GEL v1.0 Licensing Scenarios Guide

Publication Metadata

How to Read This Guide

This guide explains, in plain language, how GEL v1.0 applies to common real-world situations. It is explanatory guidance only. It does not amend, supersede, or replace GEL v1.0, and it is not legal advice.

The published licence at oda3.org/legal/gel-v1-0/ is the sole legal instrument governing use of the GAISSF Ecosystem. If this guide appears inconsistent with GEL v1.0, the published licence controls.

The Core Boundary

GEL v1.0 is a source-available licence, not an open-source licence. It establishes the following baseline:

• Internal Use is permitted under GEL v1.0 without a separate commercial licence.

• Commercial Use requires an appropriate written commercial licence from ODA3 Institute.

• A commercial licence alone does not confer partner status, assessment authority, training authorization, certification authority, or any other programme appointment.

• Where an applicable ODA3 Authorized Partner Programme exists, external professional delivery must be performed through the relevant authorized or empaneled pathway.

Internal Use includes an organization’s own governance and risk management, internal compliance mapping, internal training for its personnel, internal research and evaluation, and non-public implementation within its own systems. Commercial Use includes external deliverables, services, products, software, managed services, paid training, client engagements, and other commercial operationalization of Licensed Material.

Common Scenarios

Q1. Can I read, download, and cite the GAISSF Ecosystem? #

Yes. You may read and download published materials for evaluation, cite them academically, and refer publicly to GAISSF™, UAIF™, AI-IRF™ and PAI-SF™ with accurate attribution and trademark usage. Citation or reference does not grant rights to reproduce substantive content commercially, claim endorsement, or imply authorization.

Basis: GEL v1.0 §4 (Licence Grant), together with applicable attribution and trademark requirements.

Q2. Can my organization use GAISSF™ internally to run its own AI governance programme? #

Yes. Your organization may use the Licensed Material for its own governance, risk management, internal compliance mapping, internal staff training, internal research and evaluation, and non-public implementation within its own systems. This is Internal Use and does not require a separate commercial licence.

Basis: GEL v1.0 §3.3 (Internal Use).

Q3. I am an independent consultant or fractional CISO. Can I use GAISSF™ to advise clients? #

Not under Internal Use rights. Advising or delivering services to an external client using Licensed Material is Commercial Use. You must hold the applicable commercial rights and, where ODA3 operates a relevant authorized-partner programme, satisfy that programme’s eligibility, competency, independence, conduct and ongoing-compliance requirements before delivering those services.

Basis: GEL v1.0 §§3.3–3.4 and the applicable ODA3 commercial-licensing and authorized-partner programme rules.

Q4. My organization has Internal Use rights. Can a contractor use GAISSF™ on our behalf? #

Only within a tightly bounded internal engagement and only where the contractor is not independently providing an ODA3-based implementation, advisory, assessment, audit, training or certification service. Internal Use rights do not transfer to the contractor and cannot be reused for another client. Where the contractor is delivering an ODA3-based professional service, the work must be performed through an appropriately licensed and, where applicable, authorized or empaneled ODA3 partner.

Basis: GEL v1.0 §§3.2–3.4 (including the Contractor Engagement Clarification) and applicable ODA3 partner-programme rules.

Q5. Can I teach a paid course or workshop based on the GAISSF Ecosystem? #

Not through ordinary Internal Use or a general commercial licence. Paid external training based on Licensed Material requires the relevant commercial rights and express ODA3 training authorization. Where an Authorized Training Partner Programme exists, delivery must be through an approved training partner using authorized curriculum, qualified instructors and applicable quality controls. Internal training delivered by an organization solely to its own personnel remains Internal Use.

Basis: GEL v1.0 §§3.3–3.4 and applicable ODA3 training authorization and partner-programme rules.

Q6. Can I offer GAISSF™ certification, assessment, or audit services? #

No, unless ODA3 Institute has granted the specific authority required for the proposed service. A commercial licence does not by itself authorize assessment, audit, certification, accreditation, issuance of marks, or claims of conformity. Certification authority remains reserved to ODA3 Institute, and external assessment or audit activity must follow the applicable ODA3 programme, scope, competence, independence and quality-assurance requirements.

Basis: GEL v1.0 §10.5 (Certification Authority) and applicable ODA3 assessment, assessor, audit and certification programme rules.

Q7. Can I embed GAISSF™ control logic or taxonomies into software or a SaaS product? #

Software that merely interfaces with or references Licensed Material without reproducing its substantive content may fall within the Independent Modules carve-out. Software that implements, automates, embeds, operationalizes, or is substantially derived from GAISSF™ control logic, UAIF™ taxonomies, AI-IRF™ procedures or other Licensed Material requires appropriate commercial software rights for commercial deployment. Where ODA3 operates a relevant Technology Alliance or integration programme, commercial integration may also require programme authorization, technical conformance and approved representation of compatibility.

Basis: GEL v1.0 §3.5 (Software Derivatives and Independent Modules) and applicable ODA3 technology-alliance or integration programme rules.

Q8. Can I build an open-source project around the GAISSF Ecosystem? #

Only within GEL v1.0’s conditions. Publishing software under an open-source licence does not convert ODA3 Licensed Material into open-source material or override GEL obligations. Incorporating ODA3 mappings, taxonomies, controls or substantive references is permitted only to the extent allowed by GEL’s non-commercial redistribution terms, including attribution, licence-notice and modification-disclosure requirements. No Commercial Use rights pass downstream. Any party that later embeds, packages or deploys that project in a paid product or service must independently obtain the required commercial rights and any applicable programme authorization from ODA3 Institute.

Basis: GEL v1.0 §§3.5, 5.2 and 5.4. No GEL revision is required for this explanatory clarification.

Q9. Can I use GAISSF Ecosystem materials as training or evaluation data for an AI model? #

Purely academic or non-commercial research use may be permitted with the required attribution and licence compliance. Training, fine-tuning, retrieval, evaluation, benchmarking or other machine-readable ingestion intended for commercial deployment or commercial benefit requires appropriate written commercial rights. Those rights do not imply ODA3 endorsement, validation, certification or authorized-partner status.

Basis: GEL v1.0 §3.6 (AI and Machine-Readable Ingestion).

Q10. Can a government body use GAISSF™, and can its vendor implement it? #

A government body may use Licensed Material for its own internal governance purposes under Internal Use. A commercial vendor, integrator or contractor engaged to implement, advise, assess, audit, train, certify or otherwise operationalize the material is undertaking external professional delivery. That provider must hold the applicable commercial rights and, where the relevant ODA3 programme exists, be appropriately authorized or empaneled. The government body’s Internal Use rights do not substitute for the provider’s own authorization.

Basis: GEL v1.0 §§3.3–3.4 and applicable ODA3 authorized-partner programme rules.

Q11. Can I publicly redistribute GAISSF Ecosystem documents on my website or repository? #

Only under GEL v1.0’s non-commercial redistribution terms. Attribution and the complete licence notice must be retained; modifications must be clearly identified; required unofficial-modification disclaimers must be used; and redistribution must remain strictly non-commercial. Redistribution does not confer Commercial Use rights, authorization, endorsement, assessment authority or certification authority on the distributor or any recipient.

Basis: GEL v1.0 §§5.2 and 5.4.

Q12. What if my proposed activity requires Commercial Use rights? #

Contact ODA3 Institute for a use-case determination and the appropriate licensing pathway. Commercial rights may be scoped for advisory delivery, software embedding, enterprise deployment, training, assessment or other defined activities. Where the activity is also governed by an ODA3 programme, licensing and authorization are separate gates: both must be satisfied before delivery begins. No applicant may describe itself as an ODA3 partner, assessor, auditor, trainer, certification body or technology ally until formally appointed for that role.

Basis: GEL v1.0 §17 (Commercial Licensing) and applicable ODA3 programme rules.

Decision Guide

Notably Absent

This guide does not:

• create GEL v1.1 or amend any clause of GEL v1.0;

• grant commercial rights, partner status, assessment authority, training authorization or certification authority;

• publish or disclose controlled ODA3 programme materials, evaluation criteria or certification methods;

• state that every interface, citation, independent module or open-source project requires a commercial licence; or

• replace fact-specific legal review where the proposed use falls near a licensing boundary.

Still Have a Question?

For situations not addressed here, consult GEL v1.0 at oda3.org/legal/gel-v1-0/ or contact ODA3 Institute through oda3.org. This guide is not legal advice; obtain independent counsel for your circumstances.