AI Model Licensing: Legal Rules for Open-Source Attribution

Open-source AI model licensing falls into four frameworks: permissive licenses like MIT and Apache 2.0 allow commercial use with attribution requirements, copyleft licenses like GPL require derivative works under the same terms, and custom licenses such as Kimi K2.5's Modified MIT add commercial threshold obligations. Courts treat these licenses as enforceable contracts.

AI model licensing determines who can use, modify, and distribute the neural network weights behind today's most powerful AI systems. As open-weight models from organizations like DeepSeek, Moonshot AI, and Meta become the backbone of commercial products, the legal rules around attribution have moved from a niche developer concern to a boardroom issue.

In March 2026, two incidents put AI licensing in the spotlight. Cursor (developed by Anysphere) shipped its Composer 2 feature built on Moonshot AI's Kimi K2.5 without naming the base model at launch. Days later, Rakuten launched "Rakuten AI 3.0" built on DeepSeek V3, and reporting indicated the company removed the original DeepSeek license file from the release.

These cases illustrate a growing pattern. Companies treat open-weight models as raw material, drop the license notices, and present the result as proprietary technology. The consequences are becoming clearer, and they now arrive from more than one direction.

What Does "Open-Weight" Actually Mean?

The term "open-source AI" is widely used but often misleading. Traditional open-source software licenses (like the GNU GPL or MIT License) were written for source code. AI model weights are not source code. They are mathematical parameters learned during training.

When a company releases model weights under an open license, it grants permission to use, modify, and redistribute those weights. But that permission comes with conditions. The specific conditions depend on the license chosen.

Most "open-weight" releases use one of four license types: standard MIT, Apache 2.0, GPL/LGPL, or a custom modified license. Each carries different obligations for anyone who builds on top of the model.

Understanding these differences is not optional for companies shipping AI-powered products. Getting it wrong can result in lawsuits, forced code releases, or injunctions that shut down a product entirely.

One Repository, Two Licenses

A trap that catches teams repeatedly: the code and the weights in the same repository are frequently governed by different licenses.

DeepSeek-V3 is the clearest example. The repository's README splits the two explicitly. The code sits under the MIT License in a file named LICENSE-CODE. The weights sat under a separate LICENSE-MODEL file containing the DeepSeek License Agreement, Version 1.0, dated 23 October 2023, which is not MIT.

That model license carries use-based restrictions that MIT does not. It bars military use, use that violates applicable law, use targeting minors, and automated decision-making that adversely affects legal rights. It also requires that those same restrictions be passed on to downstream users in any redistribution agreement.

DeepSeek changed this later. The DeepSeek-V3-0324 release in March 2025 states that "This repository and the model weights are licensed under the MIT License," bringing the weights themselves under MIT.

The practical lesson is that the licensing answer depends on which release you actually pulled and which file governs the artifact you shipped. Check both files, and record the release identifier alongside them.

Common Open-Source License Types and Their Requirements

The table below compares the four most common license types used for AI model releases. Pay close attention to the attribution and distribution requirements, as these are where most violations occur.

MIT License: Simple but Binding

The MIT License is the most permissive widely used license. Its core obligation is straightforward: include the original copyright notice and license text in any copy or substantial portion of the software.

"Substantial portion" is the key phrase. When a company fine-tunes an MIT-licensed model and ships the resulting model in a commercial product, the fine-tuned weights are derived from the original. The MIT license notice must travel with them.

The MIT License is roughly 170 words long. Compliance takes seconds. Deleting the file does not extinguish the obligation, it just documents the breach.

Apache 2.0: More Structure, More Protection

Apache 2.0 adds several requirements beyond MIT. Users must preserve any NOTICE file included with the original distribution. They must state what changes they made. And the license includes an explicit patent grant, which protects downstream users from patent claims by the original developer.

For AI models, the "state changes" requirement is significant. If a company fine-tunes an Apache 2.0 model, it must document that fine-tuning occurred. Simply shipping the model as if it were built from scratch does not satisfy the license.

GPL/LGPL: The Copyleft Challenge

GPL and LGPL licenses require that derivative works be released under the same license terms. This creates a "viral" effect. If a company builds a proprietary product on a GPL-licensed model, the entire derivative work may need to be open-sourced.

Few commercial AI models use GPL precisely because of this requirement. But some research models and tools do. Companies should check carefully before incorporating any GPL-licensed components into their AI stack.

Modified MIT: Custom Commercial Terms

Some organizations add custom clauses on top of standard MIT terms. Moonshot AI's Kimi K2.5 uses a Modified MIT License with a notable addition. Where a product or service exceeds 100 million monthly active users, or more than 20 million US dollars in monthly revenue, the license states that "you shall prominently display 'Kimi K2.5' on the user interface of such product or service."

Note the structure: the thresholds are disjunctive. Either one triggers the display obligation on its own.

This type of threshold-based requirement creates a compliance trap. A startup might launch with a Kimi-based product, grow past a threshold, and only then fall out of compliance. The obligation existed from day one in the license text, but it becomes operative at scale.

Watch out: Monthly active users and monthly revenue are the trigger metrics in the Kimi K2.5 license. Valuation, headcount, and funding raised are not. A heavily valued company can sit below both thresholds, and a thinly capitalized one can sit above them.

Recent AI Licensing Incidents

Several high-profile cases in 2025 and 2026 have tested the boundaries of AI model licensing. These incidents show that attribution disputes are not theoretical risks. They are happening now, at the highest levels of the industry.

The Cursor/Kimi Incident

Cursor, the AI-powered code editor developed by Anysphere, is the most prominent case. Independent researchers identified that Cursor's Composer 2 feature, released March 19, 2026, was built on Moonshot AI's Kimi K2.5. Anysphere did not name the base model at launch.

Anysphere subsequently acknowledged it. Co-founder Aman Sanger said it was "a miss to not mention the Kimi base in our blog from the start," and the company's vice president of developer education, Lee Robinson, said roughly a quarter of the compute behind the finished model came from the base model.

The Kimi K2.5 Modified MIT License requires prominent display of the model name once a product passes 100 million monthly active users or 20 million US dollars in monthly revenue. Anysphere is privately held and has not published either figure, so whether Cursor crossed a threshold is not something an outside observer can verify. The disclosure gap is documented; the license breach is not established.

For a deeper analysis of this specific incident, see What Model Is Cursor 2.0?.

The disclosure gap is industry-wide rather than unique to Cursor. Cognition, which owns the rival editor Windsurf, described the base model behind its SWE-1.5 coding agent only as "a strong open-source model" and did not name it. The identification of that base model as GLM came from outside observers, not from the company.

The Licensing Question Became a National Security Question

The Cursor story did not stay inside copyright law, and this is the development most teams miss.

On April 29, 2026, House Committee on Homeland Security Chairman Andrew Garbarino and House Select Committee on the Chinese Communist Party Chairman John Moolenaar sent joint letters opening an investigation into Anysphere and Airbnb over their use of Chinese-developed AI models. The letter to Anysphere focused on Composer 2 and the Moonshot AI Kimi model underlying it. The letter to Airbnb concerned Alibaba's Qwen.

The committees asked for details about the companies' use of Chinese-built AI systems, the rationale behind those choices, and any communications the firms had with the model providers. They also requested that employees involved in the decisions attend an in-person briefing with lawmakers.

The inquiry has continued. In late July 2026, the same two chairmen sent a letter to DoorDash regarding its use of Moonshot AI's Kimi K2.6 model, requesting information by August 14, 2026 and a staff briefing by August 21, 2026.

Pro tip: The congressional inquiry is a national-security and supply-chain matter, not a copyright enforcement action. No committee is enforcing the Kimi license. The point for compliance teams is that the same undisclosed-dependency fact pattern created exposure on two unrelated tracks at once, and the second track moved faster than the first.

The Rakuten/DeepSeek Incident

Rakuten used DeepSeek V3 as the foundation for its "Rakuten AI 3.0" product. Reporting in March 2026 indicated that instead of retaining the DeepSeek license file, Rakuten removed it.

Both of the licenses DeepSeek has applied to V3 require the notice to survive redistribution, and the custom DeepSeek Model License goes further by requiring downstream recipients to receive the use restrictions as well. Reporting indicates Rakuten later added an attribution file, though commentators noted it appeared as a NOTICE file rather than a restoration of the original license file. We could not verify that against a Rakuten statement or the repository history, and Rakuten has not published a detailed compliance response naming which release it used.

Are AI Model Weights Copyrightable?

The legal status of AI model weights is one of the most important unresolved questions in technology law, and it is routinely described inaccurately. There are two separate questions here, and conflating them produces bad compliance advice.

The first question is whether model weights can infringe someone else's copyright, because training memorized protected expression into them. The second is whether a model developer holds an enforceable copyright in its own weights that it can assert against a downstream licensee who strips attribution. These are not the same question, and the guidance most often cited answers only the first.

The U.S. Copyright Office addressed the first question in Part 3 of its Copyright and Artificial Intelligence report, released in a pre-publication version on May 9, 2025. The Office concluded that where a model can generate verbatim or substantially similar copies of a training example without that expression being supplied in the prompt, "there is a strong argument that copying the model's weights implicates the right of reproduction for the memorized examples."

The Office then set the limiting principle plainly:

"Whether a model's weights implicate the reproduction or derivative work rights turns on whether the model has retained or memorized substantial protectable expression from the work(s) at issue." U.S. Copyright Office, Copyright and Artificial Intelligence, Part 3: Generative AI Training (Pre-Publication Version, May 2025)

That analysis concerns the rights of authors whose works were trained on. It does not address, and does not resolve, whether Moonshot AI or DeepSeek owns a copyright in its own weights that it could assert against Cursor or Rakuten. Treating the report as authority for the second proposition overstates it.

This matters for how a rights holder would actually proceed. Statutory copyright damages can reach $150,000 per work for willful infringement under 17 U.S.C. Section 504, but those damages require a viable copyright infringement claim in the first place. Where the copyright question is unsettled, the enforceable obligation is the contract, which is exactly the path the Copilot litigation has taken.

Courts Are Treating Licenses as Contracts

The more durable legal development is the treatment of open-source licenses as enforceable contracts. Contract claims do not depend on resolving whether weights are copyrightable subject matter.

Doe v. GitHub is the leading example, and its procedural posture is widely misreported. In the January 2024 order on the second round of motions to dismiss (Case No. 4:22-cv-06823-JST, N.D. Cal., ECF No. 195), Judge Jon S. Tigar dismissed the plaintiffs' DMCA Section 1202(b)(1) and 1202(b)(3) claims with leave to amend, and dismissed their state-law claims for intentional and negligent interference with prospective economic relations, unjust enrichment, negligence, and unfair competition with prejudice.

Two claims remained: common-law breach of contract for open-source license violations, and common-law breach of contract for selling licensed materials. Both are contract claims, not copyright claims.

The reason they remained is worth stating precisely, because the usual summary gets it wrong. The court did not evaluate and endorse them. As footnote 3 of the order records, "Defendants do not move to dismiss Plaintiffs' claims for breach of contract for open-source license violations or breach of contract for selling licensed materials." They survived because nobody challenged them at that stage, which is weaker support for the "licenses are contracts" proposition than the case is often cited for.

The signal is still real, just narrower. Sophisticated defendants elected not to contest the contract framing, while contesting nearly everything else. What the case has not yet produced is a merits ruling that an open-source license was breached.

The case has also moved well past that January 2024 order, and the DMCA track is not closed. The plaintiffs amended, the court dismissed the Section 1202(b) claims again on the ground that the statute reaches only identical copies from which copyright management information was removed, and on September 27, 2024 Judge Tigar certified that question for interlocutory appeal and stayed the district court case. The Ninth Circuit accepted the appeal in December 2024 and heard oral argument on February 11, 2026. A ruling on whether Section 1202(b) carries an identicality requirement is pending, and the two contract claims cannot reach a merits ruling while the case below is stayed.

The copyright track has moved separately. In Bartz v. Anthropic (No. C 24-05417 WHA, N.D. Cal.), Judge William Alsup held on June 23, 2025 that the "purpose and character" of using books to train large language models was transformative, and "spectacularly so." That was only part of the ruling. He also held that assembling a central library from pirated copies was not fair use, and that holding, not the training analysis, generated the exposure. Anthropic later settled, and the court granted final approval of the approximately $1.5 billion settlement on July 20, 2026, in an order by Judge Araceli Martinez-Olguin.

The dispute has not quieted. In March 2026, around 10,000 authors published an empty book protesting AI training on their work, distributed at the London Book Fair.

Fair use outcomes remain unsettled across cases. In Kadrey v. Meta, the court found Meta's use of copyrighted works for AI training qualified as fair use, though Judge Chhabria stressed that the ruling turned on the plaintiffs' failure to develop a record on market dilution and that it "does not stand for the proposition that Meta's use of copyrighted materials to train its language models is lawful." In Thomson Reuters v. ROSS Intelligence, the court rejected the fair use defense, though that case involved a non-generative legal research tool, which is why the two decisions sit less cleanly opposite each other than the word "split" suggests. No company should treat fair use as a reliable defense while these questions remain open.

Copyright Laundering: A Growing Concern

The term "copyright laundering" has been used by developers including Jamie Tanna to describe a specific pattern in AI development. An AI system ingests code or model weights released under attribution-required licenses, the provenance information falls away during training or fine-tuning, and the output appears unencumbered by any license.

This pattern is at the heart of the Doe v. GitHub lawsuit. The plaintiffs allege that GitHub Copilot takes code released under licenses that require attribution, processes it through a neural network, and outputs code snippets without the required license notices.

The concept extends directly to AI model weights. When a company takes an attribution-required model, fine-tunes it, and ships the result without any license notices, it is performing the same stripping of provenance. License obligations are not discharged by passing the weights through additional training.

Courts have not ruled definitively on whether fine-tuning creates a "derivative work" under copyright law. Treat that question as open, and note that a contract obligation to preserve a notice can bind you regardless of how the derivative-work question is eventually answered.

How to Stay Compliant

Companies using open-weight AI models in commercial products should follow these practices to reduce legal exposure.

Read Both License Files Before You Ship

The Rakuten and Cursor incidents suggest this is not happening consistently. Before incorporating any open-weight model into a product, read the full license text for the code and for the weights separately. They are often different, as DeepSeek-V3 demonstrates. Note attribution requirements, modification disclosure rules, use restrictions, and any threshold-based obligations.

Pin the Release, Not Just the Model Name

"DeepSeek V3" is not a licensing answer. The original release and the V3-0324 release carry different weights licenses. Record the exact release identifier or commit alongside the license terms you relied on, so you can prove later which terms applied.

Maintain a License Inventory

Track every open-source AI model and component used in your product. For each entry, record the license type, the specific attribution requirements, and whether your product currently complies. Update this inventory whenever you add or change AI model dependencies.

Preserve All License Files

Never delete, rename, or relocate license files from open-source AI model distributions. Include them in your product's distribution, whether that is a software package, a container image, or a cloud deployment.

Document Your Modifications

If you fine-tune, quantize, prune, or otherwise modify an open-weight model, document what you did. Apache 2.0 explicitly requires this. Other licenses may not, but documentation protects you in any future dispute.

Check for Copyleft and Use-Based Restrictions

If any component in your AI stack uses a GPL or LGPL license, consult legal counsel before shipping. Copyleft obligations can extend to your entire derivative work. Custom model licenses raise a different problem: use-based restrictions like those in the DeepSeek Model License must be passed down to your own users, which means they have to appear in your terms of service, not just your repository.

Monitor Threshold Triggers

For licenses with commercial thresholds, such as Kimi K2.5's Modified MIT License, set internal alerts on the metrics the license actually names. Track monthly active users and monthly revenue specifically. Do not wait until you are past a threshold to start complying.

Treat Model Provenance as a Disclosure Question Too

The April 2026 congressional letters show that undisclosed reliance on a foreign open-weight model can create regulatory and reputational exposure that has nothing to do with the license. If your product's core capability comes from someone else's model, the decision not to say so is itself a decision worth documenting and reviewing.

What Happens Next

The legal landscape for AI model licensing is evolving rapidly. Several developments will shape the next 12 to 24 months.

The nearest decision point sits at the Ninth Circuit, which heard argument on February 11, 2026 on whether DMCA Section 1202(b) carries an identicality requirement. That is the question that knocked the copyright-management-information claims out of Doe v. GitHub, and the answer will shape whether stripped license notices can be attacked under the DMCA at all.

Doe v. GitHub remains the most important pending litigation on the contract side, but be realistic about the timing. The merits ruling worth watching for, whether an open-source license was breached by AI output, cannot arrive while the district court case is stayed for that appeal. The contract claims have never been tested on their substance.

The U.S. Copyright Office may issue further guidance. Part 3 remains a pre-publication version, and the Office has said a final version will follow without substantive changes to the analysis or conclusions. Guidance squarely addressing ownership of weights, as opposed to infringement by weights, would fill the gap this article describes.

Regulators are moving on transparency from a different angle. The EU's AI Act, Regulation (EU) 2024/1689, imposes transparency obligations on providers of general-purpose AI models, and the European Commission has flagged copyright compliance among the duties attaching to those providers.

The congressional inquiry into Chinese open-weight models is the newest vector and the least predictable. It is not a licensing proceeding, but it is generating exactly the disclosure that attribution clauses were meant to compel.

For now, the defensible course is to treat every open-source AI license as a binding contract, read the code and weights licenses separately, pin the release you relied on, and document your compliance.

This article provides general legal information about open-source AI model licensing under United States law, with reference to European Union transparency rules where noted. It is not legal advice, and licensing analysis depends heavily on which model release you used and how you distribute it. Consult a lawyer licensed in your jurisdiction before relying on any license interpretation described here.

Frequently Asked Questions

Can companies rebrand open-source AI models as their own?

Companies can modify and commercialize open-source AI models, but they cannot remove the original license notices or present the model as entirely their own creation. The specific requirements depend on the license. MIT requires retaining the copyright notice. Apache 2.0 requires preserving the NOTICE file and stating changes. Custom licenses like Kimi K2.5's Modified MIT require displaying the original model name above certain commercial thresholds, and licenses like the DeepSeek Model License require passing use restrictions to downstream users. Deleting license files does not discharge those obligations.

Are AI model weights copyrightable?

This is unresolved, and two separate questions are often confused. On whether weights can infringe someone else's copyright, the U.S. Copyright Office concluded in May 2025 that where a model can reproduce a memorized training example there is a 'strong argument' that copying the weights implicates the reproduction right for that example. On whether a developer owns an enforceable copyright in its own weights that it can assert against a downstream licensee, the Office did not address the question and no court has definitively ruled. That is why license enforcement currently proceeds on contract theories.

What happens if you violate an open-source AI license?

Potential consequences include breach-of-contract claims, copyright infringement claims where the copyright question is resolvable, injunctive relief, and statutory damages up to $150,000 per work for willful copyright infringement. In Doe v. GitHub, the two claims left in the district court are both breach-of-contract claims, though it is worth noting the defendants never moved to dismiss them rather than the court upholding them on the merits. That case is currently stayed: the plaintiffs' DMCA Section 1202(b) claims were dismissed on the ground that the statute reaches only identical copies, and the Ninth Circuit heard argument on that question on February 11, 2026, with a decision pending. Companies including Cursor and Rakuten have also faced reputational consequences and, in Cursor's case, congressional scrutiny.

Do the code and the model weights use the same license?

Often they do not, and assuming they do is a common and serious error. DeepSeek-V3 published its repository code under the MIT License in a LICENSE-CODE file while the weights were governed by a separate LICENSE-MODEL file containing the DeepSeek License Agreement, which adds use-based restrictions that must be passed to downstream users. The later DeepSeek-V3-0324 release states that the repository and the model weights are both licensed under the MIT License. Check both files, and record which release you used.

Does fine-tuning an open-source model create a derivative work?

Courts have not definitively ruled on whether fine-tuning creates a derivative work under copyright law, so treat the question as open. The practical point is that it may not matter for compliance: an attribution obligation in an open-source license is a contract term, and a contract term can bind you whether or not the derivative-work question is ever resolved in your favor. The conservative approach is to carry the original license terms forward with the fine-tuned weights.

What is copyright laundering in AI?

Copyright laundering describes feeding copyleft or attribution-required code or model weights into an AI system, where the provenance information falls away during processing, so the output appears free of license obligations. Developers including Jamie Tanna have used the term to describe it. The concept is central to the Doe v. GitHub Copilot lawsuit, where plaintiffs allege that Copilot emits code without the license notices attached to the code it was trained on.

Which open-source license is safest for commercial AI products?

MIT and Apache 2.0 are the most permissive and commercially friendly options. MIT requires only that you retain the copyright notice. Apache 2.0 adds a patent grant and requires stating modifications. GPL-licensed components are the hardest to reconcile with a proprietary product because derivative works must be released under the same license. Always read for custom clauses, such as Kimi K2.5's display requirement or the DeepSeek Model License's use restrictions, which add obligations beyond the base license.

Was Cursor sued for using Moonshot AI's Kimi K2.5 model?

No licensing lawsuit against Anysphere has been reported, and the company has since acknowledged that Composer 2 was built on Kimi K2.5. What did follow was a joint congressional investigation: on April 29, 2026, the chairmen of the House Committee on Homeland Security and the House Select Committee on the Chinese Communist Party sent letters to Anysphere and Airbnb seeking details about their use of Chinese-developed AI models, with the Anysphere letter focused on Composer 2 and the Moonshot AI model it was built on. That inquiry is a national security matter rather than a copyright enforcement action.