"Open-Weight" Does Not Necessarily Mean "Open Source": What AI Model Licenses Can Limit

Your engineers downloaded a model's weights, ran it on your own servers, and built a feature on it. Nobody signed anything, so the assumption is that downloading the weights means unrestricted use. The weights may well be downloadable without a conversation, but the license that came with them can still limit who may use the model, what you must display, what you must pass on to your own customers, and what you may do with the output.

This post is for founders and engineering leads at software companies that build on downloadable models. It walks through the kinds of terms these licenses carry, using five licensors' published licenses as examples, and ends with the questions to settle before a model goes into a product. It is contract practice, not a statement of law. It does not rank the licenses, say whether any of them is "open source" under any definition, or say whether any particular use complies.

The short answer

"Open-weight" describes how a model is distributed: the trained weights are published for download. It says nothing about the terms. Among the licenses read for this post, some are the permissive Apache License 2.0, which carries conditions of its own; some are community licenses with a user-count threshold and attribution rules; some incorporate a use policy and reserve the licensor's right to restrict use; and some permit research or non-production use only.¹³⁶⁷⁸ A company that treats every downloadable model as interchangeable is likely to miss one of those terms.

Three points follow:

1. Find the license that governs the exact model and version you downloaded, and the use policy it incorporates.
2. Read it for the five kinds of terms below.
3. Compare what it requires with what your product, your documentation and your customer contracts already say.

Where the license lives

The license is usually a file distributed with the weights and a page on the licensor's site, and the two can differ in version. Google's terms for its Gemma models, for example, list the models they cover in an appendix and point to a separate license for a newer model family.³⁵ Meta's license for Llama 4 carries its own "Version Effective Date" and incorporates a separately published Acceptable Use Policy by reference.¹² Mistral AI publishes some models under the Apache License 2.0 and others under its own research and non-production licenses.⁶⁷ The cited Hugging Face repositories for Alibaba's Qwen3-235B-A22B and OpenAI's gpt-oss-120b each include the Apache License 2.0.¹⁰¹¹ DeepSeek's model license carries its own version number and date.⁹

Before relying on any of them, confirm which document, and which version of it, applies to the files you actually have. Our post on API dependency and vendor terms covers how published terms bind a company that never signed them.

Five kinds of terms to look for

Who may use the model. Meta's Llama 4 Community License contains "Additional Commercial Terms": if, on the Llama 4 version release date, the monthly active users of products or services made available by or for the licensee or its affiliates exceeded 700 million in the preceding calendar month, the licensee must request a license from Meta. Meta may grant that license in its sole discretion, and the licensee is not authorized to exercise rights under the agreement unless Meta expressly grants them.¹ Most startups are nowhere near that number; the point is to check the condition, including affiliates and the specified measurement date, rather than assume it is a threshold tested whenever the business grows or is acquired.

What you may use it for. Mistral AI's Research License limits use of the model, derivatives and outputs to "Research Purposes": solely personal, scientific or academic research for non-profit and non-commercial purposes, not directly or indirectly connected to commercial activities or business operations. That excludes company employees' or contractors' use in their daily tasks, revenue-oriented testing or proofs of concept, and distribution by a commercial entity, whether or not for payment.⁶ Its Non-Production License limits use of models and derivatives to testing, research, personal or evaluation purposes in non-production environments, excluding live conditions, commercial operations and direct interactions with or impacts on end users. It also prohibits supplying models or derivatives in the course of a commercial activity, whether or not for payment, including through a hosted or managed service.⁷ Neither license, by itself, authorizes deploying the model in a commercial product; uses outside the stated permissions require a separate license from Mistral AI, which it may grant in its sole discretion.⁶⁷

What you must not do with it. Several licenses incorporate a use policy. Llama 4's license requires adherence to Meta's Acceptable Use Policy, which lists prohibited uses.¹² Google's Gemma Terms of Use prohibit the restricted uses in its Prohibited Use Policy and reserve Google's right to restrict, "remotely or otherwise," usage it reasonably believes violates the agreement.³⁴ DeepSeek's license grants rights subject to use-based restrictions set out in an attachment.⁹ Our post on your AI provider's acceptable use policy explains upstream use restrictions; for downloadable models, check the particular license for the restrictions and any duties to impose them on downstream users.

What you must display and pass on. Llama 4's license requires a licensee that distributes or makes available the Llama Materials or derivatives, or a product or service containing them, to provide a copy of the agreement and prominently display "Built with Llama" on a related website, user interface, blogpost, about page or product documentation. If the licensee uses the materials or their outputs or results to create, train, fine-tune or otherwise improve an AI model that is distributed or made available, that model's name must begin with "Llama."¹ Gemma's terms define Distribution to include making model functionality available as a hosted service. They require distributors to include the Section 3.2 use restrictions as an enforceable provision in the agreement governing use or distribution, notify subsequent users of those restrictions, and give third-party recipients a copy of the agreement. They also require modified-file notices and, for distributions other than hosted services, a specified Notice file.³ Apache License 2.0 requires redistributors to provide a copy of the license and prominent notices of changed files. Its additional requirements include retaining pertinent notices in distributed source-form derivative works and, where the original Work includes a NOTICE file, reproducing the applicable attribution notices in an authorized location.⁸

What the licensor keeps and disclaims. Apache 2.0 grants a limited patent license from contributors; patent licenses granted under it for the Work terminate if the licensee institutes patent litigation alleging that the Work or a Contribution incorporated within it constitutes direct or contributory patent infringement, including by counterclaim or cross-claim. It also disclaims warranties, subject to applicable law or written agreement.⁸ Gemma's terms say Google claims no rights in outputs generated with the model and that the licensee and its users are solely responsible for outputs.³ Other licenses address outputs differently, as Llama 4's model-naming rule shows.¹

What this means for your product and contracts

• Your customer terms. Check whether the model license requires downstream restrictions, notices or enforceable contract provisions. Implement those requirements through the appropriate customer terms and acceptable use policy, and do not promise customers rights broader than the upstream license permits. Our post on customer contract terms for AI products covers the clauses involved.
• Your documentation and interface. An attribution requirement such as "Built with Llama" is a product requirement, not a legal footnote. Decide where it goes and who keeps it there through redesigns.
• Your model-naming and fine-tuning plans. Llama 4's naming rule can reach fine-tuned models you distribute or make available, as well as models created or improved using its outputs or results. Check the rule's precise trigger before choosing a model name.¹
• Diligence. Investors and acquirers ask which models a product depends on and under what terms, for the same reasons they ask about open-source code. Our posts on open-source licenses for SaaS startups and AI questions in investor diligence cover what they look for.
• Switching. A model under a research-only license, or one with commercial eligibility conditions, is a dependency to plan around. Our post on switching AI vendors covers what a company keeps when it moves.
• Upstream providers. If you reach a model through a hosted provider rather than running the weights yourself, the provider's terms apply as well, and may differ. Our AI vendor contract questions cover that side.

The terms change

Google's Gemma terms carry a "last modified" date and an appendix of covered models; Meta's license is tied to a version release date; Mistral's licenses carry version numbers.¹³⁶ The license offered with a later release or download may differ; do not assume that later terms replace the terms governing the copy you already downloaded, or that you may redistribute that copy under a different license. Record the license text and version that applied when you downloaded the weights, and keep it with the model. Our post on the AI governance guide for businesses covers where that record fits in a wider program.

Questions to settle before a model goes into a product

These are questions to take to your engineering and contract review, not conclusions about any particular license:

1. Which license, and which version of it, governs the exact model files we downloaded?
2. Does it incorporate a use policy, and have we read the policy as well as the license?
3. Does it limit the purposes we may use the model for, and is our use within them?
4. Does it carry a user-count or similar condition, whose users count, when is it measured, and how could an acquisition affect its application?
5. What must we display, name, or pass on to our customers, and where in the product does that live?
6. What does it say about outputs and about models trained on outputs?
7. Have we kept a copy of the license text we accepted, with the download?

What this post does not cover

This post does not say whether any license is "open source" under any organization's definition, whether any use complies with any license, or how a license term would be enforced. It does not cover patents beyond noting that one license addresses them, trademarks, export controls, or the terms of hosted model providers. Our post on AI legal risks for startups covers the wider set of questions.

How we can help

Accord & Shield Legal reviews model and software license terms, drafts customer contract terms and acceptable use policies, and advises on the contract side of AI products for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

---

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. Model licenses change, and whether a license permits your use depends on its text and your facts; consult an attorney about your situation.