What you may ship, and what nobody has settled

Three licences stack, and people check one

A model you fine-tuned carries obligations from at least three sources, and they are independent of each other.

The base weights’ licence. Apache-2.0 and MIT are permissive. Several widely used families are not, despite being called open: some carry an acceptable-use policy that travels with derivative works, some add a naming requirement, and at least one imposes conditions that only take effect above a monthly-active-user threshold. Read the licence file in the repository rather than the word on the model card.

The dataset’s licence or terms. A public dataset frequently carries a non-commercial or share-alike condition. Scraped content carries the source’s terms. Data your own users produced carries whatever your privacy notice promised them, which is a commitment you made and can be held to regardless of anything else.

The terms of any model used to generate data. If you produced training examples with a hosted model, that provider’s terms apply to the output. Several restrict using outputs to develop or improve a competing model. Whether a narrow task adapter is a competing model is contested, largely untested in court, and answered differently by different providers’ wording.

Naming clauses are real and easy to breach

Some base licences require derivative models to carry a prefix in their name and to state the base model they came from. This sounds trivial and it is the clause most often breached, because people name the artefact after their company and publish it without reading past the first paragraph.

It costs nothing to comply. Put the base model’s name and licence file alongside your weights, and follow any naming requirement literally.

What is unsettled

Three questions have no settled answer, and anyone who tells you otherwise is describing one jurisdiction’s current position as though it were universal.

Whether training on copyrighted material is permitted. Litigation is active in several countries and the reasoning has not converged. Some jurisdictions have statutory text-and-data-mining exceptions with opt-out mechanisms; others rely on fair-use-style doctrines assessed case by case; others have nothing on point. Outcomes so far have turned on narrow facts (how the material was obtained, whether it was retained, what the output competes with) rather than on a general principle. Nothing here is stable enough to plan around, and it differs by where you are and where your users are.

Whether model weights are copyrightable at all. If weights are the output of an automated process rather than an authored work, the traditional basis for copyright is unclear, which unsettles the ground that model licences stand on. Some argue licences on weights operate as contracts rather than copyright licences, with different consequences for who is bound. This is unresolved.

What erasure means for a trained model. If a person exercises a right to have their data deleted, removing the row from your dataset is straightforward. What that implies for a model already trained on it is not: retraining is sometimes impractical, machine unlearning is an active research area rather than a reliable tool, and regulators have not converged on what is required.

This course cannot resolve any of these, does not give legal advice, and would be lying if it pretended the position were clear. What it can do is tell you where the disagreement sits, so that you ask a lawyer a specific question rather than a general one.

What to do, which is cheap

The engineering practices that keep you able to answer questions later cost almost nothing at the time and are impossible to reconstruct afterwards.

Keep a provenance record per dataset: source, date, licence or terms, and how it was obtained. Keep the base model’s licence file with your weights. Record the base repository and commit. And write a short model card (half a page is enough) that states the base model, what the adapter was trained to do, what data it came from, the licence, the intended use, and the known failures you found during evaluation.

# triage-adapter v3
Base: Qwen/Qwen2.5-7B-Instruct @ <commit>  (Apache-2.0, licence file included)
Data: 1,840 internal support messages, consented under our privacy notice v4;
      180 synthetic edge cases, generated locally with the same base model.
Trained: LoRA r=16 alpha=32, 2 epochs. Eval: 0.91 exact match on held-out set.
Known failures: messages under five words; mixed-language messages.
Intended use: internal triage only. Not for clinical decisions.

That block is the difference between an artefact a colleague can safely adopt and one nobody can evaluate. It is also, if the legal questions above ever reach you, the only record of what you actually did.

Write the provenance while you still remember it. Nobody has ever successfully reconstructed where a dataset came from a year later.