A new open-weight model lands on the front page most weeks. This one was Kimi K3.1 Pro, sitting near the top of Hacker News on 23 October with the usual benchmark table and the usual question underneath it: can we actually ship this? The answer is supposed to live in one metadata field on the model repository. We checked whether that field is worth reading.
It is not. We pulled the 300 most-downloaded text-generation models on Hugging Face, 355,004,941 downloads between them in the last thirty days, and tried to obtain the licence terms for each one the way a build pipeline would: from the repository itself. A third of them cannot be cleared without a person reading a document, and for 39 of them there is no document in the repository to read.
TL;DR
- Of the 300 most-downloaded text-generation models on Hugging Face, 157 ship no licence or policy file at all. The tag on the model card is the entire legal statement.
- Nine repositories return HTTP 401 for their own LICENSE file, including eight from Meta. The document you are required to accept is behind the acceptance gate.
- Ten of 78 distinct licence links are dead, affecting 29 repositories. One organisation rename broke every licence URL in a model family.
- Qwen2.5-3B-Instruct is research-only and non-commercial, while the 0.5B, 1.5B, 7B, 14B and 32B in the same family are Apache-2.0. The licence is a property of the checkpoint, not the family.
- 13 of 165 derivative repositories declare a different licence from their base model, in both directions. Three declare none at all.
- One licence reuses Apache 2.0’s structure and wording but caps commercial use at US$1,000,000 of gross revenue. Our own string-matching classifier called it Apache.
How we measured it
We took the top 300 models under the text-generation filter, sorted by downloads, from the public Hugging Face API, and fetched the full record for each one. For every repository we recorded the license: tag, the license_name and license_link fields from the model card, the gating status, and the full file manifest. Where a repository contained anything matching a licence, notice or usage-policy filename, we requested the raw file and recorded the HTTP status. Where a card declared a license_link, we requested that URL. Everything ran unauthenticated, with a browser user agent, from one Linux box on 24 October 2026.
Then we resolved the 166 repositories that name a base model, fetched the base model’s record, and compared the two licence declarations. Finally we pulled the complete public catalogue for fifteen publishing organisations to see how many distinct licence values each one uses across its own estate.
Every count below is from that run. Download figures are Hugging Face’s rolling thirty-day numbers at the time of measurement.
Finding one: for 39 models, the terms are not in the repository
We classified a repository as having reachable terms if either a licence file in it returned HTTP 200, or its declared licence link returned 200, or its tag was a well-known SPDX identifier that resolves to a standard text. By that test, 149 of 300 serve their terms directly, 112 rely on an SPDX tag alone, and 39 provide neither. Those 39 account for 33,119,133 downloads in thirty days.
The most interesting failure is not absence, it is permission. Nine repositories ship a LICENSE file and return HTTP 401 when you ask for it. Eight are Meta’s: meta-llama/Llama-3.1-8B-Instruct, meta-llama/Llama-3.2-1B-Instruct, meta-llama/Llama-3.2-3B-Instruct, meta-llama/Llama-3.1-8B, meta-llama/Llama-3.2-1B, meta-llama/Llama-3.1-405B-FP8, meta-llama/Llama-2-7b-hf and meta-llama/Meta-Llama-3-8B-Instruct. Each also hides its USE_POLICY.md, giving 18 unreadable files in total. We probed each three times; the result never varied. You must agree to the licence in order to read the licence.
The ninth is stranger. swiss-ai/Apertus-v1.5-8B carries the tag apache-2.0, which is a licence with no acceptance mechanism at all, and yet the repository is gated, and its LICENSE.txt, USAGE_POLICY.pdf and PRIVACY_POLICY.pdf all return 401. The gate prompt is public and asks you to confirm you have read an Acceptable Use Policy that the apache-2.0 tag does not mention and that nothing in the repository will show you. The policy itself is readable on GitHub, so the terms exist in the open; they are simply not available from the artefact you are downloading. Fair to Apertus: it also ships an EU Code of Practice summary, which is more AI Act documentation than any other repository in our set provides.
Finding two: the licence facet is noise
Hugging Face lets you filter models by licence. Of our 300, 39 are tagged other and 16 carry no licence tag at all. That is 55 repositories, 18 per cent of the most-downloaded models in the ecosystem, that the filter cannot usefully answer a question about.
Alibaba’s own catalogue shows how far this goes. Across 469 Qwen repositories, 132 are tagged other and 15 are untagged. We fetched all 147 and read the license_name each one declares. There are ten distinct strings, and four of them are the same licence spelled four ways.
license_name |
Repos | 30-day downloads |
|---|---|---|
| tongyi-qianwen | 46 | 361,269 |
| qwen | 30 | 1,602,524 |
| tongyi-qianwen-research | 21 | 346,949 |
| qwen-research | 19 | 8,469,452 |
| (none declared) | 14 | 43,771 |
| apache-2.0 | 6 | 1,244,082 |
| tongyi-qianwen-license-agreement | 6 | 120,390 |
| qwen-community-1.0 | 2 | 2,942,150 |
| qwen3.8-max | 2 | 30,209 |
| tongyi-qianwen-license | 1 | 0 |
Forty of those repositories are research-only, carrying 8.8 million downloads a month. Eighty-three are commercially usable. Both sit under the single tag other, so the filter cannot separate them. Six more are plain Apache-2.0 but tagged other, which means a team filtering for Apache models never sees them.
The pattern scales with catalogue size. Across full public estates: Google publishes 1,136 model repositories under nine licence values, 336 of them the bespoke gemma terms. NVIDIA publishes 1,018 under thirteen values, 587 of them other and 98 with no tag. Allen AI publishes 980, of which 216 carry no licence tag at all. LiquidAI publishes 200, of which 195 are other. Microsoft is the outlier in the good direction: 360 of 551 are plain MIT.
Finding three: the licence is a property of the checkpoint, not the family
This is the one that will bite a delivery team. Qwen2.5-Instruct was released as a family on one day, under one brand, with one model card template. Here is what the sizes actually carry.
| Model | Licence tag | license_name |
30-day downloads |
|---|---|---|---|
| Qwen2.5-0.5B-Instruct | apache-2.0 | 5,295,916 | |
| Qwen2.5-1.5B-Instruct | apache-2.0 | 4,779,599 | |
| Qwen2.5-3B-Instruct | other | qwen-research | 3,795,251 |
| Qwen2.5-7B-Instruct | apache-2.0 | 6,369,723 | |
| Qwen2.5-14B-Instruct | apache-2.0 | 799,417 | |
| Qwen2.5-32B-Instruct | apache-2.0 | 1,257,902 | |
| Qwen2.5-72B-Instruct | other | qwen | 232,348 |
The Coder family repeats it exactly: 0.5B, 1.5B, 7B, 14B and 32B are Apache-2.0, and Qwen2.5-Coder-3B-Instruct is qwen-research. The 3B is the odd one out in both families, and 3B is precisely the size a team picks when it wants something that fits on a single commodity GPU or an edge box.
The document behind that tag is unambiguous. It is headed “Qwen RESEARCH LICENSE AGREEMENT”, it defines “Non-Commercial” as “for research or evaluation purposes only”, it grants rights “FOR NON-COMMERCIAL PURPOSES ONLY”, and it adds that if you commercially use the materials “you shall request a license from us”. It also requires that any model you fine-tune from it prominently display “Built with Qwen” in the product documentation. Between the two 3B checkpoints that is 4,234,047 downloads a month of a licence that forbids the thing most of those downloads are for.
We flagged a version of this trap last month while measuring storage costs across 41 European open-weight repositories, where one publisher shipped research and commercial builds of identical weights side by side. What is new here is the frequency and the altitude: this is a flagship family from a top-three publisher, and the anomaly is invisible from the family name.
Finding four: derivatives disagree with their base
Of the 300, 166 declare a base model. We resolved 165 of those chains. 152 declare the same licence as their base. 13 do not.
The disagreements run both ways, and both ways are a problem. Tightening is the honest direction: nvidia/Qwen2.5-VL-7B-Instruct-NVFP4 re-licenses an Apache-2.0 Qwen base as other, livekit/turn-detector wraps an Apache-2.0 Qwen 0.5B in a bespoke LiveKit model licence that forbids using it to train competing models, and webAI-Official/TwIL-LM3 takes Apache-2.0 SmolLM3 and ships it under an explicitly non-commercial licence. Nothing illegal about that, but anyone who assumed “it is a Qwen derivative, so it is Apache” has assumed wrong.
Loosening is worse. jimmy31chen/RVN-Qwen3.8-Flash-Next-Abliterated declares apache-2.0 over a base tagged other. And three high-traffic repackages declare no licence at all over an Apache-2.0 base: LeaderboardModel1/zeta-2.1-autoround-W4A16, bartowski/Qwen_Qwen3-4B-GGUF and RedHatAI/NVIDIA-Nemotron-3.5-Lightning-30B-A3B. An Apache-2.0 base does not stop being Apache-2.0, but a repository that strips the notice is not complying with the licence it inherited, and a downstream consumer pulling that GGUF gets no grant from the uploader.
Two Llama derivatives name the wrong version of Meta’s licence: NousResearch/Hermes-3-Llama-3.1-8B is tagged llama3 over a Llama 3.1 base, and casperhansen/llama-3.3-70b-instruct-awq is tagged llama3.3 over a Llama 3.1 base. Those are different documents with different terms.
Finding five: the clauses are not all aimed at hyperscalers
The received wisdom about bespoke model licences is that their commercial triggers only fire at Meta scale. We read every licence file we could retrieve, 132 of them, and that is mostly but not entirely true. Thirteen contain a commercial restriction, six set a monthly-active-user threshold, eight impose an attribution or naming obligation, five ban military or weapons use, three forbid training other models, and one bans biometric processing and surveillance outright.
The thresholds are all different, and none of them is in the metadata:
- Qwen LICENSE AGREEMENT (72B): above 100 million monthly active users you “shall request a license from us”. That is a gate, not a notice.
- Kimi K2 Modified MIT: above 100 million MAU or US$20 million monthly revenue you must prominently display “Kimi K2” in your product’s user interface.
- Qwen Community License 1.0, used by a third-party reuploader: 100,000,000 MAU or US$20,000,000 monthly revenue, same UI display obligation.
- Swift Open License v1.0: commercial use is conditioned on not exceeding a “Threshold” defined as gross revenue of US$1,000,000 across your whole corporate group in the last completed fiscal year. Above that, the licence simply does not cover you and you need a separate written agreement.
A million dollars of group revenue is an ordinary Irish SME. That licence is attached to ukisai/Swift-1.5-Qwen3.8-27B-GSQ-RCO-GGUF, which took 1,360,251 downloads in thirty days. And the highest-traffic non-commercial model in the entire set is not an exotic one: facebook/opt-125m, at 5,448,124 downloads a month, carries the OPT-175B licence, which grants rights “solely for your non-commercial research purposes” and prohibits commercial or production use, military or nuclear use, surveillance and biometric processing. Its Hugging Face tag is other, with no license_name and no link.
Finding six: the lookalike that fooled our own scanner
We classified each retrieved licence by string matching, the same way a licence scanner in a CI pipeline does. It reported Swift Open License v1.0 as Apache-2.0, and it was not being careless. The document opens with “TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION”, reuses Apache’s section numbering, reuses its definitions of Contribution, Contributor and Derivative Works, and contains the strings “Apache License” and “Version 2.0”. Measured against the real Apache 2.0 text that the same repository also ships, it is a 0.50 similarity match. Half of it is Apache. The other half includes the million-dollar cap.
That is the finding we would put in front of a CTO. Automated licence detection on model weights is not a solved problem the way it nearly is for source packages, because model licences are bespoke prose that borrows the shape of familiar documents. We measured silent SPDX licence changes across 35,319 npm releases earlier this month, and npm at least has a machine-readable field with an agreed vocabulary. Model repositories have a free-text box.
What to do about it
None of this makes open-weight models a bad idea. We deploy them for clients and will keep doing so. It makes the licence a thing you resolve once, deliberately, and record, rather than a field you glance at on a model card.
Four things that cost almost nothing:
- Pin the checkpoint, not the family. “We use Qwen2.5” is not a licence position. “We use
Qwen/Qwen2.5-7B-Instructat revision <sha>” is. The 3B in that family would have put a non-commercial model into a commercial product. - Capture the terms at fetch time. Store the licence tag, the
license_name, the gating status, the resolved licence text and the revision hash as a build artefact. Ten of 78 licence links in our sample are already dead; the Ornith family’s links all point at an organisation that has since been renamed and now 404. The terms you agreed to should not depend on a URL staying up. - Resolve the base chain. When you pull a GGUF, an AWQ build or an FP8 quantisation, read the base model’s licence as well as the uploader’s. Thirteen of our 165 chains disagree, and the uploader is not always the one with authority to loosen.
- Do not let a scanner be the last word. Any licence that is not a verbatim SPDX text needs a human to read it once. There were 101 of those in our 300.
We build and deploy AI systems on self-hosted open-weight models for clients who need the data to stay in their own infrastructure, and the licence audit is part of that work, not an afterthought bolted on at go-live. If you are running models in production and could not currently produce the licence text you are operating under, that is a short conversation worth having. Get in touch.
📷 Photo by Angèle Kamp on Unsplash
