“Open source” on a model card feels like a green light: if it’s open, the licence settles everything. But most of those models are open-weight, parameters you can download while the training data and recipe stay closed. The label can overstate what the licence grants.
That gap is where the residual risk sits. Here’s the distinction, what Meta’s Apache 2.0 move changes, and how to log the leftover risk. Not legal advice, just the pre-counsel reading list.
What does “open weights” actually mean, and how is it different from true open source?
Open weights means the published parameters are downloadable. You can run, fine-tune and build on the model, which buys self-hosting and the ability to inspect the weights, but not the ability to audit how the model was built.
True open source adds code, training-data information and a reproducible recipe, the bar the OSI’s Open Source AI Definition sets. Llama, pre-4 Gemma and Mistral‘s research releases are open-weight.
Self-hosting keeps your prompts and customer data inside your perimeter, and a forkable checkpoint keeps working if the vendor changes terms.
What does the OSI’s Open Source AI Definition (OSAID 1.0) actually require, and where do open-weight models fall short?
OSAID 1.0, published by the Open Source Initiative in 2024, makes “open source” a testable bar. It requires the four freedoms (use, study, modify, share) plus “data information”: enough detail on provenance, processing and licensing to substantially recreate the model. It does not require shipping the raw dataset, and the OSI does not certify individual models.
That’s why a model can be Apache 2.0 licensed yet not open source. Llama, DeepSeek and most Qwen variants withhold training detail; OLMo with Dolma, IBM Granite and Pythia ship the recipe, not just the dish. That gap is what makes Meta’s licence change worth reading.
Why did Meta switch from the Llama Community License to Apache 2.0, and what restrictions were removed?
The Llama Community License carried three restrictions Apache 2.0 drops: a 700 million monthly active user threshold, a ban on competing with Meta’s core products, and a rule against using Llama outputs or fine-tunes to train other models. Crossing that MAU threshold turned a conditional grant into a negotiation on Meta’s terms.
Apache 2.0 removes those frictions; the full grant is below.
Muse Glimmer is the case to watch: Meta released it under Apache 2.0, more permissive than any earlier Llama licence. The release opens the weights while the training recipe stays closed — the gap at the centre of Meta’s open source push.
The motive is commercial. The read is that Meta’s ad business does not depend on selling licences and wins when cheap models feed its compute and cloud offerings. That is the open-source manifesto in practice.
What does an Apache 2.0 licence actually let you do with model weights, and why does the patent grant matter?
Apache 2.0 grants a royalty-free licence to use, reproduce, modify, distribute and sublicense the weights. You can fine-tune on proprietary data and deploy the result closed; the only conditions are preserving notices, indicating changes and including any NOTICE file. It does not require sharing your fine-tunes or capping your users.
The part that matters is the explicit patent grant and its termination clause. MIT is silent on patents, leaving a theoretical exposure around patent-encumbered methods; RedMonk notes Apache has become the commercial preference for that reason. Apache 2.0 is broad, yet it still carries no warranty, indemnity or trademark rights.
How should you weigh Apache 2.0 against Llama, Gemma and NVIDIA licence risks before choosing a model?
That’s why the comparison should run licence by licence rather than model by model. The decision is a standard permissive licence versus vendor-authored custom terms. Apache 2.0 is the benchmark: immutable terms, no use restrictions, no flow-down obligations and a patent grant. Custom licences are contracts with updatable terms, use restrictions and termination rights.
Across the axes that matter (commercial use, redistribution, modification, use restrictions, termination risk, indemnity and vendor dependence), Apache 2.0 imposes the fewest restrictions and no unilateral termination. Llama keeps the 700M MAU cap and competitor clause. Gemma’s older terms carried a prohibited-use policy with flow-down obligations and updatable terms; Gemma 4 moved to Apache 2.0. NVIDIA permits commercial use on any hardware but keeps an acceptable-use policy, bans training competing models, and offers no patent grant.
Apache 2.0 clears the adoption friction around usage restrictions; the training-data provenance problem remains. An audit found 76% of open models trained on incompatible or more restrictive data than their own licence, and 25% of datasets had no recorded licence.
How should you incorporate model licence terms into your vendor risk register and investor disclosures?
A vendor risk register should capture each model’s licence class, restriction triggers, change-of-terms and termination rights, and flow-down obligations. A per-model software bill of materials covers the training datasets, licence status, verification date and legal review. Material open-weight dependencies belong in investor and M&A disclosures where they affect your business’s product or IP position.
Updatable terms need monitoring rather than a one-off review: a model can be compliant today and noncompliant tomorrow if a dataset’s terms change. That’s the dependency you fold into a trust and TCO evaluation, and it’s the territory the NIST AI Risk Management Framework covers.
Openness is a stack of separable grants. Parameters, code, data, recipe, patent grant and terms each grant different things, and the label rarely says which are missing. Apache 2.0 clears the legal layer and leaves the provenance layer open — one corner of the complete model and cloud picture.
The more useful question is “which residual risks remain, and have I logged them?” Treat “open source” as a claim to verify, a licence as one axis of residual risk, and deploy after that risk is documented.
Frequently Asked Questions
Is a model released under Apache 2.0 automatically open source?
No. Apache 2.0 clears the legal layer but says nothing about training data and build recipe, which the OSI’s OSAID 1.0 requires for true open source. A model can be fully Apache 2.0 licensed yet still closed in the ways that matter, because its weights are downloadable while its datasets and process stay undisclosed. Check the licence and the data disclosure separately.
Does Apache 2.0 mean the training data is legally safe to use?
No. Apache 2.0 licenses the weights and code, not the underlying training data, and it offers no warranty against copyright or provenance claims. If a model was trained on unlicensed or incompatible data, the Apache grant does not protect you. Data provenance remains a separate due-diligence step you log before production.
Do I have to open-source my fine-tuned version of an Apache 2.0 model?
No. Apache 2.0 is a permissive licence, not copyleft, so you can fine-tune a model, keep your modifications private and deploy them commercially. You must preserve the original notices, state that changes were made, and include the licence and any NOTICE file with your distribution, but your own derivative can stay closed.
What happens if my product crosses Llama’s 700M monthly active users threshold?
Under versions of the Llama Community License that carry the 700M monthly-active-user threshold, crossing it means the basic grant no longer applies and you must seek a separate commercial licence from Meta. Treat it as a scale-triggered contingency: if growth could realistically breach the cap, log it in your risk register before launch.
Can I use open-weight models commercially?
Usually, but the terms vary by model. Most open-weight releases permit commercial use, self-hosting and fine-tuning, yet custom licences can attach conditions such as Llama’s MAU threshold, Gemma’s prohibited-use policy and flow-down obligations, or NVIDIA’s acceptable-use policy. Read the specific licence rather than assuming “open” means unrestricted commercial use.
Does Apache 2.0 include a warranty or indemnity?
No. Apache 2.0 provides the software “as is”, with no warranty and no indemnity, so the model provider accepts no liability if the model fails or infringes someone’s rights. For production or procurement, that shifts responsibility onto you: assess your own legal exposure, consider internal policy or insurance, and document the gap in due diligence.
What is the difference between Apache 2.0 and MIT for model weights?
Both are permissive and allow commercial use and modification, but Apache 2.0 adds an explicit patent grant and a patent-termination clause, while MIT stays silent on patents. That makes Apache 2.0 the stronger default in patent-sensitive deployments because it converts derivative work on the weights from legally ambiguous to covered. Neither offers warranty or indemnity.
Can I use the Meta name or logo when I redistribute a model?
No. Apache 2.0 does not grant trademark rights, so you can redistribute the weights and code, but you cannot use Meta’s name, logos or branding to imply endorsement or to name your own product. Choose an original name and keep branding separate from the underlying model, even when the licence itself is permissive.
What is openwashing, and how do I spot it?
Openwashing is marketing a model as “open source” when only the weights are downloadable and the training data, code or recipe stays closed. Spot it by running the two-question test: can you download and inspect the weights, and could a skilled team substantially recreate the system from the release? If the second answer is no, it is open-weight, not open source.
Does the OSI certify individual models as open source?
No. The Open Source Initiative publishes the OSAID 1.0 definition but does not certify individual models against it. That means a vendor calling a model “open source” is making a claim, not pointing to an OSI stamp. Evaluate the release yourself against the four freedoms and the training-data information requirement before relying on the label.
What does the EU AI Act’s “free and open source” carve-out change for me?
The EU AI Act eases some obligations for systems released under free and open source licences, but the carve-out has conditions and does not automatically apply to every open-weight model. Because OSAID 1.0 raises the bar for what counts as genuinely open, check whether your chosen model qualifies and document that assessment as part of compliance.
Can I train a competing model using outputs from an Apache 2.0 model?
Yes, in most cases. Apache 2.0 removes the output-use restrictions that earlier Llama terms imposed, so you are not blocked from using outputs to improve or distil another model, subject to preserving notices where the licence applies to the distributed code or weights. Confirm the exact wording of the release you are using, since older custom licences differed.
