The success of open-source large models such as DeepSeek and Llama demonstrates that technological innovation and industrial development in AI will inevitably rely on an open-source innovation ecosystem. Open-source licenses are a key element of governance in that ecosystem; in essence, they are contracts for the transfer of rights shaped by the rightsholder's genuine manifestation of intent, and their terms are legally binding on the public with respect to the use, reproduction, modification, and distribution of "open-source resources." Because open-source large models are widely used across the AI ecosystem, enterprises' insufficient understanding and improper performance may not only trigger intellectual-property (IP) infringement risks but also trap them in compliance dilemmas where investment and return fall out of balance; there is an urgent need for compliance guidance. At present, however, there is still a lack-both domestically and internationally-of systematic research on compliance strategies for open-source licenses at the user side of large models.This paper surveys representative open-source licenses in the large-model field worldwide, identifies IP risks that may arise from license breaches through the lens of the AI value chain, and analyzes countermeasures using an integrated "law-technology-information science" paradigm. In the data pre-training stage, open-source large models typically use massive datasets from open databases and the publicly accessible internet to perform pre-training, thereafter serving as the foundational base models for downstream "service-facing" large models. Because the relationship between model parameters and training data is a nonlinear mapping that sharply reduces the feasibility of traditional cleansing techniques, and because the aggregation of massive data produces abnormally high costs for identifying rightsholders-combined with many jurisdictions' tendency to afford exemptions to open-source model developers and the absolute disclaimers commonly found in open-source licenses-the responsibility for managing IP infringement risks in the pre-training stage has shifted from the development side to the user side. Inadequate cleansing of rights-information in training data is the principal cause of IP infringement risk at the pre-training stage.During the development and use stage, differences exist both among different categories of open-source licenses and among clauses within the same category-for example, divergent obligations among permissive licenses, divergent prohibitions among weak-copyleft (restrictively permissive) licenses, and ambiguous trigger boundaries for strong-copyleft ("infectious") licenses in the large-model context. An unclear understanding of open-source licenses is the primary cause of IP infringement risk in this stage.At the output stage, open-source large models typically must rely on code subject to open-source licenses for training, and the model's propensity to memorize training data can lead to the dissemination of content that is substantially similar to the training code. A lack of control over derivative content is a principal cause of IP infringement risk at this stage.In the data pre-training stage, because AI training data are massive in scale, rightsholders are dispersed, entitlement structures are complex, and the information is often unstructured, traditional community-based review mechanisms struggle to achieve effective provenance tracing; users of open-source large models must therefore build an autonomous rights-governance framework. Enterprises should establish a full-lifecycle rights-information cleansing mechanism that integrates "technical filtering + explicit allocation of rights and responsibilities + data compliance." In the development and use stage, users of open-source models should develop a deep and accurate understanding of the various open-source licenses and, on that basis, use auxiliary license-selection tools-such as ChooseALicense and License Differentiator-to make choices aligned with their commercial preferences. They should also focus on the typological features and risk profiles of permissive licenses, weak-copyleft (restrictively permissive) licenses, and strong-copyleft ("infectious") licenses, and establish differentiated compliance management systems for each. In the output-management stage, in light of the particular risk-response needs associated with outputs from open-source large models, enterprises should construct a risk-management framework along four dimensions: data preprocessing, model training, generation control, and user oversight.