"Open-source LLM" is one of the most overloaded phrases in tech right now. In 2026 the phrase covers everything from genuinely permissive Apache 2.0 weights you can ship in a commercial product to "you can download it but talk to legal first" community licenses that look open and behave like proprietary. The OSI does not consider most "open-source LLMs" to be open source under its formal definition. Here is the honest map.
Three categories that get conflated
The 2026 landscape has three distinct buckets:
True OSS-compatible weights — Apache 2.0, MIT, BSD. No usage restrictions, no MAU thresholds, no acceptable-use addenda beyond the standard disclaimer.
Open-weight community licenses — Custom licenses that publish weights for free use with restrictions. The Llama Community License is the canonical example.
"Source-available" — Source/weights are visible, but commercial use is gated by a separate paid agreement (some Mistral frontier models in 2026 sit closer to this).
Treating these as the same thing is how legal review gets surprised six weeks before launch.
Llama: open weights with strings
Meta's Llama family — Llama 3, 3.1, 3.3, and the Llama 4 line — ships under the Llama Community License. The two clauses that matter:
The 700M MAU threshold. If your product (or, in some readings, your organization's combined products) crosses 700 million monthly active users, you must request a separate commercial license from Meta (Meta community license, summarized in Sitepoint, 2026). For almost everyone this is not a real ceiling, but it is a real clause.
Attribution and naming. Products built on Llama have to display "Built with Llama" and derivative model names typically have to begin with "Llama-". Marketing teams sometimes hate this; legal usually does not care.
There are also acceptable-use restrictions (no using Llama outputs to train competing LLMs, no specific high-risk applications). The OSI explicitly does not consider this an open-source license, because it discriminates against use cases and against certain users. That is a definitional point, not a moral one — Llama can still be the right model for your product even if it is not OSI-OSS.
Mistral: a license per release
Mistral has been the most interesting case study in 2026. Earlier checkpoints — Mistral 7B, Mixtral 8x7B, Mixtral 8x22B — shipped under Apache 2.0, which is unambiguously OSI-OSS (First AI Movers, 2026). Apache 2.0 is what most enterprise legal teams actually want: no MAU clause, no naming requirement, no acceptable-use addendum, just attribution and notice-of-modification.
Mistral's frontier-class models from 2025 onward, however, increasingly ship under custom commercial licenses — sometimes called "Mistral Research License" or product-specific terms. Mixtral 8x22B remains Apache 2.0; Mistral Large 3 and equivalents do not. The gap between "all Mistral models" and "Apache-licensed Mistral models" is now wide enough that you should always check the specific repo's LICENSE file before assuming.
Other shapes worth knowing
A few more 2026 license patterns:
Apache 2.0 — Falcon (TII), Phi (Microsoft, MIT specifically), Cohere Command R+ (per the same Sitepoint guide), Qwen 2.5 / 3 base models, OLMo (AI2), DeepSeek base models, MPT (MosaicML/Databricks). Genuinely permissive.
MIT — Phi family. The most flexible mainstream license available for capable LLMs.
Custom non-commercial — Stable Diffusion variants of certain releases, some Yi models for non-commercial use.
Source-available / commercial-tier — Some Mistral frontier models, certain Cohere production models, several enterprise releases where the weights download but real usage is gated.
Why this matters for product teams
Three concrete failure modes:
Quiet license drift. Your team picks Llama 3.1 in early 2025, Llama 4 in late 2025, and a Llama 4-derived fine-tune in 2026. Each step is "still Llama," but the addenda and attribution language can drift between releases. Re-read the license at every model upgrade.
Derivative model lineage. A LoRA fine-tune of Llama is still bound by the Llama Community License, even if you publish only the LoRA delta. The same applies to merges and distillations: the most-restrictive parent license dominates.
Multi-model pipelines. A product that uses an open-weight LLM plus an Apache-licensed embedding model plus a non-commercial-licensed reranker is bound by the intersection of all three sets of restrictions. The hidden risk is usually in the smallest component.
A practical decision tree
For most product use:
You want maximum legal clarity → Phi (MIT) or one of the Apache 2.0 families (Mixtral 8x22B, Qwen base, Command R+, Falcon, OLMo).
You want the strongest open-weight performance and you are not training a competing LLM at >700M MAU → Llama 4 / Llama 3.x. The Community License is workable for the overwhelming majority of products.
You want frontier-class quality with no operational hassle → A closed API. The licensing is simpler, even if the unit cost is higher.
The OSI debate, briefly
There is an active fight inside the Open Source community about whether "open-weight" should qualify as "open-source AI." The OSI's Open Source AI Definition (OSAID) currently requires that training data and training code also be available, which most open-weight LLMs do not provide. Reasonable people disagree about whether this is a useful bar. As a practitioner: care about the license your lawyers will read, not the label.
Frequently Asked Questions
Is Llama "open source"?
Not under the OSI definition — the Llama Community License has user and use-case restrictions. It is "open-weight." For most commercial use it behaves similarly to open source, but legal review should read the actual terms, especially the 700M MAU clause and attribution requirements.
Which open-weight LLM has the most permissive license in 2026?
Microsoft's Phi family ships under MIT, and Mixtral 8x22B remains under Apache 2.0 (source). Both are about as permissive as a model license gets.
Does fine-tuning a model change its license?
Generally no. A fine-tune (LoRA or full) of a Llama-licensed model is still bound by the Llama Community License. The most-restrictive parent license dominates derivative works in nearly every case.
