TL;DR

An AI model is not cleared for production because a repository says “open,” its weights are downloadable, or its model card displays apache-2.0. Review the exact release, every covered artifact, and every intended action. Archive the controlling terms, trace parent models and adapters, convert obligations into enforceable controls, and require human approval for ambiguity. This guide is an engineering compliance method, not legal advice.

Table of Contents

Key Takeaways

  • Open weight is a delivery fact, not a permission set.
  • A license applies to a defined artifact. Code, weights, data, tokenizer, adapters, outputs, documentation, and hosted APIs can have different terms.
  • Commercial use is not one action. Internal evaluation, SaaS inference, weight redistribution, fine-tuning, adapter publication, synthetic-data generation, and distillation need separate decisions.
  • A model-family name is not evidence. Pin repository, revision, artifact hash, license text, additional policies, and review date.
  • Automation can block missing or forbidden states; it cannot issue legal approval.

Open Source, Open Weight, and Source Available

These labels answer different questions and must not be used interchangeably.

Label Minimum useful meaning What it does not prove
Open-weight model Trained parameters can be obtained under stated terms Open-source status, commercial permission, redistribution, training-data access, output rights, or regulatory exemption
Open Source AI Under OSI Open Source AI Definition 1.0, users receive freedoms to use, study, modify, and share, together with the preferred form for modification Fitness, safety, privacy, non-infringement, or regulatory compliance
Source available Some source or artifacts are visible under terms that may restrict users or fields of use OSI approval or unrestricted commercial use
Hosted API A service exposes model behavior through a contract Rights to download, modify, or redistribute the underlying weights

The Open-Weight Model glossary gives the compact concept boundary. The critical engineering lesson is that “open weight” says nothing by itself about the applicable license.

OSI’s definition identifies three parts of the preferred form for modifying a machine-learning system:

  1. Data Information: sufficiently detailed information about training data, including provenance, selection, labeling, processing, and where obtainable data can be found.
  2. Code: the code used to process data, train, validate, test, and run the system.
  3. Parameters: weights and other configuration settings.

The definition does not require all raw training data to be redistributed when that is not legally possible. It does require the specified information. That nuance matters: “the dataset must always be downloadable” and “weights alone are open source” are both inaccurate summaries of OSAID 1.0.

Map the Complete AI Artifact Set

Model compliance starts with an artifact graph because a repository is rarely governed by one document.

flowchart LR A["Base model revision"] --> B["Fine-tune or adapter"] B --> C["Merged or converted weights"] C --> D["Inference image"] D --> E["Hosted service"] F["Tokenizer and code"] --> D G["Training and evaluation data"] --> B H["License, policy, and notices"] --> A H --> B H --> D I["Generated outputs"] --> J["Logs, evaluation, or training corpus"] E --> I

Review each node separately:

Artifact or contract Evidence to capture Typical questions
Base weights Repository, immutable revision, file hashes, license snapshot May we possess, modify, host, or redistribute them?
Code and tokenizer Package revisions, licenses, NOTICE files Are attribution, source, or patent conditions triggered?
Parent and adapter lineage Base IDs, adapter IDs, merge recipe Which upstream restrictions continue to apply?
Training and evaluation data Source, consent, license, permitted purpose May the data be used for this training or evaluation?
Generated outputs Producer, terms, provenance, downstream purpose May outputs enter logs, benchmarks, or another training set?
Container and serving stack Images, dependencies, distribution channel Is software conveyed, modified, or offered over a network?
Hosted API Terms of service and data-processing terms Are retention, output use, geography, or competitive-training limits different?
Brand and documentation Trademark policy, attribution, model card Which names, notices, and disclosures are required?

A Hugging Face metadata tag is a discovery hint. The controlling evidence is the exact license and attached terms for the pinned release, including upstream artifacts.

Read License Families Without Shortcuts

License-family names are useful routing signals, not final decisions.

MIT and Apache 2.0

MIT grants broad copyright permission for the covered software or artifact, subject to preserving the copyright and permission notice. It has no express patent grant. Avoid rewriting that as “MIT has an implicit patent grant”; any implied-license argument is jurisdiction- and fact-dependent.

Apache License 2.0 grants broad copyright permissions and an express patent license from each contributor, but only for patent claims that contributor can license and that are necessarily infringed by the contribution alone or in combination with the work. Redistribution conditions include providing the license, marking modified files, preserving relevant notices, and carrying forward NOTICE attribution when a NOTICE file exists.

Neither license can grant rights the licensor does not own. A permissively licensed weight file does not automatically clear:

  • third-party training data or outputs;
  • third-party patents;
  • names and trademarks;
  • privacy, export-control, consumer, employment, or sector rules;
  • dependencies or a parent model under different terms.

GPL and AGPL

GPL and AGPL are copyleft software licenses. Whether model weights, adapters, generated files, or a larger service are covered works is not answered by the family name alone.

The GNU AGPL v3 specifically addresses modified covered software used over a network. Section 13 requires operators to offer users interacting remotely with that modified Program access to its Corresponding Source. This is not the same as “any API using AGPL code must publish the entire stack.” Record whether the covered Program was modified, what users interact with, and how components combine, then obtain specialist review.

RAIL and OpenRAIL

RAIL Initiative guidance defines RAIL as a class of licenses with use restrictions. OpenRAIL is a subclass intended to permit free access and commercial reuse while retaining specified use restrictions. RAIL can address data, applications, models, or source code, and variants can differ.

RAIL Initiative explicitly states that OpenRAIL is not open source under the OSI definition because it restricts uses. Do not create a universal “RAIL prohibited uses” list or assume every variant allows the same commercial activity. Archive the exact text and map each clause to product controls and downstream terms.

Community, research, and custom terms

Custom model licenses can define user or revenue thresholds, attribution, naming, acceptable-use policies, geographic constraints, redistribution conditions, or training restrictions. Research and non-commercial licenses may not authorize sales demos, customer pilots, or revenue-supporting internal workflows.

Do not maintain a timeless table that says an entire model family uses one license. Each checkpoint, modality, distilled variant, and repository revision can differ.

Build an Evidence Hierarchy

Use evidence in this order:

  1. The license file attached to the exact artifact revision.
  2. Incorporated exhibits, acceptable-use policies, and model-specific terms.
  3. The parent model and dataset terms referenced by that release.
  4. Official provider documentation for the same revision and distribution channel.
  5. Repository metadata and model cards.
  6. Third-party summaries only as discovery aids.

When evidence conflicts, stop the release. Do not silently choose the most permissive interpretation.

Archive:

  • the raw text or PDF;
  • source URL and retrieval timestamp;
  • repository commit or immutable revision;
  • a cryptographic digest;
  • the relationship between each clause and each artifact;
  • reviewer, decision, assumptions, expiry, and re-review triggers.

This preserves what the team actually reviewed. A live URL alone can change or disappear.

Review Actions, Not Labels

Create a decision row for every intended action.

Action Questions that must be answered
Internal evaluation Is evaluation commercial activity? Can data and outputs be retained? Are external users involved?
SaaS inference Do weight terms permit hosting? Do separate API or acceptable-use terms apply?
Fine-tuning Are base weights and training data permitted for the purpose? What terms govern the adapter?
Quantization or conversion Is the converted artifact a derivative under the terms? What notices and restrictions travel with it?
Weight redistribution Which license, notices, source offers, names, and policies must accompany the package?
Adapter publication Can the adapter be used without the base? Does it encode protected material? Which upstream terms apply?
Merge Are all source licenses compatible for the planned distribution and use?
Synthetic-data generation Do model or API terms restrict output use? Do prompts or outputs contain third-party or personal data?
Distillation Do source-model, output, target-model, and dataset terms permit the process and release?
High-impact deployment Which product, privacy, safety, and sector duties apply regardless of license?

“Derivative work” and “output ownership” are legal conclusions, not tensor-shape properties. LoRA size, quantization precision, or whether a model can run without its base may be relevant facts, but none provides a universal legal answer.

Create a Versioned License Manifest

A model license manifest is a reviewable contract between procurement, legal, ML engineering, data engineering, and release systems.

yaml 
schemaVersion: ai-license-manifest/v1
artifact:
  id: example-org/example-model
  revision: 4f3c2b1
  sha256: sha256:replace-with-real-digest
  sourceUrl: https://example.org/model/revision/4f3c2b1
lineage:
  baseModels:
    - id: example-org/base-model
      revision: a19d6e0
  adapters: []
terms:
  licenseId: LicenseRef-Example-Model
  licenseSnapshot: legal/licenses/example-model-4f3c2b1.txt
  licenseSha256: sha256:replace-with-license-digest
  additionalPolicies:
    - legal/policies/example-acceptable-use-2026-08-23.pdf
intendedActions:
  - internal-evaluation
  - hosted-inference
  - fine-tuning
prohibitedActions:
  - public-weight-redistribution
  - output-training
controls:
  outputTrainingDataset: blocked
  artifactExport: approval-required
  tenantAuthorization: required
review:
  status: approved-with-conditions
  owner: ai-governance
  approvedBy: legal-review-ticket-1842
  expiresOn: 2026-11-23
  recheckOn:
    - revision-change
    - terms-change
    - lineage-change
    - use-case-change
    - distribution-change

The example values are placeholders, not permission advice. In production, use an internal LicenseRef-* identifier for custom terms and preserve the actual text rather than forcing it into an inaccurate SPDX ID.

Add Deterministic Release Gates

Automation should prove evidence completeness and enforce already approved policy. It must not infer legal permission from a model name.

typescript 
type Manifest = {
  artifact: { id: string; revision: string; sha256: string };
  terms: { licenseId: string; licenseSnapshot: string; licenseSha256: string };
  intendedActions: string[];
  prohibitedActions: string[];
  review: {
    status: "pending" | "approved" | "approved-with-conditions" | "rejected";
    approvedBy?: string;
    expiresOn: string;
  };
};

export function assertReleaseAllowed(
  manifest: Manifest,
  requestedAction: string,
  now = new Date(),
): void {
  const required = [
    manifest.artifact.revision,
    manifest.artifact.sha256,
    manifest.terms.licenseSnapshot,
    manifest.terms.licenseSha256,
  ];

  if (required.some((value) => !value.trim())) {
    throw new Error("License evidence is incomplete");
  }
  if (!manifest.intendedActions.includes(requestedAction)) {
    throw new Error(`Action is outside reviewed scope: ${requestedAction}`);
  }
  if (manifest.prohibitedActions.includes(requestedAction)) {
    throw new Error(`Action is prohibited: ${requestedAction}`);
  }
  if (!manifest.review.status.startsWith("approved")) {
    throw new Error("Human approval is missing");
  }
  if (!manifest.review.approvedBy) {
    throw new Error("Approval evidence is missing");
  }
  if (now >= new Date(`${manifest.review.expiresOn}T00:00:00Z`)) {
    throw new Error("License review has expired");
  }
}

Expected behavior:

text 
missing snapshot/hash       -> block
unreviewed action           -> block
explicitly prohibited action -> block
pending or expired review   -> block
approved in-scope action    -> continue to other release gates

The final line is deliberately not “legally compliant.” It only means this gate found valid evidence for a previously approved action. Security, quality, privacy, export, and product-regulation gates remain separate.

Handle EU AI Act Duties Separately

A license review and an EU AI Act assessment answer different questions.

According to the European Commission’s GPAI provider guidance, provider obligations began applying on 2 August 2025, Commission enforcement powers began applying on 2 August 2026, and providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

The guidance describes a limited exemption for qualifying free and open-source GPAI providers. Under stated conditions, it can exempt technical documentation for authorities, downstream-provider documentation, and appointment of an EU representative. It does not remove the copyright-policy or training-content-summary duties, and it does not apply to GPAI models with systemic risk.

Do not translate this into “Apache license equals EU exemption.” The assessment also depends on:

  • whether the artifact is a GPAI model;
  • which entity is the provider;
  • whether and how it is placed on the Union market;
  • whether the release satisfies the regulation’s open-source conditions;
  • whether the model has systemic risk;
  • whether a modification makes another actor a provider;
  • which separate obligations apply to the downstream AI system and deployer.

The Commission’s guidance is not legally binding; authoritative interpretation belongs to the Court of Justice of the European Union. Use the current consolidated Regulation (EU) 2024/1689 and obtain current legal advice.

For system-level controls, continue with the EU AI Act technical compliance guide and the developer safety checklist.

Operate the Model After Approval

License compliance is a continuing release property.

Re-review triggers

Automatically invalidate or pause approval when:

  • model, adapter, tokenizer, container, or dataset revision changes;
  • a license, policy, or hosted API term changes;
  • the product moves from internal use to external service or distribution;
  • outputs begin feeding evaluation, analytics, or training pipelines;
  • ownership, affiliate scope, geography, user scale, or revenue basis changes;
  • a new model merge, conversion, quantization, or distillation is introduced.

Runtime controls

Connect clauses to systems:

  • Keep outputs from restricted sources out of training datasets.
  • Require approval before exporting weights, adapters, or images.
  • Attach license and provenance metadata to artifacts in the model registry.
  • Preserve required notices in downloadable packages and containers.
  • Enforce acceptable-use and authorization policy outside the model.
  • Log decisions by stable artifact ID, action, policy revision, and approval reference.

Incident response

If lineage or permission becomes uncertain:

  1. Stop new deployments and redistribution.
  2. Quarantine affected outputs and derived datasets.
  3. Identify releases and customers by artifact digest.
  4. Preserve terms and decision evidence.
  5. Escalate to legal and security owners.
  6. Remediate, replace, obtain permission, or withdraw the artifact.
  7. Add the failure mode to release tests.

Frequently Asked Questions

Is an Apache 2.0 model automatically Open Source AI?

No. Apache 2.0 can provide qualifying terms for the artifact it covers, but OSAID 1.0 also examines the preferred form for modification, including data information, training and runtime code, and parameters. Verify the complete release, not only the weight-file license tag.

Does self-hosting avoid license obligations?

Self-hosting changes data flow and may avoid a hosted provider’s API terms, but the downloaded artifact’s terms still apply. Internal use, external service, and redistribution can trigger different conditions, and privacy, export, security, and product law remain relevant.

Can a model card override the LICENSE file?

Do not assume so. A model card may summarize or incorporate terms, but conflicts require review of the license, incorporated policies, repository revision, and publisher authority. Block release until the controlling evidence is resolved.

Can a CI scanner decide whether a model is commercially safe?

No. It can verify hashes, evidence, approved actions, expiry, notices, and explicit policy rules. It cannot determine copyrightability, derivative-work status, patent clearance, contract interpretation, or regulatory role from metadata alone.

Should teams always choose MIT or Apache 2.0 models?

No. Those licenses can reduce licensing friction, but model quality, safety, data rights, patent exposure, support, privacy, export controls, and sector regulation remain. Choose the release whose complete risk and capability profile meets the workload.

Summary

Treat AI licensing as a supply-chain and release-control problem. Pin the exact artifact, map code, weights, data, outputs, derivatives, and service terms, then evaluate each intended action against archived evidence. Use automation to block incomplete or out-of-scope releases, preserve human approval for interpretation, and assess EU AI Act and other regulations independently from the license label.