Which model are you allowed to use as a teacher? Comparing the distillation clauses
Sovereignty & Law
Dominik Keller
Founder, Kontinent
Anthropic, OpenAI, and Google contractually prohibit using their outputs to train competing models through any procurement route, including Bedrock, Azure, and Vertex. Mistral is the only one of the four without an explicit clause for text outputs. For European hosters, the obstacle is usually elsewhere: in the model's license.
Anyone who wants to train their own small model needs target responses. The obvious way is to have a large model generate or correct them. This process is called distillation; the large model is the teacher, and the small one is the student. Technically, this is routine today. Contractually, it is the opposite.
We had to clarify this question before our own training project and, on September 7, 2026, read the full text of the terms of use of four frontier providers, ten European hosters, and over twenty open models. This article is the result. It does not replace legal advice, but it tells you which document contains the clause that affects you.
The Essentials in Brief
Three contracts apply simultaneously: the provider's terms, the hoster's terms, and the model's license. All three must cover the case. Silence in one place does not help if another prohibits it.
The procurement route changes nothing. Anthropic's prohibition appears word-for-word in the Bedrock version of the Commercial Terms. For Azure and Vertex, the hyperscaler's terms apply in addition to those of the model manufacturer.
Most EU hosters are silent on the issue. Scaleway, OVHcloud, IONOS, TensorX, and Regolo contain no prohibition on using output for training. Nebius, Nebul, Infercom, Inceptron, and AKI.IO prohibit competing models or services.
Two hosters additionally prohibit benchmarking. With Nebius and Nebul, "competitive analysis or benchmarking" is expressly prohibited. This does not affect training, but it does affect any provider comparison.
For open models, Apache 2.0 or MIT is the safe bet. These licenses do not regulate outputs at all. You have to be careful with Llama (naming requirement for the distillate), Gemma 3 (the distillate inherits the usage restrictions), and MiniMax M2.7 (commercial use only with approval).
Table of Contents
What Distillation is Contractually About
Three Contractual Levels That Apply Simultaneously
Level 1: The Frontier Providers
Why the Procurement Route Changes Nothing
Level 2: The European Hosters
Level 3: The License of the Model
The Gray Area: What Does "Competing" Mean?
A Four-Step Verification Path
How We Decided Ourselves
Frequently Asked Questions
What Distillation is Contractually About
Distillation means: A large model provides the answers from which a small one learns. In practice, there are two variations. Either the teacher is allowed to generate the training examples from scratch, or the student answers first itself and the teacher corrects it. In both cases, the outputs of a third-party model end up in your training data.
Exactly this is where the contractual question hinges. It is not "am I allowed to use the model," but "am I allowed to use what comes out of it to build another model." Most terms of use answer the first question generously and the second restrictively.
This should not be confused with the question of whether the provider uses your data for their training. That concerns your inputs and what the provider is allowed to do with them. This concerns their outputs and what you are allowed to do with them. Both questions appear in the same documents and are regularly confused. The first part is explained in the article on Zero Data Retention at OpenAI, Anthropic, and Google.
The reason is obvious. Anyone who retrieves the outputs of a top model in large numbers can use them to build a smaller model that does some of the same work, at a fraction of the price. From the provider's perspective, this is building a competing product from their own material.
Three Contractual Levels That Apply Simultaneously
The most common mistake in this matter is to read only one document. In fact, up to three sets of rules stack up for a single API call:
The terms of the model provider. For Claude, this is Anthropic, even if you bill through AWS.
The terms of the hoster or platform. AWS, Microsoft, Google, or a European provider. These apply additionally, not instead.
The license of the model itself. For open models, this is the crucial level, and almost every EU hoster explicitly passes it on to you.
In practice, this means: A hoster whose terms are silent does not allow you anything that the model license prohibits. And a generous model license does not help if the hoster prohibits competing models. You need a yes or silence on all three levels.
Level 1: The Frontier Providers
For the four major providers, the picture is clear, with one exception.
Provider | Distillation according to Terms | Relevant Clause | Exception |
|---|---|---|---|
Anthropic | prohibited without written permission | Commercial ToS D.4: no access to build a competing product, "including to train competing AI models". Usage Policy: no "model distillation" without "prior authorization" | according to Help Center, allowed for non-competing models such as classifiers, summarizers, extraction |
OpenAI | prohibited for competing models | Services Agreement 3.3(e): no output to develop models that compete with OpenAI products | "Permitted Exception": Classifiers and embeddings that are not distributed to third parties, as well as fine-tuning within OpenAI services |
Google (Gemini API) | prohibited for competing models | Additional Terms, Use Restrictions: no development of models that compete with the services | no explicit exception in the document |
Mistral | not explicitly prohibited for text outputs | Commercial ToS 2.2(e) prohibits reverse engineering of the products; 3.3 prohibits training competing image generators only for image outputs | not applicable, there is no text clause. Residual risk lies in the interpretation of "reverse engineer" |
For Anthropic, it is worth taking a closer look because two documents go to different lengths. The Commercial Terms only prohibit competing models. The Usage Policy generally prohibits the training of any AI model on inputs and outputs without prior permission. Since the Commercial Terms explicitly incorporate the Usage Policy, the stricter version applies. A Help Center article dated March 16, 2026, lists sentiment analysis, categorization, summarization, and information extraction among the allowed activities, and "general purpose chatbots" and models for open text generation among the prohibited ones. However, this article is not part of the contract.
Why the Procurement Route Changes Nothing
A common misconception is that purchasing through a hyperscaler defuses the issue because you have a contract with AWS or Microsoft. The opposite is true: additional rules apply.
With Amazon Bedrock, AWS prints the Anthropic terms in full text on its own page, including the introduction "Anthropic Services on Amazon Bedrock are sold by Anthropic". Section D.4 is word-for-word identical to the API version. In addition, the AWS Service Terms apply: Section 50.5 prohibits generating content "for the express purpose of training an AI model or service or developing a substantially similar AI model or service", 50.11 prohibits extracting weights, and 50.12.1 clarifies that the model manufacturer's terms apply additionally.
With Microsoft Azure and Foundry, Microsoft's Product Terms apply, not those of OpenAI. The Universal License Terms prohibit output "for the express purpose of creating synthetic training data to develop or train AI models or systems that have substantially similar functionality to a Microsoft AI service". This is narrower than OpenAI's own clause because it refers to Microsoft services. For Foundry models, Microsoft explicitly allows synthetic data for fine-tuning within Azure.
With Google Vertex AI, the Service Specific Terms in Section 17 regulate two things separately: 17(a) Competitive Use and 17(b) Model Restrictions, i.e., no using outputs to create or improve "models similar to a Google Model". There is a narrow exception: If the service itself offers fine-tuning or distillation as a feature, a "Modified Google Model" may be created from it. However, this remains with Google, along with the rights to it.
Which route creates which contractual chain is detailed for Claude in our article Using Claude in the EU. The same logic applies here.
Level 2: The European Hosters
Among EU hosters, the field is divided into two groups. One is silent on the question, the other prohibits competing products. Important: Silence here actually means that we found no clause, not that it is explicitly permitted.
Hoster | Headquarters | Output Use for Training | Note |
|---|---|---|---|
Scaleway | Paris, FR | silent | Inputs and outputs belong to the customer according to Art. 4.4. Art. 2.2 refers to the model license |
OVHcloud | Roubaix, FR | silent | Models are "Third-Party Products", whose terms apply. Code of Conduct only prohibits reverse engineering of the models |
IONOS | Montabaur, DE | silent | The training prohibition in 2.3 binds IONOS, not you. But 2.5 and 2.6 set interactive use as the default and list script-driven queries as abuse |
TensorX | Dublin, IE | silent | AUP binds users to the model licenses |
Regolo AI | Frosinone, IT | silent | 5.3 prohibits routing API calls for commercial purposes through third-party services without written permission |
Nebius | Schiphol, NL | prohibits strictly | 5(f): no competing product, no "competitive analysis or benchmarking". Model EULAs are part of the contract |
Nebul | Leiden, NL | prohibits strictly | 5.5.5 as above, including benchmarking ban |
Infercom | Luxembourg, LU | prohibits strictly | 5.1: no development of competing AI inference services |
Inceptron | Lund, SE | prohibits | 3.2(f): no using outputs to build competing foundation models |
AKI.IO | Berlin, DE | prohibits | AUP §5: "training or replication of competing AI models using the Services" prohibited |
Two details are worth highlighting.
The benchmarking ban at Nebius and Nebul does not affect training, but something else: comparison. Anyone who publicly measures providers against each other should know that two of them prohibit this in their terms. This is relevant to us because provider comparisons are part of our work.
The IONOS clauses 2.5 and 2.6 are the most inconspicuous stumbling block of the entire research. They set "interactive use by a natural person" as the default and list "automated or repetitive queries" as well as "forwarding AI output directly as new input" as abuse. A training data pipeline is exactly that. We have not conclusively clarified whether the service description of the AI Model Hub as an API product excludes this. Anyone wishing to generate data on a large scale there should have this confirmed in writing beforehand.
Level 3: The License of the Model
For open models, the actual decision lies here. Almost every EU hoster explicitly passes on the manufacturer's license, Scaleway in Art. 2.2, OVHcloud in Appendix 10 §2, IONOS in 1.6, TensorX in the AUP.
The good news: The most common case is the simplest. Apache 2.0 and MIT do not regulate outputs at all. They license weights and code. Outputs are not subject to the license, so there is no obstacle to distillation there. This applies to the entire Qwen3 family, Gemma 4, GLM-5 to 5.3, and DeepSeek V4.
License Type | Examples | What You Need to Consider |
|---|---|---|
Apache 2.0 or MIT | Qwen3 and Qwen3.5, Gemma 4, GLM-5.1 to 5.3, DeepSeek V4 | nothing special. License and notice requirements only apply when distributing weights |
Community License with Naming Requirement | Llama 3.1 and 3.3 | Distillation is explicitly allowed, but the result must carry "Llama" at the beginning of its name and display "Built with Llama" visibly as soon as you distribute it |
License with Inheritance | Gemma 3 | Google claims no rights to outputs. However, a model trained with them is considered a "Model Derivative" and inherits the Prohibited Use Policy, which you must contractually pass on |
Threshold License | Kimi K2.5 to K3, MiniMax M2 and M3, GLM-5.3, Qwen3.8 Flash-Next | below the threshold, same as MIT. Above it, notification obligations in the UI or a separate agreement apply, usually starting at 100 million monthly users or double-digit million revenues |
non-commercial | MiniMax M2.7 | any commercial use of the software or its derivatives requires prior written approval. Unusable for a commercial pipeline |
A special case deserves mention because it points in the other direction: DeepSeek explicitly allows distillation. The Open Platform terms list "training other models (such as model distillation)" as a permissible use of API outputs. This affects DeepSeek's own API, not the European hosters, but shows the manufacturer's stance. The weights are under MIT anyway.
The Gray Area: What Does "Competing" Mean?
Almost all prohibitions hinge on the same undefined term. What is prohibited is not distillation, but distillation into a competing model. No contract defines precisely what this means.
The only halfway concrete interpretation is provided by Anthropic's Help Center, and it draws a plausible line: A classifier, a summarizer, or an extraction model does not compete with a general-purpose model. A chatbot or a model for open text generation does. OpenAI draws a similar line by naming classifiers and embeddings in the Permitted Exception, as long as they are not distributed to third parties.
For a narrowly defined task like extracting eight fields from an email, this would probably fall under the allowed category. However, the word "probably" is the problem here. It is in a Help Center article, not in the contract, and it depends on a distinction that the provider interprets itself in the event of a dispute. Anyone building a production pipeline on this should get written approval, and that is not trivial with Anthropic: We could not find a public application form or a designated contact channel for this.
A Four-Step Verification Path
If you need to clarify the issue for your own project, this is the shortest sequence:
Define what you are building. A classifier or an extraction model is positioned differently than an assistant. This classification determines almost every exception clause, so write it down before reading contracts.
Check the model manufacturer, not the invoice. The party invoicing you is often not the one whose terms apply. For Claude via Bedrock, Anthropic is the seller.
Check the hoster additionally. Pay attention not only to training clauses but also to ancillary prohibitions: benchmarking, forwarding outputs as new inputs, automated use, resale.
Check the model license. Not the model card, but the LICENSE file in the official repository. With multiple models from the same family, the license can change from version to version; Gemma 3 vs. Gemma 4 is exactly such a case.
If you are already documenting your provider chain anyway, this can be combined with the audit required for the data processing agreement. A template for this is available in our DPA Checklist for AI Tools.
How We Decided Ourselves
For our own training project, the decision was quickly made after this research. We needed a teacher to correct German business mail. The options were a frontier model with a manageable interpretation question or an open model with none.
We chose the open one: Qwen3.5-397B under Apache 2.0, sourced via Scaleway, whose terms are silent on output usage and whose Art. 4.4 explicitly assigns inputs and outputs to the customer. This means no prohibition is in the way on all three levels. The practical price of this decision was manageable: The open teacher provided corrections that were 94 percent correct in our measurement series.
The lesson here is less legal than organizational. This check costs a day, and it costs it before the project. Afterwards, it is expensive because the training data already exists and may be unusable in case of doubt.
Your Contract Chain, Discussed Once
If you are facing the same question, we will go through your case in 30 minutes: which model is suitable as a teacher, what terms attach to your procurement route, and what that means for your data pipeline. Engineering is included, and if the answer is that you don't need an external teacher, we will tell you. Book a Demo.
Frequently Asked Questions
Am I allowed to use GPT or Claude to generate training data for my own model?
Not for a competing model. Anthropic's Usage Policy even requires prior approval for any model training on inputs and outputs. For narrowly defined tasks such as classification or extraction, both providers list exceptions, though in Anthropic's case only in a Help Center article that is not part of the contract.
Does anything change if I procure via Bedrock, Azure, or Vertex?
Yes, but not to your advantage. Additional rules apply. The model manufacturer's terms still apply, and the hyperscaler's terms apply additionally. AWS prohibits generating content for the purpose of model training in Service Terms 50.5, while Microsoft focuses on "substantially similar functionality to a Microsoft AI service".
Which European hosters allow distillation?
None explicitly allow it. However, Scaleway, OVHcloud, IONOS, TensorX, and Regolo do not contain a prohibition. Nebius, Nebul, Infercom, Inceptron, and AKI.IO prohibit competing models or services. In all cases, the license of the respective model also applies, to which the hosters explicitly refer.
Is it enough if the model is under Apache 2.0?
For the license level, yes. Apache 2.0 and MIT license weights and code and do not regulate outputs, so there is no barrier there. The hoster's terms still apply: An Apache model hosted with a provider that prohibits competing models will not help you.
What about Llama and Gemma?
Both allow it but have downstream obligations. For Llama 3.1 and 3.3, a distributed distillate must carry "Llama" at the beginning of its name and display "Built with Llama". For Gemma 3, the trained model is considered a "Model Derivative" and inherits the Prohibited Use Policy, which you must contractually pass on. Gemma 4 is under Apache 2.0.
Am I allowed to publicly benchmark providers against each other?
Not with two of the hosters we reviewed. Nebius and Nebul explicitly prohibit "competitive analysis or benchmarking" in their terms. This is independent of the training question and affects any published comparison, even a favorable one.
How binding is this information?
It is a snapshot as of September 7, 2026, not legal advice. We read the clauses in the raw text ourselves for Google Cloud and AWS, and retrieved the others via extraction from the live document. Before making a legal decision, every cited passage must be cross-read word for word in the original document, especially since several providers updated their terms during the review period.
Sources
Anthropic, Commercial Terms of Service, Section D.4, and Usage Policy: Prohibition of model distillation without prior approval
OpenAI Services Agreement, Section 3.3(e) and the Permitted Exception
Google, Gemini API Additional Terms of Service and Google Cloud Service Specific Terms, Section 17
Mistral AI, Commercial Terms of Service: Non-compete clause for image outputs only
AWS Service Terms, Section 50, and Serverless Third-Party Models on Amazon Bedrock with the printed Anthropic terms
Scaleway, Specific Conditions AI Services (Art. 2.2 and 4.4) and IONOS, Terms of Use for AI Services (Clauses 1.6, 2.3, 2.5, 2.6)
Nebius, Terms of Service, Section 5(f): competing products and benchmarking
Qwen3.5 on Hugging Face (Apache 2.0) and Gemma Terms of Use: Model Derivative and Prohibited Use Policy
DeepSeek Open Platform Terms of Service: Distillation explicitly allowed
As of: September 21, 2026 · kontinent.ai. All documents retrieved live on September 7, 2026. Not legal advice. Terms of use change frequently; verify the original document before making a decision.
