Open LLM Licenses for Business — Apache, MIT, Llama, Gemma (2026)

The two license families

	Standard open source (Apache 2.0, MIT)	Vendor community licenses (Llama, Gemma)
Commercial use	Yes, unconditionally	Yes, with conditions
Example models	Qwen 3, Mistral Small, GPT-oss, Granite (Apache 2.0); DeepSeek, GLM (MIT)	Llama 3.x / 4 (Llama Community License); Gemma (Gemma Terms of Use)
Acceptable-use policy	None baked into the license	Yes — flows down to your deployment
Attribution	Keep license/notice files (Apache adds a NOTICE requirement)	Yes — e.g. Llama requires "Built with Llama" display for distributed products and llama-prefixed names for derivative models
Patent grant	Apache 2.0: explicit; MIT: no express grant	License-specific terms
Special clauses	None	Llama: companies with >700M monthly active users at release date need a separate Meta license
Legal review effort	Minutes — these licenses are decades-understood	Hours — someone must actually read the AUP and terms

The practical summary most legal teams land on: Apache 2.0 and MIT models are approve-once, the same review as any open-source dependency. Community-licensed models are approve-per-use-case, because the acceptable-use policy is a living document you're agreeing to enforce — and vendors can revise it for future model versions (each model release binds you to the license it shipped with; already-downloaded weights don't retroactively change).

The five questions legal will actually ask

1. "Can we use the outputs commercially, and who owns them?" All the mainstream licenses permit commercial use of outputs. Ownership of outputs is a broader unsettled area of law (AI-generated content and copyright), but nothing in these licenses claims your outputs for the vendor. Llama's license notably permits using its outputs to improve other models in current versions — a restriction earlier drafts were stricter about; check the version you're actually using. 2. "What must we display or keep?" Apache 2.0: retain license and NOTICE files in anything you redistribute — invisible for internal deployments. Llama: products distributed to third parties display "Built with Llama," and fine-tuned derivatives carry "Llama" in their name. A purely internal assistant triggers little of this; an AI feature in your shipped product triggers all of it. 3. "What does the AUP forbid, and can we enforce it on our users?" Community licenses prohibit lists of uses (illegal activity, some regulated domains, deception). For an internal tool with authenticated users this is manageable policy work — your usage policy mirrors the AUP, your gateway logs evidence it. For a customer-facing product, you are effectively flowing Meta's or Google's policy down to your customers; legal will want to see that reflected in your terms of service. 4. "What happens to our fine-tunes?" Under Apache 2.0/MIT: your fine-tuned weights are yours, redistribute or keep private as you wish. Under Llama: derivatives remain governed by the Llama license (naming, AUP, and all), which matters if you ever ship or sell the tuned model. This is also vendor-checklist question #7 — a platform vendor claiming ownership of fine-tunes you trained on an open model is a contract problem, not a license inevitability. 5. "Is there any indemnification?" No. No open-weight license — standard or community — indemnifies you for outputs, infringement claims, or anything else; that's a paid-API feature some cloud providers offer. Self-hosting trades that indemnity for control. Most legal teams accept this the way they accept it for every other open-source component in the stack, with the same mitigations: human review where outputs matter, and insurance where it doesn't suffice.

A pragmatic selection policy

The policy that keeps procurement simple, used implicitly across this hub's recommendations:

Default to Apache 2.0 / MIT models — Qwen 3 for general work, GPT-oss for the quality ceiling, Mistral Small for efficiency, DeepSeek for reasoning. Zero-friction approval, no AUP flow-down, fine-tunes unencumbered. Every model's license is listed on its model library page.
Use community-licensed models when they win on merit — Llama 3.3 70B remains a reference model, and its license is fine for the overwhelming majority of businesses (the 700M-MAU clause names a club of a few dozen companies worldwide). Just route them through the per-use-case review lane.
Write the choice down. A one-paragraph internal policy — "approved license families, review lane for exceptions" — turns every future model upgrade from a legal thread into a checkbox, which matters because you will change models more often than you change GPUs (TCO guide, refresh section).

Frequently asked questions

Can I use Llama commercially?

Yes, for almost every business: the Llama Community License permits commercial use. The famous exception targets giants — companies whose products exceeded 700 million monthly active users when the model version released need a separate license from Meta. The obligations that actually affect normal businesses are the acceptable-use policy, "Built with Llama" attribution on distributed products, and Llama-prefixed naming for fine-tuned derivatives. Not legal advice — have counsel read the license version you deploy.

Which open LLMs have the cleanest licenses for business use?

Apache 2.0 models: Qwen 3, Mistral Small, GPT-oss, and IBM Granite; and MIT models: DeepSeek and GLM. These are standard open-source licenses your legal team has approved hundreds of times — unconditional commercial use, no acceptable-use policy baked in, fine-tunes fully yours, and (for Apache 2.0) an explicit patent grant.

Do open-model licenses restrict what we can build?

Apache 2.0 and MIT: effectively no — standard open-source terms. Community licenses (Llama, Gemma) attach acceptable-use policies prohibiting categories like illegal activity and deceptive use; for internal tools this is routine policy work, while customer-facing products need the AUP reflected in your own terms of service. No mainstream open-weight license restricts commercial use of model outputs.

Who owns a model we fine-tune on our own data?

Under Apache 2.0 and MIT base models, the fine-tuned weights are yours without conditions. Under the Llama license, your derivative stays governed by Llama's terms — naming and AUP included — which matters mainly if you distribute it. Separately, watch platform-vendor contracts: some claim rights over fine-tunes created in their tooling, which is a negotiable contract term, not a license requirement (see our vendor checklist, question 7).

Does anyone indemnify us if a self-hosted model produces infringing output?

No — no open-weight license provides indemnification; that is a commercial feature some paid cloud APIs offer. Self-hosting trades vendor indemnity for architectural control. Legal teams typically treat this like any other open-source component: human review where outputs carry legal weight, contractual disclaimers where appropriate, and the same E&O coverage that already backs the business.

Open-Model Licenses for Commercial Use: What Legal Will Ask