The open source license in the AI stack has become the license the procurement team has been quietly trying to parse, the license the compliance team has been quietly trying to understand, the license the next lawsuit will turn on. The honest framing matters here, because the open source license the model the enterprise has been deploying ships under sits as the license the procurement team has been treating as the standard OSS license the procurement team has been signing for years.
What follows runs as the working version of the field guide. The shorter version is what the procurement team and the compliance team actually have time to read.
What the open source license in the AI actually is
Here is the working order, by impact. The first runs as the model license, where the license the model ships under (the Apache 2.0 for the open weight model, the custom commercial license for the proprietary model, the community license for the research model), the license the procurement team should be reading the terms of, the license the procurement team has been treating as the standard OSS license. The second runs as the dataset license, where the license the training data ships under (the permissive license the dataset was published under, the custom license the dataset vendor has been imposing, the unclear license the web scraper has been collecting), the dataset license the procurement team has been quietly skipping because the dataset license has not been in the standard contract review. The third runs as the output license, where the license the output ships under (the model output license, the use restriction, the attribution requirement, the commercial restriction), the output license the procurement team has been treating as the model license, the output license the procurement team should be reading separately.
What the licensing risk looks like
Here is the working order, by impact. The first runs as the dataset infringement, where the infringement the rightsholder has been quietly alleging, the infringement that the model has been trained on the copyrighted work without the license, the infringement the next settlement will turn on, the infringement the procurement team should be asking the model vendor to indemnify. The second runs as the model weight redistribution, where the redistribution the license has been restricting (the commercial use, the derivative use, the fine tuning use), the redistribution the procurement team has been treating as the open weight default, the redistribution the model license has been quietly prohibiting. The third runs as the output ownership, where the ownership the output license has been addressing, the ownership the user has been assuming the user holds, the ownership the output license has been restricting, the ownership the procurement team should be asking the model vendor to clarify.
What the enterprise can do
Three moves if you are the procurement or compliance team that wants the open source license in the AI stack to be the license the enterprise can actually use. Ask for the SBOM, where the SBOM the procurement team should be requesting, the SBOM the model vendor should be providing, the SBOM that names the license, the version, the dependency, the SBOM the procurement team can use to assess the risk the SBOM has been hiding. Ask for the indemnity, where the indemnity the model vendor should be providing, the indemnity that covers the training data infringement, the output ownership, the license breach, the indemnity the procurement team should be requiring in the contract the procurement team signs. Ask for the model card, where the card the model vendor should be publishing, the card that names the training data, the license, the use restriction, the card the procurement team can use to assess the model the procurement team is buying, the card the procurement team can use to compare the model the vendor offers to the model the competitor offers. The procurement or compliance team that asks for the SBOM, the indemnity, and the model card serves as the team that has answered the open source license question the AI stack has been quietly asking.
The bottom line
Open source license in the AI stack in 2026 sits as the license the procurement team has been quietly trying to parse. The model license, the dataset license, the output license, those three are what the license actually is. The dataset infringement, the weight redistribution, the output ownership, those three are what the risk looks like. The SBOM, the indemnity, the model card, those three are the moves. The team that asks the three answers the question. The team that has not asked the three serves as the team that will be answering the lawyer the next settlement will name.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
