Is YOLO free for commercial use?

published 2026-09-22 — an engineer's read of a public licence, not legal advice.

The code is free. The licence is not “free for commercial use”, and it is also not the wall most people assume. Whether YOLO costs you anything depends on how you ship. Here is what AGPL-3.0 actually does to a project that fine-tunes or deploys it, the three exits that exist, and what each one charges.

What the licence says.

Ultralytics publishes YOLOv5, YOLOv8 and YOLO11 under “AGPL-3.0 or Enterprise”. Two clauses matter.

The network clause (AGPL-3.0 section 13). If users interact with your modified version over a network — a web app, an API, anything reachable from outside your company — you owe those users the complete corresponding source, including your own integration code. This is the clause that separates AGPL from the ordinary GPL people expect.
The weights are not exempt. Ultralytics' published position is that checkpoints fine-tuned from their weights inherit AGPL-3.0, and that proprietary use requires an Enterprise licence. Whether merely running unmodified weights triggers derivative-work status is legally unsettled; their position is that it does, and their position is the one that gets tested. Re-check the licence text on their repository — as of 2026-09-22 this summary matches it, but their repository is what defines it.

Two cases where AGPL genuinely costs nothing: internal tools that nobody outside your company can reach, and products you were going to ship with open source anyway. Many teams are fine. The wall is the closed-source product with outside users.

The three exits, and what each charges.

1 — ship open source

Comply with AGPL-3.0: publish your source under a compatible licence. Cost: your source. Right answer when the detector is one component of something you were open-sourcing regardless. Wrong answer the moment a co-founder says “proprietary”.

2 — buy the Ultralytics Enterprise licence

A contract, priced by application. Right answer when your team lives in the Ultralytics training stack and the licence fee is smaller than the cost of retraining anywhere else. This is a real option, not a scare story — for some teams it is the cheapest exit on this page.

3 — use a permissively licensed detector

Several published architectures carry Apache-2.0 weights: YOLOX, D-FINE, LW-DETR, RF-DETR. No copyleft, no enterprise tier, attribution notices and done. Cost: you leave the Ultralytics ecosystem, and the accuracy of each architecture on your domain is unknown until someone measures it. That last part is not a footnote — it is the whole question, and COCO scores do not answer it.

What a swap actually costs.

An Apache-2.0 checkpoint is not a drop-in replacement for a YOLO export. Export docs warn against assuming output order; some checkpoints use per-class sigmoid where others use softmax; boxes arrive as normalised centre-width-height and leave as pixel corners; the background class id changes with checkpoint lineage. Get one of these quietly wrong and you get plausible boxes that are wrong, which is worse than a crash because you trust them. This is typically a day of an engineer's life per architecture, spent on a contract nobody documents.

That contract is what yolomax does once per domain and sells for $149: race the Apache-2.0 architectures on a held-out set, calibrate the winner's thresholds, export INT8, verify the decoder against the reference implementation, and ship the numbers with the pack. On vehicles in traffic, the calibrated winner reached F1 0.626 against 0.567 stock.

F1 0.6257 calibrated vs 0.5672 stock — COCO val2017 vehicle subset (250 images, 971 boxes), 800 px, 1-core x86, run 2026-09-17. COCO vehicles are evidence about our pipeline, not about your factory line; the pack page runs the winner in your browser so you can check our work before paying.

The decoder contract itself is documented in our docs, license notes included, so you can evaluate the work before it is yours.