Open Weight Is Not Open Source, and Nobody Read the Licence

An open-weight model is a licensed product: you get the parameters, and you accept terms its developer wrote. Llama, Gemma 3 and the larger Qwen2.5 and Mistral Large 2 models fail the Open Source Initiative’s definition, and their licences carry user caps, use policies, naming rules and research-only clauses that a quick check of a repository’s licence tag will miss.

My view is that every open-weight model should be governed like a vendor contract that nobody negotiated, because that is what it is. The evidence says most teams treat these models like a permissive library instead. The headline user caps touch very few companies; the use policies, naming rules, hosted-service terms and research-only clauses touch almost everyone. This piece is for the CTO or general counsel who signs off on putting an open-weight model into a product. It is a practitioner’s reading of public licence texts and EU law, not legal advice.

Updated 6 October 2026: rebuilt around the licence texts, each read on that date. The country-by-country detail now lives in the Regulation Tracker and the sector checks in the checklist. The changes are listed at the end.

What does a licence audit find?

The best evidence I know of comes from James Jewitt and colleagues at Queen’s University in Canada. In a preprint posted in July 2026, they traced 232,270 chains running from Hugging Face datasets through models to the GitHub applications that call them, and followed each licence label down the chain. Labels that carry obligations rarely survived. Where a model’s licence restricted use, as OpenRAIL and the Llama licences do, the application kept that category in 4.2% of cases, and 77.9% of those applications switched to a permissive label such as MIT. Every category that carries obligations fell below 7% survival from dataset to application, against 95.1% for permissive licences.

Read it for what it measures. The authors track labels, not the full legal text, and a different label is not a breach: a project can license its own code under MIT and still meet a model’s terms if it never ships the weights. The applications are public open-source projects, not enterprise systems. What the study does show is that a model’s terms rarely travel with it.

Sometimes the label changes on the page. DeepSeek’s R1 distilled 70B model is tagged MIT on Hugging Face and ships an MIT licence file. Further down, its model card says it “is derived from Llama3.3-70B-Instruct and is originally licensed under llama3.3 license”. The Llama 3.3 licence asks anyone who distributes a derivative to pass on a copy of the agreement, show “Built with Llama”, and start the model’s name with “Llama”. DeepSeek discloses the lineage. The point is where the disclosure sits: a scanner reads the tag, and the lineage is a paragraph further down.

Why is open weight not open source?

The Open Source Initiative published its Open Source AI Definition 1.0 on 28 October 2024. An AI system qualifies only if anyone may use it “for any purpose and without having to ask for permission”, and only if its code, its parameters and detailed information about its training data are available under OSI-approved terms. In July 2023 the OSI said Meta’s Llama licence is not open source, because it restricts commercial use for some users and limits use through its acceptable use policy. By that test, every licence in the table below other than Apache 2.0 and MIT falls short, because each limits who may use the model or for what. Even the Apache and MIT releases may not meet the full definition, which also asks for training code and data information. The licence is the part a buyer can check.

The table sets out what each licence asks of a business, read in its own text on 6 October 2026. Note how often the answer changes between versions of the same family.

What is the compatibility rule?

When you combine components, the result has to satisfy every licence in it at once. The classic software case: the Free Software Foundation has never treated Apache 2.0 as compatible with GPL version 2, the Apache Software Foundation notes, because of Apache’s patent termination and indemnification terms. Apache 2.0 code can go into a GPLv3 project; not into a GPLv2-only one.

Model licences add a twist: their obligations follow the lineage. The Llama licences put their naming rule on any model created, trained or fine-tuned with Llama or its outputs, once that model is distributed or made available. Gemma’s terms reach distillation. Mistral’s research licence says any derivative you create stays subject to its limits. So the rule I give teams is short. The strictest term anywhere in a model’s ancestry governs the model, whatever the licence file at the top of its repository says.

What does the EU AI Act exempt, and what does it not?

Less than the label suggests. Article 2(12) of the AI Act excludes AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk systems or fall under Article 5 (prohibited practices) or Article 50 (transparency). For general-purpose AI models, Article 53(2) lifts only the duties to keep technical documentation and pass it downstream, and Article 54(6) the duty to appoint an EU representative. The copyright policy and the public summary of training content still apply, and no exemption covers a model with systemic risk. The Digital Omnibus, in force since 27 July 2026, left those provisions as they were.

Who qualifies turns on the licence. In its guidelines for general-purpose AI providers, the Commission says a licence is not free and open-source under the Act if it limits use to research or non-commercial purposes, requires separate commercial licences for some uses, or adds “usage restrictions triggered by user scale thresholds (e.g. requiring additional licensing if monthly active users exceed a certain number)”. That describes the Llama and Qwen2.5 72B licences and Mistral’s research licence. Apache 2.0 and MIT pass. The guidelines do not bind a court, and they allow narrow, safety-based use limits.

For a company that builds on someone else’s model, the change is in what it is owed. Article 53(1)(b) requires a general-purpose model’s provider to give documentation to companies integrating the model into their own AI systems, and the open-source exemption lifts that duty. So the provider of an Apache or MIT model owes you none, while on the Commission’s reading the providers of Llama, Qwen2.5 72B and Mistral’s research-licensed models still do: ask for it. You become a provider yourself only if your modification uses more than a third of the original model’s training compute, the Commission’s indicative test, which ordinary fine-tuning does not reach. Duties for general-purpose models have applied since 2 August 2025, and the Commission’s power to fine their providers since 2 August 2026. Other jurisdictions treat open models differently; the Regulation Tracker keeps those rules current.

Which three-tier policy keeps a team clear?

The policy that works sorts every licence before anyone downloads a model, and records the base model as well as the one in hand.

1. Permitted. OSI-approved permissive licences such as Apache 2.0, MIT and BSD, for the model and its whole lineage. Keep the notices. With no developer use policy, the judgement about harmful uses moves in house.
2. Restricted. Custom model licences with user caps, use policies or naming rules (Llama, Gemma 3, the Qwen License), and copyleft licences. Each needs legal sign-off, a named owner, and a record of the licence version and the date it was read.
3. Prohibited. Research-only and non-commercial licences in any revenue-linked work, proofs of concept included; models with no licence; and AGPL code in a product you run as a service, unless legal has cleared it.

Two habits make the tiers hold. Read the model card for the base model, not the repository tag. And re-read the licence at every version, because Gemma, Mistral and Qwen each moved models between tiers from one release to the next. Models you buy through a vendor raise the same questions, and The AI That Hurts You Is Not the AI You Own covers that contract side. For training data that holds personal data, see The GDPR Was Not Written for AI. It Governs It Anyway.

Sources and changes

• Jewitt, Li, Rajbahadur, Adams and Hassan, Don’t Trust the Label: License Laundering in AI Supply Chains, arXiv 2607.20300, 22 July 2026. It supersedes the authors’ earlier study, arXiv 2509.09873.
• Open Source Initiative, Open Source AI Definition 1.0, 28 October 2024; statement on the Llama licence, 20 July 2023.
• Licences read 6 October 2026: Llama 4, Llama 3.3, Gemma Terms of Use, Gemma 4 (Apache 2.0), Mistral AI Research License 0.1, Qwen License, Qwen3 (Apache 2.0) and DeepSeek-R1 (MIT).
• AI Act, Regulation (EU) 2024/1689, Articles 2(12), 53 and 54 and recitals 102 to 104, as amended by Regulation (EU) 2026/1744; Commission guidelines on the scope of obligations for providers of general-purpose AI models, C(2025) 7719 of 19 November 2025 (content approved 18 July 2025), paragraphs 60 and 72 to 83.
• Apache Software Foundation on GPL compatibility, read 6 October 2026.

Changes on 6 October 2026. Cut from about 3,770 words. The opening client story and its figure were removed because they could not be sourced, as were the adoption statistics, the risk chart and the maturity model. The four-jurisdiction tabs go to the Regulation Tracker and the sector tabs to the checklist. Added: the licence-label study, each licence’s terms read at source, and the Commission’s reading of which licences earn the AI Act’s open-source exemptions.

Not legal advice. Confirm specifics with counsel.