LLM licenses: open weights are not open source
Contents
- The five you will actually meet
- The clause that voids Llama 4 for everyone in the EU
- Gemma shows what a vendor license can do, and Google just backed out of it
- OpenMDW-1.1: one license for weights, code and data
- What “open source AI” officially means, and why almost nothing qualifies
- Three traps that are not in the license name
- The rule I use
Open weights and open source are two different things, and the gap between them is where the legal risk sits. Five licenses cover almost every model on Hugging Face you would actually want to run. Two of them are real open source. Two are vendor contracts with an off switch. And one of them, if you sit in the EU, never granted you rights to Llama 4 in the first place.
The five you will actually meet
| License | Models | Commercial use | The catch |
|---|---|---|---|
| Apache 2.0 | Qwen 3.5 / 3.6, Gemma 4, Mistral Small, DeepSeek-OCR 2, PaddleOCR-VL, Agents-A1 | Yes | None worth naming. Explicit patent grant. |
| MIT | DeepSeek-R1, Unlimited-OCR, dots.ocr, GLM-OCR, Phi | Yes | No explicit patent grant. In practice fine. |
| Llama Community | Llama 3.x, Llama 4 | Below 700M monthly active users | Attribution, naming rule, acceptable-use policy, EU carve-out |
| Gemma Terms of Use | Gemma 1, 2, 3 (not 4) | Yes | Prohibited-use policy, pass-through duty, Google can restrict remotely |
| OpenMDW-1.1 | Laguna XS / S 2.1, NVIDIA families from here on | Yes | Defensive termination if you sue over the model |
Everything else is a long tail: AGPL for some document-parsing stacks, cc-by-nc-4.0 for research drops, Tongyi Qianwen on older Qwen vision models, and per-vendor custom terms tagged simply other. Two entries in that table are the ones people get wrong.
The clause that voids Llama 4 for everyone in the EU
Meta’s Llama 4 Community License (effective 5 April 2025) does not grant its Section 1(a) rights to individuals domiciled in, or companies with a principal place of business in, the European Union, for any multimodal model in Llama 4. Every Llama 4 model is multimodal. So the whole family is out.
There is no research exception and no personal-use exception. Renting a GPU in Virginia does not fix it, because the restriction attaches to where you are, not where the weights run. The one carve-out that does exist: it does not reach the end users of a product that already incorporates such a model. You can use a service built on Llama 4. You just cannot be the one building it from a German desk.
If you never noticed, that is the point. The clause is not on the download button. It is in the license text, and Meta’s stated reason is regulatory uncertainty around the EU AI Act.
The rest of the Llama license is more ordinary but still real work:
- You must display “Built with Llama” on a website, UI, blog post, about page or product documentation.
- Any model you train from it must have “Llama” at the beginning of its name.
- A Notice file must carry the string
Llama 4 is licensed under the Llama 4 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. - Above 700 million monthly active users, you have to ask Meta, and Meta may say no at its sole discretion.
Gemma shows what a vendor license can do, and Google just backed out of it
Gemma 1 through 3 shipped under Google’s own Terms of Use, not a license. The interesting parts were never the permissions. They were the prohibited-use policy incorporated by reference, the obligation to pass the same restrictions to everyone downstream of you, and Google’s reserved right to restrict use remotely if it believed the terms were violated.
None of that survives into Gemma 4. The Gemma 4 model cards on Hugging Face carry license: apache-2.0. Google dropped its custom terms for the same license Qwen and Mistral use, which is a bigger deal than any benchmark on the release page. A remote restriction clause is not a hypothetical when you have deployed a model into a customer’s product.
The lesson generalises: a license family is not a stable property of a vendor. Check per release, not per lab.
OpenMDW-1.1: one license for weights, code and data
OpenMDW is the newest thing in this space and the reason most people are reading a license page again. It came out of LF AI & Data in 2025, and the Linux Foundation released version 1.1 on 28 May 2026 alongside NVIDIA committing to it for future Cosmos, Isaac GR00T, Ising and Nemotron releases.
The problem it solves is real. A normal model release is a pile of different things - weights, training and inference code, docs, sometimes data - and until now people bolted Apache 2.0 onto the code, something else onto the weights, and left the data undefined. OpenMDW covers all of it under one term, “Model Materials”, and grants permission to deal in them “without restriction” across copyright, patent, database and trade-secret rights.
What you actually owe in return is short:
- Include a copy of the agreement when you distribute.
- Retain the copyright and origin notices that apply to your distribution.
Two clauses are worth knowing beyond that. First, it explicitly imposes no restrictions on outputs generated with the materials, which kills the “can I train on this model’s output” question that Llama’s naming rule keeps alive. Second, there is a defensive termination: file or voluntarily join a lawsuit claiming the materials infringe your patents or copyrights and all your rights end, unless you were sued first.
As of today, 145 model repos on Hugging Face carry the openmdw-1.1 tag, and most of them are Laguna and its quantizations. It is early. But license:openmdw-1.1 being a first-class Hugging Face facet at all is how these things start.
What “open source AI” officially means, and why almost nothing qualifies
The OSI published its Open Source AI Definition v1.0 in October 2024. To qualify, a release needs the weights, the source code used to train and run the system, and sufficiently detailed information about the training data - the last one being where every large lab bails out.
Models that passed the validation phase: Pythia, OLMo, Amber, CrystalCoder, T5. Llama, Gemma, Qwen and DeepSeek do not. Meta’s position is that the bar is too narrow; OSI’s is that the alternative rewards labs that publish nothing. An update is signalled for late 2026.
For day-to-day work the definition changes nothing about what you are allowed to do. It changes what you are allowed to call it, which matters the moment a client contract or a tender says “open source components”.
Three traps that are not in the license name
The paper license is not the weights license. Baidu’s Unlimited-OCR is a clean example: the arXiv paper is CC-BY-4.0, the weights on Hugging Face are MIT. Two different documents, two different grants. Read the model card, not the PDF.
A license family can flip between releases. MinerU’s MinerU2.5-2509-1.2B is AGPL-3.0. The 2026 Pro releases, MinerU2.5-Pro-2604 and -2605, are Apache 2.0. If you pinned the 2025 checkpoint in a Dockerfile and serve it over HTTP, AGPL’s network clause reaches your service. Same project, same name, completely different obligation.
Vision and embedding variants drift from the flagship. Qwen3.5 and Qwen3.6 text models are Apache 2.0. Qwen2.5-VL-72B-Instruct is tagged other. The lab’s headline license tells you nothing about the specific artifact you pulled.
The rule I use
Three buckets, decided before the download, not after the deployment:
- Apache 2.0, MIT, OpenMDW-1.1 - ship it. Record the license in the repo, keep the notice file, move on.
- Llama, Gemma 1-3, Tongyi Qianwen, anything tagged
other- read the actual text and write the obligation down somewhere a future you will find it. If the obligation is attribution and a naming rule, fine. If it is a remote off switch or a geographic carve-out, pick a different model. cc-by-nc-*and AGPL - not in anything commercial without a deliberate, documented decision. Non-commercial means non-commercial, and AGPL crosses the network boundary.
The check that catches most of it is one line: open the model card, look at the license: tag, and confirm it is the tag on the exact repo you are pulling - not the org, not the paper, not the blog post.
It takes ten seconds and it is the only part of this that anyone ever regrets skipping. The full OpenMDW-1.1 text is two pages and worth reading once, because it is the shape the next few years of model releases are going to take.