Open-weight model licences: what you can do commercially

You've found a model that runs well on your own hardware and does the job. Before it goes into a product, a client deliverable or an internal tool, someone has to answer a dull but important question: are you actually allowed to use it that way?

"Open weights" only tells you that you can download the file. It says nothing about what the licence lets you do with it. The licences behind popular models range from standard open source software licences to custom agreements with naming rules, user caps and acceptable use policies. This article walks through the actual texts, as of October 2026, so you know what to look for. It's a reading guide, not legal advice. If a lot of money or a client contract depends on the answer, get a lawyer to read the licence that ships with your exact model.

Open weights and open source aren't the same thing#

The Open Source Initiative published a definition of open source AI built on four freedoms: to use the system for any purpose without having to ask for permission, to study how it works, to modify it for any purpose, and to share it with or without changes. Measured against that, a licence that bans certain uses, or that makes very large companies ask permission first, doesn't give you the first freedom as written.

Those licences may still suit you fine. The point is that "open" in a model's marketing tells you very little. The licence file in the repository is the only thing that counts, and it can differ between versions of the same model family.

Apache 2.0: the simple case#

Plenty of open-weight models ship under the Apache License 2.0, a long-established open source software licence. Mistral's help centre says most of its open models use it, and the Mistral Small 24B base model card lists apache-2.0 and describes it as allowing use and modification for commercial and non-commercial purposes. OpenAI's gpt-oss models are also released under Apache 2.0, though OpenAI says they're used under that licence and its gpt-oss usage policy, so read both.

Google switched to it this year. Its Gemma 4 announcement says Gemma 4 models are the first in the Gemma family released under the OSI-approved Apache 2.0 licence, and frames the move as giving developers clearer terms instead of prescriptive terms of service.

So what does Apache 2.0 ask of you? The full licence text is short and worth reading once. If you only run the model internally or behind an API, the redistribution conditions mostly don't bite, because they apply when you pass the work on. When you do distribute the weights or a modified version, section 4 requires you to:

• give recipients a copy of the licence
• mark any files you changed with a prominent notice that you changed them
• keep the existing copyright, patent, trademark and attribution notices
• include the attribution notices from any NOTICE file that came with the work

Two other clauses matter in practice. Section 3 grants a patent licence from contributors, but it ends for you if you sue alleging that the work infringes a patent. Section 6 says the licence doesn't give you any right to use the licensor's trademarks beyond describing where the work came from. In plain terms, you can fine-tune a Gemma 4 or Mistral Apache model and sell a product built on it, but you can't brand your product as if Google or Mistral made it.

Mistral's modified MIT licence#

Not every Mistral model uses Apache 2.0. The same Mistral help article says certain models use a modified MIT licence. It grants the same freedoms with one exception: companies with more than US$20 million in monthly revenue must either get a commercial licence from Mistral or use the model through Mistral's own platform. Mistral says the terms for each model are set out in its model card. That's the general lesson here too. Two models from the same company, released months apart, can carry different licences.

For most small and mid-sized businesses the revenue threshold won't apply. If you're building for a larger client who will run the model themselves, read the licence with their revenue in mind too.

Llama 4: a custom licence with strings attached#

Meta's Llama models use their own community licence. The Llama 4 Community License, effective 5 April 2025, grants a non-exclusive, worldwide, non-transferable, royalty-free licence to use, copy, modify and distribute the model, and the model card says Llama 4 is intended for commercial and research use. The conditions are where it differs from Apache 2.0.

If you distribute or make available the Llama materials or a derivative, or a product or service (including another AI model) that contains them, section 1(b)(i) requires you to provide a copy of the agreement and to prominently display "Built with Llama" on a related website, user interface, blog post, about page or product documentation. Note the wording "make available". A hosted product may count, not only shipping the weights.

The same section has a naming rule that catches people out. If you use Llama materials, or any outputs or results from them, to create, train, fine-tune or otherwise improve an AI model that you distribute or make available, its name must start with "Llama". That covers distillation. A small model trained on Llama-generated data and then released inherits the naming requirement.

There are three other things to check:

1. You must follow Meta's acceptable use policy, which the licence incorporates by reference. Read it as part of the licence, because a use it prohibits is a breach.
2. Section 2 says that if, on the Llama 4 release date, your products or services (including affiliates') had more than 700 million monthly active users, you must request a licence from Meta, which it may grant at its sole discretion. Very few businesses are near that number, but it's one reason the licence doesn't meet the OSI's use-for-any-purpose freedom.
3. No trademark licence is granted, apart from using "Llama" as needed to follow the naming rule, and the agreement is governed by Californian law.

Everything above comes from the Llama 4 text. If you're on a different Llama release, read the licence file that ships with that release.

The older Gemma terms still apply to older Gemma models#

Gemma 4's move to Apache 2.0 doesn't change the licence on earlier Gemma models. The Gemma Terms of Use, last modified 1 April 2026, say they apply to the models listed in an appendix running from the first Gemma through to TranslateGemma, and point Gemma 4 users to a separate licence page.

These terms are a different kind of document from Apache 2.0. They prohibit uses listed in the Gemma Prohibited Use Policy. If you distribute Gemma or a model derivative, you must pass those use restrictions on as an enforceable provision, give recipients a copy of the agreement, and include a notice that Gemma is provided under the Gemma Terms of Use. Google also reserves the right to restrict usage of the Gemma services "remotely or otherwise" if it reasonably believes you're in breach.

The definition of a model derivative is broad. It includes models trained on synthetic data generated by Gemma and models built with distillation methods. Outputs themselves aren't derivatives, and Google says it claims no rights in the outputs you generate, though you're responsible for them and how they're used.

A checklist before you ship#

When we assess a model for a client project at TheAILAB, these are the questions we answer from the licence text, not from a blog summary (this one included):

1. Which exact licence file ships with this exact model version? Check the repository, not the family name.
2. Is it a standard licence (Apache 2.0, MIT) or a custom agreement? Custom ones need a full read, including any policy they incorporate by reference.
3. Is there a size threshold, by revenue or by users, and whose numbers count: yours or your client's?
4. Are there prohibited uses, and does anything in your use case come close to them?
5. If you'll distribute the model, a fine-tune or a product containing it, what notices, licence copies and naming rules come with that?
6. Will you train another model on its outputs? Llama's naming rule and the older Gemma terms both reach that case.
7. Do you need to use the provider's trademarks? None of these licences give you that freely.

Record the answers, the licence version and the date you checked, and keep them with the project. Licences change between releases, and the model you swap in next year may not carry the same terms as the one you tested today.

Sources

1. Llama 4 Community License Agreement (on the Llama-4-Maverick-17B-128E-Original model card) — Meta (effective 5 April 2025) (checked 2026-10-13)
2. Gemma Terms of Use — Google AI for Developers (last modified 1 April 2026) (checked 2026-10-13)
3. Gemma 4: Expanding the Gemmaverse with Apache 2.0 — Google Open Source Blog (2 April 2026) (checked 2026-10-13)
4. Apache License, Version 2.0 — Interoperable Europe, European Commission (checked 2026-10-13)
5. Under which license are Mistral's open models available? — Mistral AI Help Center (checked 2026-10-13)
6. Model Card for Mistral-Small-24B-Base-2501 — Mistral AI (Hugging Face) (checked 2026-10-13)
7. OpenAI open-weight models (gpt-oss) — OpenAI Help Center (checked 2026-10-13)
8. The Open Source AI Definition 1.0 — Open Source Initiative (checked 2026-10-13)