Open-source AI licences explained: Apache 2.0, MIT, Llama-style and 'open-weight' terms, and what each lets you do

"Open source" on a model announcement can mean four different things, and the difference decides whether you can ship a product, fine-tune on customer data, or redistribute what you built. The weights are not code, so the licence attached to them does the work that a source licence does for software, and sometimes less.

The four tiers you will actually meet

Permissive, OSI-approved licences (Apache 2.0, MIT). You may use, modify, fine-tune, sell and redistribute, for any purpose, with attribution. Apache 2.0 adds an explicit patent grant: the licensor promises not to sue you for patents that the model practises, and the grant terminates only if you sue them first. MIT is shorter and has no patent language. Thinking Machines' Inkling 2 Small (Apache 2.0) and Meituan's LongCat-2.5 (MIT) sit here. For a lawyer this is the easy tier; the only homework is checking that the licence file is actually in the repository, which Inkling's was not on day one.

Community or "open-weight" licences with use restrictions. Meta's Llama licences are the model: free for most uses, but with an acceptable-use policy, an attribution requirement, and historically a clause that very large companies need a separate deal. These are not open source by the Open Source Initiative's definition because they discriminate between users. They are fine for most businesses and a problem for anyone who needs to redistribute without conditions.

Research or non-commercial licences. Weights you can download and study but not deploy in a product. Common for early-stage releases and academic models. Useful for evaluation, useless for a roadmap.

Open-weight but closed training. Many models in the first two tiers publish weights without data or training code. You can run and fine-tune but not reproduce. This matters for audits: if a regulator asks what the model was trained on, the licence gives you no right to find out.

What the patent grant is for

Apache 2.0's patent clause is the reason enterprises prefer it over MIT for anything they will embed. Model architectures, training tricks and inference methods are patentable, and a lab that publishes weights under MIT has made no promise about its patents. Under Apache 2.0 it has. For a 594-billion-parameter model that will sit inside your product for years, that promise is worth more than the shorter licence text.

Three questions before you build

First, can you redistribute a fine-tuned derivative, and under what name? Permissive licences say yes; community licences often require their own licence to travel with it and forbid using the lab's name. Second, what does the acceptable-use policy forbid, and does your use case touch it? Health, legal, and security products hit these clauses most often. Third, what are you actually getting: weights only, or weights plus training code and data? The licence can be perfect and the artefact still unauditable.

The licence is not the cost

The AntiFox case this week shows the other side of permissive terms: an openly licensed agentic pentest framework was forked and used to attack cloud accounts, and nothing in the licence could stop it. Open licences remove legal friction, not operational risk. And open weights are not free to run: Inkling 2 Small needs about 500 GB of GPU memory and, as of this week, a development build of the serving software. Budget for the engineers before you celebrate the licence.