YOLO licensing vs dataset licensing: what a commercial product needs

Two licences, two questions

The model licence governs the code and pretrained weights you build on; the dataset licence governs the images and labels you train on. They are independent. A permissive model trained on non-commercial data is not cleared for a product, and neither is a commercial dataset used with AGPL code you will not open-source.

So a buyer asks two questions: may I ship code and weights built on this model in a closed product? and may I ship a model trained on this data?

Ultralytics YOLO: AGPL-3.0 or Enterprise

AGPL-3.0 is a copyleft licence: if you distribute a work based on it, or let users interact with a modified version over a network, you must offer them its complete source code under the same licence.

The ultralytics package (YOLOv8, YOLO11 and the current YOLO26) and the older YOLOv5 repository are released under AGPL-3.0. Ultralytics' licensing page spells out how it reads that: compliance means "publicly releasing the complete corresponding source code for the entire derivative work", including, where applicable, model weights, and the AGPL "covers the training code and the models produced by that training code". Deploying through a SaaS platform, an API or another private system still needs either AGPL compliance or an Enterprise licence.

The Ultralytics Enterprise licence is the paid alternative. According to Ultralytics it covers commercial products and services, internal business tools, closed-source software, SaaS and API deployment, embedded hardware, and custom-trained or fine-tuned models in commercial settings. It can be scoped to a single project or the whole organisation and includes access to all YOLO versions released during the term. Prices are not published; Ultralytics quotes per organisation and use case.

In practice: if your camera firmware, VMS plug-in or cloud service is closed-source and runs a model trained with the ultralytics package, budget for an Enterprise licence or plan a different model.

Detectors with permissive licences

A permissive licence such as Apache-2.0 allows commercial use and closed-source distribution, provided you include the licence text, keep the copyright and attribution notices, and mark files you changed. These real-time detectors are published that way:

Two traps. First, the same architecture can carry different licences depending on where you get it: RT-DETR from its original repository is Apache-2.0, while the RT-DETR implementation shipped inside the ultralytics package is part of an AGPL-3.0 codebase. Second, code and weights can differ: SuperGradients is Apache-2.0, but the YOLO-NAS pretrained weights come with a licence that forbids commercial use "including in connection with any models used in a production environment" unless you have a separate agreement.

Pretrained checkpoints also inherit questions from their training data. If a checkpoint was pretrained on COCO, note that COCO's annotations are CC BY 4.0, but the COCO Consortium states it does not own the copyright of the images, which are subject to Flickr's terms.

Dataset licences

A dataset licence sets what you may do with the images and labels, and, depending on how it is read, with what you build from them.

• CC BY: any use, including commercial, if you give credit and link the licence. Creative Commons suggests that for AI training, attribution "could be a simple link to the source of the dataset".
• CC BY-NC: no use "primarily intended for commercial advantage or monetary compensation". CC's conservative guidance says that under NC every stage, from copying data during training to sharing the trained model, must not be for commercial gain. SA adds share-alike; ND forbids distributing modified versions.
• Research-only: custom terms, typically academic use only, no redistribution, no commercial use.
• No licence stated: no permission is not permission. Several well-known CCTV benchmarks fall here.
• Commercial dataset licence: a contract with the data owner that names what you may do with trained models and the raw files.

Creative Commons also notes that its licences only apply where copyright permission is needed, and that applying copyright law to AI training is complex. That uncertainty cuts both ways; for a product you sell, the conservative reading is the one your customers' lawyers will use. Our comparison of public CCTV datasets lists the licence of each.

What "derived weights" means

Derived weights are the model parameters that result from training or fine-tuning on a dataset, starting from someone else's code or checkpoint.

They sit where both licences meet. The model licence can attach to them (Ultralytics says the AGPL covers models produced by its training code). The data licence can attach to them (CC's conservative NC reading covers sharing the trained model). A commercial dataset licence should state in plain words whether you may deploy and redistribute derived models. If it does not, ask before you train.

How Simuletic's licences work

Simuletic sells each catalogue image dataset as 1,000 images under one of two licences, one-time, with no seats or subscriptions.

• Research, $149: non-commercial work by one lab or course, on any dataset.
• Commercial, $590: one organisation may train models and ship them in products, with a perpetual licence for those models.

Our terms (section 7) define the commercial licence as perpetual, worldwide and non-exclusive: you may train, evaluate and deploy your own models and redistribute derived models freely. You may not resell, sublicense or publicly republish the raw dataset files. Attribution is appreciated but not required. Images you generate yourself on the platform are covered by section 6, which grants a perpetual, worldwide, royalty-free, sublicensable licence, including for training and deploying models and embedding them in products.

Free samples are separate: each follows the open licence on its Kaggle or Hugging Face page (the Pedestrian-1K sample, for example, is under a non-commercial CC licence). Every image is synthetic, so the data contains no real people. The dataset licence does not cover your model licence: if you train with the ultralytics package, AGPL-3.0 or the Enterprise licence still applies to that code.

Pre-purchase checklist

• Which detector, from which repository, under which licence? Code and weights separately.
• If AGPL: will you open-source the whole product, or buy an Enterprise licence?
• For each dataset in training, including the one behind your pretrained checkpoint: is commercial use explicit?
• Does the dataset licence name derived models, and may you redistribute them on devices and in the cloud?
• Scope: per organisation, project or seat; perpetual or annual.
• Real people in the data: what is the legal basis under GDPR?

More on choosing data in training data for AI security cameras and synthetic data for YOLO training.

FAQ

Sources

• Ultralytics licensing (AGPL-3.0 and Enterprise)
• Ultralytics repository (licence, YOLO26)
• YOLOv5 repository (AGPL-3.0)
• GNU AGPL-3.0, section 13
• YOLOX repository (Apache-2.0)
• RT-DETR repository (Apache-2.0)
• DAMO-YOLO repository (Apache-2.0)
• PaddleDetection repository (Apache-2.0)
• SuperGradients repository (Apache-2.0)
• YOLO-NAS weights licence
• Apache License 2.0
• CC BY-NC 4.0 deed
• Creative Commons: using CC-licensed works for AI training
• COCO terms of use
• PA-100K licence (HydraPlus-Net repository)
• MOT17 licence (MOTChallenge)
• UBnormal licence

Checked on October 24, 2026. This guide is not legal advice.