Local LLM Licensing Guide for Businesses (2026): Llama, Qwen, Mistral, Gemma

No — this guide is not legal advice, and it is not a substitute for reading the license text yourself. It summarizes, at a general level, how the commercial-use terms for Llama, Qwen, Mistral, and Gemma are currently structured, based on publicly published license documents. License terms change between model versions, vendors revise their terms without always renaming the license, and the specific facts of your deployment (revenue, user count, redistribution plans, jurisdiction) change how a given clause applies to you. Before any commercial deployment, read the exact license file shipped with the model checkpoint you intend to use and consult a qualified attorney familiar with software licensing and your jurisdiction.

"Open weight" means the model's trained parameters are downloadable and runnable by anyone; "open source" in the OSI sense additionally requires the license to place no restriction on the field of use or the scale of the licensee's business. The Open Source Initiative's Open Source Definition specifically prohibits licenses that discriminate against fields of endeavor or against persons/groups — a usage-based threshold like Llama's 700 million MAU cap fails that test even though the weights themselves are freely downloadable.

Use "open weight" as the accurate description when a model's license includes any usage-scale threshold, a conduct-based prohibited-use policy, or a restriction tied to a specific business activity — this covers Llama, Gemma, and any Qwen or Mistral checkpoint released under a non-Apache license. Reserve "open source" for the specific model sizes genuinely released under an OSI-approved license text like Apache 2.0 or MIT, which several Qwen and Mistral checkpoints are.

This distinction matters commercially, not just semantically: a procurement or legal team evaluating "open source AI" as a category needs to know that the label does not guarantee unrestricted commercial use, and that the actual terms vary by the specific file being deployed, not by the vendor's marketing description.

Meta distributes Llama under its own Llama Community License, which permits commercial use for most businesses but adds a usage-scale threshold that OSI-approved open source licenses do not have. If your product or service — including affiliates — had more than 700 million monthly active users in the month before the specific Llama version was released, the standard license does not authorize you to use it; you must request a separate commercial license directly from Meta, which Meta may grant or refuse at its sole discretion.

Below that threshold, the Community License permits commercial deployment, fine-tuning, and building derivative products. Recent versions have historically required attribution ("Built with Llama" or similar language) in specified circumstances, and have restricted using Llama or its outputs to train or improve a competing large language model outside the Llama family. Meta also maintains a separate Acceptable Use Policy prohibiting specific categories of use, similar in structure to Gemma's Prohibited Use Policy below.

The 700 million MAU threshold is a business-scale restriction, which is why the Llama Community License is not OSI-approved open source even though the weights are freely downloadable below that threshold — it fits the "open weight" category described above.

Alibaba releases most current Qwen model sizes under the Apache License 2.0 — a permissive, OSI-approved license with no usage-scale threshold, allowing commercial use, redistribution, and derivative models with only a standard notice-and-attribution requirement. This is the most business-friendly license among the four families for the sizes it covers.

The exception matters: Alibaba has also released specific Qwen checkpoints — historically some of the largest or newest flagship sizes — under a separate, more restrictive custom license (referred to in Qwen's own repositories as the Qwen License) that includes its own usage-scale threshold and, in some versions, a requirement to display the model's name in a derivative product. Because the license is attached to the checkpoint, not the "Qwen" brand as a whole, two different Qwen model sizes released the same week can carry two different licenses.

Before deploying any specific Qwen checkpoint commercially, open the LICENSE file in that exact model's repository (on Hugging Face or ModelScope) rather than assuming Apache 2.0 applies because other Qwen sizes use it.

Mistral AI has moved most of its current open-weight releases to the Apache License 2.0 — the same permissive, OSI-approved terms Qwen uses for most sizes — but the company's catalog also includes models released under a more restrictive research-only or non-production license. Mistral has publicly signaled a general shift toward Apache 2.0 for new releases, but that shift applies model-by-model, not retroactively to every checkpoint the company has ever published.

A model under Apache 2.0 can be deployed commercially, fine-tuned, and redistributed with only the standard notice requirement. A model still under Mistral's more restrictive research/non-production terms is not cleared for commercial deployment without a separate commercial agreement with Mistral AI — treat any Mistral checkpoint whose license file does not explicitly say Apache 2.0 as non-commercial until confirmed otherwise.

Because Mistral has changed its licensing approach across releases, do not carry forward an assumption from a prior Mistral model you deployed — check the license attached to the specific checkpoint each time you evaluate a new one.

Google distributes Gemma under its own Gemma Terms of Use, paired with a separate Gemma Prohibited Use Policy, rather than a standard OSI-approved open source license. Commercial use is generally permitted under these terms, but the license structure differs from Apache 2.0 or MIT in a way that matters to a procurement or legal review: it includes conduct-based restrictions (the Prohibited Use Policy bars specific categories of use, such as generating content that infringes rights or facilitates illegal activity) and Google reserves the right to restrict usage it believes violates those terms.

A field-of-use or conduct restriction of this kind is exactly the category of clause the OSI Open Source Definition prohibits, which is why Gemma — like Llama — belongs in the "open weight" category rather than "open source" in the strict sense, regardless of how the weights are marketed.

Google has, in public commentary and at various points, discussed more permissive licensing directions for parts of its model lineup. Do not treat any such signal as confirmed for the specific Gemma version or checkpoint you plan to deploy — the terms attached to that exact release are the only ones that govern your use, and Google can revise the Terms of Use and Prohibited Use Policy over time.

No two of these four license structures are identical, and within Qwen and Mistral, different checkpoints of the same family can carry different licenses. Use this table as an orientation, then verify against the current license file for your specific model before deployment.

A usage threshold converts a license from "commercial use permitted" to "separate license required" once your product crosses a specific scale, and only Llama publishes a hard, well-known number: 700 million monthly active users. Qwen has used comparable threshold structures on some of its non-Apache checkpoints, historically framed around a combination of monthly active users and monthly revenue, though the exact figures are set per license and should be read directly rather than assumed.

Use case: a startup building a customer-facing product on a Llama-licensed model does not need to think about the 700 million MAU threshold at launch — it becomes relevant only if the company later reaches a scale most startups never hit, and legal counsel should revisit licensing at that growth stage, not before.

For Apache 2.0-licensed checkpoints (most Qwen and Mistral sizes), there is no usage-scale threshold at all — the license permits commercial use regardless of company size or revenue. This is a meaningful differentiator when your business model anticipates high growth and you want to avoid revisiting the license question later.

Attribution requirements range from "none beyond a standard license notice" (Apache 2.0) to "credit the model by name in specified circumstances" (Llama, some Qwen checkpoints). Redistribution — passing the model or a derivative of it to a third party — is permitted under all four license structures for their current mainstream releases, but each attaches its own conditions.

Use Apache 2.0-licensed checkpoints (most current Qwen and Mistral sizes) when your deployment plan involves redistributing a fine-tuned derivative to customers or embedding the model in a product you resell — the attribution burden is limited to retaining the standard notice. Use extra care with Llama and Gemma derivatives: both require the derivative to carry forward the parent license's conditions (including, for Llama, the "Built with Llama" credit in specified circumstances, and for Gemma, adherence to the Prohibited Use Policy), and Qwen's non-Apache checkpoints can impose a similar pass-through requirement.

When NOT to assume redistribution is unrestricted: if your product embeds a fine-tuned Llama, Gemma, or non-Apache Qwen/Mistral derivative inside a SaaS product sold to enterprise customers, confirm whether the license's attribution and pass-through conditions apply to your specific distribution model — API-only access, on-premises delivery, and bundled software each raise slightly different questions under these license texts.

None of the four license families offers indemnification to the deploying business, and all four distribute the model "as is," without warranty of any kind — this is standard for open-weight and open-source licenses generally, not unique to any one vendor. If a third party later asserts an intellectual-property claim related to a model's training data or output, the license text does not obligate Meta, Alibaba, Mistral AI, or Google to defend or reimburse the business that deployed the model.

This differs from how some commercial, closed AI vendors structure enterprise agreements, where limited indemnification against IP claims is sometimes offered as a paid-tier feature. When evaluating open-weight models for a use case with elevated IP-litigation exposure, the absence of indemnification is a genuine business risk factor to weigh against the cost savings and control benefits of self-hosting — this is a business decision, not something a summary article can resolve for you.

Businesses in this position typically manage the risk through their own liability insurance, contractual risk allocation with their own customers, or by limiting deployment to internal/non-customer-facing use cases where third-party exposure is lower — none of which substitutes for a legal risk assessment specific to your situation.

Match your deployment scenario to the license structure that fits it, then verify the exact checkpoint's license file before committing engineering time to it.

Most licensing problems come from treating a model family's brand name as a proxy for its license, rather than reading the specific file attached to the checkpoint being deployed.

Work through this checklist before a commercial launch on any Llama, Qwen, Mistral, or Gemma checkpoint.