Open Weights, Open Source and Licences

By the end of this lesson you will be able to answer the two questions that matter about any model you download: may I use this for what I intend, and what must I ship or do if I do. You will find the clause that a given action triggers in Apache-2.0, MIT, the Llama 3.1 Community License, the Gemma Terms of Use and a publisher’s own text; check a release against the Open Source Initiative’s definition; pull a repository’s licence facts from the Hub with a script and trace them to the base model and the datasets; and work out, with arithmetic, whether the EU AI Act’s obligations for general-purpose models could ever reach something you trained.

⚠Warning

This course is educational material and not legal advice. Licence texts are quoted here so that you read them, not so that you can avoid reading them; the quotations are short and the originals are linked. For anything commercial, the obligations are yours and a lawyer is cheaper than the alternative. The disclaimer says this at more length.

What you actually receive

A model release is a bundle, and different publishers put different things in it.

What an 'open' model release may include, from most to least commonly published

published less often

1. WeightsThe checkpoint: safetensors, GGUF or MLX files. Almost always present, and the reason "open weight" is the honest name for most releases.
2. Inference code and configurationTokeniser, chat template, generation defaults, and often a reference implementation. Usually present.
3. Evaluation detailsWhich benchmarks, which settings, which prompts. Sometimes present, often only as a table of scores.
4. Training codeThe scripts that produced the weights. Occasionally present, more often for research releases than for flagship models.
5. Data informationA description of the corpus detailed enough to rebuild something equivalent. Rare.
6. The training data itselfThe corpus, redistributable. Very rare for a large model, and the reason most releases cannot meet the OSI definition.

A licence governs the layers that are published. It says nothing about the layers that are not.

The licence on a release covers the weights and whatever else is shipped with them. Whether the training data’s own licences permitted its use is a separate question, the unsettled part of the field, and one a downstream user usually cannot check.

Conditions attach to actions

A licence is a grant of permissions with conditions, and each condition is switched on by something you do. Five actions cover nearly everything in this course, and the rest of the lesson reads every licence against them.

Action	Where the course does it	Words the licence texts use for it
Use	Running Qwen3-8B (Apache-2.0) in llama.cpp, Part 6	“use”
Modify	Fine-tuning, merging, quantising, Parts 13 and 16	“Derivative Works” (Apache), “derivative works” (Llama), “Model Derivatives” (Gemma)
Redistribute a copy	Publishing a fine-tune or a GGUF	“distribute” in every text
Offer it as a service	Serving other people from your machine, Part 23	“make available” (Llama), “Hosted Service” (Gemma); no such clause in Apache-2.0 or MIT
Train another model on its outputs	Distillation, Part 15	“outputs or results” (Llama), “Model Derivatives” including synthetic data (Gemma)

Where the file came from does not change the terms. The Gemma terms define Gemma, in section 1.1(c), as the listed models “regardless of the source that you obtained it from”, and the Llama agreement binds you “by clicking ‘I Accept’ below or by using or distributing any portion or element of the Llama Materials”. A community GGUF conversion carries its upstream licence with it.

The permissive pair: Apache-2.0 and MIT

Most of the models this course uses are Apache-2.0: the whole Qwen3 family, gpt-oss-20b, and Gemma 4 E4B, whose card links Google’s Gemma 4 licence page, which is the Apache text. It is standard software licensing, and its terms are worth knowing precisely because they are what “no strings” actually looks like.

Section 2 grants “a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work”, and section 3 grants a matching patent licence “to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work”. The patent grant has a trigger of its own: if you start patent litigation “alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate”. MIT has no patent clause at all, which is why organisations that worry about patents prefer Apache-2.0.

Two definitions in section 1 decide what a model file is. “Object” form includes “conversions to other media types”, and a “Derivative Work” is anything “based on (or derived from) the Work” whose modifications “represent, as a whole, an original work of authorship”. A GGUF file produced by a conversion script and a fine-tuned checkpoint both sit inside what section 4 governs once you distribute them.

Worked example: publishing a quantised Qwen3-8B

Section 4 lists four conditions for distributing “the Work or Derivative Works thereof”. Here they are applied to a repository you might publish after Part 13, yourname/Qwen3-8B-Q4_K_M-GGUF, checked against the upstream Qwen/Qwen3-8B file listing at revision b968826d9c46.

Condition	The text	What your repository needs	Upstream on 2026-09-12
4(a)	“a copy of this License”	A LICENSE file	LICENSE present: copy it
4(b)	“prominent notices stating that You changed the files”	A README line: converted to GGUF and quantised to Q4_K_M, from which repository and revision, with which tool version	Yours to write
4(c)	retain “all copyright, patent, trademark, and attribution notices”	The upstream notices, unedited	The LICENSE appendix reads “Copyright 2024 Alibaba Cloud”; copying the file keeps it
4(d)	Derivative Works “must include a readable copy of the attribution notices contained within such NOTICE file”	A NOTICE file only if upstream has one	No NOTICE in the listing: nothing to carry
6	no permission to use trade names “except as required for reasonable and customary use in describing the origin of the Work”	Say where it came from; do not present it as the publisher’s release	Name the origin, not a brand

Section 4 is worded around distributing copies. Nothing in Apache-2.0 or MIT mentions offering the model over a network, so running either kind of model on your machine, using what it writes, or serving it to other people triggers none of those conditions. The Gemma terms, below, write the network case in explicitly, which is what makes the comparison informative. Apache-2.0 also lets you “provide additional or different license terms and conditions” for your own modifications, as long as your handling of the original work still complies.

MIT is shorter still. It grants permission “to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software”, on one condition: “The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.” No change notice, no NOTICE mechanism, no patent grant. GLM-4.6, the course’s alternative at the largest tier, is MIT-licensed.

Community licences: Llama

Llama 3.1 8B Instruct, the course’s cross-engine comparison model, and Llama 3.1 405B Instruct in the cluster parts are both under the Llama 3.1 Community License and both gated on the Hub. The agreement permits commercial use and attaches conditions a permissive licence does not, and its grant in 1.a is different in kind: a “non-exclusive, worldwide, non-transferable and royalty-free limited license”, where Apache’s is perpetual and irrevocable.

Clause	What it says	Switched on by	What you do
1.b.i, first sentence	“provide a copy of this Agreement” and “prominently display ‘Built with Llama’ on a related website, user interface, blogpost, about page, or product documentation”	You “distribute or make available the Llama Materials (or any derivative works thereof), or a product or service (including another AI model) that contains any of them”	Ship the agreement; put the phrase where users see it
1.b.i, second sentence	“include ‘Llama’ at the beginning of any such AI model name”	You use “the Llama Materials or any outputs or results” of them “to create, train, fine tune, or otherwise improve an AI model, which is distributed or made available”	Name the model Llama…
1.b.iii	“Llama 3.1 is licensed under the Llama 3.1 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.” within a “Notice” text file	You distribute copies	A Notice file with that sentence
1.b.iv	The Acceptable Use Policy “is hereby incorporated by reference”	Any use, including private use	Check your purpose against the policy
2	Over “700 million monthly active users in the preceding calendar month”, measured “on the Llama 3.1 version release date”, means you “must request a license from Meta”	Your user count in the month before 23 July 2024	Almost everyone: nothing
5.c	Litigation “against Meta or any entity” alleging the Llama Materials or “Llama 3.1 outputs or results” infringe “intellectual property or other rights owned or licensable by you” ends “any licenses granted to you”; and “You will indemnify and hold harmless Meta from and against any claim by any third party arising out of or related to your use or distribution of the Llama Materials”	Such litigation against anyone over the materials or outputs (termination); any use or distribution (indemnity)	Check before suing anyone over Llama outputs; show the indemnity to counsel
6	“Upon termination of this Agreement, you shall delete and cease use of the Llama Materials”	A breach	—

Two rows repay a closer look. The naming condition reaches through outputs: a Qwen3-1.7B student (Apache-2.0) trained on Llama 3.1 8B answers and then published must still carry a name beginning “Llama”, whatever its architecture. Llama-3.1-8B-support-sft complies; support-bot-llama-8b and Qwen3-1.7B-distilled-from-Llama do not. Part 15 works through the distillation case in full.

The user threshold, read literally, is a single test pinned to the release date of 23 July 2024, not a ceiling that follows you: a company founded afterwards never met it, however large it grows, unless its affiliates’ products or services had more than 700 million monthly active users in the calendar month before that date. Section 1.b.ii adds that an end user who receives Llama inside “an integrated end user product” is not subject to section 2 at all. The conditions that turn up in real compliance reviews are the attribution, notice and naming rows, because they apply to everyone who distributes or makes something available.

The Acceptable Use Policy is the business-relevant part. Among its prohibited uses are “the unauthorized or unlicensed practice of any profession including, but not limited to, financial, legal, medical/health, or related professional practices”; activities related to “military, warfare, nuclear industries or applications, espionage”; “operation of critical infrastructure, transportation technologies, or heavy machinery”; “representing that the use of Llama 3.1 or outputs are human-generated”; and failing “to appropriately disclose to end users any known dangers of your AI system”. A product in any of those domains needs that reading before it needs a benchmark.

Terms of use: Gemma

Start with scope, because the name “Gemma” does not tell you which document applies. The Gemma Terms of Use, last modified on 1 April 2026, “apply to Gemma models listed in the Appendix”, which lists the generations before Gemma 4 and their named variants; the same page says “For Gemma 4 terms, see the Gemma 4 license”, and that page is the Apache 2.0 text. A card whose license field reads gemma is under the Terms of Use.

Two definitions make the Terms behave differently from everything above.

Definition	Text	Consequence
1.1(b) Distribution	“any transmission, publication, or other sharing of Gemma or Model Derivatives to a third party, including by providing or making Gemma or its functionality available as a hosted service via API, web access, or any other electronic or remote means”	Serving a Gemma model is distributing it
1.1(e) Model Derivatives	includes “any other machine learning model which is created by transfer of patterns of the weights, parameters, operations, or Output of Gemma”, “including distillation methods” and “synthetic data Outputs”; “Outputs are not deemed Model Derivatives”	A student trained on Gemma output is covered; the text Gemma writes is not

Section 3.1 then sets four conditions on any Distribution: include the use restrictions of section 3.2 “as an enforceable provision in any agreement (e.g., license agreement, terms of use, etc.) governing the use and/or distribution” and tell downstream users about them; give “all third party recipients” a copy of the Terms; mark modified files; and, for “All Distributions (other than through a Hosted Service)”, include a Notice file reading “Gemma is provided under and subject to the Gemma Terms of Use found at ai.google.dev/gemma/terms”. Section 3.2 incorporates the Gemma Prohibited Use Policy, last modified on 21 February 2024, and Google “reserves the right to restrict (remotely or otherwise) usage” that Google “reasonably believes are in violation of this Agreement”. Section 3.3 says “Google claims no rights in Outputs you generate using Gemma.”

Apply that to a paid API serving your fine-tune of a model listed in the Terms’ Appendix, such as Gemma 3 (Gemma Terms of Use). The hosted service is a Distribution, so your customer terms must carry the 3.2 restrictions as an enforceable provision and your users must be told; the Notice file is expressly not required for a hosted service; whether an API customer is a “third party recipient” owed a copy of the Terms is a question for counsel. Then read the Prohibited Use Policy against your product: it forbids, among other things, “making automated decisions in domains that affect material or individual rights or well-being (e.g., finance, legal, employment, healthcare, housing, insurance, and social welfare)”, which rules out a whole class of business product regardless of how well the model performs. The mistake to avoid is serving such a fine-tune under customer terms with no use-restriction clause; the symptom is terms of service that never mention the Prohibited Use Policy, and the fix is to incorporate section 3.2’s restrictions into the customer agreement as an enforceable provision.

On termination under section 4.5 you “must delete and cease use and Distribution of all copies of Gemma and Model Derivatives”; the sections that survive are “1, 2.1, 3.3, 4.2 to 4.9”.

⌚Version note

Terms of use and use policies are revised; licence texts of the Apache and MIT kind essentially are not. This course therefore records a retrieved: date on every source and a verification date on every model: a quotation is accurate as of the day it was read.

A publisher’s own licence: diff it against one you know

Nemotron 3 Nano 30B-A3B carries the NVIDIA Nemotron Open Model License, which is neither Apache nor MIT. Publisher-written licences are often built on a familiar template, so the efficient way to read one is clause by clause against the template. This is the December 15, 2025 version.

Clause	Apache-2.0	NVIDIA Nemotron Open Model License	What changes for you
Grant	Copyright licence in section 2, separate patent licence in section 3	One “perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license” in section 2	No express patent licence: the section 2 grant covers copyright-type acts only, like MIT
Litigation trigger	Patent litigation over the Work ends the patent licence	“patent or copyright litigation” alleging “that the Work or an output from the Work” infringes ends “any licenses granted”	Wider: copyright claims, and claims about outputs
Change notice	Required, 4(b)	Absent	One duty fewer
NOTICE	Carry the upstream NOTICE contents	If the Work includes a NOTICE file, a Notice file with “Licensed by NVIDIA Corporation under the NVIDIA Nemotron Model License.”	A fixed sentence
Indemnity	Only if you choose to offer a warranty, section 9	“You will indemnify and hold harmless NVIDIA from and against any claim by any third party arising out of or related to your use or distribution” of the Works, Derivative Works “or output” from them	An obligation on every user, new relative to Apache-2.0
Outputs	Silent	“NVIDIA does not claim ownership to any outputs”	Stated
Governing law and trade	None	Delaware law, Santa Clara County courts, export and sanctions compliance	Named forum and trade duties
Use restrictions	None	None in the text read	As permissive as Apache on use

The diff is a short read and produces what a business needs. Three lines go to a lawyer: the missing express patent grant, the indemnity, and the wider termination trigger. The indemnity is new only relative to Apache-2.0: Llama 3.1’s section 5.c imposes the same kind on every Llama user, and NVIDIA’s also names outputs. The redistribution conditions otherwise read as Apache.

Open weight is not open source

The Open Source Initiative’s Open Source AI Definition, version 1.0, is the reference point for this distinction. It requires that a system grant four freedoms: to “Use the system for any purpose and without having to ask for permission”; to “Study how the system works and inspect its components”; to “Modify the system for any purpose, including to change its output”; and to “Share the system for others to use with or without modifications, for any purpose”.

A precondition is “access to the preferred form to make modifications”, which the definition spells out as three components. Data information: “sufficiently detailed information about the data used to train the system so that a skilled person can build a substantially equivalent system”, including “a listing of all publicly available training data and where to obtain it”. Code: “the complete source code used to train and run the system”, which “shall represent the full specification of how the data was processed and filtered, and how the training was done”, under OSI-approved licences. Parameters: “the model parameters, such as weights or other configuration settings”, under OSI-approved terms. The definition applies the same test to a model or to weights alone: “‘Open Source models’ and ‘Open Source weights’ must include the data information and code used to derive those parameters.”

The data requirement is graded rather than absolute. The OSI FAQ sorts training data into four classes and asks something different of each.

Class	Example	What the definition asks
Open training data	A corpus under a licence permitting copying and resharing	“This must be shared.”
Public training data	Web pages others can inspect while they stay online	Disclosed “with full details on where to obtain it”
Obtainable training data	A dataset available for a fee	Disclosed “with full details on where to obtain it”
Unshareable non-public data	Personal data such as patient records	“revealed in detail” so someone can build a dataset “with identical structure”

Now apply the test. The licence alone can fail it: the Llama Acceptable Use Policy restricts purposes and section 2 makes the largest licensees ask Meta for permission, so no amount of published data would make a Llama 3.1 release open source. An Apache-2.0 release passes the licence part and then usually stops at data information. The Qwen3 report describes the corpus by size, languages and kinds of content (“approximately 36 trillion tokens” covering up to 119 languages and dialects, with text extracted from PDFs and synthetic data from earlier models); it does not list the training datasets and where to obtain them. Nemotron 3 Nano’s card metadata lists sixteen NVIDIA datasets, which is much closer, and whether the whole release meets the Data Information and Code requirements is exactly the check OSI’s published checklist exists for.

During validation, OSI’s volunteers found that the systems which passed were releases from EleutherAI, AI2, LLM360 and Google that publish their training data, and an earlier Llama generation was among those that did not. The FAQ adds that OSI “will not validate or review individual AI systems”; it validates legal documents. So the course says open weight for a release whose weights you can download under some licence, and keeps “open source” for releases that meet the definition. A model can be Apache-2.0, freely usable, freely redistributable, reproducible by nobody, and still not open source.

Reading a model card for obligations

Obligations are spread across a Hub repository, and Part 4 teaches the rest of the card. The compliance subset lives in five places.

Where	What to read	What it settles
license in the card metadata	A Hub identifier such as apache-2.0, mit, llama3.1, gemma, odc-by, cc-by-nc-4.0; or other with license_name and license_link	Which text governs; other means a publisher’s own text you must open
Files in the repository	LICENSE, NOTICE, USE_POLICY.md	The documents you must copy on redistribution
The gate	gated is auto, manual or false; a gate can show its own extra_gated_prompt text	Accepting in the browser is where the agreement is entered
base_model	A parent repository; the Hub infers the relation (quantized, finetune, adapter, merge)	Whose licence a conversion or fine-tune inherits: follow it upward
datasets	Dataset repositories used in training	Where to read the data licences

A statement about outputs matters too, because distillation trains on them; it is usually in the licence text rather than the metadata. With Part 2’s environment active (it installed huggingface_hub), this script prints those facts for any repositories you name, anonymously, so you see what anyone sees.

RunnableAll tracks

licence-audit.py

"""Print the licence facts a Hub repository publishes about itself, one block per repository."""
import sys
from huggingface_hub import HfApi

REPOS = sys.argv[1:] or [
    "Qwen/Qwen3-8B",
    "unsloth/Qwen3-8B-GGUF",
    "meta-llama/Llama-3.1-8B-Instruct",
    "bartowski/Meta-Llama-3.1-8B-Instruct-GGUF",
    "google/gemma-4-E4B-it",
    "nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B-BF16",
]
CHECK = {  # what this lesson says each identifier asks of you
    "apache-2.0": "redistributing: LICENSE copy, change notice, keep notices, NOTICE if upstream has one",
    "mit": "redistributing: keep the copyright and permission notice",
    "llama3.1": "Llama 3.1 licence + AUP: copy of the Agreement, Notice file, "
                "'Built with Llama', 'Llama' name prefix",
    "gemma": "Gemma Terms of Use: use restrictions in your terms (a hosted service counts), "
             "copy of the Terms, Notice file unless hosted",
}

api = HfApi()
for repo in REPOS:
    info = api.model_info(repo, token=False)          # anonymous: what anyone can see
    card = info.card_data
    lic = card.license if card else None
    lics = lic if isinstance(lic, list) else [lic]    # a card may list several licences
    files = sorted({s.rfilename.split("/")[-1] for s in info.siblings or []})
    legal = [f for f in files if f.upper().startswith(("LICENSE", "NOTICE", "USE_POLICY"))]
    print(f"{repo}  @ {info.sha[:12]}")
    print(f"  license: {lic}" + (f" ({card.license_name})" if "other" in lics else ""))
    print(f"  link:    {card.license_link if card else None}")
    print(f"  gated:   {info.gated}   base_model: {card.base_model if card else None}")
    print(f"  files:   {', '.join(legal) or 'no LICENSE, NOTICE or USE_POLICY file'}")
    for one in lics:
        print(f"  check:   {CHECK.get(one, 'publisher text: read the link in full')}")

Output — what you should see

python licence-audit.py, huggingface_hub 1.30.0, run on 2026-09-12

Qwen/Qwen3-8B  @ b968826d9c46
  license: apache-2.0
  link:    https://huggingface.co/Qwen/Qwen3-8B/blob/main/LICENSE
  gated:   False   base_model: ['Qwen/Qwen3-8B-Base']
  files:   LICENSE
  check:   redistributing: LICENSE copy, change notice, keep notices, NOTICE if upstream has one
unsloth/Qwen3-8B-GGUF  @ a6adef130ffb
  license: apache-2.0
  link:    https://huggingface.co/Qwen/Qwen3-8B/blob/main/LICENSE
  gated:   False   base_model: Qwen/Qwen3-8B
  files:   no LICENSE, NOTICE or USE_POLICY file
  check:   redistributing: LICENSE copy, change notice, keep notices, NOTICE if upstream has one
meta-llama/Llama-3.1-8B-Instruct  @ 0e9e39f249a1
  license: llama3.1
  link:    None
  gated:   manual   base_model: meta-llama/Meta-Llama-3.1-8B
  files:   LICENSE, USE_POLICY.md
  check:   Llama 3.1 licence + AUP: copy of the Agreement, Notice file, 'Built with Llama', 'Llama' name prefix
bartowski/Meta-Llama-3.1-8B-Instruct-GGUF  @ bf5b95e96dac
  license: llama3.1
  link:    None
  gated:   False   base_model: meta-llama/Meta-Llama-3.1-8B-Instruct
  files:   no LICENSE, NOTICE or USE_POLICY file
  check:   Llama 3.1 licence + AUP: copy of the Agreement, Notice file, 'Built with Llama', 'Llama' name prefix
google/gemma-4-E4B-it  @ ee0ef6023621
  license: apache-2.0
  link:    https://ai.google.dev/gemma/docs/gemma_4_license
  gated:   False   base_model: ['google/gemma-4-E4B']
  files:   no LICENSE, NOTICE or USE_POLICY file
  check:   redistributing: LICENSE copy, change notice, keep notices, NOTICE if upstream has one
nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B-BF16  @ bf77c3174f68
  license: other (nvidia-nemotron-open-model-license)
  link:    https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-nemotron-open-model-license/
  gated:   False   base_model: None
  files:   no LICENSE, NOTICE or USE_POLICY file
  check:   publisher text: read the link in full

The revision hashes and file lists are what the Hub returned on that date; yours will differ as repositories are updated, which is the reason the script prints them. license and base_model can each be a string or a list, as the two forms of base_model above show, so the script prints one check: line per listed licence. Four things in that output are worth reading closely. The two conversions point base_model at their upstream, and neither ships a licence file of its own, so the text you would copy on redistribution lives one step up. Re-publishing from a conversion therefore copies no licence text, because there is none to copy: the symptom is a published repository whose file list has no LICENSE, and the fix is to copy LICENSE from the upstream repository at the pinned revision. The Llama publisher repository is gated with manual approval, while its GGUF conversion is not gated at all and still says llama3.1. Gemma 4 E4B’s card says apache-2.0 and links the Gemma 4 licence page, not the Terms of Use. And Nemotron’s other is the signal to open the link, which is what the previous section did.

✕Common mistake

Treating the gate as the licence. A reader downloads the ungated Llama 3.1 GGUF conversion, never clicks “I Accept”, and builds a product on the belief that no conditions apply. The symptom arrives in a review: no “Built with Llama”, no Notice file, a derived model named without the prefix. The agreement binds on use, so accept the licence where it lives, as Part 4’s shortlist lab does, and record that you did.

Dataset licences

A dataset has a licence of its own, read from the same metadata field with dataset_info in place of model_info. Pass the ids from a model card’s datasets field on the command line to trace a model’s data; with no arguments the script reads four datasets this course touches.

RunnableAll tracks

dataset-licences.py

"""Print the licence field each Hub dataset card declares, anonymously."""
import sys
from huggingface_hub import HfApi

DATASETS = sys.argv[1:] or [
    "HuggingFaceFW/fineweb-edu",
    "HuggingFaceTB/cosmopedia",
    "openai/gsm8k",
    "nvidia/ClimbMix",
]
api = HfApi()
for repo in DATASETS:
    info = api.dataset_info(repo, token=False)
    card = info.card_data
    print(f"{repo:<28} @ {info.sha[:12]}  license: {card.license if card else None}")

Output — what you should see

python dataset-licences.py, huggingface_hub 1.30.0, run on 2026-09-12

HuggingFaceFW/fineweb-edu    @ 87f09149ef47  license: odc-by
HuggingFaceTB/cosmopedia     @ 0ae6ec63f917  license: apache-2.0
openai/gsm8k                 @ 740312add88f  license: ['mit']
nvidia/ClimbMix              @ 5eaa64b9c0c8  license: cc-by-nc-4.0

These are the identifiers you will meet most, with the condition their own texts set and a course example of each.

Identifier	Condition in the licence’s own summary	Course example (dataset or model)
odc-by	“You must attribute any public use of the database, or works produced from the database” and keep its notices	HuggingFaceFW/fineweb-edu
apache-2.0, mit	The software conditions above	HuggingFaceTB/cosmopedia (Apache-2.0), openai/gsm8k (MIT)
cc-by-4.0	Attribution: “give appropriate credit, provide a link to the license, and indicate if changes were made”	No course dataset; the model Parakeet TDT 0.6B v3 (speech) publishes its weights under it
cc-by-sa-4.0	Attribution, and “If you remix, transform, or build upon the material, you must distribute your contributions under the same license”	—
cc-by-nc-4.0	Attribution, and “You may not use the material for commercial purposes”	nvidia/ClimbMix

The deeds do not say whether training a model counts as building upon the material, and this course cannot answer that for you, which is why a business treats NC and SA data as a decision for counsel and a hobbyist treats it as a reason to record where the data came from. A dataset card’s licence covers the compilation; the documents inside may carry their own, which the pretraining lesson showed with FineWeb. And a re-upload’s licence field is the uploader’s statement: Part 12 finds a repackaged corpus tagged mit whose upstream is cc-by-nc-4.0, and the rule is to trace data to its origin exactly as base_model traces weights.

The EU AI Act, in one page

If you publish a model, rather than only using one, one more layer applies in the European Union. The Act’s rules for general-purpose AI models sit in Chapter V and bind the provider: whoever “develops a general-purpose AI model or that has such a model developed and places it on the market”, paid or free, wherever that provider is established. The Commission’s guidelines list uploading a model “to a public catalogue, hub, or repository for direct download”, offering it through an API, and integrating it into a chatbot or app as ways of placing it on the market.

What counts as general-purpose is set by an indicative criterion in the guidelines: training compute greater than 10²³ FLOP and the ability to generate language, text-to-image or text-to-video. Models trained with more than 10²⁵ floating-point operations are presumed under Article 51(2) to have high-impact capabilities, which classifies them as carrying systemic risk under Article 51(1)(a), and the Commission can also designate models by impact. For someone who modifies another provider’s model, the guidelines’ indicative criterion is that “the training compute used for the modification is greater than a third of the training compute of the original model”; if the modifier cannot know or estimate that figure, the fallback is a third of 10²³ FLOP (or of 10²⁵ for a systemic-risk original). Recital 109 then limits a modifier’s obligations to the modification itself.

The arithmetic, with the course’s models

The guidelines accept the approximation C ≈ 6 · P · D for dense transformers, the same rule the pretraining lesson derived. Parameters come from the course’s model data, the Qwen3 tokens from the Qwen3 report, and the Llama tokens from the Meta figures that lesson quotes. The Qwen3 models are Apache-2.0. This is arithmetic from stated inputs, not a statement about any regulator’s classification.

RunnableAll tracks

ai-act-compute.py

"""Place training runs against the AI Act compute criteria, using C ~ 6 x N x D from stated inputs."""
GPAI_INDICATIVE = 1e23      # guidelines 2.1: above this and generates language -> indicates general-purpose
SYSTEMIC_RISK = 1e25        # Article 51(2): presumption of high-impact capabilities

def flops(n_params, tokens):
    return 6 * n_params * tokens

originals = {  # parameters: course model data; tokens: Qwen3 report, Meta figures in the pretraining lesson
    "Qwen3-0.6B": flops(0.6e9, 36e12),
    "Qwen3-8B": flops(8.2e9, 36e12),
    "Llama 3.1 8B": flops(8.0e9, 15e12),
    "Llama 3.1 405B": flops(405e9, 15.6e12),
}
for name, c in originals.items():
    tier = "above 1e25" if c > SYSTEMIC_RISK else ("above 1e23" if c > GPAI_INDICATIVE else "below 1e23")
    print(f"{name:<15} {c:9.2e} FLOP  {tier}")

print()
base = originals["Qwen3-8B"]
for label, tokens in [("SFT, 20M tokens", 20e6), ("SFT, 2B tokens", 2e9)]:
    c = flops(8.2e9, tokens)   # full fine-tune; a LoRA run computes less, so this over-estimates
    print(f"Qwen3-8B {label:<16} {c:9.2e} FLOP = {c / base:.1e} of the original")
print(f"one third of the original:              {base / 3:9.2e} FLOP")
print(f"tokens to cross it with a full fine-tune: {base / 3 / (6 * 8.2e9):9.2e}")
print(f"tokens to cross the fallback (1e23 / 3):  {GPAI_INDICATIVE / 3 / (6 * 8.2e9):9.2e}")

Output — what you should see

python ai-act-compute.py, Python 3.12, standard library only

Qwen3-0.6B       1.30e+23 FLOP  above 1e23
Qwen3-8B         1.77e+24 FLOP  above 1e23
Llama 3.1 8B     7.20e+23 FLOP  above 1e23
Llama 3.1 405B   3.79e+25 FLOP  above 1e25

Qwen3-8B SFT, 20M tokens   9.84e+17 FLOP = 5.6e-07 of the original
Qwen3-8B SFT, 2B tokens    9.84e+19 FLOP = 5.6e-05 of the original
one third of the original:               5.90e+23 FLOP
tokens to cross it with a full fine-tune:  1.20e+13
tokens to cross the fallback (1e23 / 3):   6.78e+11

Read the output as ratios. Every original in the table is above the general-purpose indication, including a 0.6B model, because modern small models are trained on very many tokens. Only the 405B run crosses the systemic-risk line. Because the modifier’s criterion is relative and both runs use the same 6 · P per token, crossing it with a full fine-tune means training on a third of the original’s tokens: 12 trillion for Qwen3-8B, against the 20 million of the example fine-tune. Even the fallback, about 680 billion tokens, is far beyond any fine-tune in Part 13.

What a provider owes, and what an open release is excused

Obligation	Article	Applies to every provider	Excused for a qualifying open-source release
Technical documentation for the AI Office and national authorities	53(1)(a)	Yes	Yes, unless systemic risk
Information and documentation for downstream providers	53(1)(b)	Yes	Yes, unless systemic risk
“a policy to comply with Union law on copyright and related rights”, including honouring text-and-data-mining opt-outs	53(1)(c)	Yes	No
“a sufficiently detailed summary about the content used for training”, on the Commission’s template	53(1)(d)	Yes	No
An authorised representative in the EU, for providers established elsewhere	54	Yes	Yes, unless systemic risk
Evaluations, serious-incident reporting, cybersecurity, notification within two weeks of meeting the threshold	52, 55	Systemic risk only	Never

The exemption has three conditions in section 4.2 of the guidelines. The licence must allow access, use, modification and distribution, and the guidelines give examples that disqualify one: “limitations to non-commercial or research-only use”, “prohibitions on distributing the model”, “usage restrictions triggered by user scale thresholds (e.g. requiring additional licensing if monthly active users exceed a certain number)”, and “requirements to obtain separate commercial licences for specific use cases”. There must be no monetisation, which includes dual licensing and paid-only hosting. And the parameters, architecture information and usage information must be public. Apache-2.0 and MIT fit that shape. The Llama 3.1 section 2 clause has the shape of the user-scale example. Paragraph 81 allows “specific, safety-oriented terms” that are proportionate and non-discriminatory, and whether a given acceptable use policy qualifies is not something the guidelines settle. Paragraph 84 treats a model whose access requires collecting personal data like monetisation, unless the processing is “exclusively and strictly limited to the security of the model”, which bears on a gated repository that collects contact details.

Date	What happens
2 August 2025	Obligations for providers of general-purpose models apply
2 August 2026	Commission enforcement powers apply, including fines of “up to 3% of global annual turnover or 15 million Euros, whichever is higher”
2 August 2027	Deadline for models placed on the market before 2 August 2025

The AI Omnibus, in force since 27 July 2026, moved the high-risk system timelines; the Service Desk timeline read on 12 September 2026 still shows the dates above for general-purpose model providers. If you build a product on someone else’s model, Chapter V is usually not yours; as the Commission’s questions and answers put it, that entity “must comply with the relevant AI Act requirements and obligations for AI systems”, which is a different chapter with its own dates.

What a hobbyist and a business each check

Question	Hobbyist: runs models, may publish a fine-tune	Business: serves, sells or ships
Which text governs?	The license field, traced through base_model to the upstream repository	The same, plus the licence file at a pinned revision, archived
Does my purpose break a use policy?	Llama and Gemma policies bind even private use	Read the policy against the product’s domain: professions, automated decisions, critical infrastructure
Am I distributing?	Publishing weights is	Also an API under the Gemma Terms; “make available” under Llama
What do I ship with copies?	LICENSE, change notice, upstream NOTICE or Notice file	The same inside the product’s documentation and downloads
What must my derived model be called?	“Llama” first if Llama or its outputs trained it	The same, and check trademarks before branding
What did I train on?	Record dataset ids and licences	NC and SA data go to counsel; archive the dataset cards
Am I an EU provider?	Not for fine-tunes at course scale	Only if you place your own general-purpose model on the market, or modify one past the one-third criterion
Indemnities, governing law?	Note them	Counsel reads them: the indemnities in Llama 3.1 section 5.c and Nemotron section 7; California law for Llama and Gemma, Delaware for Nemotron

The course’s rule

Every model this course names carries its licence where it is named, and says “gated” when the Hub requires acceptance. The mechanism behind the rule is data, not memory. Each entry in the course’s model data has a licence.name taken from a closed list of ten values (Apache-2.0, MIT, Llama-3.1-Community, Llama-4-Community, Gemma-Terms, NVIDIA-Open-Model, Modified-MIT, CC-BY-4.0, Custom and Unverified), a licence.url, and a verifiedOn date. The data validator fails the build on a licence name outside the list and on a page whose models: list names a model the data does not contain, and warns when a verification is more than 120 days old. The model reference renders the result. Unverified exists so that a model whose licence could not be confirmed says so rather than borrowing a plausible answer.

Adopt the same habit in your own projects: a table beside the code, one row per model, filled from the audit script, so the licence was read at a revision you can name.

Repository	Revision	Licence	Read on	Triggered by what we do	Evidence
Qwen/Qwen3-8B	b968826d9c46	apache-2.0	2026-09-12	We publish a GGUF: LICENSE, change notice	LICENSE copied into our repository
meta-llama/Llama-3.1-8B-Instruct	0e9e39f249a1	llama3.1, gated (manual)	2026-09-12	Internal comparison only: AUP applies, nothing distributed	Access accepted by the account holder on the date

Build an artefact-specific licence record

Treat a deployment as a collection of artefacts: base weights, adapter, tokeniser, inference engine, training examples and redistributed application files. Their permissions need not be identical. An engine’s permissive code licence does not grant rights to every checkpoint it can load, and an adapter’s licence does not remove conditions attached to the base it requires.

For each artefact, record the publisher, immutable revision, licence file and intended action: download, internal use, modification, redistribution or hosted access. Read the actual terms governing that action. Preserve attribution and notices in the distribution package where required. A model-card tag is an index to investigate; it is not a replacement for the licence text.

Work through a fictional case: you can use a checkpoint internally but have not established redistribution rights for the dataset used to adapt it. The correct engineering action is to keep the dataset out of the release bundle and resolve the missing permission before publishing it. This inventory is a reproducibility and review aid, not a legal determination; jurisdiction and the precise terms decide the real case.

Recap

Apache-2.0 and MIT attach their conditions to redistributing copies, and only Apache adds a patent grant, a change notice and the NOTICE mechanism. Community licences and terms of use reach further: Llama 3.1 attaches conditions to making things available and to training on outputs and adds an indemnity and a use policy that binds private use, the Gemma Terms count a hosted service as distribution and a distilled student as a Model Derivative, and a publisher’s own licence is read as a diff against one of these. Open source under OSI 1.0 needs the four freedoms plus data information and code, so most releases are open weight, and the facts that decide which text governs sit in the card metadata, the files, the gate and the parent repositories, where a script reads them. The AI Act reaches providers of general-purpose models, which fine-tunes at course scale are not, by a factor the arithmetic makes plain.

Check your understanding

Question 1. You generate 50,000 answers with Llama 3.1 8B Instruct, fine-tune Qwen3-1.7B (Apache-2.0) on them, and offer the student to customers through an API. No weights leave your machine. What does the Llama 3.1 Community License require of the student?

• Nothing: no Llama weights are distributed and the student is a different architecture
• Its name must begin with "Llama": outputs were used to train a model that is made available, and serving it makes it available
• Nothing: the Qwen3 Apache-2.0 licence governs the student
• Publication of the 50,000 answers

Show the answer and why

Answer: Its name must begin with "Llama": outputs were used to train a model that is made available, and serving it makes it available

Section 1.b.i triggers on using "any outputs or results of the Llama Materials" to train a model "which is distributed or made available". An API is making available, so no copy of weights has to move. The Apache-2.0 licence on the student's base weights adds its own conditions only if you redistribute copies; it does not cancel a condition you accepted under another agreement.

Question 2. You fine-tuned Llama 3.1 8B Instruct, converted the result to GGUF and are about to publish it. Which lines of its model card metadata are defects? Select all that apply.

license: apache-2.0
base_model: meta-llama/Llama-3.1-8B-Instruct
model_name: support-assistant-8b-Q4_K_M

• license: apache-2.0
• base_model: meta-llama/Llama-3.1-8B-Instruct
• model_name: support-assistant-8b-Q4_K_M
• None: a fine-tuned and converted model is a new work with its own licence

Show the answer and why

Answer: license: apache-2.0, model_name: support-assistant-8b-Q4_K_M

Fine-tuning and converting do not change the terms: the licence field should be llama3.1, and a model fine-tuned from Llama materials and distributed needs a name beginning with "Llama". The base_model line is correct and is what lets the next reader trace the licence upward.

Question 3. You serve a fine-tune of a model listed in the Gemma Terms' Appendix, such as Gemma 3 (Gemma Terms of Use), to paying customers through an HTTP API, without distributing any weights. Which statement matches the Terms?

• Nothing applies, because no copy of the weights leaves your machine
• The API is a Distribution, so the use restrictions must be an enforceable provision of your customer terms, while the Notice file requirement expressly excludes hosted services
• You must ship a Notice file to every API customer
• Only the naming rule applies

Show the answer and why

Answer: The API is a Distribution, so the use restrictions must be an enforceable provision of your customer terms, while the Notice file requirement expressly excludes hosted services

Section 1.1(b) defines Distribution to include a hosted service via API, which is the opposite of Apache-2.0, whose section 4 is about distributing copies. Section 3.1 makes the Notice file a condition for "All Distributions (other than through a Hosted Service)". Your fine-tune is a Model Derivative, so the conditions attach to it too.

Question 4. Llama 3.1 8B was pretrained on about 15 trillion tokens. Using C ≈ 6 · P · D, how many tokens would a full fine-tune of it need before its compute exceeds one third of the original, the guidelines' indicative criterion for a modifier becoming a provider?

• About 2.4 × 10^23, a third of its 7.2 × 10^23 FLOP
• About 5 trillion
• About 15 trillion
• It depends on the GPU used

Show the answer and why

Answer: About 5 trillion

P is the same on both sides: (6 · P · D_mod) / (6 · P · D_orig) = D_mod / D_orig, so the criterion is a third of the original tokens, 15 trillion ÷ 3. The first option is the compute threshold, not a token count. Hardware changes how long the run takes, not how many operations it counts.

Question 5. Under the EU AI Act, which obligations still apply to a provider whose general-purpose model is released under a qualifying free and open-source licence with public parameters, and which is not above the systemic-risk threshold?

• All Article 53(1) obligations without exception
• The copyright policy and the public summary of training content; the documentation duties and the authorised-representative duty are excused
• No obligations at all
• Only registration with the AI Office

Show the answer and why

Answer: The copyright policy and the public summary of training content; the documentation duties and the authorised-representative duty are excused

Article 53(2) and 54(6), as the guidelines explain in section 4.1, excuse 53(1)(a), 53(1)(b) and Article 54. The guidelines give the reason the other two stay: an open release "does not necessarily reveal substantial information on the data used for training", nor how copyright compliance was ensured.

Question 6. A lab releases weights under Apache-2.0, its complete training and data-processing code under MIT, and a card describing the corpus as "15 trillion tokens of public web pages, code and books, filtered for quality". Does the release meet the OSI Open Source AI Definition 1.0?

• Yes: both licences are OSI-approved and the code is complete
• No: Data Information must include a listing of all publicly available training data and where to obtain it, and a description of the filtering detailed enough to build a substantially equivalent system
• No: the training data itself must always be redistributed
• Yes: the definition only concerns the weights

Show the answer and why

Answer: No: Data Information must include a listing of all publicly available training data and where to obtain it, and a description of the filtering detailed enough to build a substantially equivalent system

The definition grades data by class: public data must be disclosed with where to obtain it, and only open training data must be shared outright, so the third option overstates it. A one-line corpus description is not a listing, and the definition applies to weights and models too: they "must include the data information and code used to derive those parameters".

Check my answersClear