MICKAI® Trust AgentFree AI courses

assurance · Level 3

Open model licences, datasets and deployment obligations

Open weights versus open source, the licence families you will meet, dataset rights, model cards, AI bills of materials and supply-chain checks, with a licence checklist tool you build and test.

By Mickarle Wagstaff-Irons - Micky Irons

  • Level 3Building
  • 110 min
  • 6 chapters
  • Free PDF, no account
Read a sample Download free PDF (PDF, 1.9 MB)
The Boundaryassurance / 03

Start with the essentials

The short answer

An open model is only as open as its terms. Open weights are not open source: the OSI's definition also asks for complete code, detailed data information and freedom to use for any purpose. Before you use, host or redistribute a model or dataset, read the grant, restrictions, thresholds, attribution and termination terms, check dataset rights separately, verify hashes, and involve a solicitor when unsure.

What you will learn

  • You will be able to explain the difference between open weights and open source, using what the Open Source AI Definition 1.0 actually requires.
  • You will be able to read any model licence for its grant, field-of-use limits, redistribution, attribution, patents, outputs, derivatives, termination and thresholds.
  • You will be able to tell a dataset's licence apart from the rights in its items, and spot terms that clash with your intended use.
  • You will be able to use model cards, datasheets and a CycloneDX or SPDX bill of materials as evidence, and say what each records.
  • You will have built and tested a standard-library Python licence checklist that flags common problems and drafts a NOTICE file, and you will be able to verify hashes and explain why pickled files are risky.

Who it is for

Procurement, legal-adjacent, security and engineering staff in UK public-sector and regulated organisations who must decide whether an 'open' model or dataset may be used, modified, hosted or redistributed. You need to read short Python and run a script from a terminal.

Before you start

  • Know what an open-weight model is, as in Which AI model should I use?, and be able to run a Python script from a terminal, as in Python: from first script to a useful automation. Privacy and data minimisation in AI applications helps with the personal data parts.

Read a sample · Chapter 05 of 06

05

Build a licence checklist tool

Turn the questions into a small tool that reads an inventory, flags problems and drafts a NOTICE file. Everything is invented; nothing is downloaded.

In a new folder, save this as inventory.json: three invented models with planted mistakes. Sources use example.org, which IANA keeps for documentation.

json · 20 lines
[
  {"model": "fern-summarise", "version": "1.2", "licence": "Apache-2.0",
   "source": "example.org/fern-summarise",
   "sha256": "5f40da6a3889713715188839b3f2901be2b0ff831bb5bf8d51f6fc4e6625b08e",
   "dataset": "civic-letters", "dataset_licence": "CC-BY-4.0",
   "intended_use": ["summarisation"], "commercial": false,
   "redistribute": true, "above_threshold": false,
   "notice": "Copyright 2025 Fernwood Labs (invented)"},
  {"model": "harbour-triage", "version": "0.9", "licence": "LicenseRef-Harbour-RAIL-1.0",
   "source": "example.org/harbour-triage", "sha256": "",
   "dataset": "clinic-notes", "dataset_licence": "CC-BY-NC-4.0",
   "intended_use": ["triage", "medical-advice"], "commercial": true,
   "redistribute": false, "above_threshold": false, "notice": ""},
  {"model": "kestrel-chat", "version": "3.0", "licence": "LicenseRef-Kestrel-Community-2.0",
   "source": "example.org/kestrel-chat",
   "sha256": "40c74848309fe8d05b570ea39700045a580bfeafb791a54a193bc9ae850a7634",
   "dataset": "forum-scrape", "dataset_licence": "",
   "intended_use": ["chat"], "commercial": false,
   "redistribute": true, "above_threshold": null, "notice": ""}
]

The tool holds simplified summaries. STOP means do not deploy, FIX means an incomplete record, DUTY is something you must do. Save it as licence_check.py beside the inventory.

python · 55 lines
"""licence_check.py: report licence problems; --write drafts a NOTICE file."""
import json
import re
import sys
from pathlib import Path

# Simplified summaries. Both LicenseRef- licences are INVENTED.
MODELS = {"Apache-2.0": {}, "MIT": {},
          "LicenseRef-Harbour-RAIL-1.0": {"restricted": ["medical-advice"], "flow_down": True},
          "LicenseRef-Kestrel-Community-2.0": {"threshold": True}}
DATA = {"CC-BY-4.0": True, "CC0-1.0": True, "CC-BY-NC-4.0": False}  # commercial use allowed?


def check(e):
    lic = MODELS.get(e["licence"])
    issues = [] if lic is not None else [("STOP", f"unknown licence '{e['licence']}'")]
    lic = lic or {}
    for use in e["intended_use"]:
        if use in lic.get("restricted", []):
            issues.append(("STOP", f"licence restricts '{use}'"))
    if lic.get("threshold") and e["above_threshold"] is not False:
        issues.append(("STOP", "user threshold passed or unknown"))
    if not re.fullmatch(r"[0-9a-f]{64}", e["sha256"]):
        issues.append(("FIX", "sha256 missing or malformed"))
    if e["redistribute"] and not e["notice"]:
        issues.append(("FIX", "no attribution text for NOTICE"))
    if e["dataset_licence"] not in DATA:
        issues.append(("STOP", f"unknown dataset terms '{e['dataset_licence']}'"))
    elif e["commercial"] and not DATA[e["dataset_licence"]]:
        issues.append(("STOP", "dataset licence forbids commercial use"))
    if lic.get("flow_down"):
        issues.append(("DUTY", "pass use restrictions on to users"))
    return issues


inventory = Path(sys.argv[1])
totals, notice = {}, ["NOTICE (practice file)"]
for e in json.loads(inventory.read_text(encoding="utf-8")):
    print(e["model"], e["version"], e["licence"])
    for level, text in check(e) or [("ok", "no issues found")]:
        print(f"  {level:<4} {text}")
        totals[level] = totals.get(level, 0) + 1
    if e["redistribute"]:
        notice += [f"{e['model']} {e['version']} ({e['licence']})",
                   "  " + (e["notice"] or "ATTRIBUTION MISSING: fix before release")]
print("Totals:", totals)
out = Path("practice") / f"NOTICE-{inventory.stem}.txt"
if "--write" not in sys.argv:
    print(f"Dry run: {out.name} not written. Add --write.")
elif out.exists():
    print(f"Skipped: {out.name} already exists")
else:
    out.parent.mkdir(exist_ok=True)
    out.write_text("\n".join(notice) + "\n", encoding="utf-8")
    print("Wrote", out.as_posix())

Only false passes a threshold check: null means nobody checked. A missing field stops Python with a KeyError. Nothing is written without --write, or overwritten: to redo a NOTICE file, delete the old one. Run the dry run (python3 on macOS and Linux):

text · 14 lines
python licence_check.py inventory.json
fern-summarise 1.2 Apache-2.0
  ok   no issues found
harbour-triage 0.9 LicenseRef-Harbour-RAIL-1.0
  STOP licence restricts 'medical-advice'
  FIX  sha256 missing or malformed
  STOP dataset licence forbids commercial use
  DUTY pass use restrictions on to users
kestrel-chat 3.0 LicenseRef-Kestrel-Community-2.0
  STOP user threshold passed or unknown
  FIX  no attribution text for NOTICE
  STOP unknown dataset terms ''
Totals: {'ok': 1, 'STOP': 4, 'FIX': 2, 'DUTY': 1}
Dry run: NOTICE-inventory.txt not written. Add --write.

All six planted problems are caught. With --write the last line becomes Wrote practice/NOTICE-inventory.txt, and the file shows the gap:

text · 5 lines
NOTICE (practice file)
fern-summarise 1.2 (Apache-2.0)
  Copyright 2025 Fernwood Labs (invented)
kestrel-chat 3.0 (LicenseRef-Kestrel-Community-2.0)
  ATTRIBUTION MISSING: fix before release

Deployment obligations. The tool drafts; people decide. Before release, check:

  • Notices: licence copies, NOTICE contents and marked changes (Apache-2.0 section 4); credit lines or name prefixes custom licences require.
  • Flow-down: use restrictions and acceptable-use policies reach your users through your own terms.
  • Transparency: GOV.UK says the Algorithmic Transparency Recording Standard is mandatory for in-scope tools in government departments and in arm's-length bodies delivering public or frontline services or dealing directly with the public. Records ask about third-party suppliers and models.
  • Logs and incidents: the UK's voluntary AI cyber security code asks operators to log system and user actions, plan for incidents and tell end-users before model updates. The UK GDPR requires certain personal data breaches to be reported to the ICO within 72 hours, where feasible.

Try it yourself · Activity 05

20 min

Catch and fix the mistakes

Plant one more mistake, then fix what can honestly be fixed.

  1. Change Apache-2.0 to Apache 2.0 in inventory.json, predict, do the dry run, then change it back.
  2. Copy it to inventory-fixed.json. For harbour-triage, remove "medical-advice" and the comma before it, set commercial to false and sha256 to 14da5db577177ba83d2a52518102f346615297c8677e5b2e4610ca7ccbb25fdf. For kestrel-chat, set above_threshold to false and notice to "Copyright 2026 Kestrel Collective (invented)".
  3. Run python licence_check.py inventory-fixed.json --write.

Which STOP could no honest edit fix?

Worked answer

Step 1 prints STOP unknown licence 'Apache 2.0' and totals of 'STOP': 5: identifiers must match exactly. Step 3 prints ok, only the DUTY line for harbour-triage, STOP unknown dataset terms '' for kestrel-chat, Totals: {'ok': 1, 'DUTY': 1, 'STOP': 1} and Wrote practice/NOTICE-inventory-fixed.txt. Such edits are honest only if the facts changed. forum-scrape still needs real terms.

Keep learning

The complete workbook

This workbook is for procurement, legal-adjacent, security and engineering staff in UK public-sector and regulated organisations. You will learn what the Open Source AI Definition requires, how permissive, use-restricted and custom licences differ, and how dataset licences relate to rights in the data. Then you will build and test a small Python licence checklist, verify file hashes and see why pickled model files are risky.

  1. 01
    Open weights are not open source

    Many releases are called open. Pin down what was actually released, and what the Open Source AI Definition asks for.

    In the workbook · 1 exercise
  2. 02
    Licence families and what to read in any licence

    Model licences fall into three broad families. Whatever the family, ten questions show what you may do.

    In the workbook · 1 exercise
  3. 03
    Datasets: the licence, the items and the law

    A dataset carries two layers of rights: the licence on the collection, and the rights in each item inside it. Check both.

    In the workbook · 1 exercise
  4. 04
    Model cards, datasheets and an AI bill of materials

    Documentation is your evidence. Learn what good records contain, then keep your own in a standard form.

    In the workbook · 1 exercise
  5. 05
    Build a licence checklist tool

    Turn the questions into a small tool that reads an inventory, flags problems and drafts a NOTICE file. Everything is invented; nothing is downloaded.

    Read here · 1 exercise
  6. 06
    Supply-chain checks before you run anything

    A licence covers a specific file. Check that the file you hold is that file, and that opening it cannot run someone else's code.

    In the workbook · 1 exercise

Also inside: a 10-point checklist, a glossary of 12 terms and 10 questions and answers to test yourself. 6 hands-on exercises, each with a worked answer at the back where the workbook gives one.

Download all 6 chapters as PDF (PDF, 1.9 MB)

No login, no card, no account. Before the download we ask you to follow Mickai (two quick links). Free to download and use for personal learning, study groups and inside your own team. Please do not resell the workbooks or republish them as your own. Link people to trust-agent.ai instead.

Test yourself

Questions and answers

Is this workbook legal advice?

No. It is general education based on primary sources read on 26 September 2026. Involve your legal team or a solicitor before redistributing a model, relying on a custom or use-restricted licence for a public service, accepting another country's governing law or using a dataset whose rights are unclear, and when a complaint arrives. Involve your data protection officer whenever personal data may be present.

Is an open-weight model open source?

Not necessarily. The OSI's Open Source AI Definition requires freedom to use for any purpose, study, modify and share, plus detailed data information, complete code and the parameters under OSI-approved terms. Many open-weight releases lack code or data information, or restrict uses. Unless the terms meet the definition, describe it as open weights under the named licence.

Does open source AI mean all the training data is published?

No. The OSAID requires data information detailed enough for a skilled person to build a substantially equivalent system, including where to obtain public and third-party data. Data that cannot be shared, such as personal data, must be described rather than published.

Can we use an Apache-2.0 or MIT model in a public service?

Usually the licence allows it, including modification and commercial use. The main conditions bite when you redistribute: include the licence, keep the notices and, for Apache-2.0, pass on NOTICE contents and mark changed files. Dataset rights, personal data, security and procurement rules still apply separately.

What is a RAIL licence?

A Responsible AI Licence grants broad permissions but restricts listed uses, and those restrictions must bind downstream users and derivatives. The RAIL FAQ says OpenRAIL licences are not open source under the OSI's definition. If your use falls within a restriction, the licence does not permit it, and you must pass the restrictions on to your users.

What should we do about user thresholds in a model licence?

Record the threshold, how and when it is measured, and whether your organisation is above it (and affiliates, if the licence counts them), with evidence and a date. Treat unknown as a problem. Above a threshold you may need a separate licence before using the model at all, so ask your legal team early.

If a dataset is CC BY or CC0, can we use everything in it?

Not necessarily. The publisher may not hold rights in every item. Creative Commons says its licences may not give every permission you need, and that publicity, privacy or moral rights may limit use; it has not verified the status of works marked CC0. Check item rights, personal data and the source platform's terms.

What is an AI bill of materials?

A machine-readable inventory of an AI system's models, datasets and other components, with versions, suppliers, licences, hashes, training data and lineage. CycloneDX (ML-BOM) and SPDX 3 (AI and Dataset profiles) are open standards for it. The NCSC names model cards, data cards and software bills of materials as useful documentation.

Why are pickled model files risky?

Python's documentation says the pickle module is not secure: malicious pickle data can execute arbitrary code during unpickling. Load pickles only from sources you trust completely, inspect them with pickletools without loading, and prefer data-only formats such as safetensors, while still checking the loading software.

Which deployment obligations commonly apply?

Licence notices and NOTICE contents, credit lines or naming rules, passing use restrictions and acceptable-use policies to users, and keeping hashes and records. Government departments and in-scope arm's-length bodies must publish Algorithmic Transparency Recording Standard records for in-scope tools. The UK's voluntary AI cyber security code adds logging, incident plans and warning users before model updates. The UK GDPR requires certain personal data breaches to be reported to the ICO within 72 hours, where feasible.

When you have finished

Get your certificate of completion

Type your name and download a certificate for this workbook as a PDF, ready to print or to add to LinkedIn. It is made on your own device, so your name is never sent to us. It is a self-declared certificate, not an accredited qualification.

Make my certificate

Learn the language

Key terms

Open weights
A release whose trained weights can be downloaded under some licence. It says nothing about code, data or freedom of use.
Open Source AI Definition (OSAID)
The Open Source Initiative's definition, version 1.0: freedoms to use, study, modify and share, plus data information, complete code and parameters under OSI-approved terms.
Permissive licence
A licence granting broad rights in return for light conditions such as keeping notices, for example Apache-2.0 or MIT.
Use restriction
A clause forbidding particular uses. In RAIL licences it must also bind downstream users and derivatives.
Threshold clause
A term that changes or removes your rights above a stated size, such as a number of monthly active users.
NOTICE file
A text file of attribution notices shipped with a work. Apache-2.0 requires its contents to be passed on when you redistribute.

6 of the workbook's 12 terms. The complete glossary is in the workbook.

Follow the evidence

Sources and checks

Facts last checked: .

Examples in this workbook were run on: Python 3.12.10 on Windows 11 (standard library only), run in Git Bash (2026-09-26).

These workbooks use AI assistance. See how the workbooks are made.

  1. The Open Source AI Definition 1.0Open Source Initiative
  2. Open Source AI Definition: frequently asked questionsOpen Source Initiative
  3. Apache License, Version 2.0Apache Software Foundation
  4. The MIT LicenseOpen Source Initiative
  5. Responsible AI Licenses (RAIL)RAIL initiative
  6. RAIL frequently asked questionsRAIL initiative
  7. Naming convention of Responsible AI Licenses (18 August 2022)RAIL initiative
  8. Attribution 4.0 International (CC BY 4.0) deedCreative Commons
  9. Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) deedCreative Commons
  10. Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) deedCreative Commons
  11. CC0 1.0 Universal deedCreative Commons
  12. CC License Guidance (September 2026)Creative Commons
  13. Frequently Asked Questions (NonCommercial licences)Creative Commons
  14. Open Database License (ODbL) v1.0, legal text (section 2.4, contents)Open Data Commons (Open Knowledge Foundation)
  15. Open Data Commons Attribution License (ODC-By)Open Data Commons (Open Knowledge Foundation)
  16. Public Domain Dedication and License (PDDL)Open Data Commons (Open Knowledge Foundation)
  17. Copyright, Designs and Patents Act 1988, section 29A (Copies for text and data analysis for non-commercial research)legislation.gov.uk (The National Archives)
  18. Report on Copyright and Artificial Intelligence (18 March 2026)DSIT, DCMS and Intellectual Property Office (GOV.UK)
  19. Response to the consultation series on generative AI: the lawful basis for web scraping to train generative AI modelsInformation Commissioner's Office (ICO)
  20. Personal data breaches: a guideInformation Commissioner's Office (ICO)
  21. Model Cards for Model Reporting (Mitchell and others)arXiv
  22. Datasheets for Datasets (Gebru and others)arXiv
  23. Model Cards (documented practice reference)Hugging Face Hub documentation
  24. Guidelines for secure AI system development: secure developmentNational Cyber Security Centre (NCSC)
  25. Software Bill of Materials (SBOM)Cybersecurity and Infrastructure Security Agency (CISA)
  26. Machine Learning Bill of Materials (ML-BOM)OWASP CycloneDX
  27. CycloneDX v1.7 JSON referenceOWASP CycloneDX
  28. SPDX 3.0.1: AI profileSPDX (The Linux Foundation)
  29. SPDX 3.0.1: AIPackage classSPDX (The Linux Foundation)
  30. SPDX 3.0.1: Dataset profileSPDX (The Linux Foundation)
  31. SPDX 3.0.1: DatasetPackage classSPDX (The Linux Foundation)
  32. SPDX 3.0.1: RelationshipType vocabulary (declared and concluded licences, trainedOn, testedOn)SPDX (The Linux Foundation)
  33. SPDX 3.0.1: verifiedUsing propertySPDX (The Linux Foundation)
  34. SPDX 3.0.1 Annex B: SPDX license expressions (LicenseRef-)SPDX (The Linux Foundation)
  35. SPDX License List (version 3.29.0, 16 September 2026)SPDX (The Linux Foundation)
  36. Code of Practice for the Cyber Security of AI (31 January 2025)Department for Science, Innovation and Technology (GOV.UK)
  37. Algorithmic Transparency Recording Standard HubGovernment Digital Service (GOV.UK)
  38. Algorithmic Transparency Recording Standard: guidance for public sector bodiesGovernment Digital Service (GOV.UK)
  39. pickle: Python object serializationPython Software Foundation
  40. pickletools: tools for pickle developersPython Software Foundation
  41. hashlib: secure hashes and message digests (file_digest)Python Software Foundation
  42. Pickle scanningHugging Face Hub documentation
  43. safetensors README (format and safety aims)safetensors project on GitHub
  44. Example DomainsInternet Assigned Numbers Authority (IANA)

Created by Mickarle Wagstaff-Irons - Micky Irons with the Mickai team. Published by Mickai LTD. Last updated 26 September 2026.

NextKeep going

Where to go next