Open Source Licensing Skill

Open Source Licensing Skill

Overview

Expertise in navigating open-source licenses for AI models and tools, ensuring commercial compliance, managing license obligations, and mitigating intellectual property risks in enterprise AI deployments.

Key Capabilities

• License identification and classification
• Commercial use eligibility assessment
• License obligation management
• IP risk evaluation for AI models
• License compliance documentation
• Open source governance frameworks

License Classification

Permissive Licenses (Low Restriction)

Best for enterprise: Apache 2.0 (includes patent grant)

AI-Specific Licenses

Copyleft Licenses (Higher Restriction)

License Deep Dives

Apache 2.0 (Recommended)

## Apache 2.0 License Summary

### What You Can Do
- Use commercially without restrictions
- Modify and create derivative works
- Distribute modified or unmodified versions
- Use in proprietary software
- Sublicense

### What You Must Do
- Include copyright notice
- Include copy of Apache 2.0 license
- Document significant changes made
- Include NOTICE file if provided

### Patent Grant
"Subject to the terms and conditions of this License, each Contributor
hereby grants to You a perpetual, worldwide, non-exclusive, no-charge,
royalty-free, irrevocable... patent license"

### Termination
License terminates automatically if you initiate patent litigation
claiming the software infringes a patent.

### Models Using Apache 2.0
- Some current-generation model/tool releases may be Apache 2.0 (variant dependent)
- Falcon family
- MPT family

MIT License

## MIT License Summary

### What You Can Do
- Everything Apache 2.0 allows
- Even simpler attribution requirements

### What You Must Do
- Include copyright notice and license text

### What's Missing (vs Apache 2.0)
- No explicit patent grant
- No explicit contribution terms

### Models Using MIT
- Some current-generation model/tool releases may be MIT (variant dependent)
- Some StableLM variants

### Risk Consideration
For enterprise use, MIT is slightly higher risk than Apache 2.0
due to lack of explicit patent grant. Generally acceptable for
inference use but consider patent landscape.

Provider Open-Weights License (Most Common in 2025)

## Provider Open-Weights License Summary

### Commercial Use Rules
Commercial use, redistribution, and fine-tuning rights vary by provider and by variant.

### Common Restrictions to Look For
1. **Redistribution limits:** whether you can mirror weights internally / ship to air-gapped networks
2. **Usage restrictions:** regulated domains, disallowed content, safety constraints
3. **Attribution/notice:** requirements in documentation or UI
4. **Fine-tuning/training constraints:** whether LoRA/QLoRA is allowed; whether re-training is restricted

### Derivative Works
Often allowed, but obligations differ (model card usually defines it).

### Practical Implications
| Use Case | Allowed | Notes |
|----------|---------|-------|
| Internal code assistant | Usually | Verify internal redistribution + logging constraints |
| Customer-facing product | Sometimes | Check any usage restrictions and attribution requirements |
| Fine-tuned model | Often | Confirm fine-tune + redistribution terms |
| Training new model | Varies | Many licenses restrict training new foundation models |
| Enterprise deployment | Usually | Ensure legal sign-off and archiving of terms |

### Compliance Checklist
- [ ] Archive the model card + license text alongside deployment artifacts
- [ ] Confirm commercial use + internal redistribution rights
- [ ] Confirm any usage restrictions fit your intended use
- [ ] Implement any required attribution/notice
- [ ] Legal review sign-off (recommended)

RAIL-Style Licenses (Use Restrictions)

## RAIL-Style License Summary

### Permissive Base
- Commercial use allowed
- Modification allowed
- Distribution allowed

### Use Restrictions (Behavioral)
The license includes specific "Use Restrictions" prohibiting:

1. **Harmful Content Generation**
   - Violence, harassment, discrimination
   - Illegal activities

2. **Deceptive Uses**
   - Impersonation
   - Disinformation

3. **High-Risk Automated Decisions Without Human Review**
   - Legal advice
   - Medical diagnosis
   - Financial advice
   - Employment decisions

4. **Surveillance**
   - Unauthorized surveillance
   - Biometric processing without consent

### Practical Compliance
For typical code assistant use:
- [ ] Don't use for illegal purposes
- [ ] Include human review for critical decisions
- [ ] Don't use for surveillance
- [ ] Pass through use restrictions to end users

### Enterprise Consideration
The use restrictions are reasonable for code assistant use cases.
Primary concern: Ensure end users understand restrictions if
building customer-facing products.

License Compliance Workflow

Pre-Deployment Assessment

## License Assessment Checklist

### Step 1: Identify All Components
| Component | License | Source | Commercial OK |
|-----------|---------|--------|---------------|
| Base model | [e.g., Apache 2.0] | Hugging Face | Yes |
| Fine-tune data | [source license] | Internal | Yes |
| Tokenizer | [license] | Model repo | Yes |
| Serving framework | [e.g., Apache 2.0] | vLLM | Yes |
| Dependencies | [various] | pip | Check each |

### Step 2: Commercial Use Verification
For each component:
- [ ] License explicitly allows commercial use
- [ ] No use restrictions that conflict with intended use
- [ ] No threshold triggers (MAU, revenue, etc.)

### Step 3: Obligation Mapping
| Obligation | Components | How to Comply |
|------------|------------|---------------|
| Attribution | Model, framework | Include in docs |
| License inclusion | All | Bundle licenses |
| Source disclosure | None (permissive) | N/A |
| Patent notice | Apache 2.0 | Include PATENTS |

### Step 4: Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|------------|--------|------------|
| License change | Low | Medium | Version lock, alternatives |
| Patent claim | Very Low | High | Use Apache 2.0 where possible |
| Compliance audit | Medium | Medium | Document everything |

Ongoing Compliance

## License Compliance Maintenance

### Quarterly Review
- [ ] Check for license changes in dependencies
- [ ] Review new model versions for license changes
- [ ] Update compliance documentation
- [ ] Audit distribution for proper attribution

### When Updating Models
- [ ] Verify new version has same/compatible license
- [ ] Update attribution if required
- [ ] Document license in change log
- [ ] Re-assess use restrictions

### Documentation Requirements
1. **License Inventory:** List of all components and licenses
2. **Attribution Notices:** Consolidated attribution file
3. **Distribution Package:** Include all required license texts
4. **Compliance Decisions:** Document any interpretations made

Model-Specific Guidance

Recommended Models by License Risk

## License Risk Tiers for Enterprise

### Tier 1: Minimal Risk (Apache 2.0 / MIT)
**Use freely with standard attribution**

| Model | License | Notes |
|-------|---------|-------|
| Any license-approved variant of Qwen-Next / GLM-4.6 / MiniMax-M2 | Apache 2.0 / MIT / BSD | Verify the specific model card and include required notices |

### Tier 2: Low Risk (Clear Commercial, Some Obligations)
**Commercial use clear, follow specific terms**

| Model | License | Key Obligation |
|-------|---------|----------------|
| Qwen-Next / GLM-4.6 / MiniMax-M2 (provider terms) | Provider Open-Weights License | Archive terms; follow attribution/redistribution rules |
| Any RAIL-style release | RAIL-style | Enforce usage restrictions and pass-through obligations |

### Tier 3: Medium Risk (Review Required)
**Need legal review for specific use case**

| Model | License | Concern |
|-------|---------|---------|
| Large/enterprise variants | Provider-specific | Redistribution and commercial terms may differ by variant |
| Some fine-tuned models | Varies | May inherit restrictions |
| Datasets (for fine-tuning) | Varies | Often unclear terms |

### Tier 4: Avoid for Commercial Use
**Significant restrictions or unclear commercial terms**

| Model | License | Issue |
|-------|---------|-------|
| Models with NC (Non-Commercial) | Various | No commercial use |
| Research-only models | Varies | Explicit restriction |
| Models from unclear sources | Unknown | Provenance risk |

IP Considerations

Training Data Concerns

## Training Data IP Issues

### Known Concerns
- **Copyrighted code:** Many models trained on GitHub code
- **Licensed content:** Training data may include licensed works
- **Opt-out requests:** Some publishers opted out

### Mitigation Strategies
1. **Use models with transparent training:**
   - Prefer models with published data documentation and clear licensing provenance

2. **Implement output filtering:**
   - Detect verbatim code reproduction
   - License header detection

3. **Document model selection rationale:**
   - Why this model was chosen
   - Training data considerations
   - Risk acceptance if applicable

### Indemnification
- Some commercial providers offer indemnification
- Open source models typically have no indemnification
- Consider insurance for IP claims

Output Ownership

## Who Owns AI-Generated Code?

### Current Legal Landscape (2024-2025)
- **Unclear:** Copyright law still evolving
- **Generally:** Human authorship required for copyright
- **Practical:** Treat AI output as work product

### Enterprise Best Practices
1. **Treat as if company owns:**
   - Add standard company copyright
   - Include in version control
   - Apply normal IP policies

2. **Document AI involvement:**
   - Code review for AI-generated content
   - Note AI assistance in commit messages (optional)
   - Maintain records for potential future requirements

3. **Avoid problematic outputs:**
   - Don't commit verbatim model regurgitation
   - Review for license headers from training data
   - Treat as starting point, not final code

Compliance Documentation Templates

License Inventory

## AI System License Inventory

**System:** Local Code Assistant
**Last Updated:** [Date]
**Maintained By:** [Name]

### Core Components

| Component | Version | License | Source | Commercial | Notes |
|-----------|---------|---------|--------|------------|-------|
| <MODEL_NAME> (e.g., Qwen-Next / GLM-4.6 / MiniMax-M2) | <MODEL_VERSION> | <MODEL_LICENSE> | <MODEL_SOURCE> | <YES/NO> | Archive model card + terms |
| vLLM | 0.5.0 | Apache 2.0 | GitHub | Yes | |
| NGINX | 1.24 | BSD 2-clause | nginx.org | Yes | |
| Python | 3.11 | PSF License | python.org | Yes | |

### Dependencies (Notable)

| Package | License | Risk | Notes |
|---------|---------|------|-------|
| transformers | Apache 2.0 | Low | |
| torch | BSD | Low | |
| numpy | BSD | Low | |

### License Files Location
- `/opt/llm/licenses/` - All third-party licenses
- `/opt/llm/NOTICE` - Attribution notices
- `/opt/llm/THIRD_PARTY` - Complete inventory

Attribution Notice

## Third-Party Attribution Notice

This software includes the following third-party components:

### Model Attribution (Fill In)
<MODEL_ATTRIBUTION>
<MODEL_LICENSE_URL>
<REQUIRED_NOTICE_TEXT>

### vLLM
Copyright (c) 2023 vLLM Team
Licensed under the Apache License, Version 2.0.
https://github.com/vllm-project/vllm/blob/main/LICENSE

### [Additional components...]

---

For complete license texts, see the /licenses directory.

Best Practices

License Selection

1. Prefer Apache 2.0 for patent protection
2. MIT is acceptable for inference use
3. Review AI-specific licenses carefully
4. Avoid GPL/AGPL unless specifically needed
5. Document all license decisions

Compliance

1. Maintain license inventory for all components
2. Include all required notices in distributions
3. Review quarterly for license changes
4. Train team on license obligations
5. Establish escalation path for license questions

Risk Management

1. Have alternatives for critical components
2. Version lock to avoid surprise license changes
3. Consider legal review for Tier 3+ licenses
4. Document risk acceptance for any gray areas
5. Monitor legal developments in AI/copyright

This skill ensures organizations navigate open-source licensing effectively, minimizing legal risk while maximizing the benefits of open-source AI.