Licenses decoded: Apache-2.0, MIT, Llama and custom terms

0:00 Licenses decoded

Picture this. Your team spends six weeks building on the model that topped your benchmark. Launch review arrives, legal reads the license, and the answer is no. Six weeks gone. It happens more than you would think. In this lesson you will learn to read model licenses like a practitioner, know which families use which terms right now, and keep a simple register so this never catches you out. One note first: this is practical guidance, not legal advice.

0:34 Analogy: a shop lease

Think of a model license like a lease on a shop. Some leases say: use it for anything, just keep the landlord's sign on the wall. That is roughly Apache or MIT. Others say: you can run your business here, but you must display our brand at the entrance, name your shop after us, follow our house rules, and if you become enormous you need to renegotiate. That is closer to a community license like Llama's. Neither lease is bad. But you would never sign a lease without reading it, and you should never ship a model without reading its license.

1:18 Permissive licenses

Start with the permissive two. Apache 2.0 lets you use, modify and distribute, including commercially. You keep the copyright and license notices, mark significant changes, and pass on any NOTICE file. It also includes an explicit patent grant from contributors. MIT is even shorter: keep the notice, and do almost anything, but there is no explicit patent clause. Right now, gpt-oss, Gemma 4, the Mistral 3 family and most Qwen three and three point five open weights use Apache 2.0. DeepSeek and Microsoft's Phi-4 family use MIT. Always confirm on the specific model card.

1:59 Llama 4 Community License

Now Meta's Llama 4 Community License. It is free for most commercial use, with conditions. If your products had more than seven hundred million monthly active users on the release date, you need a separate license from Meta. You must show "Built with Llama", and derivative model names must start with the word Llama. And you must follow the Acceptable Use Policy, which says that for the multimodal Llama 4 models, rights are not granted to individuals or companies based in the European Union, though end users of a product built on them are not covered by that restriction.

2:42 The release, not the brand

Here is the trap. Licenses belong to a specific release, not to a brand. Earlier Gemma versions used Google's own terms, and Gemma 4 moved to Apache. Some older Qwen sizes used Alibaba's own licenses. And when someone uploads a quantized copy of a model, it inherits the original license. They cannot relabel it. So "we use Qwen" is not an answer to a license question. "We use this exact model file, under this license text" is.

3:15 Three more checks

Three more checks beyond the weights. First, outputs: some terms restrict using a model's outputs to train competing models, which matters if you plan to distil. Second, provenance: download from the publisher or a trusted mirror, and make sure the license file is included. Third, regulation: data protection law and rules like the EU AI Act apply to your use case, whatever the license says. Apache does not make an unlawful use lawful.

3:47 Worked example: Lahore SaaS

Let's triage a real-style case. A Lahore start-up sells a WhatsApp support assistant to retailers across Pakistan and the Gulf, and plans to sign an Irish customer next year. They shortlist a Llama 4 model, a Qwen three point five model and gpt-oss twenty B. They are nowhere near seven hundred million users, but Llama would require attribution in their product, and their legal team wants zero ambiguity for future EU customers. So they shortlist the two Apache models and keep Llama only as a benchmark reference.

4:25 Hands-on: model register

Your hands-on tool is a model register: one small YAML file per model you deploy. It records the exact model, the source, the license, extra policies, attribution and naming rules, geographic limits, whether outputs can train other models, who reviewed it and when to review again. The template is in the lesson. It takes ten minutes to fill in and it turns license review from a memory test into a checklist.

4:56 Simple example: internal summarizer

Here is a simple example. A developer in Manchester builds an internal meeting-notes summarizer for her own ten-person company using gpt-oss twenty B. The license is Apache 2.0. Her obligations are light: keep the license and notice files if she ever redistributes the weights, and follow OpenAI's usage policy. She is not redistributing anything, she is running it internally. So her register entry takes five minutes, and the answer is a clear yes. Simple cases should be simple. The register just proves you checked.

5:33 Pitfalls

A few pitfalls I see again and again. Teams assume a family has one license, then upgrade to a new release with different terms without anyone noticing. Engineers download a quantized copy from a stranger's repository where the license file is simply missing. Designers forget the attribution line in the product interface and the documentation. And people read Apache 2.0 as permission to ignore responsible-use policies and the law. The fix for all four is the same: make the register entry a required gate before any model reaches staging, and re-check it on every upgrade.

6:14 Try this now

Try this now. Pick one model you are curious about, open its model card, and find three things: the exact license name, whether there is a separate acceptable use or usage policy, and whether there are any attribution or naming rules. Write them into the YAML template from the lesson. If you cannot find one of them within five minutes, that itself is a finding. Flag it for review before anyone builds on that model.

6:47 Watch me do it

Watch me do it. I will fill in a register entry for a model from scratch. I open the model's page and scroll to the license section. It says Apache 2.0, so I type that in. Next I search the page for the words usage policy and find a link to the publisher's policy; I paste the link into additional policies. Then I check for attribution rules: Apache asks me to keep the license and notice files if I redistribute, so I note that. Naming rules: none. Geographic restrictions: I search for European Union and region, and find nothing, so I write none found, re-check on upgrade. Finally, I note how we will use it: internal only, a quantized copy built from the official weights. I add the reviewer and a review date six months out. Seven fields, eight minutes, and the next person who asks can we use this gets an answer immediately.

7:54 Recap

To recap. Check licenses before benchmarks. Apache and MIT are permissive but still carry notices and sometimes usage policies. Llama's community license adds a user threshold, branding and naming rules, and an acceptable use policy with an EU limit on multimodal models. Licenses belong to releases, and quantized copies inherit them. Your next step: fill in a register entry for one model you are considering, and link the license text itself.