I am not a lawyer and this is not legal advice. It is a list of the things that surprise people, so you know what to hand to someone who is.
Three families
Genuine open source. Apache 2.0 or MIT. Mistral's main line, Qwen3, DeepSeek-R1, Phi-4, OLMo, IBM Granite, SmolLM. Keep the notice, do what you like. No user caps, no acceptable use policy, no naming rules. If two candidates are close and one is Apache 2.0, that is a real tiebreaker.
Bespoke community licences. Llama, Gemma, and some Qwen releases. Free for nearly everyone, with conditions attached. Written by the lab, not by lawyers who expected you to redistribute.
Non-commercial or non-production. Cohere's Command R family under CC-BY-NC. Mistral's Codestral under a non-production licence. A large share of research fine-tunes on Hugging Face. You can prototype. You cannot ship.
The clauses people miss
User thresholds. Llama's licence stops being free above 700 million monthly active users, measured before the model's release date. Some Qwen releases use 100 million. This will not bite you. It bites the company that acquires you, and it is the first thing their diligence checks.
Naming and attribution. Llama requires "Built with Llama" displayed prominently, a specific attribution line in your notice file, and any model you derive from it must have a name that *starts with* "Llama". Teams discover this after printing the branding.
Acceptable use policies incorporated by reference. Gemma's terms attach a prohibited use policy that Google can update, and reserve Google's right to restrict use it believes violates that policy. You are agreeing to a document that can change after you ship.
Territory. Llama 4's licence carried a restriction on the multimodal models for entities domiciled in the EU. Read the geography clause if you have European users or a European entity.
What you may do with outputs. Some licences restrict using generations to train other models. Llama's recent terms allow it if the resulting model's name begins with "Llama". If your plan is to generate synthetic training data, this clause is the whole plan.
The inheritance trap
This is the one that catches careful people.
DeepSeek-R1-Distill-Llama-70B is a Llama model that was trained on R1's reasoning traces. DeepSeek-R1 itself is MIT. The distill is not. It carries Meta's community licence, because the base weights are Meta's.
A fine-tune inherits the base model's licence. So does a fine-tune of a fine-tune. Follow the chain to the bottom:
# the front matter of a model card names its parent
hf download deepseek-ai/DeepSeek-R1-Distill-Llama-70B README.md --local-dir ./card
head -20 ./card/README.md # look for: license:, base_model:Repeat on the parent. Keep going until you reach something with no base_model field.
And separately from the weights: the *data* a fine-tune was trained on has its own terms. A great many popular community fine-tunes were trained on outputs scraped from a closed commercial API, which typically breaches that API's terms of service. An Apache 2.0 badge on the resulting weights does not repair that.
A five minute check
For every model you are seriously considering:
hf download <org>/<model> LICENSE USE_POLICY.md README.md --local-dir ./chkRead the LICENSE. Read the use policy. Read the README front matter for license, base_model, and whether the repo is gated.
On gated repos: clicking "agree" on Hugging Face is you entering an agreement. A CI job with a shared token that inherits your acceptance is not a separate acceptance, and mirroring the weights to a public bucket to dodge the gate breaks the terms you agreed to.
Write it down once
Keep a two-line-per-model inventory in the repo:
Qwen/Qwen3-8B | rev 9a3f21c | Apache-2.0 | no restrictions | prod: summarizer
google/gemma-3-4b-it | rev 4b1e07d | Gemma Terms | prohibited-use policy, updatable | prod: on-deviceIt takes ten minutes to start and saves a bad week later, when someone asks what you are shipping and the honest answer has to be assembled from memory.
Before you move on