Software & AI Licenses Explained

Start here

The five questions that matter

A software license is a grant of permission with strings attached. Almost every dispute comes down to five practical questions. Read any license — open source or not — by answering these:

Can I use it commercially? Most open-source licenses say yes without restriction. A few (and many "source-available" licenses) limit or forbid it.
Must I share my source code? This is copyleft. Permissive licenses say no; copyleft licenses say yes when you distribute — and the trigger (distribute vs. offer over a network) varies.
Must I give attribution? Nearly all permissive licenses require you to keep the copyright notice and license text. Failing to do this is the single most common compliance violation.
Do I get a patent license? Copyright covers the expression of code; patents can cover the technique. Apache-2.0, MPL-2.0 and GPL-3.0 include an express patent grant. MIT/BSD do not (the grant, if any, is only implied).
What exactly does the license cover? For ordinary software it's the code. For AI, "the work" splits into code, model weights, training data, and outputs — each can carry different terms.

Copyleft in one sentence: a copyleft license uses copyright to require that derivative works be released under the same (or a compatible) license — the opposite of public domain. "Strong" copyleft reaches into code you link against; "weak" copyleft is limited to the licensed files; "network" copyleft adds the trigger of merely offering the software as a hosted service.

The big reference

License comparison table

The major software, source-available, data, and AI licenses at a glance. "Must share source?" describes the copyleft trigger; "Patent grant?" means an express grant in the license text. This is a summary for orientation — always read the actual license and confirm version numbers.

✅ = yes ❌ = no ⚠️ = conditional / see notes. Summary only; not a substitute for the license text or legal advice.
License	Type	Commercial use	Must share source?	Attribution?	Patent grant?	Notes
Permissive
MIT	Permissive	✅ Yes	❌ No	✅ Keep notice	❌ None express	Shortest, most popular. Do anything; keep the copyright + license text.
BSD-2-Clause	Permissive	✅ Yes	❌ No	✅ Keep notice	❌ None express	"Simplified BSD." Like MIT with a no-warranty clause.
BSD-3-Clause	Permissive	✅ Yes	❌ No	✅ Keep notice	❌ None express	Adds a no-endorsement clause: don't use the author's name to promote your product.
ISC	Permissive	✅ Yes	❌ No	✅ Keep notice	❌ None express	Functionally equivalent to MIT, simpler wording. Default in the npm ecosystem.
Apache-2.0	Permissive	✅ Yes	❌ No	✅ Notice + NOTICE file; state changes	✅ Express + retaliation	The "business-safe" permissive license. Explicit patent grant that terminates if you sue over patents. Preferred for company projects.
Unlicense	Public-domain	✅ Yes	❌ No	❌ None	❌ None express	Dedicates work to the public domain. No attribution required. (Public-domain dedication isn't valid in every jurisdiction.)
CC0-1.0	Public-domain (data/docs)	✅ Yes	❌ No	❌ None	❌ None	Creative Commons public-domain tool. Common for datasets. Not recommended for source code (no warranty/patent terms).
Weak copyleft (file- or library-scoped)
MPL-2.0	Weak copyleft	✅ Yes	⚠️ Modified MPL files only	✅ Keep notices	✅ Express	File-level copyleft: share changes to MPL-licensed files; your other files stay yours. Mixes cleanly into proprietary products.
LGPL-2.1 / 3.0	Weak copyleft	✅ Yes	⚠️ Library changes; allow relinking	✅ Keep notices	⚠️ Via GPL terms (3.0)	For libraries. You may link from proprietary code if users can replace the LGPL library (dynamic linking / object files).
EPL-2.0	Weak copyleft	✅ Yes	⚠️ Modified EPL files only	✅ Keep notices	✅ Express	Eclipse Public License. File-level copyleft, business-friendly. Common in the Java/Eclipse world.
Strong copyleft
GPL-2.0	Strong copyleft	✅ Yes	⚠️ On distribution (whole work)	✅ Keep notices	❌ None express (implied)	Distribute a binary → must offer complete corresponding source under GPL. No express patent grant. Linking GPL code generally makes the combined work GPL.
GPL-3.0	Strong copyleft	✅ Yes	⚠️ On distribution (whole work)	✅ Keep notices	✅ Express + anti-tivoization	GPL-2.0 plus an express patent grant, hardware install-info ("anti-tivoization"), and clearer termination. Not one-way compatible with GPL-2.0-only.
Network copyleft
AGPL-3.0	Network copyleft	✅ Yes	⚠️ Also when offered over a network	✅ Keep notices	✅ Express	Closes the "SaaS loophole": if users interact with a modified version over a network, you must offer them the source. Often avoided by companies for internal/hosted use.
Source-available (NOT OSI open source)
BSL 1.1 (Business Source)	Source-available	⚠️ Limited until change date	✅ Source visible	✅ Keep notices	❌ None express	Source is public but production use may be restricted (e.g., no competing service) until a "change date," when it converts to an open license (often Apache/GPL). Used by MariaDB, HashiCorp.
Elastic License 2.0	Source-available	⚠️ Not as a managed service	✅ Source visible	✅ Keep notices	❌ None express	Free to use/modify, but you may not provide it as a hosted/managed service to third parties or circumvent license keys.
SSPL-1.0	Source-available	⚠️ Service-provider burden	⚠️ Must open the whole service stack	✅ Keep notices	❌ None express	AGPL-derived. If you offer it as a service, you must release the source of the entire management/hosting stack. Not OSI-approved. Used by MongoDB.
Data & documentation (Creative Commons)
CC-BY-4.0	Data/docs · attribution	✅ Yes	❌ No (share-alike not required)	✅ Credit required	❌ N/A	Use anything if you credit the author. Standard for open datasets and docs. (CC is for content, not code.)
CC-BY-SA-4.0	Data/docs · copyleft	✅ Yes	⚠️ Derivatives under same license	✅ Credit required	❌ N/A	"Copyleft for content." Adaptations must be CC-BY-SA. Powers Wikipedia / OpenStreetMap.
CC-BY-NC-4.0	Data/docs · non-commercial	❌ Non-commercial only	❌ No	✅ Credit required	❌ N/A	No commercial use without a separate license. "NC" is a frequent trap for businesses building on "free" data.
AI model & dataset licenses
OpenRAIL / OpenRAIL-M	AI · responsible-use	✅ Yes	❌ No	✅ Pass terms downstream	⚠️ Varies by instance	Permissive except for enumerated use-based restrictions (e.g., no harm, no unlawful surveillance). Restrictions must flow to all downstream users. Used by Stable Diffusion, BLOOM.
Llama Community License	AI · custom (Meta)	⚠️ Yes, with conditions	❌ No	✅ "Built with Llama" + license	⚠️ Conditional	Commercial use allowed, but a >700M monthly-active-user threshold requires a separate Meta license; naming/attribution rules apply. Not OSI open source.
Gemma Terms of Use	AI · custom (Google)	✅ Yes	❌ No	✅ Pass terms + notices	⚠️ Conditional	Broad commercial rights with a Prohibited Use Policy that binds you and all downstream recipients. Not OSI open source.
Commercial / Proprietary	Proprietary	⚠️ Per contract	❌ No (closed)	⚠️ Per contract	⚠️ Per contract	A negotiated EULA/SaaS agreement. Everything — use, redistribution, patents, support, indemnity — is whatever the contract says. No default rights.

Reading the "Type" column: only permissive, weak/strong/network copyleft, and the public-domain rows are OSI-approved open source. Source-available licenses (BSL, Elastic, SSPL) and the custom AI licenses (Llama, Gemma) let you see the code or weights but are not open source — they carry field-of-use limits. Don't assume "the source is on GitHub" means "I can do anything."

What each category means

Plain-English explainers for the six families above. When in doubt, classify a license into one of these before you read the fine print.

Permissive

Do almost anything

MIT, BSD, ISC, Apache-2.0. Use, modify, embed in closed products — you only have to preserve the copyright and license notice. Apache-2.0 adds an express patent grant, which is why companies prefer it for anything patent-sensitive.

Weak copyleft

Share changes to these files

MPL-2.0, LGPL, EPL-2.0. The copyleft is scoped to the licensed files or library — your surrounding proprietary code stays proprietary. The classic way to consume copyleft inside a commercial product.

Strong copyleft

The whole work goes with it

GPL-2.0, GPL-3.0. Distribute software that includes GPL code and the combined work generally must be GPL — and you must offer complete source. Powerful for ensuring freedom; needs care in a commercial stack.

Network copyleft

SaaS counts as distribution

AGPL-3.0. Adds a trigger that ordinary GPL lacks: if users reach a modified version over a network, you must offer them the source. This is what makes AGPL controversial for hosted services.

Source-available

Visible, but restricted

BSL, Elastic-2.0, SSPL. You can read and modify the code, but commercial or "compete-with-us" use is curtailed — sometimes until a future change date. Useful, but not open source.

AI & data

Weights, data, and outputs

OpenRAIL, Llama, Gemma, Creative Commons. Here "the work" fragments into code, model weights, training data, and generated output — each potentially under different terms and use-based restrictions.

Special focus

AI model & dataset licenses

AI licensing breaks the old assumption that "the license covers the code." A modern model release is really a bundle of distinct assets — and the rights to each can differ. This is where most teams get exposed.

Weights ≠ code. A repository can ship its training/inference code under Apache-2.0 while the model weights ship under a custom license (Llama, Gemma) or an OpenRAIL responsible-use license. Permission to run the code is not permission to use the weights commercially.

Data rights ≠ model rights. A dataset under CC-BY-NC (non-commercial) does not automatically taint a model trained on it — and conversely, a permissively licensed model may have been trained on data you have no rights to redistribute. Track the dataset license and the weights license separately; they answer different questions.

Use-based restrictions travel downstream. OpenRAIL, Llama, and Gemma all attach acceptable-use rules (no enumerated harms; Meta's MAU threshold; Google's Prohibited Use Policy) that you must pass on to everyone you distribute to. Stripping those terms breaks the license.

Output ownership is a fourth question. Who owns what the model generates, and whether you may use those outputs to train a competing model, is governed by the model's terms — not by the weights' copyright status. Read the "outputs" clause explicitly.

Practical checklist for adopting any open-weight model: (1) identify the license on the weights, separately from the code; (2) confirm commercial use is allowed at your scale; (3) record the acceptable-use restrictions you must propagate; (4) check the dataset provenance and its license; (5) verify the terms on model outputs. A model that's "free to download" can still be unusable for your product.

The five questions that matter

License comparison table

What each category means

Do almost anything

Share changes to these files

The whole work goes with it

SaaS counts as distribution

Visible, but restricted

Weights, data, and outputs

AI model & dataset licenses

Not sure what your stack is actually licensed to do?