“Open” is a heavily overloaded term in medical AI. Before your lab starts building with a free model, you need to understand exactly what you are receiving and what you are agreeing to.
By Dr Emeka Patrick Chukwuka, MBBS, FWACP, FMCPath · Physician-haematologist · Founder, EEHLSS | ALAFIAAI · ~8 min read
Education & research only · not medical, legal or regulatory advice. Licence summaries below are simplified; always read the full licence for the exact model version you use.
Three years ago, the strongest medical language models sat behind a vendor’s API. Today a laboratory in Lagos or Al-Hasa can download a capable model, run it on a single workstation and never send a byte of data off site. Meditron, released by an EPFL-led team in 2023, showed that continued pre-training on medical literature could lift an openly available base model on medical benchmarks. In July 2025 Google released MedGemma, a family of open health models in 4B and 27B sizes with text and image variants, and reported that the 27B text model scored 87.7% on the MedQA benchmark. DeepSeek-R1 arrived under the permissive MIT licence and was quickly surveyed for clinical use.
That is real progress. However, “open” encompasses many different arrangements, and these differences matter most in the areas where healthcare is least forgiving: patient data, liability, and long-term support.
What “open” actually means
Most models called open-source are actually open-weight. This means you can download the trained parameters, but the training data and often the full training code remain private. The Open Source Initiative attempted to clarify this with its Open Source AI Definition 1.0, released in October 2024. To meet this standard, a system must allow users to use, study, modify, and share it. In practice, this requires releasing the parameters, the code, and enough detail about the training data so a skilled person could build a substantially equivalent system.
Not many popular models meet that bar. Many are released under custom licences that impose use restrictions, attribution rules, or commercial thresholds. This isn’t always an issue, but it means “free to download” and “free to build a product on” are two different questions.
Why open models matter for labs in Nigeria and the GCC
Data stays home. Nigeria’s Data Protection Act 2023 treats health information as sensitive personal data and sets specific conditions for transferring data abroad. Saudi Arabia’s Personal Data Protection Law takes a similarly cautious approach to health data and cross-border transfers. Running a model on a local server keeps laboratory data within the institution, which can simplify compliance. However, it does not eliminate the need for oversight: local processing is still processing.
Predictable cost. Budgeting for per-token API pricing in dollars is difficult when your revenue is in naira. Buying hardware once and using a fixed model makes planning much simpler.
Auditability and version control. When you hold the weights, the model cannot change silently. You can freeze a version, record its checksum, and reproduce the exact output you validated months later. For those working towards ISO 15189 discipline, this traceability is essential.
Local adaptation. Open weights allow us to fine-tune models on our own terminology, reporting conventions and disease patterns. For instance, sickle cell disease, malaria and G6PD deficiency present differently in a Nigerian reference laboratory than they do in the datasets most models use for training.
Resilience. An offline model keeps working even during bandwidth outages, which are still common in many facilities.
The risks people underplay
Benchmarks are not bedside performance. Exam-style scores like MedQA measure how well a model answers questions, not how it behaves in a real clinical workflow. Google’s own model card is explicit: MedGemma outputs are not intended to directly inform diagnosis or treatment and must be validated for each specific use.
Bias travels with the weights. A 2023 study in npj Digital Medicine found that several large language models reproduced debunked race-based medical claims. Fine-tuning a model on local data does not automatically remove these patterns. Populations under-represented in training data, including many African populations, carry the most risk.
Weaker guardrails. A 2025 survey of DeepSeek in healthcare highlighted vulnerability to bias, misinformation and adversarial manipulation alongside its strengths. Because these are open weights models, anyone can remove the safety tuning. This means a fine-tuned copy found on a public hub may behave very differently from the original.
When you download the weights, you also download the responsibility. There is no vendor on the other end of the phone.
Supply-chain security. Model files can carry malicious code if you load them from unsafe formats. I recommend using safetensors files, downloading directly from the original publisher, and verifying hashes.
You become the manufacturer. If you wrap an open model into a tool used for clinical decisions, your organisation—not the model’s author—may carry the regulatory obligations of a medical device developer. NAFDAC, the Saudi Food and Drug Authority, and other regulators will want to know who validated the system, which population was used, and how you control changes.
Reading the licence before you build
The licence is where “open” actually gets defined in practice. Here is a simplified comparison:
| Licence type | Example | What to watch |
|---|---|---|
| Permissive | Apache 2.0, MIT (e.g. DeepSeek-R1) | Broad commercial use; keep copyright and licence notices; Apache 2.0 adds an express patent grant. |
| Custom community licence | Llama 4 Community License | Separate licence needed above 700 million monthly active users; “Built with Llama” attribution; derivative model names must begin with “Llama”; an acceptable use policy applies. |
| Health-specific terms | Health AI Developer Foundations terms (MedGemma) | Use restrictions and expectations that you validate for your use case; check the current terms page for the exact version. |
| Non-commercial / research-only | CC BY-NC and similar | Fine for teaching and research; not for a paid product. |
Regulation adds another layer for anyone selling into Europe. Under the EU AI Act, obligations for general-purpose AI model providers have applied since 2 August 2025, with Commission enforcement starting in August 2026. Truly open-source models that are not monetised receive some exemptions, but they are not exempt from the copyright policy duty, nor are they exempt if the model is considered to carry systemic risk.
The WHO’s 2024 guidance on large multi-modal models reminds governments and developers that accountability spans the entire chain, from the model developer to the provider deploying the system.
A seven-point checklist for lab leaders
- Record the exact model name, version and file checksum, and keep a copy of the licence text you accepted.
- Check that your licence covers how you plan to use it: whether for research, an internal tool, or a commercial product.
- Run it locally or within your country if data protection laws require it, and make sure to log every inference.
- Validate on a local, de-identified or synthetic test set before anyone relies on it. Report sensitivity, failure modes, and subgroup performance rather than just accuracy.
- We must keep a qualified human in the loop. The interface should be designed so the expert can see the reasoning behind the model’s output.
- Our plan for change control must address two core questions: who holds the authority to approve a model update, and what the specific process for re-validation looks like.
- Decide early if your use case might classify the tool as a medical device, and consult the regulator before you scale.
How we approach it at ALAFIAAI
We built our MedLabAI-LIS and BloodBankAI tools as research and decision-support prototypes. I prefer using locally run models so laboratory data stays on-site. We develop and test these against synthetic cases, and I ensure clinician review is required before any output is used. We do not make diagnostic performance claims for these prototypes. Using open models makes this privacy-first approach possible for a small team, but they do not replace the necessary validation work.
Open models offer significant advantages for health AI in resource-limited settings. When used carefully, they allow laboratories in Africa and the Gulf to build tools tailored to their specific patient populations and local regulations. However, careless implementation shifts the risk from a vendor’s contract directly onto your own desk. The difference usually depends on whether the licence was read and whether proper validation was performed.
References
- Open Source Initiative. The Open Source AI Definition 1.0. October 2024. opensource.org/ai/open-source-ai-definition
- Chen Z, Hernández Cano A, Romanou A, et al. MEDITRON-70B: Scaling Medical Pretraining for Large Language Models. arXiv:2311.16079; 2023. arxiv.org/abs/2311.16079
- Google Research. MedGemma: Our most capable open models for health AI development. 9 July 2025. research.google/blog/medgemma…
- Google. Health AI Developer Foundations (HAI-DEF) and Terms of Use. developers.google.com/health-ai-developer-foundations
- Ye J, Bronstein S, Hai J, Abu Hashish M. DeepSeek in Healthcare: A Survey of Capabilities, Risks, and Clinical Applications of Open-Source Large Language Models. arXiv:2506.01257; 2025. arxiv.org/abs/2506.01257
- Omiye JA, Lester JC, Spichak S, Rotemberg V, Daneshjou R. Large language models propagate race-based medicine. npj Digital Medicine. 2023;6:195. doi.org/10.1038/s41746-023-00939-z
- Meta. Llama 4 Community License Agreement. 2025. llama.com/llama4/license
- Apache Software Foundation. Apache License, Version 2.0. apache.org/licenses/LICENSE-2.0
- World Health Organization. Ethics and governance of artificial intelligence for health: guidance on large multi-modal models. January 2024. who.int (news release, 18 Jan 2024)
- WilmerHale. European Commission issues guidelines for providers of general-purpose AI models. July 2025. wilmerhale.com
- Federal Republic of Nigeria. Nigeria Data Protection Act 2023. Act text (DataGuidance PDF)
© 2026 EEHLSS | ALAFIAAI · Education & research only · not medical advice
Leave a Reply