Open Weights Is Not Open Source: What a Model Licence Actually Lets You Do

You can download a model, hash it, run it offline on a laptop with no account and no network, and still not have open source. Those are real wins. Local inference keeps your prompts on your machine and keeps a vendor's policy change from switching off your notebook. But "I have the file" answers a different question from "I am free to study, change, and share this system for any purpose."

Thesis: open weights means the learned parameters are downloadable. Open source means a specific set of freedoms, granted by the terms, over the form you'd actually need to modify the thing. A model can be the first without being the second. For anyone building on local AI for the long run, the gap shows up in three places: the licence text, the training data, and what you can actually check from where you sit.

The yardstick: two OSI definitions

The Open Source Definition has governed software licences for decades. Two of its criteria matter most here. Criterion 5: "The license must not discriminate against any person or group of persons." Criterion 6: the licence "must not restrict anyone from making use of the program in a specific field of endeavor." Criterion 2 adds that source must be "the preferred form in which a programmer would modify the program."

For AI, the Open Source Initiative published the Open Source AI Definition 1.0. It carries over four freedoms (use for any purpose "without having to ask for permission", study, modify, share) and then says what the "preferred form to make modifications" means for a machine-learning system. It's three things together:

• Data information: enough detail about the training data "so that a skilled person can build a substantially equivalent system", including provenance, selection, labelling and filtering, plus where to get the public and third-party data.
• Code: "the complete source code used to train and run the system," including data processing, training settings, and tokenizers.
• Parameters: the weights, under OSI-approved terms.

The definition is explicit that "Open Source models" and "Open Source weights" "must include the data information and code used to derive those parameters." Under this yardstick, weights alone are a compiled binary with a generous download button.

Three licences, three different answers

A community licence with conditions. The Llama 3.1 Community License grants a "non-exclusive, worldwide, non-transferable and royalty-free limited license" to use, modify, and redistribute. That's broad. It also attaches conditions that the OSD doesn't allow:

• If your products had more than "700 million monthly active users in the preceding calendar month" on the release date, you must ask Meta for a licence, "which Meta may grant to you in its sole discretion."
• Use must follow an Acceptable Use Policy "incorporated by reference," which lives at a URL rather than in a fixed text.
• Derivative models that are distributed must put "Llama" at the beginning of their name, and products must display "Built with Llama."

The Llama 3.2 Acceptable Use Policy goes further for one class of model: for its multimodal models, the Section 1(a) rights "are not being granted to you if you are an individual domiciled in, or a company with a principal place of business in, the European Union" (end users of a product built on them excepted). That is discrimination by geography, written into the terms. You can disagree about whether it's justified. You can't call it open source under criterion 5.

Use restrictions that travel downstream. The Gemma Terms of Use, which cover Gemma 1 through Gemma 3 and their variants, require anyone redistributing Gemma or Model Derivatives to carry the use restrictions forward "as an enforceable provision" in their own terms. "Model Derivatives" explicitly includes models trained by distillation or on "synthetic data Outputs by Gemma." The terms also say Google "reserves the right to restrict (remotely or otherwise) usage" it believes violates the agreement. Then, on 2 April 2026, Google released Gemma 4 under Apache 2.0, calling it "the first in the Gemmaverse to be released under the OSI-approved Apache 2.0 license." Same family name, different legal object. The licence belongs to the specific release, not to the brand.

Weights plus data plus code. Ai2's OLMo is the reference case on the other end. The repository publishes the pretraining mixes by name (OLMo-mix-1124, Dolmino-mix-1124), training configs, a reproduce command, and checkpoints "at minimum every 1000 training steps." The OLMo 2 7B model card declares apache-2.0 and lists those datasets, and the pretraining mix declares odc-by. That's what "the preferred form to make modifications" looks like in practice: you could, at least in principle, rebuild it.

Most local users never retrain a model. The difference still matters. The study and modify freedoms are what let outsiders audit what a model was taught, and data information is the only route to that audit.

What you can actually verify from your machine

Here the local-AI habit of "verify, don't trust" hits a hard limit.

You can verify the file. A hash pins exactly which bytes you run. Earlier notes cover why that matters and where it falls short (loaders, background upgrades).

You can read the declared licence, but not trust it blindly. The GGUF spec defines general.license as an SPDX expression, plus general.license.link and general.base_model.* fields naming parent models. Ollama's Modelfile has a LICENSE instruction to embed the licence text. Hugging Face model cards carry a license: identifier from a fixed list that includes apache-2.0 and mit next to llama3.1, gemma, and other. All of these are labels set by whoever packaged the file. They help you find the governing terms. They don't change them.

A missing gate is not a missing licence. Hugging Face's gated models feature makes users share a username and email before downloading. Authors "can decide at any time to block your access," and there's even an extra_gated_eu_disallowed flag that geoblocks by IP. When we checked the Hub API, meta-llama/Llama-3.1-8B-Instruct was gated with manual approval, while a widely used community GGUF conversion of it was ungated and still tagged llama3.1. The gate controls who downloads from one repository. The licence follows the weights into every quant.

You cannot verify the training data from the weights. No hash, metadata field, or benchmark tells you what a model was trained on, what was filtered out, or whose writing is in it. If the publisher doesn't release data information, nobody downstream can reconstruct it. That's the part of the OSAID that weights-only releases leave out, and it's the part a local runner can't fill in.

Why this matters beyond licence pedantry

People run models locally because they don't want their work to depend on someone else's permission: newsrooms protecting sources, clinics and legal-aid groups with confidential files, researchers in places where cloud access is unreliable or watched, and small teams that can't afford to be cut off. Terms that can be revised by URL, rights that end above a usage threshold, geographic carve-outs, and restrictions inherited by every fine-tune are all dependencies that offline execution doesn't remove. The model keeps running when the network goes down. The licence still applies.

A practical habit that travels: before you build on a model, record three things beside its hash. Which licence text applies to this release, whether training data information is published, and which base model it descends from. If you can't fill in the second, call it "open weights" in your own docs and keep the stronger word for systems that earn it.

What this is not

This isn't a ranking of models or a claim that weights-only releases are bad. They're a real public good, and many people run them for sound reasons. It isn't legal advice about whether a given use complies with a given licence; read the actual terms and get qualified counsel if your use depends on it. It doesn't argue that the OSAID is the only reasonable definition, only that it's the published one with criteria you can check. Licence terms change between releases, so read the text for the exact version in front of you. And nothing here touches prices, tokens, custody, or trading.

Related on CryptoDecentral

• Decentralised / local AI pillar
• Local and Peer-to-Peer AI: Data Residency Without the Hype
• Successful Load Is Not Proof: Embedded GGUF Alignment and Wrong Tensors
• A Background Upgrade Is Not a Verified Pull
• DeepSeek Harness on a Local Stack
• Inference Residency Is Not Action Residency: Tools, MCP, and Local LLMs

Further reading (primary)

• OSI: The Open Source Definition
• OSI: The Open Source AI Definition 1.0
• Llama 3.1 Community License Agreement
• Llama 3.2 Acceptable Use Policy (EU multimodal clause)
• Gemma Terms of Use (Gemma 1–3 family)
• Google Open Source Blog: Gemma 4 under Apache 2.0
• Ai2 OLMo repository (data mixes, configs, checkpoints)
• GGUF specification: general.license and base_model metadata
• Ollama Modelfile reference: LICENSE instruction
• Hugging Face: licences on the Hub
• Hugging Face: gated models