Open weight models explained: what you get, what the license allows, when to use them

What are open weight models? The weights, and only the weights

What are model weights, then? Physically, a trained language model is a large file of numbers: billions of parameters set during training, which decide how the model turns your input into an answer. When a lab releases a model as open weight, that file is what you can download, usually in the safetensors format on Hugging Face, together with a config file, the tokenizer and a model card. Stanford HAI's glossary puts it in one line: a model "whose core components are publicly released, allowing anyone to download it".

What you usually do not get is the training data, the code and recipes used to train the model, and the evaluation sets behind the published scores. So you can run the model, fine-tune it and test it as much as you like, but you cannot rebuild it from scratch or check what it learned from.

That gap is exactly where the Open Source Initiative draws its line. Its Open Source AI Definition 1.0 asks for three things in the form a developer would actually modify: "sufficiently detailed information about the data used to train the system", "the complete source code used to train and run the system", and the parameters themselves. On top of that come four freedoms, to use, study, modify and share the system for any purpose.

Most well-known releases publish the weights and stop there, so by this test they are open weight and nothing more. Which models came out this month is a moving target, tracked in the open source LLM roundup. This page stays on the concept, because the concept is what decides whether you can use any of them.

Open weight vs open source: why the difference matters to a buyer

Open weight vs open source sounds like a naming dispute. One question, is Llama open source, shows why it is more than that.

The short answer is no. The OSI reviewed Meta's license in February 2025 and concluded that "Llama 3.x is still not Open Source by any stretch of the imagination", because the license discriminates against some users and restricts some fields of use. The weights are free to download. The conditions attached to them are what fail the test.

A buyer should care for a practical reason. With open source in the OSI sense, you can find out what the model was trained on, which matters the day a customer or a regulator asks whether personal or copyrighted data went in. With open weight you take the model as delivered and rely on the model card. And the word "open" gets stretched: releases with user caps, revenue clauses or non-commercial terms are still marketed as open, sometimes as open source, which critics call open washing.

The middle column is the one to read twice. Open weight covers everything from "do what you like" to "ask us first if you are big", so the label tells you very little on its own. The license tells you the rest.

An open weight model license is the real product: a plain-words cheat sheet

Every open weight model license answers the same handful of questions: can you use it commercially, can you fine-tune it, can you sell access to it as an API, do you have to credit anyone, and what is off limits. The answers differ more than the launch posts suggest.

The permissive end is crowded. OpenAI's gpt-oss-120b ships under Apache 2.0, as do Qwen3 and, since April 2026, Gemma 4. DeepSeek V4 uses MIT. Earlier Gemma versions, 1 to 3, still run under Google's own Gemma Terms of Use, which pull in a Prohibited Use Policy, so "Gemma terms" without a version number is now ambiguous.

Meta's Llama 4 Community License is where the conditions start. If your group had more than 700 million monthly active users when the model came out, "you must request a license from Meta". You must display "Built with Llama", and any model you derive must have "Llama" at the beginning of its name. The Acceptable Use Policy adds that rights to the multimodal Llama 4 models are not granted to individuals domiciled in, or companies with their principal place of business in, the European Union, though end users of a product built on them are fine. Meta's newer Muse Model License for Muse Spark Open, released on 15 October 2026, needs a separate agreement before you offer the model as a service once your group's revenue reaches $20 million in 12 months, and its "Built with Muse Spark Open" line must also appear on products built on derivatives, a term that covers fine-tuned and distilled models, per the Muse Spark Open model card.

Two traps hide behind the table. The first is that one family can carry different licenses. Bielik 7B Instruct v0.1 is CC BY-NC 4.0, non-commercial, while Bielik 11B v3 is Apache 2.0. PLLuM 12B is Apache 2.0, yet Llama-PLLuM-70B is under Meta's Llama 3.1 license because it is built on Llama. Read the model card of the exact checkpoint, not the family page.

The second is that the license that applies is the one the weights shipped with. When a lab changes terms for a new version, as Google did with Gemma 4, the copy you downloaded earlier keeps its old terms. Store the license file next to the weights, with the date.

Open weight models for business: four patterns that hold up

Most real uses of open weight models for business fall into four patterns, and only one of them is mainly about saving money.

Private search over internal documents. The whole retrieval pipeline, from embeddings and the vector store to the model itself, runs inside your network, so contracts or patient files never leave it. The hard parts are the usual ones for RAG over a knowledge base and for giving AI access to your data. The model is simply one more component you now host.

A narrow task or a specific language. A smaller open model tuned for one job often beats a large general one on that job. In Poland, Credit Agricole bought GPU servers and runs Bielik locally for a plain-language text corrector tuned on the bank's own texts, and the government's PLLuM model answers citizens inside the mObywatel app, with over 730,000 conversations reported by August 2026.

Cost tiering. A small open model handles the high-volume, simple requests, and a closed frontier model gets the hard ones. An empirical 100 trillion token study of OpenRouter traffic found that open weight models reached about a third of all tokens by late 2025. Among the enterprises Menlo Ventures surveyed, the open share of usage fell from 19% to 11% over the same year. Different populations, different questions, so neither number is "the" adoption rate.

A frozen version, or no internet at all. Weights you host only change when you change them. That suits regulated processes that need the same model for years, devices in the field, and sites that run offline.

A common mistake is calling a hosted API for an open model and treating it as on-prem. It is not, because the data still leaves. What open weights really add is the option to move: the same model runs at another host or on your own server, which no closed API offers.

Self-hosted LLM vs API: open weights are rarely free to run

The weights cost nothing. The GPU, the people and the upgrades around them do, and most self-hosted LLM vs API comparisons are done on GPU price alone, and that is where they go wrong.

Start with the GPU, since it is the one line with a public price. CloudFerro's price list for its WAW3-2 cloud quotes a full NVIDIA H100 at 6.29 EUR per hour, or 2,776 EUR per month on a one-year term, and a full L40S at 1.97 EUR per hour or 888 EUR per month (excluding VAT, checked 30 October 2026). Which card a given model needs is a separate question, covered in the hardware requirements guide.

Then comes utilisation, the number that usually decides the outcome. A rented or owned GPU bills whether it works or not, and IntuitionLabs' cost analysis puts it bluntly: "Low utilization directly inflates the effective cost per token." The arithmetic is simple: a server busy 10% of the time pays ten times more per useful token than the same server at full load. The studies it cites found most production GPUs running below 60% utilisation, and it refuses to name a universal break-even point, which we think is the honest answer.

After that come the costs that never appear in a GPU quote. Someone has to keep the serving stack patched and answer when it falls over at night. You need an evaluation set to rerun before every model upgrade, plus guardrails, logging and access control. A better model appears every few months and moving to it is work. This operational load is one of the usual reasons AI systems pass the demo and fail in production.

Self-hosting often competes less with GPT or Claude than with the same open model behind someone else's API, where prices are low. OpenRouter's June 2026 snapshot put DeepSeek V4 Flash's first-party output price at "roughly 150x cheaper than GPT-5.5's output costs". A private GPU that sits half idle rarely beats that. When self-hosting wins, the reason is usually data control or high, steady volume, not the price per token.

A check you can do in a spreadsheet this week: take the monthly GPU cost, divide it by the tokens you will really process per month at your real load, and compare the result with the per-token price of a hosted version of the same model. Then add the cost of the person who runs it. If the number still looks good, self-hosting is worth a pilot.

Why open models matter even if you never download the weights

Open models matter even to a company that will only ever call an API: open weights put a ceiling on what closed labs can charge, and they give you somewhere to go.

Prices first. Epoch AI found that the price of reaching a given level of performance fell between 9x and 900x per year, depending on the milestone. The market noticed what open releases do to that curve in January 2025, when DeepSeek's release was followed by Nvidia losing about $589 billion in market value in a day.

Then quality. Stanford's AI Index 2025 measured the lead of the best closed model over the best open one on Chatbot Arena at 8.04% in January 2024 and 1.70% by February 2025. The AI Index 2026 shows the gap reopening, to 3.3% in March 2026. Epoch AI measures it in time instead: in 2026 the best open models trail the closed frontier by about 4 months.

Geography is the part that turned this into politics. Chinese models took 41% of Hugging Face downloads over the past year, and the Qwen family alone has more than 113,000 derivative models. In July 2026, 25 companies and groups including Nvidia, Microsoft, Meta, Mistral and Hugging Face signed an open letter defending open weights in Washington, while OpenAI, Anthropic and Google did not sign.

For an ordinary company, the most practical benefit is the exit path. Closed models are retired on the vendor's schedule, which forces migrations like the move to a new Claude version. An open model you host changes only when you decide, and even if you never host one, knowing that a good enough open alternative exists is leverage when the contract comes up for renewal.

The EU AI Act open source exemption covers less than its name suggests

The EU AI Act open source exemption is real but narrow, and it is written for the company that releases a model, not for the one that uses it.

Article 53(1) of the AI Act gives providers of general-purpose AI models four duties: (a) technical documentation for the authorities, (b) documentation for developers who build on the model, (c) a copyright policy, and (d) a public summary of the training content. Article 53(2), as published on the Commission's AI Act Service Desk, lifts only (a) and (b), and only for models under a free and open-source license with the weights, architecture and usage information public. It ends: "This exception shall not apply to general-purpose AI models with systemic risks." Those are models presumed above 10²⁵ training FLOPs.

The Commission's FAQ on its GPAI guidelines narrows it further: the license must allow access, use, modification and distribution "without monetisation". The guidelines overview on artificialintelligenceact.eu lists non-commercial or research-only terms among the restrictions that disqualify a license, and paid hosted access among the monetisation signals. Our reading is that licenses with user or revenue thresholds, like Llama's or Muse's, likely do not qualify. That is the provider's paperwork, though, not yours.

Fine-tuning does not turn you into a model provider either. The same FAQ says a company that modifies a model becomes its provider only "when the modification or fine-tuning uses more than one-third of the original model's training compute". A business-sized fine-tune sits far below that.

As a deployer, your obligations come from what you do with the model, meaning its risk category under the Act, not from the license class. That side is covered in the AI Act compliance guide.

GDPR works the same way. Running the model on your own servers changes who processes the data: no external processor, and no transfer outside the EU to justify. Your own duties stay where they were: a legal basis, a DPIA where the processing is risky, access control and logs. A model on a rented GPU in an EU region sits in between, with a processor but no third-country transfer.

The risk side: safeguards come off, and weights never come back

Open washing, calling a release open source when the license says otherwise, is the mild risk. The sharper one is that published weights cannot be recalled or patched for everyone who already has them.

Safety training can be edited out. NPR reported in May 2026 that Hugging Face lists over 6,000 "abliterated" models, with their ability to refuse removed, against about 600 in 2024, and that a tool called Heretic automates the process in minutes. That count is NPR's and we have not reproduced it, but the direction is not in dispute.

Provenance is the other half. In February 2026 Anthropic said it had detected more than 16 million exchanges through about 24,000 fraudulent accounts used to distill Claude, and named DeepSeek, Moonshot and MiniMax. That is Anthropic's claim in a commercial dispute, but the point for a buyer stands: from the weights alone you cannot see how a model was trained, and some customers and public buyers now ask where a model comes from. Check your contracts before you pick one.

A model file is also software from the internet, with the same supply-chain risks as any unvetted code or package. Before you download anything, check four things on the model card. Is the uploader the lab's official organisation and not a lookalike account? Does the license file match what the card claims? Is there a training data statement? Are the weights in safetensors rather than pickle files, which can execute code when loaded?

Public benchmarks will not tell you how a model handles your invoices or your contracts. Build a small test set from your own documents and measure the errors yourself. Smaller open models fail differently from frontier ones, and only your own data shows where.

Should your company use open weight models? A decision rule

For most businesses, the honest default is to start on a closed API and keep an exit path. Move to open weights when at least one of these is true.

Data cannot leave your perimeter. A contract, a regulator or a client says so, and an EU-hosted closed API does not satisfy them.

Volume is high and steady. Your GPU would be busy most of the day, and the spreadsheet check from the cost section comes out ahead after staff costs.

You need a frozen version. The process has to behave identically for years, and vendor deprecations would mean re-validating it each time.

You need a narrow fine-tune. The task is specific enough that a small tuned model wins your evaluation, often in a language or domain the big models handle poorly.

If none of these holds, a closed API is usually cheaper and better, and the wider buy-or-build reasoning is in four questions that settle build vs buy.

Before you commit either way, run this checklist on your own material.

1. Collect a few dozen real inputs from the process, with the answers a person on your team would accept.

2. Run them through one open model on a hosted API and one closed model. No servers yet.

3. Score both on your own criteria, and note where each fails, not just how often.

4. Read the license of the exact checkpoint you would deploy, including any acceptable use policy, and save a copy.

5. Do the per-token arithmetic at your real load, people included, and write down how you would switch if the model or its host disappeared.

The short version: read the license, then test on your own data

Open weight models give you the trained file and the freedom to run it where you like, not the data or recipe behind it, so they are not open source. The license decides what you may do, the utilisation decides what it costs, and the EU AI Act exemption mostly concerns the lab, not you. The gap to closed models is measured in months, which is small enough that for many business tasks the decision rests on data control and volume rather than raw quality.

The next step is cheap: take one process, build a test set from your own documents, and run an open and a closed model against it. If you would like a second opinion on the result, we do a free audit of exactly this kind of decision.

FAQ