Open LLMs can be used in a commercial product only if the license for that specific model version allows it, not the “family” as a whole. As of October 21, 2026, Qwen3-8B, gpt-oss, and Gemma 4 are distributed under Apache 2.0, DeepSeek-R1 and the DeepSeek V4 line under MIT, Llama under Meta’s proprietary license with a 700 million-user threshold, and YandexGPT-5-Lite-8B has a threshold of 10 million output tokens per month. There are also models for research use only.
Prepared by AIrassvet October 21, 2026 for executives, CIOs, and in-house counsel at companies planning to deploy open language models on their own servers or in their product. The answers are based on license texts from the repositories of Meta, Alibaba Cloud, Google, Mistral AI, DeepSeek, Yandex, and model cards on Hugging Face, as well as the Civil Code of the Russian Federation. We did not prepare our own legal opinions: this is not legal advice, make the final decision with your lawyer.
Contents
- In Brief
- What this article covers and does not cover
- Questions about licensing basics
- Questions about specific models
- Questions about fine-tuning, derivatives, and model outputs
- Questions about risks and review
- Licenses for popular open models: summary table
- Source documents and verification method
In Brief
- The license is set separately for each model. Qwen3-8B — Apache 2.0, Qwen2.5-72B-Instruct — Qwen License with a threshold, Qwen2.5-3B-Instruct — noncommercial use only.
- “Open weights” is not the same as open source. The OSI Open Source AI 1.0 definition also requires information about the training data and code.
- Thresholds are more common than you might think: 700 million monthly active users for Llama, 100 million for Qwen License, and 10 million output tokens per month for YandexGPT-5-Lite-8B.
- The terms move with the model. Attribution, acceptable-use policies, and naming rules apply to fine-tuned versions and sometimes to models trained on outputs.
- Check the LICENSE file in the repository for the specific version and keep a dated copy.
What this article covers and does not cover
This article covers the licenses for open-weight text language models that a company downloads and runs itself: on its own servers, in the cloud, or inside a product. We do not cover cloud API terms (YandexGPT API, GigaChat API, OpenAI API), dataset licenses, libraries, or image generators, as well as hardware export controls. We discussed how to choose a model and hardware in the local LLM review for 2026.
Terms. *Open weights* — the published parameters of a trained model that can be downloaded. *Permissive license* — a permissive license with minimal conditions, such as Apache 2.0 or MIT. *Derivative model* — a model created through fine-tuning, merging, quantization, or other transformation of the original. *MAU* — the number of monthly active users of a product. *Attribution* — a required statement of authorship and license.
Questions about licensing basics
How is an “open model” different from open source?
An open model usually means only published weights, while open source in the strict sense also includes access to the data and training code. The Open Source Initiative’s Open Source AI 1.0 definition requires detailed information about the data, the full training code, and the parameters under OSI-approved terms. Most popular LLMs publish weights and inference code, but not training data. For business, the label matters less than the specific rights in the license.
Can you use an open LLM in a commercial product for free?
Often yes, but only if the selected version’s license explicitly allows it. Apache 2.0 and MIT permit commercial use without royalties. The Qwen Research License allows use only for noncommercial purposes, and the Mistral AI Research License expressly excludes even internal testing and proof-of-concept work from “research purposes.” So first check the license, then the hardware cost and model quality.
How does Apache 2.0 differ from MIT for business?
Both are permissive, but Apache 2.0 provides more explicit protection against patent claims. Section 3 of Apache 2.0 grants an express patent license that ends if you bring a patent suit over this work. Section 4 requires you to keep the NOTICE file and mark modified files. MIT is shorter: you must keep the copyright notice and license text, and it does not contain an express patent license. Qwen3-8B and gpt-oss are released under Apache 2.0, while DeepSeek-R1 and Phi-4 are under MIT.
What is a license with a threshold, and where does it appear?
This is a license that allows free use up to a certain scale and then requires you to negotiate with the rights holder. Llama 3.1 and Llama 4 require you to request a license from Meta if your company’s products have more than 700 million monthly active users. The Qwen License applies at commercial use and above 100 million MAU. YandexGPT-5-Lite-8B has a much lower threshold: 10 million output tokens per month, after which you must contact Yandex within 30 days.
Questions about specific models
Can Llama be used in a commercial project?
Yes, if you comply with the Llama Community License. When distributing the model or a product that includes it, you must attach the agreement text, prominently display “Built with Llama,” and keep the Notice file. A model created or improved using Llama and made available to others must use the prefix “Llama” in its name. An acceptable-use policy applies, along with the 700 million MAU threshold. License disputes are governed by California law, and access to the weights on Hugging Face is granted after manual approval of the request.
What licenses do Qwen models use?
Qwen’s license depends on the model generation and size. Qwen3-8B is released under Apache 2.0 with no thresholds. Qwen2.5-72B-Instruct is distributed under the Qwen License: commercial use is allowed up to 100 million MAU, and any derivative model you distribute must include the label “Built with Qwen” or “Improved using Qwen.” Qwen2.5-3B-Instruct is released under the Qwen Research License, meaning it is for research and evaluation only. Check the license for each checkpoint separately.
Can Gemma be used in a product?
Yes, but the terms depend on the generation. Google’s Gemma 4 is distributed under Apache 2.0, as stated in the model metadata on Hugging Face. Gemma 1–3 are governed by the Gemma Terms of Use: when distributing, you must include the prohibited-use restrictions from the policy in your user agreement, and Google reserves the right to restrict use it considers a violation, including remotely. Google does not claim rights to the model outputs.
What are the terms for Russian open models — YandexGPT, GigaChat, T-Pro?
The three models have three different regimes. YandexGPT-5-Lite-8B is distributed under Yandex’s own Russian-language agreement: commercial use is allowed, but after 10 million output tokens per month you must contact the company. GigaChat 3.5 from Sber is marked with an MIT license on its Hugging Face model card, while T-pro-it-2.0 from T-Technologies is under Apache 2.0. There was no separate LICENSE file in either repository as of October 21, 2026, so the terms should be confirmed in writing.
Can DeepSeek and Mistral be used commercially?
DeepSeek — yes in most cases. Mistral — it depends on the model. DeepSeek-R1, DeepSeek-V3-0324, and the V4 line are marked with the MIT license. But the original DeepSeek-V3 from December 2024 was distributed under the DeepSeek Model License with restrictions on certain uses. On Mistral’s side, small models such as Mistral Small 3.1 were released under Apache 2.0, while Mistral Large Instruct 2411 is under the MRL research license: commercial use requires a separate license from Mistral AI.
Questions about fine-tuning, derivatives, and model outputs
Can you fine-tune an open model and sell the result?
Usually yes, but the original license terms still apply. The Llama and Qwen License explicitly recognize that derivative models you create belong to you, but attribution, thresholds, and naming requirements still apply to them as well. The DeepSeek Model License and Gemma Terms of Use require you to pass use restrictions through to your users in your contract. Under Apache 2.0 and MIT, it is enough to retain the notices. For more on fine-tuning itself, see our FAQ on fine-tuning LLMs on company data.
Can you train your own model on the outputs of an open LLM?
It depends on the license, and this is where people most often get it wrong. The Gemma Terms of Use treat anything trained by transferring Gemma behavior, including distillation and synthetic data from Gemma, as derivative models. Llama 3.1 allows you to train models on Llama outputs, but any released model must use the prefix “Llama.” The Qwen License requires the label “Built with Qwen.” The Mistral Research License limits use to research and the outputs themselves. Apache 2.0 and MIT do not add separate rules for outputs.
Who owns the text generated by an open model?
Model licenses usually do not transfer copyright in the outputs to you, and they do not claim it for the rights holder either. In the Gemma Terms of Use, Google explicitly says it does not claim ownership of model outputs. Under Russian law, the author of a work is the individual whose creative labor produced it (Article 1257 of the Russian Civil Code), so protection of text without human creative input is legally uncertain. The licenses place responsibility for the content of outputs on the user: the models are provided “as is.”
Questions about risk and compliance checks
Does a foreign model license apply in Russia?
Russian law recognizes contracts entered into by accepting published terms. Article 1286.1 of the Russian Civil Code describes an open license: it is accepted through actions, and for software and databases it applies for the entire term of exclusive rights; if no territory is specified, it applies worldwide. But many licenses choose foreign law: Llama uses California law and California courts. How such terms apply to a Russian company is for a lawyer to determine; this is not legal advice.
What happens if you violate a model license?
The main risk is losing the right to use the model and receiving a claim from the rights holder. The Llama Community License allows Meta to terminate the agreement for a breach, after which the model must be deleted and use must stop. Rights under it also end if you sue Meta for intellectual property infringement. Under Apache 2.0, the patent license terminates if a patent suit is filed. The Gemma Terms of Use and the DeepSeek Model License reserve the right holder’s right to restrict use, including remotely.
How do you check a model license before deployment?
Open the LICENSE file in the repository for the exact version you plan to deploy and save a dated copy. The Hugging Face tag is metadata, not a contract. Check six points: whether commercial use is allowed, whether there are thresholds, what attribution is required, what usage policy applies, what is said about derivative models and outputs, and which law governs. A quantized version from a third-party author inherits the original model’s license — compare it with the source model.
What should you put in an agreement with a contractor about model licenses?
List all models in the specification with their versions, licenses, and links to the license texts. The licensee should be your company, not the contractor’s employee who accepted the terms when downloading. The contractor confirms that the solution complies with the licenses, delivers the NOTICE files, and specifies who monitors the thresholds. Include a replacement model if the terms change. The rest of the points are covered in our AI implementation contract checklist.
Licenses for popular open models: summary table
The table was compiled from LICENSE files and repository metadata on Hugging Face and GitHub, verified on October 21, 2026. Terms change from version to version, so before deployment compare the row with the license text.
| Model | License | Commercial use | What to watch for |
|---|---|---|---|
| Qwen3-8B | Apache 2.0 | Yes | Keep the notices and license text |
| Qwen2.5-72B-Instruct | Qwen License | Yes, up to 100 million MAU | “Built with Qwen” for distributed derivatives |
| Qwen2.5-3B-Instruct | Qwen Research License | No | Research and evaluation only |
| Llama 3.1, Llama 4 | Llama Community License | Yes, up to 700 million MAU | “Built with Llama,” the “Llama” prefix, usage policy, California law |
| Gemma 4 | Apache 2.0 | Yes | Keep the notices |
| Gemma 1–3 | Gemma Terms of Use | Yes | Prohibited-use policy, distillation is treated as derivative |
| gpt-oss-20b, gpt-oss-120b | Apache 2.0 | Yes | OpenAI usage policy |
| DeepSeek-R1, DeepSeek V4 | MIT | Yes | Keep the notice and license text |
| DeepSeek-V3 (December 2024) | DeepSeek Model License | Yes, with restrictions | The prohibitions in Appendix A must be passed on to users |
| Mistral Small 3.1 | Apache 2.0 | Yes | Keep the notices |
| Mistral Large Instruct 2411 | Mistral AI Research License | No | A separate license is required for business use |
| YandexGPT-5-Lite-8B | Yandex agreement | Yes, up to 10 million output tokens per month | After the threshold, contact Yandex within 30 days |
| GigaChat 3.5 | MIT (model card metadata) | Yes | LICENSE file not found in the repository |
| T-pro-it-2.0 | Apache 2.0 (card metadata) | Yes | LICENSE file not found in the repository |
How to interpret the YandexGPT-5-Lite-8B threshold. 10 million output tokens per month is about 333,000 tokens per day on average in a 30-day month (AIrassvet calculation). For an internal assistant for a hundred employees or a chatbot with noticeable traffic, that volume is realistic, so the threshold should be built into monitoring from day one.
Primary sources and verification method
We downloaded the license texts and repository metadata on October 21, 2026, and cross-checked each answer against the primary source:
- Llama 3.1 Community License and Llama 4 Community License — Meta.
- Qwen License, Qwen Research License and Qwen3-8B model card — Alibaba Cloud.
- Gemma Terms of Use and Gemma 4 license — Google.
- Mistral AI Research License and Mistral Small 3.1 model card.
- DeepSeek Model License, model cards DeepSeek-R1 and DeepSeek-V4.1-Flash.
- YandexGPT-5-Lite-8B license, model cards GigaChat 3.5, T-pro-it-2.0 and gpt-oss-120b.
- Apache License 2.0 and Open Source AI Definition 1.0.
- Russian Civil Code, Article 1257 and Article 1286.1.
Limitations: we did not verify the terms for every quantized copy, we cite acceptable use policies using the links from the licenses, and we did not assess whether foreign law applies to Russian companies — that is a lawyer's job.
How AIrassvet helps you launch an open LLM without licensing surprises
The license is easiest to account for before choosing a model, not after launch. On the AIrassvet website the following services are listed to cover this task:
- LLM implementation and fine-tuning, including deployment on the customer's servers: selecting a model that fits both the quality requirements and the license terms;
- RAG systems built on company knowledge bases — when instead of fine-tuning, it is enough to connect documents and avoid creating a derivative model;
- process audit, testing, and rollout: checking candidates against your tasks and recording model versions and their licenses in the project documentation.
The first step is to choose one process that needs its own model and document the current result, data sources, processing constraints, and acceptance criteria.
Bottom line: license first, model second
Open LLMs give businesses control over data and costs, but not all models are equally open. Apache 2.0 and MIT place almost no restrictions on commercial use, proprietary licenses from Meta, Alibaba Cloud, Google, and Yandex add thresholds, attribution, and rules for derivatives, and research licenses fully block commercial use.
That is why you should start with a register: model, version, license, verification date, thresholds, and owner. Add this register to your contract with the contractor and review it every time the model is updated. Then model selection remains a technical decision, not a legal risk.
