How Do Licensing and Closed-Provider Terms Affect Model Distillation?

Distillation, in the practical sense used in this series, means using a closed model's outputs, or examples reviewed against them, to train a smaller open model. The closed provider's terms govern what its outputs may be used for. The open base model's license governs what you may do with the weights and what you must call the result. The fine-tuning host's terms govern what you may upload, how long it is kept, and what you may export. The customer's own data rights govern whether the conversations behind the examples may be used this way at all.

Each layer can independently block the pipeline. A base model with a permissive license does not help if the provider's terms forbid the use of its outputs. A provider that permits the use does not help if the customer's terms with its own users do not. The review has to cover all four, and it has to be written down, because the answer changes over time and someone will need to know which version of which terms the dataset was built under.

The closed providers' terms address this directly, and they differ in wording. Anthropic's commercial terms, as reviewed on 2026-09-23, state that customers may not use the services to build a competing product or service, including to train competing AI models. Google's Gemini API additional terms, reviewed the same day, state that users may not use the services to develop models that compete with the services. OpenAI's terms of use contain a comparable restriction on using output to develop models that compete with OpenAI; read the current text, because that document could not be retrieved for this review.

The word that carries the weight in each clause is competing. A customer-specific agent model, trained to do one customer's task and never offered as a general model, is a different thing from a general-purpose model trained on frontier outputs. Where that line falls for a given project is a question for counsel with the current terms in hand, not for an engineering team reading a summary. The practical consequence is that the review has to happen before generation at scale, and its conclusion has to be recorded.

Open-weight does not mean license-free. The Qwen3 dense models, as stated in the Qwen team's release post reviewed on 2026-09-23, are released under the Apache License 2.0, which permits commercial use, modification, and redistribution with attribution and without a naming requirement. The Llama 4 Community License, reviewed the same day, permits use and fine-tuning but requires that a model built from Llama materials include Llama at the beginning of its name and that Built with Llama be displayed on a related website, interface, or documentation.

Those requirements pass through to the fine-tuned model. A customer that does not want a third-party name on its product has a base-model constraint before any capability question is asked. Read the base model's license for the exact version being fine-tuned, record it, and confirm that the hosting and serving plan satisfies its attribution and naming terms. Part 37 covers choosing the base against capability; the license is a filter applied before that choice.

Managed fine-tuning providers have their own terms, and they cover three things a distillation pipeline cares about. What may be uploaded: some terms restrict the content of training inputs, and generated data may sit close to those restrictions. How long uploads and adapters are retained, and whether inference-time retention commitments extend to training data. Whether the trained adapter can be exported, or only served on the host.

The export question decides ownership in practice. An adapter that can only be served on one host is owned on paper and rented in fact. Part 35 treats ownership as a product question; here it is a terms question, and the answer is in the host's documentation for the specific fine-tuning method used. Read it for LoRA adapters specifically, because full-weight and adapter export terms can differ.

The conversations that become training examples belong to the customer's relationship with its users, and that relationship has its own terms. A customer whose privacy policy promises that conversations are used only to provide the service has not promised its users that conversations will train a model, even a model that serves only them. De-identification helps with some regimes and not others. Contract language with the customer's own users may need to change before the pipeline is allowed to start.

There is a symmetric obligation on any vendor in the loop. A vendor whose standard terms promise not to train on customer data cannot run this pipeline on that customer's data without a written, customer-specific election that overrides the default. That election has to be scoped: which agent, which data, which model, tenant-exclusive, and revocable. A vendor that trains without it has breached its own terms regardless of what the provider or the base license allow.

The order matters because generation at scale spends money and creates data that may then be unusable. Run a small pilot to establish the pipeline, take the four-layer review to counsel with the pilot's actual artifacts, and get a written conclusion that names the provider terms version, the base license version, the host terms version, and the customer election. Then scale. A review after training either blesses a dataset already built or writes off the spend, and neither is a good position.

Written means a document, with a date, that a later reader can find. Verbal comfort from a meeting does not survive a personnel change or a terms update. The review is part of the dataset's lineage, alongside the source runs and the reviewer decisions that part 12 describes.

Every dataset version should carry a receipt: the teacher model id and version that produced or was reviewed against each example, the dates and versions of the four sets of terms it was built under, and the counsel conclusion. When any of those inputs changes, the receipt tells you which examples are affected. A provider terms update that tightens output use affects every example whose teacher was that provider. A customer revoking its election affects every example from that customer's runs.

The lapse rule should be written before the first lapse. The conservative rule is that a lapse invalidates dependent examples and any dataset version or model trained from them until the examples are reassessed under the new terms or withdrawn. That may mean retiring a model. It is a real cost, and it is the cost of building on terms that can change; the receipt makes it bounded rather than existential.

Start with the customer election, because it is the layer the team controls. Then read the base license and rule out any model whose obligations the product cannot meet. Then take the provider terms to counsel with a clear description of the model's scope: one customer, one task, not offered as a general model, tenant-exclusive. Then read the host's terms for the exact fine-tuning method and confirm adapter export. Record all four conclusions against the pilot dataset version, and only then generate at scale.

None of this makes a project slow if it is started early. It makes a project impossible if it is started after the model is trained and a customer is waiting. This article describes what the reviewed documents say and how to organize the work; what they mean for a specific project is a question for the project's counsel.

Converra's default terms forbid using customer data to train, fine-tune, or improve any model, and that default holds unless a customer makes a written, tenant-exclusive election for a specific agent. Its fine-tuning workflow keeps that scope explicit: datasets are versioned, each example carries its source run and reviewer decision, and the training job and gate result are recorded against a dataset version so the receipt this article describes has somewhere to live.

Converra does not run training and does not provide legal review; the four-layer review is the customer's, with counsel. No open-weight production verdict for a customer agent has been published. The trust page describes the data handling defaults; a model transfer that changes them starts with the written election, not with a training run.