Downloading a model’s parameters and calling it open source is one of the industry’s most persistent conflations. Almost everything sold as “open AI” is really open weights: a company publishes the learned parameters that let the model run, wrapped in a licence that is either genuinely permissive or stuffed with conditions. True open source, as the Open Source Initiative defines it, demands considerably more. For a hobbyist running a chatbot on a laptop the gap barely matters; for anyone building a business on a model, it decides everything.
- Weights are not source: releasing parameters satisfies one of three requirements, not all of them.
- Licences diverge sharply: Apache 2.0 and MIT coexist with revenue thresholds and territorial exclusions.
- Regulation is watching: the EU AI Act eases the burden for open licences, but only those allowing use, study, modification and redistribution.
What open weights deliver, and what they leave out
Once the weights are on your disk you can run the model on your own hardware without shipping data to a server, fine-tune it on proprietary material, or embed it in an application — provided the licence permits it. What you rarely receive is the recipe. The Open Source AI Definition 1.0, published by the OSI in October 2024, carries four freedoms inherited from free software: to use the system for any purpose without asking, to study how it works, to modify it and to share it. Exercising them takes three artefacts: a description of the training data detailed enough for a qualified person to build a substantially equivalent system, including provenance and filtering; the full code used to train and run the model under an OSI-approved licence; and the parameters themselves under OSI-approved terms.
Open source models and open weights must include the data information and the code used to obtain those parameters.
A released set of weights, however generous its terms, covers one of the three.
Licence by licence: where the fine print bites
Auditing the official model cards on Hugging Face and each vendor’s site in October 2026 produces an uneven picture.
- OpenAI’s gpt-oss-120b and gpt-oss-20b ship under Apache 2.0, pitched without copyleft obligations or patent risk.
- Google DeepMind’s Gemma 4 is Apache 2.0 across pretrained and instruction-tuned variants.
- DeepSeek-V4.1-Flash puts repository and weights under MIT.
- Mistral Small 4 and Mistral Large 3 are plainly permissive under Apache 2.0.
- Mistral Medium 3.5 uses a modified MIT that strips usage rights when a company’s consolidated monthly billing topped $20 million (about €17.8 million) the previous month.
- Qwen3.8 depends on the size: the 27B is Apache 2.0, while other variants carry bespoke terms.
- Meta’s Llama 4 falls under the Llama 4 Community License, capped at 700 million users, with an EU carve-out for multimodal models.
The Qwen Community License 1.0 governing Qwen3.8-Flash-Next requires products with more than 100 million monthly active users or $20 million in monthly revenue to display the model’s name, and demands a separate agreement from anyone selling access to the model as a service or as an AI work assistant. The licence for the largest Qwen3.8 asks for that extra agreement only when the group also bills above $50 million (roughly €44.5 million) across twelve months.
Llama is the most restrictive. Meta’s terms require permission if a product already exceeded 700 million monthly active users at launch, mandate a “Built with Llama” credit and force distributed derivatives to start with the word “Llama”. The acceptable use policy withholds licence rights over Llama 4’s multimodal models from anyone domiciled in, or any company headquartered in, the European Union, while still letting end users work with products that embed them. As of October 2026, the newest models on Meta’s official Llama account date from April 2025.
Revenue and user thresholds sit badly with a freedom to use a system for any purpose without permission. Such terms may suit a vendor’s commercial strategy, but describing them as open source is marketing.
Brussels offers relief, with strings attached
Europe’s AI rulebook treats open licences more gently. Article 2.12 of Regulation (EU) 2024/1689 keeps AI systems released under free and open-source licences out of scope unless they are high-risk, involve prohibited practices or fall under the transparency duties of Article 50. For general-purpose models, Article 53.2 exempts providers from technical documentation obligations when a model ships under a free licence permitting access, use, modification and distribution, with weights, architecture and usage information available. Two boundaries apply: the exemption does not cover models posing systemic risk, and it does not waive the copyright policy or the public summary of training content.
Recital 102 adds that the licence must allow running, copying, distributing, studying, modifying and improving the model, while recital 103 excludes anyone who monetises it — by charging for the model or for support — except among micro-enterprises. Whether a licence barring large companies or EU residents fits remains a question the text does not settle.
For anyone who wants AI on a phone or laptop without a round trip to the cloud, open weights are unambiguously good news, and offline-capable releases such as Gemma 4 prove the point. The lesson is to read “open” the way you read a nutrition label: which licence, which limits, what is missing. That some frontier models now arrive under Apache 2.0 or MIT while others come wrapped in thresholds and territorial caveats is the clearest sign that the word, on its own, no longer tells a buyer anything.