AI Model License check — check model licenses free

Six model identifiers in one file, six licence clauses broken - that is what thirty-three lines of ordinary model-loading code returned for an engineer at an EU-established software company. Seventeen findings in total, five of them blocking, naming seven distinct licences. The same linter run over a loader that pins Whisper, Mistral 7B and Qwen2.5-7B, with revisions and an attribution file, returns zero.

The first finding is the one people do not expect. The line was meta-llama/Llama-3.2-11B-Vision-Instruct, suggested by a code assistant, and it worked on the first try. The Llama 3.2 Community License withholds its grant for the multimodal builds from individuals domiciled in, and companies with a principal place of business in, the European Union. An EU-established team running those weights does not have a narrower licence than an American one. It has none. Nothing in the code says so; the import sits there until an acquirer's diligence team greps for it.

The rest of the list is the same shape: conditions that live in the licence text and nowhere near the code. FLUX.1 [dev] is released under a Non-Commercial License, so serving it inside anything that makes the company money needs a commercial grant - while FLUX.1 [schnell], one word away in the identifier, is Apache 2.0. Codestral weights are under the Mistral AI Non-Production License: development and testing only, which means the internal tool built on them is outside the grant too. Mistral Large is research-licensed, where Mistral 7B, Mixtral and NeMo are Apache 2.0. Stable Diffusion 1.5 and SDXL carry CreativeML OpenRAIL behavioural use restrictions that have to be reproduced for your own users, not merely accepted by you. Stable Diffusion 3.x is free for commercial use only below one million US dollars in annual revenue - a revenue trigger, so the day it fires has nothing to do with how much you used the model.

Then there is the comment reading # open source, same as our Apache-2 stack, sitting beside google/gemma-2-9b-it. Gemma ships under Google's Gemma Terms of Use with prohibited-use restrictions attached, not an OSI-approved licence. A README or an SBOM that calls it open source is a misstatement, and the kind a procurement review finds without trying.

The reason this class of mistake is common in 2026 is structural. The clauses that bite are keyed to where your company is established, its revenue, its monthly active users and whether the deployment is production - four facts a code assistant suggesting a model identifier knows nothing about. Ask a chatbot and you get an answer regenerated from a snapshot, which is how Gemma keeps getting called Apache 2.0. A model card links the licence, but never says which clause your company trips.

AI Model License Lint is a fixed, dated rule set - 22 rules as of 2026-09-14 - that you run against your own files. It makes no network call, downloads no weights, and puts each finding on the line that caused it with the clause spelled out. It also flags the quieter failures: gated repositories where the licence acceptance is logged against a developer's personal account rather than the company, model loads with no revision pin, and files that reference restricted weights without pointing at any NOTICE or model card.

Scanning is free and finished. You open the file, you read the clause, you change the model. For comparison, outside technology counsel bills roughly 350 to 600 US dollars an hour for an open-source and model-licence review, and that review repeats every time an engineer swaps a model.