Apache License 2.0
Last reviewed
Sources
15 citations
Review status
Source-backed
Revision
v2 · 2,920 words
Improve this article
Add missing citations, update stale details, or suggest a clearer explanation.
Suggest edit
CtrlK
Last reviewed
Sources
15 citations
Review status
Source-backed
Revision
v2 · 2,920 words
Add missing citations, update stale details, or suggest a clearer explanation.
The Apache License, Version 2.0 is a permissive open source software license published by the Apache Software Foundation (ASF) in January 2004 and approved by the ASF board on January 21, 2004.[1][13] It lets anyone use, modify, and distribute the covered software for any purpose, including commercial products and proprietary derivatives, provided they keep the required copyright and license notices intact.[2] Unlike copyleft licenses such as the GNU General Public License, it does not require that modified versions be released under the same terms, so a company can build closed-source software on top of Apache-licensed code without publishing its changes.
What sets the Apache License apart from short permissive licenses like MIT and BSD is that it addresses software patents directly. Every contributor grants users an explicit, royalty-free patent license covering their contributions, and that grant is paired with a termination clause: anyone who files a patent lawsuit claiming the software infringes their patents loses the patent rights the license had given them.[3] This "patent retaliation" provision is the main reason the Free Software Foundation recommends the Apache License over other non-copyleft licenses for substantial programs.[4]
The license is approved by the Open Source Initiative, listed as a free software license by the Free Software Foundation, and carries the SPDX identifier Apache-2.0.[5][6][4] It has become one of the most widely used licenses in software generally: by 2022 it ranked first among licenses on GitHub at roughly 30 percent of licensed repositories, ahead of the MIT License at about 26 percent.[14] In artificial intelligence specifically it is among the most common choices for releasing open-weight models, machine learning frameworks, and supporting infrastructure.[7]
| Field | Value |
|---|---|
| Author | Apache Software Foundation (drafted by Roy T. Fielding) |
| Version | 2.0 |
| Published | January 2004 |
| Board approval | January 21, 2004 |
| SPDX identifier | Apache-2.0 |
| OSI-approved | Yes |
| Copyleft | No |
| Patent grant | Yes |
| GPLv3-compatible | Yes |
| FSF free software | Yes |
The Apache License grew out of the Apache HTTP Server project. When the Apache Group began releasing the server in 1995, it used a license modeled on the original four-clause BSD license, including an advertising clause that required attribution in promotional materials.[7] In 2000 the group issued version 1.1, which removed the advertising clause that had drawn complaints for being awkward when many components were combined.[7]
Version 2.0 was a larger rewrite. The Apache Software Foundation released it in January 2004 with two main goals: make the license reusable by projects outside the ASF, and improve its handling of patents and license compatibility.[1][7] The text was drafted on the ASF's public "license" mailing list, revised on December 24, 2003 and January 20, 2004 to reflect two rounds of public comment, and approved by the ASF board on January 21, 2004.[13] It was authored by Roy T. Fielding, a co-founder of the foundation.[13] Earlier Apache licenses had been written specifically for the foundation's own software, so applying them elsewhere was clumsy. Version 2.0 defines its terms abstractly enough that any project can adopt it by attaching the standard header to source files, without editing the license body, and the ASF explicitly designed it to be "included by reference instead of listed in every file."[13] It also added the explicit patent grant and patent termination language that the 1.x licenses lacked. The Open Source Initiative recorded the license as submitted for approval in February 2004.[5]
The 2.0 text is the only version in current use. The Apache Software Foundation treats versions 1.0 and 1.1 as historical, and new ASF projects release under 2.0.[7] By the mid-2010s the Apache License had become one of the most popular free and open source licenses in use, ranking alongside the MIT License and the GNU GPL in surveys of public repositories, and by 2022 it had moved into first place on GitHub at about 30 percent of licensed repositories.[7][14]
The license is structured as nine numbered sections. Section 1 defines the key terms it uses, including "Work" (the licensed material), "Derivative Works," "Contribution," and "Contributor," and it distinguishes "Source form" from "Object form" so the conditions apply consistently to both source code and compiled binaries.[2]
Section 2 is the copyright grant. Each contributor grants every recipient a "perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form."[2] In plain terms, users may copy, change, and redistribute the software freely, in both source and binary form.
Section 4 sets out the conditions for redistribution. They are the heart of the license's compliance requirements, and there are four of them.[3] First, anyone who distributes the Work or a derivative must give recipients a copy of the license. Second, modified files must carry prominent notices stating that they were changed. Third, redistributed source must retain all copyright, patent, trademark, and attribution notices from the original, except those that do not pertain to any part of the derivative work. Fourth, if the original distribution includes a file named NOTICE, then any derivative the user distributes must include a readable copy of the attribution notices contained in that NOTICE file.[3]
The NOTICE file is a distinctive feature. It is a plain-text file that ships with many Apache-licensed projects and lists required attributions, such as statements about which third-party code is included and who holds copyright.[8] Recipients must propagate the relevant contents of NOTICE when they redistribute, but the license also clarifies that they may add their own attribution notices and that the NOTICE file is informational and does not modify the license itself.[3] This separates the legally binding license text from the project-specific credits, which keeps attribution manageable when many components are combined.
Section 5 covers contributions. Any work a contributor intentionally submits for inclusion in the licensed project is automatically governed by the license terms, unless the contributor explicitly marks it otherwise.[2] This default removes the need for a separate agreement every time someone submits a patch, although many large projects still use a separate Contributor License Agreement on top of it.
Sections 7 and 8 disclaim warranty and limit liability. The software is provided "AS IS" without warranties or conditions of any kind, whether of title, non-infringement, merchantability, or fitness for a particular purpose, and contributors are not liable for damages arising from use of the work.[2] Section 9 lets a redistributor offer its own warranty or support for a fee, but only on its own behalf, and it must indemnify the other contributors against any liability that such an offer creates.[2]
The patent grant in Section 3 is the clause most often cited as the license's defining feature. Each contributor grants users a "perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable ... patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work."[3] The grant is deliberately scoped: it covers only those patent claims that the contributor can license and that are "necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted."[3] In other words, a contributor licenses the patents needed to use what they actually contributed, in combination with the project they contributed to, but not patents that only become relevant when the code is combined with unrelated software later.
The grant is balanced by a defensive termination condition. The license states: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed."[3] A user who sues over patents in the covered software loses the patent license, though the copyright license remains. The mechanism discourages patent litigation among users of the same software, which is why it is sometimes described as a defensive or retaliatory clause.
Short permissive licenses do not do this. The MIT and BSD licenses grant copyright permissions but say nothing explicit about patents, which leaves open the theoretical risk that a contributor could later assert a patent against users of code they themselves released.[4] The Apache License closes that gap with an express grant and makes the grant self-enforcing through the termination clause. The Free Software Foundation considers the patent termination provision a benefit and recommends the Apache License over other lax permissive licenses for any program of substantial size, on the grounds that it prevents what the FSF calls patent treachery.[4]
The Apache License is permissive, so combining Apache-licensed code with code under most other licenses is straightforward as long as the Apache notices are preserved. The notable exception involves the GNU General Public License, and the relationship there runs in one direction.
Apache-2.0 code can be incorporated into a project licensed under version 3 of the GPL, and the combined result is then distributed under GPLv3.[4][7] The Free Software Foundation and the Apache Software Foundation both treat the Apache License 2.0 as compatible with GPLv3, an outcome made possible by terms added in GPLv3 that accommodate the Apache License's patent and termination provisions.[4] The compatibility is not symmetric. Apache-licensed software can be pulled into GPLv3 projects, but GPLv3 code cannot be relicensed under the Apache License, because the GPL's copyleft requires the whole combined work to stay under the GPL.
The Apache License 2.0 is not compatible with version 2 of the GPL. The Free Software Foundation explains that the Apache License contains requirements not present in GPLv2, specifically its patent termination and indemnification provisions, and GPLv2 does not permit adding such conditions.[4] As a result, Apache-2.0 code generally cannot be combined with GPLv2-only code in a single distributable work. Projects that want to bridge the two often release under "GPLv2 or later," which lets downstream users move to GPLv3 where the Apache terms fit.
Not everyone accepts the license. The OpenBSD project, for instance, declined to use Apache 2.0 for its base system, objecting that the patent and indemnification language reads more like contract terms than a simple permission grant.[7]
The table below compares the Apache License 2.0 with the MIT, BSD (3-clause), GNU GPL, and Mozilla Public License along the dimensions that usually matter when choosing a license.
| Feature | Apache 2.0 | MIT | BSD 3-clause | GPL (v3) | MPL 2.0 |
|---|---|---|---|---|---|
| Type | Permissive | Permissive | Permissive | Strong copyleft | Weak/file-level copyleft |
| Commercial and proprietary use | Yes | Yes | Yes | Yes, but derivative must stay GPL | Yes |
| Must open-source derivatives | No | No | No | Yes | Only modified files |
| Explicit patent grant | Yes | No | No | Yes | Yes |
| Patent retaliation clause | Yes | No | No | Yes | Yes |
| Attribution / notice required | Yes (incl. NOTICE) | Yes | Yes | Yes | Yes |
| Length | Long | Very short | Short | Long | Medium |
| GPLv3 compatible | Yes | Yes | Yes | Yes | Yes |
| GPLv2 compatible | No | Yes | Yes | n/a | No |
The MIT License (also called Expat) is the shortest of these and the easiest to read; it grants broad permission with only an attribution requirement and is silent on patents.[6] The 3-clause BSD license is similar in spirit, adding a clause that bars using the contributors' names to endorse derived products. The GNU GPL is the main copyleft option: it allows commercial use but requires that any distributed derivative be released under the GPL, which keeps the source open downstream. The Mozilla Public License sits between the permissive and copyleft camps; its copyleft applies file by file, so changes to MPL-covered files must be shared, but the surrounding code in a larger project can use other licenses. Of the permissive group, Apache 2.0 is the only one that combines a broad grant with an express patent license and a retaliation clause, which is the trade-off for its greater length and the NOTICE requirement.
The Apache License 2.0 is one of the most common licenses applied to open machine learning software and to open-weight model releases.[7] Major frameworks and infrastructure projects use it, and a large share of the models distributed on Hugging Face carry it. Recent examples among large language models include the Qwen family from Alibaba, models from Mistral such as Mistral Small, and Google DeepMind's Gemma 4 release on April 2, 2026, all of which have shipped weights under Apache 2.0 without per-user restrictions.[9][15] Google reports that the Gemma family had been downloaded more than 400 million times and spawned over 100,000 community variants, a scale of permissionless reuse that the Apache terms enable directly.[15]
The explicit patent grant is a large part of why companies prefer Apache 2.0 over MIT for AI work. Training and deploying models touches a dense field of patents, and an Apache release gives downstream users a written patent license from every contributor along with the assurance, through the termination clause, that contributors will not later sue users over the same software.[10] MIT and BSD provide no such written patent terms, so a cautious legal team building a commercial product on a model may treat an Apache release as lower risk even though both license families permit commercial use. This is the same reasoning the Free Software Foundation gives for preferring Apache for substantial programs, applied to the AI setting.[4]
A complication specific to AI is that these licenses were written for source code, and a trained model is not obviously source code. Model weights are large arrays of numbers produced by a training process, and it is debated whether copyright even attaches to them the way it does to authored code.[10] When a model is released "under Apache 2.0," the license is generally applied as the publisher's chosen terms for the whole package, which can include training and inference code, configuration, and the weight files. The Linux Foundation and others have noted that traditional software licenses do not neatly cover data-like artifacts such as weights, and some efforts have proposed dedicated model licenses or pairing a code license with a data license for the weights.[11] In practice, an Apache-licensed model release is treated as permissive: users may run, fine-tune, and redistribute the model and build commercial products on it, subject to the usual notice requirements.
That permissive stance contrasts sharply with the restricted licenses that several prominent "open-weight" models use. Meta distributes its Llama models under the Llama Community License rather than an OSI-approved open source license. The Llama license permits broad commercial use but adds conditions a true open source license cannot, most notably a clause requiring companies with more than 700 million monthly active users to obtain a separate license from Meta, along with use-policy restrictions.[9] Because those terms discriminate based on the licensee and field of use, the Open Source Initiative has stated that Llama does not meet the open source definition.[12] The distinction matters for downstream developers: an Apache-2.0 model can be used by anyone for anything within the license's notice rules, whereas a restricted model license can carry caps, acceptable-use clauses, and approval requirements that limit what an organization can build. The broader debate over what counts as open source AI, and the gap between "open weights" and "open source," turns largely on this difference between genuinely permissive licensing and bespoke community licenses.[12]