Direct answer: “Open source” is not enough to decide commercial use. Separate the code, model weights, and training data/outputs; read the LICENSE, model card and acceptable-use terms. Apache/MIT usually allow commercial use, while custom community licences may impose user-scale, attribution, redistribution or use-case limits.
This report is for enterprise AI, IT, legal, procurement and product teams evaluating commercial use, private deployment, fine-tuning, distillation, quantization and redistribution of open models/code. Information is current to 2026-10-29. It is not legal advice and does not guarantee that any model/code is commercially usable; the licence, model card, contract and counsel govern.
Treat code, weights and data/outputs separately; Apache/MIT still require licence/NOTICE; read the model card and acceptable-use policy for custom licences—not just the words “commercial use”.
Are code, model weights and licences the same thing?
Code, model weights, training data and outputs may each have different licences; a README saying “open source” does not mean the weights are commercially usable—find the LICENSE, model card and acceptable-use terms.
A model repository may contain inference code (Apache/MIT), weights (custom community licence), training data (another licence) and example outputs. A code licence does not automatically cover weights; a weight licence does not automatically cover training data or trademarks. Procurement/legal should separate “what is used, how, and by whom” rather than relying on the GitHub “open source” label.
| Object | Possible licence | What to confirm | Common mistake |
|---|---|---|---|
| Inference/training code | Apache 2.0, MIT, GPL, etc. | Commercial use, modification, distribution, patents | Code licence covers weights |
| Model weights | Custom community/open-weight licence | Commercial use, user scale, redistribution | “Open source” means free commercial use |
| Training data | Data licence/contract/public terms | Source, authorisation, personal data | Model licence covers data |
| Outputs | Platform terms/copyright/trademark | Commercial use, attribution, infringement | Output always belongs to user |
| Fine-tuned/distilled weights | Inherited/derivative licence | Whether the original licence applies | Modified means no obligation |
| Quantized/converted weights | May remain derivative | Redistribution/commercial conditions | Format change makes it free |
The three-layer object model is an editorial framework; licence applicability depends on the repository LICENSE, model card, data source and counsel.
Can Apache 2.0 / MIT be used commercially?
They usually allow commercial use, modification and distribution, but require copyright/licence/NOTICE retention, change notices and attention to patent/trademark/warranty terms; a permissive licence does not erase model/data/output limits.
Apache 2.0 and MIT are common permissive licences that usually allow commercial use, modification and redistribution; Apache 2.0 also has a patent grant and NOTICE requirement, while MIT requires retaining the copyright/licence notice. They do not grant trademark rights or warranties; if weights/data have another licence, the code licence does not replace it. Keep the licence text, NOTICE, change record and distribution method.
| Licence | Commercial use | Main obligations | Easily missed |
|---|---|---|---|
| Apache 2.0 | Usually allowed | LICENSE/NOTICE, change notices, patent terms | NOTICE/change record |
| MIT | Usually allowed | Retain copyright/licence notice | No warranty/trademark |
| Custom community licence | Check terms | User scale, acceptable use, attribution, redistribution | Treating “commercial use” as unconditional |
| GPL/AGPL | Depends on distribution | Source/derivative obligations | SaaS/distribution boundary |
| Weight licence | Check terms | Use, scale, redistribution, outputs | Replacing with code licence |
Apache 2.0 text: apache.org; MIT text: opensource.org; applicability depends on the licence and counsel.
What should be checked in Llama/custom community licences?
Check commercial scope, user-scale/MAU, acceptable use, attribution/brand, redistribution, outputs and termination; custom community licences are often not OSI-approved open source—do not rely on “open weights” alone.
For Llama and similar open-weight models, the model card/licence may allow commercial use but attach acceptable-use, user-scale, attribution/brand, redistribution and termination terms. Read the model card, LICENSE and Acceptable Use Policy; confirm your product, customers, region and scale. If the product serves end users or redistributes weights, obligations may be heavier.
| Term | What to confirm | Evidence | Common issue |
|---|---|---|---|
| Commercial scope | Internal/external/SaaS/embedded | Licence/model card | Only “commercial use” |
| User scale | MAU/seats/distribution | Terms/metrics | Exceeding scale |
| Acceptable use | Prohibited uses/industries/content | Policy/review | Ignoring AUP |
| Attribution/brand | “Built with”/trademark/promotion | Terms/page | Missing attribution |
| Redistribution | Weights/derivatives/API/delivery | Terms/contract | Delivering weights to clients |
| Termination | Breach/stop use/deletion | Terms/process | No exit plan |
Llama and similar model cards can reference the Meta Llama 3 model card; licences/policies change—use the official text and counsel.
How do fine-tuning, distillation, quantization and redistribution count?
Fine-tuned, distilled or quantized weights may be derivative works and remain subject to the original licence/model card; redistribution, APIs, embedded delivery and commercial outputs need separate checks—modification does not remove obligations.
Fine-tuned weights, distilled student models and quantized/converted formats may be treated as derivative/redistributed works; whether you must keep the original licence, may close-source, or must attribute/restrict use depends on the terms. Providing an API, delivering private weights, embedding in hardware/software, or using outputs in advertising/medical/financial scenarios have different obligations. Procurement should require the supplier to state “what is delivered, under which licence, who is responsible for compliance”.
| Scenario | Possible trigger | What to confirm | Common issue |
|---|---|---|---|
| Internal use | Commercial/internal policy | User scale/use | Assuming internal is exempt |
| SaaS/API | External service/outputs | Service terms/outputs | Not disclosing model |
| Private delivery | Weight redistribution | Redistribution/licence | Delivery equals compliance |
| Fine-tune/distill | Derivative weights | Inheritance/limits | Renaming/relicensing |
| Quantize/convert | Derivative/redistribution | Format/licence | Format change makes it free |
| Embedded/hardware | Distribution/end users | Licence/notice | No licence included |
Derivative/redistribution analysis depends on the licence text, model card and counsel; this article gives no legal conclusion.
Procurement/deployment acceptance checklist
Collect the licence/model card/NOTICE/source/version, commercial and redistribution terms, user scale/acceptable use, output/data/trademark terms and exit plan; receiving model files is not enough.
Ask the supplier/internal team for: model name/version/source, code/weight/data licences, model card and AUP, NOTICE/attribution, commercial/redistribution/user-scale terms, fine-tune/distill/quantize limits, outputs/trademark/privacy, support/security updates, termination/deletion. Put these into procurement/contract/acceptance records—not only someone's laptop.
| Material | What to confirm | Evidence | Common issue |
|---|---|---|---|
| Licence | Code/weights/data separately | LICENSE/model card | README only |
| Version/source | Model version, download URL, hash | List/checksum | Unknown source |
| Commercial/redistribution | Internal/external/delivery/scale | Terms/contract | Verbal promise |
| Attribution/NOTICE | Brand/copyright/change record | NOTICE/page | Missing attribution |
| Data/outputs | Training data/output/privacy/trademark | Source/policy | Assuming outputs are free |
| Exit | Termination/deletion/replacement | Process/record | Cannot stop using |
The procurement/acceptance list is an editorial suggestion, not legal advice; terms depend on the licence, contract and counsel.
How should the 90 days be sequenced?
Weeks 1–2 inventory models/code/data/delivery, weeks 3–4 read licences/model cards and risk-tier, weeks 5–8 add NOTICE/contracts/alternatives, weeks 9–12 review release/redistribution/exit and archive.
List every model/code/data/delivery scenario, then classify “internal/external/redistribution/derivative”; high-risk cases (custom licences, weight redistribution, medical/financial use) go to counsel first. Weeks 5–8 add LICENSE/NOTICE/attribution/contract/review; weeks 9–12 check product pages, APIs, delivery packages and exit plans. Without a licence/source/commercial conclusion, do not go to production.
| Stage | Action | Evidence | Pause gate |
|---|---|---|---|
| Weeks 0–2 | Model/code/data/delivery inventory | List, source | Unknown source: pause |
| Weeks 3–4 | Licence/model card/AUP, risk tier | Terms/tier | Commercial/redistribution unclear: counsel |
| Weeks 5–8 | NOTICE/attribution/contract/alternative | Files/contract | No licence: do not launch |
| Weeks 9–12 | API/delivery/page/exit review | Test/record | Mismatch: remediate |
The 90-day window is an editorial suggestion, not a legal-approval timeline promise; actual timing depends on the model, delivery and legal process.
Who should read this, who should not, and what decision does it support?
It fits companies using open models for products/private deployment/fine-tuning; it does not fit a “download and use” team, a company without a licence/legal owner, or one redistributing weights without reading terms.
Who should read: enterprise AI/IT/legal/procurement/product teams; companies using open models for SaaS, private deployment, embedded products, fine-tuning/distillation or external delivery; procurement evaluating supplier models/licences. Who should not: closed API-only use with no weights/redistribution; no legal/procurement owner; looking for a “free commercial use” list; expecting this article to replace counsel. Decisions supported: whether commercial use is allowed, whether redistribution/private delivery is allowed, whether fine-tuning/distillation/quantization is restricted, what procurement must collect, and when to pause for counsel.
FAQ
Are Apache 2.0/MIT models always commercially usable?
Usually commercial use is allowed, but retain the licence/NOTICE/copyright, note changes, and confirm the weights/data/outputs have no other licence or restriction; a code licence does not automatically cover weights and data.
Is every “open-source” model free to use?
Not necessarily. “Open source/open weights” is not a legal conclusion; a custom community licence may limit user scale, use, redistribution or require attribution. Read the LICENSE, model card and AUP.
Must a fine-tuned model keep the original licence?
It may be a derivative work; confirm under the original licence/model card. Renaming or relicensing does not automatically remove obligations. Distillation and quantization/conversion may also trigger derivative/redistribution terms.
Can we deliver private weights to a customer?
Check whether the licence allows redistribution, requires the licence/NOTICE, or limits user scale/use. Confirm with legal/the supplier before delivery; an ordinary procurement contract is not enough.
Can model outputs be used commercially?
Check the model/platform terms, whether outputs contain third-party rights and whether the use is high-risk; outputs are not automatically free of copyright/infringement. Confirm under the licence, platform terms and business scenario.
Is the model card enough?
No. A model card is a summary; read the licence/AUP/data/code licence/third-party components together. Model cards can change. Procurement should collect the LICENSE, NOTICE, version/source and written confirmation.
Bottom line
For commercial use of open models, separate code, weights and data/outputs, then read the LICENSE, model card and AUP. Apache/MIT still require licence/NOTICE; custom licences need review of user scale, redistribution, attribution and exit. When unsure, ask counsel.
Method and limits
This article is public licence, model-card and editorial research, not legal advice for any model, code, data, product, delivery or project. It uses no unpublished client contracts, model weights or legal opinions; licence summaries, risk tiers and the 90-day plan are editorial, and applicability must be confirmed under the licence text, model card, contract and counsel. Licences/model cards change; the official text governs.
Sources
Information is current to 2026-10-29; each official/primary page governs its own scope and version.
- Apache License 2.0: apache.org. Commercial use, modification, distribution, NOTICE and patent terms; applicability depends on the text and counsel.
- MIT License: opensource.org. Commercial use, modification, distribution and copyright/licence notice; no warranty/trademark grant.
- Open Source Initiative, Licenses: opensource.org. OSI-approved licence list; custom community licences may not be listed.
- Meta Llama 3 8B model card: huggingface.co. Model-card/licence entry; the official Meta licence and AUP govern.