How would you assess Llama licence risk before committing a product roadmap to it?

## Framing: this is a supplier review, not a legal formality The instinct that fails here is to treat "is the licence OK?" as a yes/no question answered once by legal. Llama's agreement is reissued per release, incorporates a policy that Meta can revise independently, and terminates on events partly outside the engineering team's control. That profile makes it a supplier-continuity question that a technical leader owns, with counsel advising on specific clauses. ## The five checks ### 1. Scale headroom The additional commercial terms require licensees whose products exceeded 700 million monthly active users in the month before a version's release date to obtain Meta's discretionary permission. The count aggregates the group, including affiliates, and covers all products — not just the AI-backed one. For nearly every company this clears instantly and the check costs five minutes. For a subsidiary of a large consumer platform, it is a hard gate that must be resolved before any roadmap commitment, because the permission is at Meta's sole discretion with no stated terms or timeline. ### 2. Region and modality carve-outs Rights have not been uniform across geographies. The Llama 3.2 Community License withheld the grant for the release's multimodal models from individuals domiciled in the European Union and companies with a principal place of business there, while carving out end users of a product that incorporates such a model. Whether a comparable restriction applies to the release you intend to deploy is a question you answer by reading *that* agreement, not by generalising. The review therefore needs three inputs: which release, which modality, and where your contracting entity sits. ### 3. Product-surface obligations These are cheap but they must be assigned to owners, because they cross engineering and marketing: - A prominent "Built with Llama" attribution on a user-visible surface (the exact string is release-specific). - Any distributed derivative model named with a "Llama" prefix — which is a branding decision, not just a repository label. - The licence text and a NOTICE file inside every artefact that carries weights: container images, model registry entries, on-prem appliance builds. - Terms of service that mirror the acceptable-use restrictions, since the agreement flows through to anyone you distribute to. Automate the file injection in the packaging pipeline; a checklist will drift within two releases. ### 4. Termination exposure Two distinct clauses end the grant. Breach of the incorporated acceptable-use policy allows Meta to terminate, with an obligation to cease use and delete the Llama Materials. And instituting IP litigation against Meta or another entity alleging that the Llama Materials or their outputs infringe intellectual-property rights terminates the licences as of the filing date — a clause worth surfacing to counsel in any organisation with an active patent-assertion posture, because it links an unrelated corporate action to an engineering dependency. Because the policy is incorporated by URL, the restrictions can change without a new agreement. Snapshot the policy text on acceptance, store it with the model provenance record, and re-check on upgrade. ### 5. Exit cost The honest question a principal answers is: if rights to this family ended tomorrow, what would it cost to move? The components are the serving stack (largely portable, since open-weight serving is model-agnostic), the prompts and chat formatting (family-specific and cheap to re-tune), fine-tuned adapters (the expensive part — they do not transfer to another base model), evaluation harnesses (portable), and any synthetic data generated from Llama outputs, which is governed by the agreement of the version that produced it. Keeping the adapter-training pipeline reproducible and the base model configurable is the concrete mitigation, and it costs almost nothing to design in at the start. ## The artefact the review should produce A short, dated decision record per Llama version deployed: version and release date, group MAU at that date, contracting entity and jurisdiction, modality used, the accepted agreement text and acceptable-use policy snapshot, the owners of each product-surface obligation, the weights inventory (every location holding the artefacts), and the estimated exit cost with its largest component named. That document answers due diligence, survives staff turnover, and turns the next version upgrade into a diff rather than a re-investigation. ## What separates the principal-level answer Junior and mid-level answers recite terms. A principal answer says which of them can actually stop the roadmap (scale gate, regional carve-out), which are cheap to comply with once automated (attribution, naming, NOTICE files), which are residual risks to be monitored rather than solved (mutable policy, termination clauses), and how the architecture keeps the exit cost low. It also says plainly when the answer is "this is fine, spend five minutes and move on" — because for most organisations that is the truthful conclusion, and manufacturing ceremony around a non-risk is its own failure of judgment.