Before an open-weight model reaches production, read the licence for the exact checkpoint you will run and check five things: commercial limits, the acceptable use policy, rules on outputs, naming and attribution for anything you build on it, and whether the terms can change. Downloadable weights do not mean the model is open source.
Why open weights need a licence review
Teams often choose an open-weight model for control: to run an AI agent on a model you host yourself, keep data in a chosen region or fine-tune for a domain. The engineering case is usually sound. The legal case is often assumed.
Model licences are not standard software licences. Some releases use permissive terms such as Apache 2.0. Others use a custom community licence written by the model's publisher, with conditions that a general open source policy will not catch. Analysts reviewing these licences in 2026, including Cooley's guide for enterprises deploying open-weight models, point out that terms vary between publishers and can even differ between checkpoints in the same model family. A label on a model hub is a hint, not a licence.
Five things to check in every model licence
Commercial use and scale limits
Some licences allow commercial use only below a usage threshold, only for certain kinds of organisation, or not at all without a separate agreement. Check whether your product, your customers' use and your expected growth all stay inside the grant. If a threshold applies, record who will watch it.
The acceptable use policy
Many custom licences attach an acceptable use policy that lists banned uses, and some let the publisher update that policy over time. Map your use cases against it, including what your AI agents can do with tools, not just what the model writes. A use that is fine in a chatbot can become a problem once an agent acts on systems.
Rules on outputs and training other models
Some licences restrict using the model's outputs to train or improve another model. If your team plans to distil a smaller model, generate synthetic training data or evaluate competitors with the outputs, check this clause first.
Naming, attribution and derivatives
Fine-tuned versions are usually treated as derivatives. Some licences require a notice in your product, specific wording in documentation or a model name that credits the original. Agree how fine-tuned checkpoints will be named and where the required notices will live before the first release.
Changes, termination and jurisdiction
Read how the licence can end, which law governs it, and whether any regions or entity types are excluded. A licence that terminates on breach makes your compliance record part of your uptime.
Make the review part of model governance
Treat each model checkpoint like any other third-party dependency with conditions. Record the model name, version, source, licence text and the date you reviewed it alongside your inventory of agents, as described in keeping track of every AI agent your company runs. Store a copy of the licence text you accepted, since hosted pages can change.
Add the check to the same gates you use for model changes. When a team swaps models, upgrades a checkpoint or plans for what happens when a model is deprecated, the licence review runs again. Hosting the model through a cloud marketplace does not replace this review; the publisher's terms still apply alongside the provider's.
Finally, give engineers a short decision path: permissive licence and no flags, proceed; custom licence or any flag above, legal review before production. Most of the effort sits in the first review of each model family, after which the record makes later upgrades quick to assess.
If you are choosing models for an agent that will run on your own infrastructure, talk to CodeDTX about building the licence review into your delivery process.
Frequently asked questions
Is an open-weight model the same as an open source model?
No. Open weights means you can download and run the trained parameters. Open source usually also implies freedom to use, study, modify and share without field-of-use restrictions, often with training code and data details. Many open-weight releases carry custom licences with usage limits or acceptable use policies, so check the actual terms rather than relying on how the release is described.
Do licence terms still apply if we only use the model internally?
Usually, yes. Internal use avoids some distribution clauses, but acceptable use policies, commercial limits and restrictions on using outputs to train other models typically apply to any use. An internal AI agent that acts on customer data or business systems is still a commercial use for most licences, so review it the same way as a customer-facing product.
Does fine-tuning change which licence applies?
Fine-tuning normally creates a derivative that stays under the original model's licence, plus any conditions you add. Your training data does not remove the publisher's terms. Check whether the licence asks for notices, naming conventions or the same restrictions to pass on to anyone who receives the fine-tuned model, and record those duties with the checkpoint in your model inventory.
Who should own open-weight model licence reviews?
Engineering should own the inventory and flag new models, versions and use cases, because they see changes first. Legal or procurement should own the reading of custom licences and decide on anything flagged. Agree a simple rule for which licences need legal review, and make the check a gate in model change approval so a new checkpoint cannot reach production without a recorded decision.
