IT EN
Start a trial

Operational notes Observatory

Derivatives of a model barred in Europe carry different licences

7 min read

A row of painted wooden matryoshka dolls lined up, from the smallest in sharp focus at the front to the largest blurred in the background, black-and-white photograph
Each copy holds the one before it. The label, though, someone gets to rewrite.

If someone asked you right now which AI models are running inside your organisation, in which version, and from which repository they were downloaded, how long would it take you to answer? And could you say whether the licence declared on that repository is the same one covering the weights it contains, or whether someone further down the chain has changed it? For most organisations the honest answer is: we don’t know, and we have no single place to check.

The case below serves as the evidence. It concerns MiniMax H3, whose European Union exclusion we already reported. Here the subject is different: what happens once that model gets copied, recompressed and redistributed by others, and which licence those copies carry.

The licence upstream

On 7 August we already wrote that MiniMax H3’s weights are out, and the licence excludes the European Union; we won’t retread that ground. One detail we hadn’t highlighted enough: the “Excluded Territories” are not only the European Union. The licence defines them like this: “‘Excluded Territories’ means the European Union, the United Kingdom, the Republic of Korea and the United States of America” — alongside the European Union sit the United Kingdom, the Republic of Korea and, which surprises anyone reading the clause for the first time, the United States. The grant of rights applies “Solely within the Applicable Territory”.

The point this piece rests on is a different passage of the licence, the one on derivatives: “you may not impose additional or different terms and conditions on the use, reproduction, or distribution of your modifications or of any aggregate Model Derivatives, and your use, reproduction, modification, distribution, running, and display of the work must otherwise comply with the terms and conditions of this Agreement (including the provisions concerning the Applicable Territory)”. The upstream licence, in other words, follows the derivative — territorial clauses included. The closing line leaves no room for reading it another way: “You may not use, reproduce, modify, distribute, or display the MiniMax H3 Works or any of their Outputs or results outside the Applicable Territory. Any such use outside the Applicable Territory is not authorized by this Agreement”.

What the derivatives declare

On paper, every derivative should carry the same licence as the original. We checked what each repository declares, reading its base_model and license fields.

The first link behaves as expected: Comfy-Org/MiniMax-H3, created on 30 July, declares base_model: MiniMaxAI/MiniMax-H3 and reports license: other with license_name: minimax-h3-community-license-agreement — the same licence as the original. It is also, by a wide margin, the most downloaded repository in the chain: 4,947,943 downloads, 1,068 likes.

From the second link onward, the declarations split into three groups:

  • Declare the upstream licence, correctly. Abiray/Minimax-H3-nvfp4-INT4-INT8-Convrot, created on 3 August, base model MiniMaxAI/MiniMax-H3, declares license: other with the same license_name as the original. 511,473 downloads, 155 likes.
  • Declare Apache 2.0. lightx2v/Minimax-h3-Turbo (7 August, base model MiniMaxAI/MiniMax-H3, 6,117 downloads, 233 likes), drbaph/MiniMax-H3-Turbo-Lora-ComfyUI (6 August, base model Comfy-Org/MiniMax-H3, 231 likes) and larryvrh/MiniMax-H3-Turbo-Lora (5 August, base model Comfy-Org/MiniMax-H3, 543 likes, no downloads on record) all report license: apache-2.0.
  • Declare no licence at all, or declare “unknown”. realrebelai/MiniMax-H3_GGUFs (3 August, base model Comfy-Org/MiniMax-H3) declares license: unknown — and is the second most downloaded derivative of all, with 160,747 downloads and 187 likes. Kijai/MiniMax-H3_comfy (7 August) and Kijai/MiniMax-H3-experimental (5 August) declare no licence at all and, the first of the two, no base model either — 233 and 168 likes respectively.

Among the two most downloaded derivatives, one correctly declares the upstream licence and the other declares “unknown”. Among the most-liked, three declare Apache 2.0 and two declare nothing at all: different things declared about the same model, copied and lightly modified.

What we find, and what we don’t say

We find three things, and stop there. First: what each repository declares, with the numbers above — public metadata fields, readable by anyone who queries the API. Second: what the upstream licence says, verbatim, including the ban on imposing “additional or different terms and conditions” on modifications and aggregate derivatives. Third: that the question “which licence actually applies to the weights I downloaded” is not settled by reading the label on the repository you took them from — that label, as shown above, changes from one link in the chain to the next.

We do not say the Apache 2.0 declarations are incorrect, nor that whoever declares nothing is in breach: the authors may have direct arrangements with MiniMax we know nothing about, or simply filled in a field loosely on a platform that doesn’t verify it. A card’s label is a metadata field, not a contract: anyone wanting to know which licence really applies to a file has to read the upstream licence, not the drop-down menu on the card. The legal assessment of any concrete case belongs to a lawyer, not an article: we line up the public facts so that assessment starts from the right data.

The forms that enter a company

The most downloaded derivative in the chain — 511,473 downloads — is a quantised repackaging, built to run with less memory. The second — 160,747 downloads — is a GGUF package, the format built for inference on modest hardware. These are exactly the forms someone, inside a company, downloads because “it runs on my laptop”: not the official repository with 4.9 million downloads and the correct licence in plain sight, but a compressed version a few steps further down.

Whoever downloads that version, in most cases, never passes through the original repository and never reads its licence. They see a familiar name, a licence field that says whatever it says — Apache 2.0, “unknown”, nothing — and a file that runs. The problem is not that someone is lying: it is that the distance between where the reading stops and where it needs to reach grows with every step down the chain.

How we check it

When a client asks us to assess an open-weight model, we don’t stop at the card it was downloaded from. We trace the base_model field back to its origin and compare the upstream licence against what the intermediate repository declares. From the first session comes a dated list of the models in production — artefact, repository, revision, declared licence and upstream weights licence — with the mismatched lines flagged, and it stays with the client even if they don’t go on to work with us.

See the service · Talk to an engineer

What to do about it

  1. Always trace back to the upstream model via the base_model field, and read the licence declared there — not the one on the repository you’re actually downloading from.
  2. For every model in production, record: artefact, repository, revision, declared licence and upstream licence.
  3. Treat “unknown” and “no licence declared” as a block on adoption, not a detail to tidy up later.
  4. Check the territories a licence covers: some exclude by geography, not by revenue threshold, regardless of how large the company is.
  5. Repeat the check on every update: a card’s licence field can change without notice, and an updated derivative can inherit — or lose — a correct declaration.

The two axes, applied

Complying: verifying the licence, provenance and derivative chain of every model in production becomes a check that runs on the client’s own systems, with a dated register — artefact, repository, revision, declared licence, upstream licence, date of verification — ready to show an inspector or a client.

Deciding: the same system brings models, data, documents and systems into a single operating model, on which AI agents execute decisions with a human operator in command, for large enterprises, defence, government and healthcare. The multi-model argument is concrete here: if a model’s licence excludes your territory, you swap the component, not the project — the ontology, the data and the processes remain the client’s.

Always in two delivery modes: on-premise, on self-contained machines with no deep integration into the client’s network, or dedicated cloud with a data centre in Italy — always with shared management. It is the same system we propose to defence.

Could you say, without asking anyone, which repository each model running today in your organisation was downloaded from, and which licence it carries? Talk to one of our engineers: the first session is at no cost, and produces the dated list of models in production, with declared licence and upstream licence, regardless.

Sources