Safeguard
Compliance•

What should you do when a model license says other or unknown?

A model card with license other or unknown gives no clear terms. Find the license text, ask the publisher, and decide whether to use the model.

Safeguard Security Team
3 min read

Treat it as no permission until you find the actual terms. A license value of other means custom terms stored elsewhere, and unknown means the publisher did not say. Find the license text, ask the publisher, get your counsel to read it, and do not ship until you have an answer in writing.

What the values mean on the Hub

The Hugging Face license documentation lists standard identifiers, such as Apache 2.0, MIT and several others, and also includes entries for model specific community licenses and research licenses. It also has two catch all values: other and unknown.

For other, the docs say to add the license text to a LICENSE file inside the repository and set a name for it in license_name. The model card documentation shows the pattern: license set to other, a license_name, and a license_link. So with other you should be able to find the text. If you cannot, the card is incomplete.

Unknown simply means no license was identified. Under copyright law in many places, no license means no permission to reuse, though a lawyer should confirm that for your country.

Steps

  1. Open the model card metadata and copy the license, license_name and license_link values.
  2. Open the LICENSE file in the repository at the revision you plan to use. Save a copy with the date.
  3. Read the key terms: commercial use, redistribution, derivative works, attribution, field of use limits, and any user count or revenue thresholds.
  4. Check the base model. A fine tune inherits the parent's terms. Follow base_model to the parent and read its license too.
  5. Check the datasets the card lists, since their licenses may add limits.
  6. If anything is unclear, contact the publisher through the repository's discussion area and keep the reply.
  7. Decide, and write the decision down: approved, approved with limits, or rejected, with the date and who decided.

A decision table

SituationSuggested handling
other with clear text that fits your useApprove, save the text, record limits
other with a link that no longer worksTreat as unknown, ask the publisher
unknown, base model has a clear licenseAsk the publisher; do not assume it matches the parent
unknown and no responseChoose another model
Research only termsDo not use in a product

Why this matters beyond legal risk

License terms also affect your own customers. If you ship software that includes a model, your customers may ask what is inside and under what terms. A record that says "license: unknown, shipped anyway" is hard to defend. A record that says "reviewed, terms saved, approved on this date" is easy.

The Hub itself reminds users to seek out and respect a project's license. Its list is for tagging convenience and is not legal advice.

Quick check

Can I use a model with license unknown for internal experiments?

Often yes for private testing, but check your own policy. Do not move it into a product or share it outside the company without clarifying the terms.

Does a link to a license page count as saving the license?

No. Pages move or change. Save the text itself with the date and revision.

Safeguard scans dependencies, generates SBOMs and checks license data for packages in your repositories. Try a free scan at gold.safeguard.sh/scan.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.