How to review large model licences: separate weights, code, data and use terms

After obtaining a downloadable large model, enterprises should review the weights, code, data, and other terms separately. A single license label in a repository is insufficient to indicate that all assets are covered by the same license or directly prove any commercial use is allowed.

How open weights differ from open-source AI

The OSI Open Source AI Definition 1.0 has been officially released. It focuses on freedom in use, research, modification, and sharing, requiring access to data descriptions, code, and parameters needed for modifications. Data descriptions should be detailed enough for professionals to build an equivalent system and clearly state the sources and acquisition methods of relevant data; this cannot simply mean all original training data must be made public without conditions. OSI Definition

This framework helps assess openness, but it does not provide legal opinions or automatically grant commercial usage rights. Actual use still requires reading the corresponding version of the weight license, software license, and additional policies.

Build a layered licence inventory

Model Layer: Record the publisher, model name, version, source of weights, base relationships, and micro-tuning connections. Do not ignore upstream models' conditions just because a derivative repository has new licenses.

Code Layer records training, inference, quantization, adaptation, and deployment code, as well as dependencies that enter the deliverables. Code uses a permissive license, which does not imply that weights or data also use the same license.

Data Layer records the source of data, acquisition methods, usage scope, and cleanup process; one cannot infer that training data, personal information, or third-party materials have all been authorized using a weight license.

License Terms Layer checks for use restrictions, redistribution permissions, attribution requirements, notification policies, trademark usage, acceptable use policies, and additional authorization needs. Definitions and versions within the terms should also be preserved.

Validate conclusions against actual business behaviour

Describe what your team plans to do: internal inference, external API services, fine-tuning for weights before deployment, or handing over the model to customers. The obligations that need to be verified may differ based on how a model is used. Reviews should provide 'scope of permission, conditions to meet, and missing documentation,' rather than just stating 'commercial use.'

Recheck licenses after version upgrades or changing the base; verify declarations and documents that need to be retained during the delivery process.

If a company plans to release its own model, it should first confirm what rights it has over upstream code, weights, and data before deciding on the open scope and licensing arrangements.