Cómo mantenerse legalmente seguro al utilizar modelos de IA de código abierto

Open-source AI models are the fastest way to ship an AI feature without renting someone else's API forever. They are also the fastest way to inherit legal obligations you never read. The weights download in ten minutes; the licence that governs them can outlive your product.

The word "open" does a lot of unearned work here. Some model licences really are permissive software licences. Others are custom agreements that cap who may use the model, dictate what you must call your fine-tune, forbid entire categories of use, and reserve the right to switch you off. Several of the most popular model families are not open source at all in the sense the Open Source Initiative uses the term, even though everyone calls them that.

This article is general information for builders, not legal advice, and it is not a substitute for a lawyer who knows your product and your jurisdiction. Licence texts also change between versions. Read the licence attached to the exact model you downloaded, and treat everything below as a checklist for that reading.

What "open source" actually means for a model

A traditional software licence covers source code. An AI model release usually bundles several things that are legally distinct: the weights, the inference code, the training code, the training data, and the outputs. A single licence may treat them differently, and some releases put the code under Apache 2.0 while the weights sit under a bespoke agreement.

Before you look at a single clause, work out which of those five things you are actually taking, and which of them you plan to distribute. Almost every obligation in every licence below is triggered by distribution, not by private use. If you only run a model on your own servers and never hand the weights to anyone, your exposure is far narrower than if you publish a fine-tuned checkpoint. That single distinction resolves most of the panic people have about copyleft.

The AI model you pick sets your ceiling for what you are allowed to build, so pick it with the licence open in the other tab.

The licence families you will actually meet

Here is what the common families require, drawn from the licence texts themselves rather than from summaries.

Licence family	Commercial use	Core obligations	The trap people hit
MIT, BSD	Yes	Keep the copyright notice and the permission notice in all copies or substantial portions	No express patent grant, so patent risk is not addressed either way
Apache 2.0	Yes	Ship a copy of the licence; mark modified files as changed; keep existing notices; reproduce any NOTICE file	The NOTICE file and the "you changed this file" markings are routinely skipped
GPL, AGPL	Yes	Provide corresponding source to whoever you distribute to, under the same licence	Obligations fire on distribution; AGPL extends that to users reached over a network
Llama Community License	Yes, below a user threshold	Display "Built with Llama"; ship the agreement; include the Notice text; name derived models starting with "Llama"	A very large licensee must ask Meta for permission, and the naming rule catches fine-tunes
Gemma Terms of Use	Yes	Pass the use restrictions downstream as an enforceable term; give recipients the agreement; include the required notice	Google reserves the right to restrict usage remotely
OpenRAIL variants	Yes	Apply and propagate the Attachment A use restrictions to every downstream recipient	Use restrictions mean it is not OSI open source, and they bind your customers too
CC BY-NC (datasets)	No	Attribution, and non-commercial use only	Internal business use and freemium products still count as commercial

Permissive licences: MIT, BSD and Apache 2.0

These are the low-friction options. You can modify the work, ship it inside a closed-source product, and keep your own code private. MIT asks for one thing: the copyright notice and the permission notice must travel with all copies or substantial portions of the software.

Apache 2.0 asks for four, and they are the four most commonly ignored obligations in the whole ecosystem. Section 4 requires you to give recipients a copy of the licence, to cause any modified files to carry prominent notices stating that you changed them, to retain the copyright, patent, trademark and attribution notices from the source, and to reproduce the attribution notices from any NOTICE file the project ships.

Apache 2.0 also gives you something MIT does not: an express patent licence from every contributor, described in section 3 as perpetual, worldwide, non-exclusive, no-charge, royalty-free and irrevocable. It comes with a defensive catch. If you file patent litigation alleging that the work infringes your patents, your patent licence under Apache 2.0 terminates on the day that litigation is filed.

Copyleft: GPL and AGPL

Copyleft is widely misdescribed, including in most articles about AI licensing. GPL does not require you to open-source your project because you used the software. It requires that when you distribute the covered work or a derivative of it, the recipients get the corresponding source under the same terms. Run it internally and never ship it, and the distribution obligations never trigger.

AGPL closes exactly that gap for one scenario: if users interact with a modified version over a network, they must be offered the corresponding source. That is the clause that matters for a hosted product, and it is the reason AGPL scares commercial teams while GPL often does not.

In practice you meet these licences on the tooling around models far more often than on the weights: inference servers, vector stores, orchestration frameworks. Scope your review to what you actually redistribute.

Community licences: Llama and Gemma

These are the ones that surprise people, because they are custom agreements rather than standard open-source licences.

The Llama Community License permits broad commercial use, but section 1.b attaches conditions that apply the moment you distribute the materials or anything containing them. You must provide a copy of the agreement, and you must prominently display "Built with Llama" on a related website, user interface, blog post, about page or product documentation. If you use the materials or their outputs to create, train or fine-tune an AI model that you then distribute, the licence requires that model's name to begin with "Llama". Copies you distribute must retain a Notice text file carrying Meta's attribution notice, and the Acceptable Use Policy is incorporated into the agreement.

Then there is the clause everyone quotes and few read carefully. Section 2, Additional Commercial Terms, says that if, on the version's release date, the monthly active users of the products or services made available by or for the licensee or its affiliates exceeded 700 million monthly active users in the preceding calendar month, you must request a licence from Meta, which Meta may grant at its sole discretion, and you are not authorised to exercise rights under the agreement until it does. The important nuance is the measurement point: it is assessed as of the release date of that Llama version, not continuously. Crossing 700 million users next year does not retroactively strip your rights to a model released while you were far below it. If you are anywhere near that scale, this is a question for counsel and for Meta, not for a blog post.

Gemma's terms run on a different mechanism. Google's Prohibited Use Policy is incorporated by reference, and when you distribute Gemma or a model derivative you must include those use restrictions "as an enforceable provision in any agreement" with your recipients, provide them a copy of the agreement, and, for non-hosted distributions, include the notice stating that Gemma is provided under and subject to the Gemma Terms of Use. Google also reserves the right to restrict usage, remotely or otherwise, where it reasonably believes the agreement is being violated. On the upside, Google claims no rights in the outputs you generate.

Responsible AI licences: the OpenRAIL family

OpenRAIL licences, including the CreativeML OpenRAIL-M licence used by several widely deployed image models, grant a royalty-free, worldwide, non-exclusive licence and permit commercial use. What they add is a list of behavioural restrictions in Attachment A: no unlawful use, no exploiting or harming minors, no generating or disseminating false information to harm others, no defamation or harassment, no generating personal information to harm someone, no fully automated decision-making that adversely affects legal rights, no discriminatory treatment based on protected characteristics or social behaviour, no unlicensed medical advice, and no law-enforcement uses such as predicting criminal behaviour.

Two consequences follow. First, because it restricts fields of use, an OpenRAIL licence does not meet the Open Source Definition, whatever the model card calls it. Second, the restrictions are viral in a specific way: you must include them as an enforceable provision in any agreement covering the model or its derivatives, and inform downstream users that the restrictions apply. If you resell or embed the model, those clauses have to appear in your own contracts. Your terms of service generator output is a starting skeleton for that, not a finished clause; the restriction text itself should be copied from the licence and reviewed by a lawyer.

These licences also let the licensor restrict use remotely and update the model, and while the licensor claims no rights in your outputs, you remain accountable for them.

Creative Commons on datasets

Creative Commons shows up on training data, evaluation sets and media far more than on models. The variants matter enormously. CC BY needs attribution and nothing else. CC BY-SA imposes share-alike on adaptations. CC BY-NC forbids commercial use, and "non-commercial" is read broadly: an internal business tool, a free tier that funnels into a paid plan, and a product with revenue plans on the roadmap are all commercial. CC0 waives rights entirely. Never treat "Creative Commons" as a single answer.

The obligations most teams actually miss

Across all these families the same four failures recur, and none are hard to fix once you know to look.

The NOTICE file. Apache 2.0 projects frequently ship one and its contents must be reproduced in your distribution. Copying LICENSE alone is not compliance.
Marking modified files. If you changed the code, Apache 2.0 wants prominent notices saying so. It is a one-line header, and skipping it is a plain breach.
Naming and badging. "Built with Llama", the "Llama" name prefix and Gemma's notice line are contract terms, not branding suggestions.
Propagating use restrictions. OpenRAIL and Gemma require you to bind downstream recipients to the same restrictions, which means editing your customer agreement, not just your README.

A licence review you can run before you ship

Do this once per model, and again whenever you upgrade to a new version. It takes under an hour.

Identify exactly what you are taking: weights, inference code, training code, data, or some combination. Check whether each carries a different licence.
Open the licence file in the model repository itself. Do not rely on the badge on the model card or on a third-party summary; badges are frequently wrong or stale.
Decide whether you will distribute. Write down the answer, because it determines which obligations fire at all.
List every affirmative obligation the licence imposes: notices, NOTICE files, change markings, naming, required disclosure text.
List every restriction: non-commercial, field-of-use, acceptable use policy, territorial limits, user thresholds.
Check whether restrictions must be passed downstream, and if so, get the clause into your customer terms.
Check the training data disclosure on the model card, and record what the provider does and does not claim about provenance.
Archive the evidence: licence text, model card, version identifier, and the date you retrieved them.
Re-run steps 2 through 8 at every version bump. Model licences change between releases, and your compliance position changes with them.

Where the EU AI Act touches open-source models

If you serve users in the EU, the AI Act matters regardless of where you are incorporated, and its treatment of open source is narrower than the headlines suggested.

Article 2(12) states that the Regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems, or as systems falling under Article 5 (prohibited practices) or Article 50 (transparency obligations). So the exemption evaporates precisely where the stakes are highest. Building an open-source model into a hiring or credit-scoring product does not buy you an exemption.

For general-purpose AI models, Article 53(2) offers a separate and partial carve-out. A GPAI model released under a free and open-source licence that allows access, use, modification and distribution, and whose parameters including weights, architecture information and usage information are publicly available, is exempt from the technical documentation obligations in Article 53(1)(a) and the downstream-provider documentation in 53(1)(b). That exemption does not apply to models classified as having systemic risk.

Two obligations survive the carve-out for everyone. Article 53(1)(c) requires a policy to comply with Union copyright law, including respecting rights reservations under the 2019 copyright directive. Article 53(1)(d) requires a sufficiently detailed public summary of the content used for training, following the Commission's template.

On timing: the prohibited-practices rules applied from 2 February 2025, and the GPAI obligations from 2 August 2025. The Article 50 transparency rules, covering disclosure that content is AI-generated and that a user is talking to an AI system, apply from 2 August 2026. The 2026 Digital Omnibus pushed the high-risk deadlines back, moving standalone Annex III high-risk systems to 2 December 2027 and Annex I systems embedded in regulated products to 2 August 2028. Deadlines in this area have moved more than once, so confirm the current dates against the official text before you plan around them.

Keep records you could defend two years from now

Repositories get pulled. Licences get relicensed. Model cards get edited without a changelog. If someone challenges your use in 2028, "I'm fairly sure it was Apache" is not a defence, and a screenshot with a date is.

For every model you ship, keep the source URL, the exact version or revision hash, the full licence text as it read on the day you downloaded it, the model card, and a note of every modification you made. Take a dated capture of the licence page with a website screenshot generator so you have the page as it appeared, and save the text form as well with an HTML to Markdown converter so it is greppable and diffable later.

Pin the artefact itself, not just its name. Run the weights file through a SHA generator and store the checksum alongside the licence snapshot; that is what proves which bytes you actually audited when a repository has since force-pushed. If you keep model metadata as JSON, a JSON to Markdown table converter turns the inventory into a readable register your reviewers and auditors can actually scan.

Get the business structure right early

If you are earning money from an AI product, even as a side project, the entity you run it through determines who pays when something goes wrong. A limited liability company puts a boundary between your personal assets and business disputes, and it makes you legible to customers, banks and investors who expect to contract with an entity rather than a person. It is not the whole job: you will also need an EIN as the business's federal tax identifier and a registered agent with a physical address in the state to receive legal and tax documents. Requirements, fees and annual filings differ by state; for a worked example of one state's process, see this guide to the requirements to form an LLC in New York, then check the rules where you actually operate.

Write down how your product handles user data too, because model licences and privacy law are separate obligations that people conflate. A privacy policy generator gives you a draft to edit, not a document to publish unread; the parts describing what your model does with prompts and outputs have to be written by someone who knows your architecture.

When to bring in a lawyer

An hour of a technology lawyer's time is cheaper than a cease-and-desist, and much cheaper than discovery. The situations that genuinely warrant it are specific:

You are raising money, and investors will diligence your licence stack.
You are stacking several models and datasets with different licences, and need to know whether the combination is coherent.
You are redistributing weights or shipping a fine-tune, which is where most obligations trigger.
A licence requires you to bind your own customers to use restrictions, which means your contracts need real drafting.
You are operating in the EU, or in a regulated sector, where sector rules sit on top of the licence.

Ship it, but read the licence first

Open-source AI is one of the best deals available to a small team, and the obligations attached to it are mostly cheap to satisfy and expensive to ignore. Almost all of them are administrative: a notice file, a badge, a name prefix, a clause in your terms, a folder of dated snapshots.

The teams that get hurt are not the ones that read the licence and made a judgement call. They are the ones that assumed "open source" was a single thing and found out what their licence said from someone else's lawyer. Read the text attached to the version you downloaded, write down what it requires, and get professional advice where the answer matters commercially.

Frequently asked questions

Is a model with an open licence automatically safe to use commercially?

No. Commercial permission is one clause among several. A licence can allow commercial use while still restricting fields of use, requiring you to bind your customers to those restrictions, dictating what you may call a fine-tune, or capping eligibility above a user threshold. Check permission, obligations and restrictions separately.

Does the Llama licence's 700 million user clause apply to my startup?

Almost certainly not, and the mechanics matter. The clause is assessed as of the release date of that Llama version: if the licensee's or its affiliates' products had more than 700 million monthly active users in the preceding calendar month, a separate licence must be requested from Meta, which Meta may grant at its sole discretion. Growing past that number later does not retroactively trigger it for a version you were already licensed for. At that scale, ask counsel rather than relying on any summary.

What is the difference between an OpenRAIL licence and a real open-source licence?

Use restrictions. OpenRAIL licences attach a list of prohibited uses and require you to propagate them to everyone downstream. A licence that limits fields of endeavour does not satisfy the Open Source Definition, so an OpenRAIL model is openly available but not open source in the strict sense — and your customer agreements have to carry the restrictions too.

If I only run a model on my own servers, do copyleft obligations apply?

GPL obligations attach to distribution, so purely internal use does not trigger them. AGPL is the exception: it extends the source-provision obligation to users who interact with a modified version over a network, which covers a typical hosted product. Confirm which of the two you are dealing with before assuming you are clear.

Does the EU AI Act exempt open-source AI?

Only partially. Article 2(12) exempts AI systems released under free and open-source licences except where they are high-risk or fall under Article 5 or Article 50. For general-purpose models, Article 53(2) exempts qualifying open-source releases from certain documentation duties, but not if the model has systemic risk, and never from the copyright policy and public training-data summary obligations in Article 53(1)(c) and (d).

What records should I keep for each model I use?

The source URL, the exact version or revision, a dated copy of the licence text as it read when you downloaded it, the model card, a checksum of the weights file, and a note of every modification you made — stored together, per model, per version, where your future auditor can find them.

Is this article legal advice?

No. It is general information about how these licences and rules are written, prepared for builders rather than lawyers. Licence texts vary by model and by version, regulatory deadlines have already shifted once, and your obligations depend on facts specific to your product and jurisdiction. Consult a qualified lawyer before making decisions that carry real commercial risk.