Open-Source LLM Licenses Explained: What You Can Actually Ship
Not every open-weight model is open source. MIT and Apache 2.0 mean no strings, while Llama caps commercial use at 700 million monthly users.
By Galactic News Editorial · Published 2026-11-09T04:26:12+00:00 · Updated 2026-11-09T04:26:12+00:00
Open-Source LLM Licenses Explained: What You Can Actually Ship
Not every open-weight model is open source. The weights may be free to download while the license still limits what you can sell. This guide explains the five license types that matter for developers: MIT, Apache 2.0, the Llama Community License, the Gemma terms, and custom vendor licenses. Read the license on the exact model checkpoint you plan to ship. A model card tag is not a legal clearance.
Open Source LLM Licenses: The Two That Mean No Strings
Two licenses are genuinely permissive. MIT and Apache 2.0 both allow commercial use, modification, and redistribution. Neither has a revenue cap or a user cap. The difference is small but real. Apache 2.0 adds an explicit patent grant. It also requires you to state significant changes in redistributed copies. MIT is shorter. It has no patent grant and no change-notice rule. Both require you to keep the license notice and copyright notice. For a business self-hosting a model, these are the only two labels that mean no strings attached. Many models now ship under them. Qwen models ship under Apache 2.0. DeepSeek models ship under MIT. Gemma 4 ships under Apache 2.0. If your legal review is tight, start here.
The Llama Community License: Commercial, With Conditions
Llama is the most famous open-weight family. It is not open source under the Open Source Definition. Meta's Llama Community License is a custom license with real restrictions. Commercial use is allowed, but only below 700 million monthly active users. Above that threshold, you must request a separate license from Meta. Meta grants or denies it at its sole discretion. The license also requires attribution. Consumer-facing products must display Built with Llama. Models you fine-tune from Llama must carry the Llama name. An acceptable use policy applies. It bans certain uses, including some categories of harmful content. For Llama 4 multimodal models, the license excludes individuals and companies based in the EU from using the multimodal features. Text generation is still allowed for them. The Open Source Initiative says the Llama license fails the Open Source Definition. The use restriction tied to who you are is the reason. Treat Llama as source-available, not open source. It is fine for most startups. It is a problem for large platforms and for EU teams using multimodal features.
Gemma: From Custom Terms to Apache 2.0
Gemma shows how fast license terms change. Gemma 1 through 3 shipped under Google's custom Gemma Terms of Use. That license was permissive but not OSI-approved. It had usage carve-outs that made enterprise legal review painful. Gemma 4 changed that. As of the March 2026 release, Gemma 4 weights ship under Apache 2.0. Google confirmed the change on its Open Source Blog and on the Hugging Face model cards. Apache 2.0 means no acceptable-use policy, no revenue threshold, and no terms to accept before downloading. The lesson is general. Always check the license of the exact version you download. A model family can change licenses between releases. What was true for Gemma 3 is not true for Gemma 4.
Qwen, Mistral, and the Apache 2.0 Mainstream
Qwen is the clearest example of the permissive mainstream. Alibaba released recent Qwen models under plain Apache 2.0. There is no user cap, no attribution requirement beyond the standard license notice, and commercial fine-tuning is allowed. Mistral 7B also ships under Apache 2.0. Falcon 40B does too. These models are the safe default for commercial self-hosting. Larger models in the same families can differ. Mistral Large uses a custom license with revenue and hosting conditions. Qwen's largest models have used custom terms in some releases. Check the model card for the exact checkpoint. Never assume the small model's license covers the large one.
The Fine-Tune Trap: Licenses Travel Down the Family Tree
The most common licensing mistake is reading only the model card. Licenses travel down the family tree. If you fine-tune a fine-tune of Llama 3.2, the Llama 3.2 agreement comes along. It does not matter what your model card says. Some upload tools write license: apache-2.0 on every upload by default. That tag is metadata, not a legal fact. In one analysis of Hugging Face, about 49,000 models declared a permissive license while sitting below a model under restricted terms. Over 11,000 of them claimed commercial use was fine while an ancestor's license said it was not. The fix is simple. Trace the base model. Read the license of the original checkpoint. Keep a record of the chain before you ship. If any part of the chain is unknown, do not claim the model is clear.
Custom Vendor Licenses: Read the Fine Print
Not every model fits the categories above. Some vendors write their own license for their largest models. Mistral Large uses a custom license with revenue and hosting conditions. Some Qwen releases in the largest sizes have used custom terms too. DeepSeek models ship under MIT, which is permissive. But hosted versions of any model are governed by the host's terms, not the model license. The pattern is consistent. Small and mid-size models tend to ship under Apache 2.0 or MIT. The largest flagship models tend to carry custom terms. The reason is commercial. Vendors protect their most valuable weights. For developers, the rule is simple. Read the license file on the model card for the exact checkpoint. Do not rely on the family name. Do not rely on a blog post from last year. License terms change between releases, and a model that was permissive in one version can be restricted in the next. Keep a copy of the license text with your release records. If your product depends on the model, that file is part of your compliance trail.
What to Check Before You Ship: A Compliance Checklist
| License | Commercial use | Key conditions | OSI approved |
|---|---|---|---|
| MIT | Unrestricted | Keep license and copyright notice | Yes |
| Apache 2.0 | Unrestricted | Patent grant; state changes; keep notices | Yes |
| Llama Community License | Below 700M monthly active users | Built with Llama attribution; Llama name on derivatives; acceptable use policy; EU multimodal exclusion | No |
| Gemma Terms of Use (Gemma 1-3) | With conditions | Usage carve-outs; terms acceptance | No |
| Custom vendor licenses | Varies | Revenue limits or hosting conditions possible | No |
- Pin the exact weight artifact and license version you ship.
- Trace the base model and read every license in the chain.
- Confirm commercial, hosted-service, modification, and distribution grants.
- Preserve license notices and attribution strings.
- Get legal review before a commercial rollout.
Calling a model through a host's API is a different case. The host's terms govern API use, not the model license. Downloading weights and calling an API are two different legal acts. Keep them separate in your review.
Bottom Line
Open source LLM licenses fall into two groups. MIT and Apache 2.0 mean no strings: commercial use, modification, and redistribution with only notice requirements. The Llama Community License allows commercial use below 700 million monthly active users, but it adds attribution, naming rules, an acceptable use policy, and an EU multimodal exclusion. Gemma 4 moved to Apache 2.0, leaving its custom terms behind. Custom vendor licenses vary and need a full read. Before you ship, trace the license chain to the base model. A permissive tag on a fine-tune does not erase the restrictions of its parent.