Using open AI models in your organisation: what the licences allow

What licences do open AI models come with?

Open models make their weights available for download. The licence sets the conditions under which you may use them. Broadly, there are three groups (as of October 2026):

Licence	Examples	Commercial and public-sector use	Conditions
Apache 2.0	open models from OpenAI, Alibaba, most from Mistral AI, the new generation from Google	permitted	include the licence text and notices when redistributing, mark changes
MIT	models from various vendors, also tools such as Ollama	permitted	include the licence text when redistributing
Vendor’s own licence	Meta, older models from Google, some models from Mistral AI	mostly permitted, with conditions	name notice, usage prohibitions, thresholds by size or revenue, in some cases exclusion of regions

Apache 2.0 and MIT are licences approved by the Open Source Initiative. They permit use, modification and redistribution for any purpose and exclude warranty and liability. Apache 2.0 additionally includes a patent licence from the contributors.

What do the vendors’ own licences say?

Meta releases its models under its own community licence. For the fourth generation (effective 5 April 2025), the following applies, among other things:

• Name notice: Anyone who redistributes the models or a product using them must display “Built with” and the model name prominently. Anyone who uses the models or their answers to train another model and redistributes it must begin that model’s name with the name of the model family.
• Large providers: From 700 million monthly active people, a separate licence from Meta is required.
• Prohibited uses: The acceptable use policy rules out, among other things, operating critical infrastructure and the unauthorised practice of healthcare professions.
• EU exclusion for multimodal models: For multimodal models (text and image) of this generation, individuals domiciled in the EU and companies with their principal place of business in the EU are not granted the usage rights. End customers of a product that contains such a model are exempt. A hospital or public authority in the EU that runs the model itself, however, is not an end customer in this sense.
• Law: The law of California applies, and the courts there have jurisdiction.

Google had its own terms of use with a list of prohibited uses for its open models up to the third generation. There, Google reserved the right to restrict use “remotely or otherwise” if it believed there had been a violation. The new generation from April 2026, by contrast, is under Apache 2.0.

Mistral AI releases most of its open models under Apache 2.0. According to the company, some are under a modified MIT licence: companies with more than 20 million US dollars in monthly revenue then need a commercial licence or use the model via the Mistral AI platform. Other models are only released for research or non-production purposes.

What should hospitals and public authorities watch out for?

• Version, not family: The licence can change from one generation to the next, as with Google. Check the licence file of the specific version you use and record it with the date.
• Usage prohibitions: Lists of prohibited uses are broadly worded, for example medical activity without a licence to practise or critical infrastructure. Whether your use falls under them should be clarified before rollout, especially in clinical settings and critical infrastructure (KRITIS).
• Regions: An exclusion for companies based in the EU also affects municipalities and hospitals that run the model themselves.
• Foreign law: Vendors’ own licences often refer to US law and US courts. That does not always fit the requirements of public contracting authorities.
• Tools are not models: Software such as Ollama is under MIT; the models it loads each have their own licences. The tool’s licence says nothing about the model’s.
• Redistribution: If you pass a model on to third parties, for example to other organisations in a group or as a service provider, the redistribution obligations apply: licence text, notice file and, with Meta, the name notice.

Is an open model open source within the meaning of the AI Act?

The AI Act relieves AI systems and models under a “free and open-source licence” in some places (Art. 2(12), Art. 53(2)). According to recitals 102 to 104, this requires that the licence freely permits use, modification and redistribution and that the model is not provided against payment. Whether licences with usage prohibitions or thresholds for large companies meet this is disputed. For organisations that only use a model, this changes little: their obligations as deployers depend on the use, not on the model’s licence. In its 2024 definition, the Open Source Initiative additionally requires information on training data and code.

How does this work with basebox?

basebox selects the AI model and runs it, in our cloud or on your server. A model register documents the developer, version and licence of each model. If your organisation has requirements on the origin of a model, we implement them. Your own models with an OpenAI-compatible interface can be connected; you then check their licence yourself. More on proof under Security.

Not legal advice: This guide reflects the state of our research on 11 October 2026. Licences change with every model version. What counts is the licence text of the version you use. If in doubt, have it reviewed by a lawyer.