Phi-3's License: What the MIT Terms Permit

Phi-3 is released under the MIT License. That is unusual among open-weight models of its generation and it is the whole reason this page is short on prohibitions and long on what is missing from the text.

What ships under MIT

Microsoft publishes each Phi-3 checkpoint on Hugging Face with a LICENSE file in the repository root, and the repository metadata carries license: mit. The Phi-3 technical report, “Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone” published in April 2024, describes the release of the weights, and the same MIT terms have carried through the Phi-3.5 and Phi-4 releases.

The scope is the artefacts in that repository: the weights, the configuration, the tokenizer files and any modelling code Microsoft ships alongside them. It is not a statement about the training data and it is not a statement about anything you download from anywhere else — a community quantisation or a fine-tune is covered by whatever its own publisher applied, which is usually but not always the same.

The grant, and its two conditions

The operative sentence of the MIT License grants permission to use the software “without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense” and to sell copies. Applied to a model checkpoint, that reads as: run it commercially, fine-tune it, quantise it, redistribute it, embed it in a closed-source product, and sell the result.

Two conditions attach, and only two:

• The notice travels. The copyright notice and the permission notice must be included in copies or substantial portions of the software. In practice that means shipping the LICENSE file alongside the weights when you redistribute them — including in a container image or an app bundle that embeds the checkpoint.
• There is no warranty. The text disclaims warranties and liability in capitals. There is no support commitment and no fitness guarantee attached to the weights.

There is no third condition. Nothing to sign, no registration, no notification, no revenue threshold, no reporting.

What MIT does not contain

The useful part of reading a permissive licence is noticing the clauses that are not there:

• No acceptable-use policy. MIT has no field-of-use restriction and incorporates no external policy document by reference. Whatever limits apply to your application come from law, from your own policy, and from the model’s safety training — not from the licence.
• No user-count trigger. Nothing changes at any scale of deployment.
• No attribution or naming rule beyond keeping the notice. You are not required to name the model in your product or adopt a prefix in derivative model names.
• No copyleft. A fine-tune is yours to license as you choose, subject only to keeping the notice on the parts you redistribute.
• No claim over outputs. The licence does not assert rights in what the model generates. Whether those outputs are protectable at all is a question of law in your jurisdiction, not a question this licence answers.
• No express patent grant. This is the one asymmetry worth knowing. Apache 2.0 contains an explicit patent licence and a termination clause; MIT does not mention patents. Counsel differ on how much of a patent licence is implied by the broad grant, and if that distinction matters to you it is a question to raise deliberately rather than to assume.

Where the restricted licences differ

Set against the other open-weight families in this territory, the gap is structural rather than a matter of degree. Meta’s Llama releases ship under a bespoke community licence that incorporates an acceptable-use policy by reference, imposes a naming requirement on derivatives and carries a monthly-active-user threshold above which a separate licence must be requested — the details are in the Llama 3 commercial-use terms. Google’s Gemma releases are governed by terms of use with a prohibited-use policy that the terms require you to pass on to downstream recipients; see the Gemma model licence terms.

The practical difference is what your legal review has to read. Under MIT the review is a page and it is finished. Under a bespoke licence the review must also cover a policy document that the licensor can revise, and must establish that your own downstream distribution passes the obligations along correctly. That work is real and recurring, and it is a legitimate input to model selection quite apart from capability.

What a licence cannot settle

Three things people expect from “MIT” that it does not give you. First, it is not a promise of availability: Microsoft can stop publishing a repository, and the licence on the copy you already hold does not oblige anyone to keep serving it. Mirror what you depend on; see Phi model deprecation on Azure.

Second, it does not cover a hosted endpoint. If you call Phi through Azure AI Foundry rather than running the weights, your relationship is governed by the Azure product terms for that service — data handling, availability, acceptable use — and the MIT licence on the weights is beside the point. The same model can reach you under two entirely different agreements depending on how you got it.

Third, it says nothing about the training data. A permissive licence on the weights is the publisher’s grant of rights in the artefact they produced; it is not an indemnity, and it makes no representation about the provenance of what went in. If your risk posture depends on that question, the licence is not where the answer lives.

What to actually check before shipping

“Phi-3 is MIT” is true of Microsoft’s repositories and is not a property that survives every route the weights can reach you by. Five checks, each of which takes a minute:

1. Open the LICENSE file in the exact repository you are downloading from. Not the family, not the card summary, not the Hub’s tag — the file. Community quantisations and fine-tunes live under different namespaces with different terms, and a merged model inherits the most restrictive licence among its ingredients.
2. Record the repository and commit alongside the licence text. If you are asked in two years what you shipped under what terms, the answer should be in the same place as your dependency lock file. See pinning a Phi checkpoint.
3. Include the notice wherever the weights go. Container images, desktop application bundles and mobile app packages all count as redistribution when the checkpoint is inside them. A third-party notices file is the usual home for it.
4. Decide separately about your fine-tune. MIT lets you license derivative weights as you choose, but the training data you used has its own terms, and those are usually the binding constraint rather than the base model’s.
5. Note which agreement each call path is under. If some traffic hits self-hosted weights and some hits a managed endpoint, two different sets of terms apply to the same model in the same product. That is normal, and it needs to be written down somewhere other than in one engineer’s head.