing on privacy, though. The one direction that runs your way: weights you host process data inside your own boundary, which simplifies data-residency and subprocessor questions considerably. That is the real argument for open weights, and it is worth stating plainly instead of dressing the decision up as a licensing preference.

A One-Page Compliance Pass

Inventory checkpoints, not vendors. Every model in your stack: repository, revision, licence file, retrieval date. Include adapters, merges and anything a contractor brought with them.
Classify each licence. Permissive (Apache/MIT), community-with-conditions, research or non-commercial only. The third category should never be in a production path, and it regularly is.
Archive the incorporated policies. Save the acceptable-use policy as a dated file next to the licence. It is the term most likely to change and the one hardest to reconstruct.
Push restrictions into your ToS. Downstream prohibitions, output restrictions and any naming duty need to exist in documents your users are bound by and your UI actually displays.
Tag synthetic data at generation. Source model, checkpoint, date. Retrofitting provenance onto a mature dataset is usually impossible.
Reconcile with your customer promises. If you indemnify customers for AI deliverables while your upstream disclaims everything, that gap is yours. Price it, insure it, or narrow the promise — but name it in writing.

Frequently Asked Questions

We only run the model internally and never distribute it. Do the naming and attribution clauses still apply?

Attribution duties usually attach to distribution and to products made available to third parties, so purely internal use is the lightest case — but read the definition of distribution in your specific licence, because several are drafted to cover making the model available as a service rather than only shipping the file. If users outside your organisation can send a prompt and get an answer, most licences treat that as the triggering act even though nobody downloaded weights. Acceptable-use restrictions, by contrast, apply from first use regardless of distribution.

A vendor sells us a product built on an open-weight model. Whose licence problem is it?

Theirs contractually and yours practically. Your protection is the vendor's warranty that it has the rights to grant what it is granting you, plus an indemnity for third-party IP claims — and that is exactly what a vendor building on a no-indemnity community licence will resist giving. Ask two questions in diligence: which base model and checkpoint, and what indemnity does your agreement with us provide. A vendor that cannot answer the first question has not done the work, and a vendor that declines the second is asking you to carry the risk they declined to carry.

Does the EU AI Act change anything for open-weight models?

It changes who carries which duties. Deploying a general-purpose model in your own product generally puts obligations on you as the provider of the AI system you have built, and there are limited allowances for models released under genuinely free and open licences that do not extend to every community licence. The practical point for a licensing review is that a bespoke licence with field-of-use restrictions and user thresholds is unlikely to qualify as the free-and-open case, so do not assume an exemption applies because the weights were downloadable.

Can we relicense our fine-tune under our own terms to customers?

Not if the base licence defines your fine-tune as a derivative and requires downstream recipients to be bound by the same agreement, which is the common pattern. You can add your own terms on top — additional restrictions are generally permitted where the base terms are not — but you cannot subtract, and you cannot present the model as licensed solely under your agreement. Where teams get into trouble is the customer contract that promises a perpetual, unrestricted licence to the delivered model, drafted from a software template that predates anyone thinking about weights.

What is the minimum evidence a security reviewer will accept?

A model inventory with a licence classification per checkpoint, dated copies of the incorporated acceptable-use policies, the clause in your terms of service that passes restrictions downstream, and a named owner with a review date. That set answers the questions that actually get asked and takes an afternoon to assemble. The reason it is worth assembling before it is requested is that reconstructing checkpoint provenance under time pressure — after the engineer who downloaded the model has left — is the part that turns a routine review into a delay.

Start With the Checkpoint Inventory

Almost every open-weight licensing problem is a provenance problem wearing a legal costume. Someone downloaded a model, someone else fine-tuned it, a third person shipped it, and no record connects the artefact in production to the terms that govern it.

List the checkpoints, attach the licence and the dated acceptable-use policy to each, and put a named owner against the review. That sequence answers the diligence questions, and it is the only version of this work that survives staff turnover.