Downloading an AI model is easy. Knowing what you're allowed to do with it, and what you still can't see, is the hard part.
Picture a small team building a customer support chatbot. They find a free AI model online, Alibaba's Qwen2.5-3B, download it, and train it further on a few thousand of their old support tickets so it learns their product. It works surprisingly well. The demo goes great, and a launch date is set.
A week before launch, someone finally reads the license. This version of Qwen is licensed for non-commercial purposes only
(license). Its slightly bigger sibling, Qwen2.5-7B, uses Apache 2.0, a standard license that allows business use (model card). The biggest, Qwen2.5-72B, uses a third license, which, among other rules, makes products with more than 100 million monthly users ask permission first (license). Same family, same release day, three different rule books.
Nothing stopped the download. That's the whole problem in one story. Being able to download an AI model and being allowed to build a business on it are two separate questions, and "open" gets used for both.
Think of an AI model as a cake. The weights are the finished cake: billions of numbers the model learned during training, packed into files you can download. With the cake you can serve it, slice it, or add your own frosting, which in AI terms means running the model and fine-tuning it on your own data.
What the cake doesn't come with is the recipe. That would be the training code (the instructions used to build the model), the training data (the ingredients), and the tests used to check it. Then there's the license: the rules about whether you're allowed to sell slices.
Different companies put different things in the box. OpenAI's gpt-oss-120b, released in August 2025, comes with its weights and the code to run it, but its training data gets only a short description (model card). Ai2's Olmo 3, from November 2025, also publishes its training data, training code, test tools and snapshots saved partway through training (Ai2). Both are useful. Only one lets you check how it was made.
| Piece | Paid AI service (typical) | Open weights: gpt-oss-120b | Fully open: Olmo 3 |
|---|---|---|---|
| The trained model (weights)The finished "cake" | Not shared | Shared (Apache 2.0) | Shared (Apache 2.0) |
| Model blueprintHow it is put together | Described at most | Shared | Shared |
| Code to run it | Not shared | Shared | Shared |
| Code used to train itPart of the recipe | Not shared | Not shared | Shared |
| Training dataThe ingredients | Not shared | Not shared | Shared (Dolma 3) |
| Description of the data | Brief at most | A short paragraph | Shared in detail |
| Test tools and results | Results only | Results only | Shared |
| Snapshots from training | Not shared | Not shared | Shared |
| License (rules of use) | Terms of service | Apache 2.0 + usage policy | Apache 2.0 |
There is a widely recognized answer. The Open Source Initiative (OSI), the nonprofit that maintains the definition of open source software, published the Open Source AI Definition 1.0 in October 2024. It says a truly open source AI must give everyone four freedoms: to use it for any purpose without asking permission, to study how it works, to change it, and to share it, changed or not.
To make those freedoms real, you need three things: the weights, the complete code used to train and run the model, and a description of the training data detailed enough that a skilled person can build a substantially equivalent system
. That doesn't mean every document has to be published. Private data, like personal information, can be described instead of shared. But weights on their own don't qualify.
| Freedom | What it means |
|---|---|
| Use | For any purpose, without asking permission |
| Study | See how it works and inspect its parts |
| Change | For any purpose, including changing its answers |
| Share | With anyone, changed or unchanged |
| Ingredient | What the definition asks for |
|---|---|
| Data information | Enough detail about the training data that "a skilled person can build a substantially equivalent system." Open data must be shared, public data must say where to find it, data sold by others must be listed, and private data (like personal information) must be described but not handed over. |
| Code | The complete code used to prepare the data, train the model, test it and run it, under an approved open source license. |
| Weights | The trained model itself, on open terms. Weights alone are not enough: they must come with the data information and code used to make them. |
When the OSI tested real models against its draft, EleutherAI's Pythia and Ai2's OLMo passed, while Meta's Llama 2 and Microsoft's Phi-2 did not (OSI FAQ). Outside the OSI, companies use these words loosely. So when someone calls a model open, ask which parts.
Quite a lot. Free tools like Ollama and llama.cpp let you run a model on your own computer, with no internet connection needed once it's downloaded. A technique called quantization shrinks models by storing each number less precisely, a bit like compressing a photo: smaller file, slightly lower quality. That's how OpenAI's gpt-oss-20b runs on a machine with 16 GB of memory (model card). Customizing a model is within reach, too: a method called QLoRA fine-tuned a 65-billion-parameter model on a single 48 GB graphics card.
| Example model | Full size | Shrunk to a quarter | What can run the shrunk version |
|---|---|---|---|
| Small: Qwen2.5-3B3 billion parameters | 6 GB | 1.5 GB | A typical laptop |
| Medium: Phi-414 billion parameters | 28 GB | 7 GB | A laptop with 16 GB of memory |
| Large: Llama 3.3 70B70 billion parameters | 140 GB | 35 GB | A high-end workstation or a data-center graphics card |
What you can't do is look inside the kitchen. Meta's Llama 3.1 model card says it learned from ~15 trillion tokens of data from publicly available sources
(model card). (Tokens are small chunks of text.) Meta's technical report adds a rough breakdown by topic, but the data itself isn't released (Llama 3 paper). You can't check whether a test the model aces was in its training data, like a student who saw the exam in advance. And when it gets something wrong, you can't trace the mistake back to where it came from.
Some models use standard software licenses. Apache 2.0 and MIT both let you use, change, share and sell the model, as long as you keep the original copyright notices. Apache 2.0 also includes a patent license from the people who contributed to it. Gemma 4, gpt-oss, Phi-4, Qwen3 and IBM's Granite 4.0 all use one of these two.
Others use a company's own license, and these come with strings attached. Meta's Llama 3.1 license allows business use, but companies whose products had more than 700 million monthly users on its release date must ask Meta first. If you ship it in a product, you also have to display "Built with Llama," and every user must follow Meta's acceptable use policy (license). Llama 4's models all understand images, and for those, Meta's policy doesn't grant rights to people or companies based in the EU, though anyone can still use products built with them (policy). Google's Gemma 3 terms carry their banned uses into any modified version, and Google reserves the right to restrict (remotely or otherwise) usage
it believes breaks the rules (terms). Mistral's Devstral 2 coding model isn't licensed to companies earning more than $20 million a month (license).
The rules also change from one release to the next. Gemma 4 moved to Apache 2.0 in April 2026 (Google). Mistral Large 3 did the same after Large 2 was research-only (Mistral; license). Meta's Muse Glimmer 30B, released in August 2026, is Apache 2.0 too, unlike every Llama model before it (model card). So never guess a license from the company name.
| Model | License | Business use | Key rules |
|---|---|---|---|
| Olmo 3Ai2 · Nov 2025 | Apache 2.0 | Allowed | Keep the license and notices. Training data and code are public too. Source |
| gpt-oss-120b / 20bOpenAI · Aug 2025 | Apache 2.0 + usage policy | Allowed | A short usage policy asks you to "comply with all applicable law." Source |
| Llama 3.1Meta · Jul 2024 | Llama 3.1 Community License | Allowed, with conditions | Over 700 million monthly users on the release date: ask Meta first. If you ship it, show "Built with Llama." Shared models trained with it must start their names with "Llama." Source |
| Gemma 3Google · Mar 2025 | Gemma Terms of Use | Allowed, with rules | Banned uses carry over to modified copies. Google can restrict use it believes breaks the rules. Source |
| Gemma 4Google · Apr 2026 | Apache 2.0 | Allowed | The first Gemma under a standard license. Same company, new rules. Source |
| Qwen2.5-3BAlibaba · Sep 2024 | Qwen Research License | Non-commercial | Research or testing only. Source |
| Qwen2.5-7BAlibaba · Sep 2024 | Apache 2.0 | Allowed | Same family and release day as the 3B, different rules. Source |
| Devstral 2Mistral AI · Dec 2025 | Modified MIT | Revenue limit | No rights for companies earning more than $20 million a month. Source |
The quotes come straight from the original documents, but how a rule applies to your business depends on your situation and where you operate. For anything important, ask a lawyer.
A big reason companies like downloadable models is privacy. When the model runs on your own computers or cloud account, your customers' messages never go to an outside AI company. For hospitals or banks, that can settle the decision.
| Your own computers | Your cloud account | An AI company's service | |
|---|---|---|---|
| Where messages go | Stay in your building | Stay in your cloud account | Go to the AI company |
| Who runs the model | You | You | The AI company |
| Your job | Hardware, updates, security fixes, access, protecting logs, fixing problems | Cloud servers, updates, security fixes, access, choosing the data region, fixing problems | Your app, what data you send, reading their data terms, coping with outages or changes |
| Someone else's job | Model makers: the model and its license | Cloud company: the data centers. Model makers: the model and its license | AI company: computers, running the model, updates and storing your data per your contract |
But control isn't the same as safety. Your chat logs still hold sensitive data, and your servers still need locking down. Even model files can be risky: Hugging Face warns that a widely used file format can run hidden code when it's opened, which is why the safer "safetensors" format exists (Hugging Face). Once you run a model yourself, updates, security fixes and monitoring are all your job.
And seeing a model's weights doesn't make it trustworthy. Open models can make things up (AI people call this "hallucinating"), just like closed ones. Openness makes it possible to check a model. It doesn't do the checking for you.
Openness isn't automatically better. A paid AI service from a company like OpenAI or Google is the easiest place to start and often among the most capable, but you depend on their prices and rules, and your data goes to them. Open-weight models give you control and privacy in exchange for running your own hardware. Fully open models add the ability to inspect and rebuild, from a much smaller selection.
| Paid AI service | Open-weight model | Fully open model | |
|---|---|---|---|
| In short | Rent it | Own the cake | Own the recipe |
| You get | Access over the internet, plus support | The trained model and code to run it | The model, its code and its data details |
| Runs on | The AI company's computers | Your own hardware or cloud | Your own hardware or cloud |
| Customize it? | Only in the ways the company offers | Yes, if the license allows | Yes, even rebuild it from scratch |
| See how it was made? | Only what the company publishes | No, only how it behaves | Yes |
| Costs | Pay as you go | Hardware plus the people to run it | Same as open weights, more to rebuild |
| You depend on | The company's prices, rules and plans | The license and your own team | A smaller choice of models |
Not sure where your project stands? Start with these six questions.
| Question | What to do |
|---|---|
| 1. Have you read the license and model card for the exact version you plan to use? | Read them first. Rules can differ between sizes of the same model (Qwen2.5-3B vs 7B) or between versions (Gemma 3 vs 4). |
| 2. Does the license allow the way your business wants to use it? | Not sure: ask a lawyer to look at the specific rules. No: ask the maker for a business license, or pick another model. |
| 3. Will you share the model, or offer it inside a product or service? | If yes, follow the sharing rules: include the license, keep the notices, and add any required credit, like "Built with Llama." Some licenses, including Llama's, count offering it in a product as sharing. |
| 4. Do you need to show what data the model learned from? | If yes, downloadable weights won't be enough. Look at fully open models that publish their data and code, like Olmo 3 or Pythia. |
| 5. Does your team have the skills to run and secure its own AI servers? | Consider a paid service, or a company that hosts the open model for you. Either way, read how they handle your data. |
| 6. Have you tested the model on your own real examples? | Test accuracy, safety, speed and cost before you commit. Public leaderboards aren't enough. |
Open weights and open source AI aren't two names for the same thing. Open weights give you the finished cake: you can run the model, shrink it and customize it, within whatever rules its license sets. Open source AI, as the OSI defines it, also gives you the recipe: the code that built the model and enough detail about its data to build something similar. Well-known "open" models like Llama, Gemma and gpt-oss are the first kind.
Neither is automatically the better choice. What matters is knowing which one you have. Before you build on a model, check what parts you actually get, what the license allows for that exact version, and what you still can't see. Those answers tell you far more than the word "open."