The License Fine Print
Lesson 2 of 3 in Open vs Closed Weights.
Two license worlds sit under the open-weights tier, and confusing them is the most expensive mistake in this domain.
Permissive licenses — Apache 2.0 and MIT are the ones you will meet — are short, standardized open-source grants. Their text is identical everywhere it appears, lawyers know them cold, and their conditions are minimal (keep the notice, essentially). When a model card says MIT or Apache 2.0, you are on well-charted ground. Documented examples, each verified on that specific model’s card: gpt-oss (“Permissive Apache 2.0 license”), DeepSeek-V4.1-Flash (MIT), Phi-4-reasoning-vision-15B (MIT), Qwen3.8-27B (apache-2.0).
Custom licenses and terms of use are developer-authored documents, different every time, with obligations that standardized licenses never contain. The two most instructive documented specimens: the Llama 4 Community License Agreement requires “Built with Llama” attribution, requires derived model names to start with “Llama”, and requires a separate license for entities exceeding 700 million monthly active users. The Gemma Terms of Use include a Prohibited Use Policy, reserve Google’s right to “remotely restrict violating usage”, and state that Google claims no rights in generated outputs.
And some families mix both worlds in one catalog. Mistral’s own models overview tags models “Apache 2.0” and “Modified MIT” (Mistral Medium 3.5 — its card describes an “Open-source license for both commercial and non-commercial use with exceptions for companies with large revenue”) and “CC BY-NC 4.0” (a non-commercial license), alongside “Premier” commercial models with no open weights at all. One Model family, four different answers to “may I use this?” — per model.
| License pattern | What it permits | What it requires or reserves | Documented example |
|---|---|---|---|
Permissive (Apache 2.0) | Broad reuse, modification, and redistribution — commercial included — under standardized, well-understood terms | Minimal: preserve the license and notices | gpt-oss — card: “Permissive Apache 2.0 license”; Qwen3.8-27B — apache-2.0 in card metadata (verified for that model only) |
Permissive (MIT) | Same spirit, even shorter: broad reuse with almost no conditions | Keep the copyright and license notice | DeepSeek-V4.1-Flash — “License: mit” on the card; Phi-4-reasoning-vision-15B — MIT (each verified for that model only) |
Custom community license | Commercial use and redistribution — on the developer’s conditions | “Built with Llama” attribution; derived model names must start with “Llama”; separate license required above 700 million monthly active users | Llama 4 Community License Agreement (effective April 5, 2025; earlier Llama versions carry their own licenses — e.g. the Llama 3.2 card titles its own “Community License Agreement”) |
Custom terms of use | Use under a policy regime the developer maintains | Prohibited Use Policy; Google’s right to “remotely restrict violating usage”; Google claims no rights in generated outputs | Gemma Terms of Use (last modified April 1, 2026; the page notes Gemma 4 has a separate Apache 2 license) |
Mixed / tiered catalog | Depends entirely on the model — read the tag on every card | Some models permissive (Apache 2.0, Modified MIT), some non-commercial (CC BY-NC 4.0), some “Premier” commercial with no open weights | Mistral / Mixtral — license tiers listed per model on the official docs models overview |
Proprietary API terms | Hosted inference through the provider’s API | No weights leave the provider; use is governed by the provider’s service terms | GPT, Claude, Gemini — the closed-weights API families |
Here is the discipline this lesson exists to install: legal reads the license — you read it first. Legal review takes weeks and needs your use case described precisely; you can disqualify a model in ten minutes, or arrive at legal’s door with the three clauses that matter already flagged. Engineers who skip this step discover naming requirements after the product launched, or usage thresholds after the growth round. (Turning license obligations into a running compliance program — inventories, attestations, renewal watch — is our sister AI Governance Academy’s territory; your job here is to spot the clauses early.)
One more habit the documented record insists on: the license attaches to the release, not the family. The Gemma Terms of Use apply to the models listed in that page’s own Appendix — and the same page notes Gemma 4 has a separate Apache 2 license. Mistral’s catalog answers the license question differently per model. This is why careful sourcing hedges every license claim as verified for that model only, and why the Model card of the exact version you plan to ship — the card idea itself goes back to Mitchell et al. (2018) — is where the reading starts, not the family’s homepage.
How to read a model license in ten minutes
A repeatable pass, in order. The output is a one-paragraph note in your repo: license name and date, the clauses that bind you, and your go / no-go / ask-legal call.
- Find the actual text. The card’s license tag is a hint, not the contract — follow it to the license file or page. Where tag and text differ in nuance (Mistral Medium 3.5’s card shows metadata “License: other” while describing a Modified MIT grant), the text wins.
- Confirm coverage. Does this document govern this model version? The Gemma Terms of Use apply to the models in their Appendix; Gemma 4 is documented as carrying a separate Apache 2 license. Never assume family-wide coverage.
- Classify the pattern. Standardized permissive (Apache 2.0, MIT) → fast lane. Custom community license or terms of use → the remaining steps are mandatory.
- Scan for attribution and naming. The Llama 4 license requires “Built with Llama” attribution and derived model names starting with “Llama”. Clauses like these reach into your branding.
- Scan for scale thresholds. Llama 4: entities exceeding 700 million monthly active users need a separate license. Thresholds convert a free license into a negotiation — at exactly the moment you have the least leverage.
- Read the use policy. Check your actual use case against any acceptable-use or prohibited-use policy (Gemma’s terms include a Prohibited Use Policy) — not the use case you would defend in a meeting, the one you are shipping.
- Look for reserved rights. Gemma’s terms reserve Google’s right to “remotely restrict violating usage”. If your architecture story is “nobody can touch our deployment”, a clause like that belongs in front of legal before the story gets told.
- Check the outputs clause. Who claims what over generated outputs? (Gemma’s terms state Google claims no rights in outputs — a clause you want to find, not assume.)
- Record and diff. Note the license’s version or date (Llama 4: effective April 5, 2025; Gemma terms: last modified April 1, 2026) and, on any model upgrade, diff the new license against the one you recorded. Licenses change between releases; your note is how you notice.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.