The concern about "open" model licenses is usually argued from anecdotes: one vendor's terms, one researcher's quote. Our dataset lets it be counted instead. Across 200 open models, 89 carry a recorded restriction beyond the headline permissions, and the restrictions cluster into a few repeatable patterns. None of this makes the models closed. It makes the word "open" a starting point for reading, not a conclusion, and the patterns below are the reading list.
Pattern one: the user ceiling
The most consequential restriction in the dataset is a number. Twenty-eight models place a true cap on how many monthly users a product built on them may reach before a separate license is required: every one of the 23 Llama-licensed models caps at 700 million monthly active users, and five more, the large Qwen models and MiniMax-Text-01 among them, cap at 100 million. Our caps census counts them model by model, and the 700M threshold explainer works through the Llama clause itself. A ceiling that high touches almost no one today, which is precisely how it survives unnoticed into the products it will eventually touch.
Pattern two: your outputs are not entirely yours to train with
Several Gemma records in the dataset carry a clause with long reach: outputs may not be used to develop or train competing models. The restriction does not limit what you generate; it limits what the generations may become, which matters to anyone distilling a fine-tune from synthetic data. Because the Gemma terms also pass through on redistribution, the clause flows downstream into derivatives, including models trained on Gemma-generated data. It is the dataset's clearest example of a restriction that binds people who never downloaded the model from Google at all.
Pattern three: the policy incorporated by reference
Gemma's terms prohibit the uses listed in a separate Prohibited Use Policy, weapons, illegal activity, CSAM and more, incorporated by reference rather than printed in the license. Fourteen models in the dataset sit under those terms. The structural point is bigger than Gemma: a license that points at a policy page is a license whose restrictions can be edited on a website. Our Gemma terms walkthrough covers what shipping under that arrangement takes. The RAIL licenses (6 models) hard-code a similar idea, writing forbidden uses into the grant itself, where at least they cannot change after the fact.
Pattern four: the duties that travel
Redistribution is allowed for all 200 models in the dataset, but on community licenses it is conditional: pass the terms through, carry the notices, state your modifications, and, on Llama models, display "Built with Llama" in the product. Attribution of some form is required on 198 of the 200 models. These are small duties with a long tail: they bind every downstream recipient, which is how a restriction written for a model release ends up governing products three handoffs away.
The extreme end: no commercial use at all
Eight of the 200 models refuse commercial use outright, and they are the honest end of the spectrum: Qwen2.5-Coder 3B under a Qwen research license, Mistral Large under a Mistral research license, Codestral 22B under a non-production license, OpenELM 3B under Apple's research model license, OPT 6.7B, MiniMax M2.7 under a license named, simply, Non-Commercial, and SOLAR 10.7B under Creative Commons noncommercial. Nobody was misled by these; the license names say research and noncommercial out loud. They are in this census because they mark the boundary: the restrictions in the patterns above live on models whose pages say "open" without qualification, and that gap between the label and the terms is the whole subject. Filter any of them by your own constraints in the ShipSafe Filter before a model gets into your stack, and read the model you pick the way our five-minute license reading describes: permissions first, then the patterns, in that order.