The open-weight licence trap: Apache 2.0 vs. the community-licence model

LLM Radar — Mon, 20 Apr 2026 11:49:01 +0000

Why "Llama community" and "Gemma terms" aren't the same as Apache 2.0, and why European procurement is starting to notice

Welcome to LLM Radar. Independent evaluation of API providers and open-weight models against European hosting, GDPR and licensing requirements. Updated monthly, sourced from official documentation.

I've been tracking open-weight model licences on LLM Radar since early 2025, and for a long time I treated "open-weight" as a single category. It isn't. The category collapsed under its own weight over the past twelve months, and the consequences are now showing up in European procurement decisions, quietly but with real money attached.

The short version: Meta's Llama Community License and Google's original Gemma Terms of Use look permissive until you read them. They aren't Apache 2.0. The gap matters more every quarter, and the market is starting to price it in.

What the community licences actually restrict

The Llama 4 Community License Agreement, published by Meta in April 2025, is the clearest case. Section 2 carves out a "700 million monthly active users" threshold above which commercial use requires a separate negotiated licence with Meta. Section 1.b.i requires any derivative AI model to begin its name with "Llama" and display "Built with Llama" in product documentation. Section 5.a reserves all trademark goodwill from that required naming to Meta. The Acceptable Use Policy is incorporated by reference and, per Meta's own FAQ, continued use of the model after a policy update constitutes acceptance of the new terms.

That last point is the one most teams miss. Shuji Sado, a Japanese open-source licensing lawyer, laid this out in a detailed January 2025 analysis: the Llama License is functionally a bilateral commercial contract under California law, not a conventional copyright licence. The contractual propagation extends to downstream users of derivative models, and the obligations exceed what Meta's underlying IP rights would allow on their own.

There's a specific EU-relevant restriction that gets less coverage than it should. Llama 3.2's multimodal variants explicitly exclude EU-domiciled individuals from using the weights directly. Per Meta's own FAQ, an EU-based employee can use the models within the scope of employment for a non-EU company, but not for their own purposes. Companies can licence. Individuals cannot.

The original Gemma Terms of Use had a different problem. Oleg Prosin at WCR Legal wrote in March 2026 that no OSI-approved open-source licence grants the licensor the right to unilaterally modify terms after release or to terminate the licence of a downstream user. The Gemma terms reserved both rights for Google. In practical terms, Google could "restrict (remotely or otherwise) usage" it believed violated the Prohibited Use Policy. No Apache 2.0 licensor has ever claimed that power.

Why this matters for EU deployment

I ran into this the hard way when evaluating vendors for European public-sector work. A CTO at a French bank pointed out something I'd been underweighting: when a bank buys a vendor product, legal reviews the licence. Apache 2.0 takes hours. A custom AI licence takes weeks, because novel licence frameworks need line-by-line analysis.

Nick Vidal, head of community at the Open Source Initiative, put it bluntly in TechCrunch in March 2025: "The restrictive and inconsistent licensing of so-called 'open' AI models is creating significant uncertainty, particularly for commercial adoption." Han-Chung Lee, director of machine learning at Moody's, told the same outlet that custom licences make models "not usable" in many commercial scenarios.

The European angle sharpens this. The French Ministry of the Armed Forces, through AMIAD (Agence ministérielle pour l'intelligence artificielle de défense), signed a framework agreement with Mistral on 2026-01-08, hosted on French infrastructure. SAP and Mistral announced a sovereign AI partnership at the Franco-German EU Summit on Digital Sovereignty in November 2025. All of Mistral 3, released on 2025-12-02 per Mistral's own announcement, including the 675B-total-param Large 3 mixture-of-experts model, ships under Apache 2.0.

That licence posture wasn't incidental to the French defence deal. It was part of the underwriting. Arthur Mensch, Mistral's CEO, told the AI Impact Summit in India in February 2026 that customers need the ability to "turn on and turn off" their AI workloads without depending on an external provider. Apache 2.0 makes that possible in a way the Llama licence structurally cannot.

The Gemma 4 concession

The most interesting move came from Google. Gemma 1 through 3 shipped under the Gemma Terms of Use, with Prohibited Use Policy flow-down and unilateral restriction rights. Gemma 4, released in April 2025, shipped under Apache 2.0. No prohibited-use appendix. No revocability. No flow-down obligation to downstream users.

Google did not frame this as a concession. The release notes treated it as a matter-of-fact detail. But from a procurement perspective it reads as Google accepting that the previous Gemma terms were a friction point enterprise legal teams wouldn't absorb. The 31B variant reportedly scores 89.2% on AIME 2026 and 84.3% on GPQA Diamond, which means Google is now offering frontier-ish open weights with no licensing catch. Meta has not matched this move for Llama 4.

Who's defending the community-licence model

In fairness, Meta's own position is that the Llama Community License is "a bespoke commercial license that balances open access to the models with responsibility and protections in place to help address potential misuse." Meta's FAQ explicitly defends the 700M MAU threshold, the naming requirement, and the Acceptable Use Policy as reasonable guardrails on a product Meta makes available at no cost.

That's a coherent position, and for very large users it may be the right one. But it's a position that assumes the licensor-licensee relationship continues indefinitely on Meta's terms. For a European public-sector buyer planning a ten-year deployment, that's a structural dependency. For a regulated-industry buyer facing auditors, it's an ongoing review burden. For a startup building a product brand, the Llama prefix requirement alone is probably disqualifying.

What to watch next

Three signals worth tracking over the next six months.

One, whether Meta adjusts the Llama 5 licence. If Meta keeps the community-licence structure while Google and Mistral ship Apache 2.0 at the frontier, European procurement will continue routing around Meta, regardless of benchmark performance. Mark Zuckerberg's July 2024 open letter positioned openness as Meta's strategic lever. The community licence is the contradiction.

Two, whether the EU AI Office's GPAI Code of Practice disclosures create any pressure on licence form. The Code of Practice doesn't regulate licences directly, but mandatory training-data summaries and copyright-compliance reporting interact oddly with licences that restrict how outputs can be used to train other models.