Every few months, another AI lab announces a "family" of models. Usually the excitement lasts about one news cycle. The Qwen 3 release deserves a slightly longer look, but not because of benchmark bragging rights. The reason is the combination of open weights and Apache 2.0 – and what that combination means for companies that have to live with GDPR and the AI Act.
According to The Decoder, Alibaba's Qwen team has released eight models under Apache 2.0. That is a statement about licensing, not just about "openness". Apache 2.0 is one of the most permissive licenses in software. It allows you to use, modify, distribute and sell the software, and it includes an explicit patent grant. For a business, that removes a lot of legal uncertainty.
One family, eight starting points
Eight models means that the release is not one-size-fits-all. There are smaller models that fit on consumer GPUs, and larger models for servers. We have not benchmarked this specific release in our AI Arena yet, but we know the hardware constraints from thousands of local LLM runs: on an RTX 5060 Ti with 16 GB of VRAM, smaller models are the ones you can actually use day-to-day. That is why a family release matters – it gives developers a choice between speed and quality for a given GPU.
We will put these models through our own tests in the coming days and publish real numbers – tokens per second, time to first token, VRAM usage – at our AI Arena. Until then, treat third-party benchmark tables with caution. A model's score on a public leaderboard tells you far less than how it behaves on your own documents, your own queries and your own infrastructure.
Why the license matters more than the hype
Let's be precise about what "open weights" means. You get the trained weights and the code to run them. You do not get the training data or the full training pipeline. That means "open weights" is not the same as "open source" in the classic OSI sense, and organisations using the models should still document what they are using, especially under the EU AI Act.
What Apache 2.0 gives you is the freedom to skip the API middleman. You don't need to sign a contract with Alibaba, you don't pay per token, and you don't send your prompts to a foreign cloud provider. You can run the model on your own server, on your own laptop, or on an EU cloud provider that offers GPU instances.
The European angle: GDPR, AI Act, and self-hosting
For European companies, the self-hosting angle is not a philosophical preference. It is a compliance strategy. When you use a US or Chinese LLM API to process personal data, you are transferring data to a third country. GDPR allows that only under specific safeguards – standard contractual clauses, adequacy decisions, or explicit consent. The EU's adequacy decision for the US exists, but it has been challenged before and does not cover every data flow. With an open-weight model running in the EU, you remove the transfer problem entirely.
Open weights do not automatically make you GDPR-compliant. You are still processing personal data, and you still need to decide whether your use case is legitimate. But self-hosting gives you data sovereignty – the data stays where you put it. That is a tangible advantage for law firms, medical institutions, public administration and any company working with customer data.
The EU AI Act adds another layer. The Act distinguishes between general-purpose AI models and AI systems. Some obligations for open-source general-purpose models are lighter, but if you build a system around Qwen and deploy it to users, you are the deployer and you own the compliance burden. A permissive license does not exempt you from the rules. This is not a reason to avoid open weights; it is a reason to start your risk assessment early.
What to do now
First, download the models and test them on your own data – not just on a leaderboard. Second, check which model size fits your hardware and your latency requirements. Third, run a quick GDPR and AI Act assessment before you put the model into production. The legal work is less glamorous than model benchmarks, but in Europe it's the part that decides whether a deployment survives contact with the real world.
The Qwen 3 release is not the first open-weight family to show up in Europe, and it won't be the last. But the combination of Apache 2.0, multiple sizes and serious backing means European developers finally have a solid, practical option for running a modern LLM on their own terms.
What exactly does the Apache 2.0 license allow?
Apache 2.0 allows commercial use, modification, distribution and sale of the software. It also includes an explicit patent grant, which means the original author grants you a license to patents embodied in the work.
Does "open weights" mean the model is fully open source?
Not in the OSI sense. The trained weights and code are public, but the training data and detailed training pipeline are not. "Open weights" is the more accurate term.
Can a company in the EU use Qwen 3 models without falling foul of GDPR?
Self-hosting or using an EU cloud removes the cross-border data transfer issue, but you still have to process personal data lawfully. GDPR compliance depends on your use case, not on the license.
