What an open-weight model license actually is
An open-weight model is one whose trained parameters you can download and run yourself. That is a statement about access, not about rights. The license attached to those weights decides whether you may use the model commercially, whether you must credit it, whether you may fine-tune it and sell the result, and whether there is a size of business at which the permission stops.
Open-weight and open source are not the same thing, and most coverage blurs them. The Open Source Initiative's Open Source AI Definition 1.0 requires four freedoms — use the system for any purpose without asking permission, study how it works, modify it for any purpose, and share it with or without modifications — and requires that the parameters, the complete source code used to train and run the system, and sufficiently detailed information about the training data all be available. Almost every model marketed as an open-source model clears the weights bar and fails the data bar, which is why the open-source and open-weight distinction is worth keeping straight.
Everything below was checked against the model card or LICENSE file in the relevant repository in September 2026. License text changes, the file in the repository you download is the only version that counts, and none of this is legal advice.
The license families you will actually meet
Nearly every open-weight release in 2026 falls into one of five buckets, and knowing which bucket you are in answers most questions in about a minute.
Permissive OSI licenses: Apache 2.0 and MIT
These are the ones with no AI-specific strings attached. Apache 2.0 and MIT are ordinary software licenses: commercial use, modification, redistribution and closed-source derivatives are all permitted, with attribution and, in Apache 2.0's case, an explicit patent grant.
A large share of the current open-weight field sits here. OpenAI's gpt-oss-120b model card describes its license as permissive Apache 2.0, without copyleft restrictions or patent risk. Qwen3-235B-A22B-Instruct-2507 lists apache-2.0. Mistral-Large-3-675B-Instruct-2512 lists apache-2.0. GLM-4.6 is released under the MIT License. DeepSeek-R1 states plainly that the code repository and the model weights are both under the MIT License, and that this allows modifications and derivative works including distillation for training other LLMs. If your legal review has limited time, spend it here.
Community licenses with thresholds: Llama
Meta's releases use a bespoke community license rather than an OSI license, and it carries three obligations worth knowing before you build. The Llama 4 Community License requires that if, on the version's release date, your products or services had more than 700 million monthly active users in the preceding calendar month, you must request a separate license from Meta. It requires you to prominently display 'Built with Llama' on a related website, user interface, blog post, about page or product documentation. And if you use the materials or their outputs to create, train or fine-tune a distributed model, you must include 'Llama' at the beginning of that model's name.
For almost every business reading this, the user threshold is irrelevant and the attribution and naming rules are not. The naming rule catches teams who fine-tune one of these models, give it an internal product name, and then distribute it. Using the outputs to improve another distributed model pulls that model into the naming requirement too.
One correction worth making: checked against the Llama 4 license text in September 2026, there is no European Union domicile restriction in that agreement. A clause of that kind existed on some earlier Meta multimodal releases and still gets repeated as though it were current.
Vendor terms of use: Gemma before version 4
Google's Gemma Terms of Use permit commercial use, subject to a restricted-use section and a Prohibited Use Policy incorporated by reference. Distributing a model derivative means passing the use restrictions on in your own agreement, giving recipients a copy of the terms, marking modified files with prominent notices, and including a notice that Gemma is provided under the Gemma Terms of Use. The terms also reserve Google's right to restrict, remotely or otherwise, usage it reasonably believes violates the agreement.
Gemma 4 changed this. The Gemma 4 model card lists the license as Apache 2.0 — the first Gemma generation under an OSI license, covering the E2B and E4B sizes, the 12B unified model, the 26B A4B mixture-of-experts variant and the 31B dense model. Google's documentation still links a prohibited use policy alongside it, so read the files in the repository you download.
This is the clearest example of why you cannot reason about a model family from memory. The same brand name carries a restrictive vendor agreement in one generation and a permissive OSI license in the next.
Modified MIT and other bolt-on clauses: Kimi
Kimi K2, the open-weight model from Moonshot AI, states that both the code repository and the model weights are under a Modified MIT License. The modification is a single added clause: if the software or any derivative is used in commercial products or services with more than 100 million monthly active users, or more than 20 million US dollars in monthly revenue, you must prominently display 'Kimi K2' on the user interface of that product or service.
That is a light obligation, and for a small or mid-sized business it never triggers. The reason to read it anyway is that 'MIT' in the license field did not mean plain MIT, and a keyword scan of license tags would have missed the difference.
Research-only licenses: Mistral's MRL
Mistral splits its catalog. Some models are Apache 2.0, as above. Others ship under the Mistral AI Research License, which states that you shall only use the models, derivatives and outputs for research purposes — defined as personal, scientific or academic research and non-profit, non-commercial use, not connected directly or indirectly to commercial activities or business operations. Anything else requires requesting a license from Mistral, granted at their discretion.
This is the bucket that ends projects late. A model that is free to download, strong on reasoning tasks and coding, and completely unusable in your product is a worse outcome than a weaker model you can ship. Check the license field before the evaluation, not after.
Vendor open-model licenses: NVIDIA
The NVIDIA Open Model License Agreement permits commercial use and the creation and distribution of derivative models, with a notice stating the model is licensed by NVIDIA Corporation under that license. It also contains conditions that ordinary open source licenses do not: your rights terminate if you bypass, disable or circumvent a safety guardrail without substituting a substantially similar one appropriate to your use case, and they terminate if you bring patent or copyright litigation claiming the model infringes your rights.
Licenses in this bucket are usually workable for a business deployment. They are simply not interchangeable with Apache 2.0, and if your enterprise compliance process assumes 'open' means 'no conditions', it will produce a surprise.
Licenses differ inside a single model family
This is the failure mode that catches careful teams, and it is worth stating plainly: the license belongs to the specific repository, not to the brand.
DeepSeek-R1 is the clearest case. The main model is MIT. The distilled variants are not uniformly MIT, because they inherit from their base models — the Qwen-based distills derive from Qwen 2.5 under Apache 2.0, the 8B Llama distill derives from Llama 3.1 and carries the Llama 3.1 license, and the 70B Llama distill derives from Llama 3.3 and carries the Llama 3.3 license. One family page, three different sets of obligations. Our guide to DeepSeek for business covers what those variants are actually good for.
Gemma, as above, changed license between generations. Mistral runs Apache 2.0 and a research-only license side by side in the same catalog. And obligations can arrive from training data rather than from the base model: the OLMo 2 13B Instruct card lists Apache 2.0 and then notes the model is subject to additional terms — the Gemma Terms of Use — because its fine-tuning dataset includes outputs from third-party models.
That last pattern matters more as synthetic post-training data becomes standard. A permissive base model fine-tuned on another model's outputs can pick up the other model's terms, so if you fine-tune you need the provenance of the training data as well as the license on the weights.
What a model card tells you, and what it doesn't
Model cards are built to sell capability. You get total parameters and activated parameters for an MoE model, context window and context length, multimodal and multilingual support, benchmark tables, coding agent and agentic scores, tool use results, inference throughput and time to first token. All useful for choosing between large language models.
The license is one field near the top, often a single tag, and it is the field that decides whether the rest matters. A language model that wins every benchmark in your evaluation and cannot legally ship is not a candidate.
Two habits fix this. Read the LICENSE file in the repository on GitHub or Hugging Face rather than the license tag, because the tag is metadata a human typed and Kimi's 'Modified MIT' shows how much can hide behind one. And record the license and the exact model revision when you shortlist, because families get new versions under new terms.
For a capability-first view of the same field, see our comparison of the best open-source LLMs for business.
Five questions to answer before you ship an open-weight model
Run these against the license file for the exact repository and revision you intend to deploy.
Is commercial use permitted outright? If the answer needs a paragraph, you are not in Apache 2.0 or MIT territory. Is there a size threshold? Llama's 700 million monthly active users and Kimi's 100 million users or 20 million dollars monthly revenue are the examples above. What must you display or name? 'Built with Llama' and the Llama name prefix on derivatives are obligations, not suggestions. What happens to derivatives and distillations? Some licenses pass their terms down, and fine-tuning on another model's outputs can import terms from a third party. Is there an acceptable use policy attached? Community licenses and vendor terms usually incorporate one by reference, and it binds you exactly as the license body does.
How the license changes your deployment options
The license question sharpens the moment you self-host, because self-hosting is where you take on redistribution and derivative obligations an API consumer never touches. Calling a hosted endpoint puts you under the provider's terms of service; downloading the weights puts you under the model license.
Running open weights yourself also means GPU capacity, an inference stack, and someone who maintains it — our local LLM cost and hardware guide has the arithmetic, and self-hosted AI for business covers when the data-residency case justifies it.
For a typical enterprise or small-business workflow, a permissively licensed open-weight model behind your own API, or a commercial model such as Claude on a bring-your-own-key arrangement, gets the same outcome with far less license exposure. Pick the deployment shape first, filter by license second, compare capability third.
Frequently asked questions
The questions that come up when a team first reads a model license properly.
Is an open-weight model fully open source?
Usually not. Open weights means the parameters are downloadable. The Open Source AI Definition 1.0 also requires the complete training and inference source code and sufficiently detailed information about the training data, and most releases publish neither. A language model can be permissively licensed on its weights and still fall short of the definition because the data is undisclosed.
Can open-source LLMs be used commercially?
Models under Apache 2.0 or MIT, yes, without conditions beyond attribution. Models under community or vendor terms, usually yes but with obligations such as displaying 'Built with Llama' or passing terms on to recipients. Models under a research license such as the Mistral AI Research License, no — that license restricts use to personal, scientific or academic research and non-commercial purposes, and commercial use requires a separate grant.
What is the difference between open-source and open-weight LLMs?
Open-weight describes what you can download: the trained parameters. Open source describes the rights and the transparency around them. The practical test is whether the license is OSI-approved and whether the training data and training code are published. Most of the strongest downloadable models today are open-weight; a smaller number, such as the OLMo family, publish code, checkpoints and training details too.
Do I have to credit the model in my product?
It depends on the license. Apache 2.0 and MIT require you to preserve the license and copyright notice, which normally means an attributions file rather than anything user-facing. Meta's community license requires a visible 'Built with Llama'. Kimi K2's modified MIT requires a user-interface credit only above 100 million monthly active users or 20 million dollars in monthly revenue. NVIDIA's open model license requires a notice naming NVIDIA when you distribute the model.
Can I fine-tune an open-weight model and license the result how I like?
Under a permissive license, broadly yes — you can keep your fine-tuned weights closed. Under a community license, no: the terms typically follow the derivative, and Meta's additionally require the derivative's name to begin with 'Llama'. Check the training data too, because tuning on another model's outputs can attach that model's terms, as the OLMo 2 Instruct card does with the Gemma Terms of Use.
Which open-weight license is safest for a commercial product?
Apache 2.0, then MIT. The former includes an express patent grant, which MIT does not, and neither carries AI-specific restrictions or acceptable use policies. If two models are close on your evaluation and one of them is permissively licensed, that is a legitimate tiebreaker — it removes a category of review from every future release you ship.
Does the license apply to the model's outputs?
Some licenses speak to outputs explicitly and some do not. Llama's terms reach outputs used to train or improve another distributed model. The Mistral research license covers outputs directly. Permissive licenses generally do not restrict output use. Where a license is silent, silence is not permission, and it is a reasonable question to put to a lawyer before building a product on synthetic data from that model.
Read the file, not the headline
The recurring mistake here is treating a model family as one thing with one license. Gemma changed license between generations, DeepSeek's distills carry their base models' terms, Mistral runs permissive and research-only licenses at once, and a model can inherit obligations through its training data. Every claim above was verified against the relevant model card or LICENSE file in September 2026; the repository text at the moment you download is what governs your use, and a licensing question with money behind it deserves a lawyer rather than a blog post.
If you are working out whether to run open weights at all, our free automation playbook covers where self-hosted models pay off in a small-business stack and where a hosted API on your own key is the better answer.