A guide to open-model licenses.
“Open” does not mean “free for any use”. Before putting a model in a paid service, a hospital or a public body, you must read the license. Here is how we classify them.
Five buckets, from green to red.
Category, examples, what you can do.
DeepSeek V4, GLM-5.2, Qwen3.5, Mistral Large 3 and Ministral 3, gpt-oss, Gemma 4, Granite, Velvet, Minerva, Omnilingual ASR, MADLAD-400, Sunflower, TerraMind and Prithvi
commercial use, modification, on-site installation
Llama (user threshold and use policy), N-ATLaS (license beyond 1,000 users per month), Liquid AI LFM (free under $10 M revenue), Kimi K3 and GLM-5.3 (own terms)
commercial within the limits; read the terms
MedGemma, MedASR, TxGemma (HAI-DEF terms)
research and products, but clinical use only after authorization as a medical device
NLLB-200, MMS, Seamless, InkubaLM, the Aya family, UNI, CONCH, Virchow, Aurora
no commercial use without a separate agreement
Llama 4
the license places limits on entities based in the EU
The license of the wrapper too.
The model is one thing; the interface around it is another.
The software around the model has its own license too. Open WebUI, for example, beyond 50 users imposes its own brand; LibreChat and AnythingLLM (MIT) do not.
The AI Act in brief.
Who is responsible, and when the obligations start.
Obligations on general-purpose models remain with the model providers. Whoever sells an AI system under their own brand becomes its provider; for high-risk uses (access to care, public services, education) obligations apply from 2 December 2027. The obligation to tell the user they are talking to an AI applies from 2 August 2026. With the Digital Omnibus, in force from 27 July 2026, the staff literacy obligation (art. 4) became “adopt measures to support it”.
This page is for informational purposes and does not constitute legal advice.