CIOs can’t equate local hosting with ownership. Many “community” AI licenses restrict commercial use, transferability, or fork rights. True control requires OSI-approved licenses (with SPDX IDs) so AI can be transferred, audited, and treated as an asset.
