Open-source licences in AI products: code, model weights and datasets

Almost every AI startup builds on someone else’s work: frameworks and libraries, a base model, and data. That’s normal and usually fine. Problems start when nobody has tracked which licence covers what, and an investor or enterprise customer asks.

This post is general information, not legal advice.

Three layers, three sets of terms

Code. Libraries, frameworks and tools are usually released under an open-source licence approved by the Open Source Initiative.

Model weights. Many “open” models are released under licences written by the model developer. Some are standard open-source licences, such as Apache 2.0. Others are custom licences with use restrictions, acceptable use policies or conditions that apply above a certain size of user base. “Open weights” isn’t the same as open source.

Data. Datasets used to train, fine-tune or evaluate models may be released under Creative Commons licences, custom terms, or no clear licence at all. Some Creative Commons licences prohibit commercial use (NC) or require derivative works to be shared under the same terms (SA).

Permissive licences

Permissive licences such as MIT, BSD and Apache 2.0 let you use, modify and include the code in a commercial, closed product. The main obligations are to keep copyright and licence notices. Apache 2.0 also includes an express patent licence from contributors, ends that licence for anyone who brings a patent claim over the work, and requires you to pass along any NOTICE file.

Copyleft licences

Copyleft licences require that if you distribute software that includes or is based on the licensed code, you make the corresponding source available under the same licence.

• GPL. Obligations are triggered when you distribute the software. A SaaS product that runs only on your servers usually doesn’t distribute it, but a downloadable app, desktop client, on-premises install or SDK can.
• AGPL. The AGPL closes that gap. Under its section 13, if you modify AGPL code and users interact with it over a network, you must offer them the source of your modified version. AGPL code inside a hosted product is a common diligence flag.
• LGPL and MPL. These are weaker copyleft licences. They generally allow linking from proprietary code if you follow their conditions for the licensed files.

Whether a particular use triggers copyleft depends on how the code is combined, which can be technical. Check before AGPL or GPL code goes into your core product, not after.

Model licences

Read the model licence itself, not a summary of it. Points to look for:

• whether commercial use is permitted, and on what conditions;
• an acceptable use policy that your customers will also need to follow;
• thresholds based on users or revenue that trigger a separate licence;
• naming or attribution requirements for products and derivative models;
• restrictions on using outputs to train other models;
• whether the licence can be updated or terminated.

If you fine-tune a model, your fine-tuned weights are usually still governed by the base model’s licence. If you pass a model or its outputs to customers, the conditions may need to flow through your AI product terms.

Datasets

Under the Copyright Act, copying a protected work without permission is infringement unless an exception such as fair dealing applies, and Canada has no exception written specifically for AI training or text and data mining. A dataset’s licence, and the terms of the site it came from, matter. Records of where each dataset came from, its licence and how you used it are worth keeping from the start. Personal information in a dataset raises privacy issues on top of copyright.

What investors and customers ask

Expect a request for an open-source inventory in due diligence, and representations about open-source use in your financing documents and enterprise contracts. Enterprise customers may ask whether any copyleft code is in what they receive.

A practical setup

• Keep a software bill of materials, generated by a scanning tool, and review it before releases.
• Keep a short register of models and datasets with source, licence, version and how you use each one.
• Set a rule for AGPL, GPL and non-commercial licences: legal review before use.
• Read the model licence and acceptable use policy before you build on a base model.
• Make sure contractors and agencies tell you what open-source code they include. See who owns code a contractor writes.

We prepare AI product terms and SaaS agreements, and help with investor due diligence prep, at fixed fees listed on our fees page. To talk through the licences in your stack, book a free 15-minute consult.