EU AI Act Open-Source Exemptions for GPAI Models: What Is and Is Not Covered

Two Different Open-Source Provisions

Regulation (EU) 2024/1689 contains two separate open-source carve-outs that are frequently confused. Article 2(12) addresses AI systems: the regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems, fall under the prohibited practices of Article 5, or trigger the transparency obligations of Article 50. Article 53(2) addresses general-purpose AI models, and it is the provision that matters for anyone publishing model weights.

Under Article 53(2), the obligations to maintain Annex XI technical documentation and to provide Annex XII information to downstream providers do not apply to providers of AI models released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters — including the weights — together with information on the model architecture and on model usage, are made publicly available. The exemption is explicitly conditional and explicitly partial.

What Open-Source Providers Must Still Do

Two of the four Article 53 duties apply to every GPAI provider without exception:

• The copyright policy under Article 53(1)(c), including identification of and compliance with text and data mining opt-outs reserved under Article 4(3) of Directive (EU) 2019/790.
• The publicly available training content summary under Article 53(1)(d), drawn up according to the AI Office template published in July 2025.

The logic, set out in recital 104, is that transparency about training content and respect for copyright serve the public and rightsholders regardless of distribution model, while the documentation duties are relaxed because open release itself provides much of the transparency that Annex XI and XII would otherwise deliver: anyone can inspect the weights and architecture.

The Conditions in Detail

Licence quality

The licence must genuinely allow access, usage, modification and distribution. Licences that prohibit commercial use, cap usage by company size, restrict fields of application, or require separate agreements for redistribution sit in a grey zone — many widely used community licences for model weights carry exactly such restrictions, and a provider relying on the exemption should assess honestly whether its licence meets the regulation's description rather than assuming that any public release qualifies.

Public parameters and information

Weights, architecture information and usage information must actually be publicly available. A model whose weights sit behind a gated approval process raises the question whether parameters are made publicly available in the required sense; providers should document their reasoning.

No monetisation

Recital 103 explains that the exemption reflects free and open release, and that making a model available against a price, or otherwise monetising it — including by providing paid technical support or by using the model within paid services in ways that go beyond mere hosting — is inconsistent with the exemption. A provider that releases weights freely but sells a managed API of the same model should treat the exemption as unavailable for the monetised offering.

The Systemic Risk Cliff

Article 53(2) contains its own limit: the exemption does not apply to GPAI models with systemic risk. Once a model meets the Article 51 classification — presumed above 10^25 FLOPs of cumulative training compute, or by Commission designation — the provider carries the full set of obligations: Annex XI documentation, Annex XII downstream information, the Article 52 notification duty, and all Article 55 duties including model evaluation with adversarial testing, systemic risk mitigation, serious incident reporting and cybersecurity protection. Open release is not a defence at the frontier; if anything, supervisors pay particular attention to highly capable open-weight models because released weights cannot be recalled.

Who Benefits in Practice

The exemption is most valuable for research groups, non-profits and companies releasing small and mid-scale models without commercial wrappers: they avoid maintaining regulator-facing Annex XI files and structured downstream documentation packages. Three groups should be cautious. Companies with hybrid distribution — free weights plus paid API or support — cannot stretch the exemption across the paid channel. Downstream modifiers who fine-tune an open model and place the result on the market under their own name may become providers themselves, and their own distribution choices determine whether they can claim the exemption. And any provider near the compute threshold should remember that the entire exemption evaporates with systemic-risk classification.

Practical Steps

• Audit your licence against the four freedoms the regulation names — access, usage, modification, distribution — and record the assessment.
• Verify that weights, architecture details and usage information are genuinely public, and archive evidence of what was published and when.
• Map your revenue streams around the model. Identify anything that could count as monetisation and decide channel by channel where the exemption applies.
• Comply fully with the two universal duties: adopt the copyright policy and publish the template-conformant training data summary at release.
• Track training compute. If a future release approaches 10^25 FLOPs, plan for full Chapter V compliance from day one.
• Even where exempt, consider maintaining lightweight documentation anyway — downstream integrators building high-risk systems will ask for it contractually, exemption or not.

Timeline and Enforcement Context

The Chapter V obligations, including the boundaries of the open-source exemption, have applied since August 2, 2025. Models placed on the market before that date benefit from the transition rule in Article 111(3) and must comply by August 2, 2027 — a rule that matters for the many open-weight models published in 2023 and 2024 that remain widely used. Supervision of GPAI obligations sits exclusively with the Commission's AI Office, and from August 2, 2026 the Commission can impose fines on GPAI providers of up to 3 percent of total worldwide annual turnover or 15 million euros, whichever is higher. For open-source projects without turnover, the practical exposure is less about fines and more about orders to comply, reputational cost, and the willingness of downstream commercial users to keep building on a non-compliant base.

The AI Office's July 2025 guidelines on the scope of GPAI obligations also addressed open release directly, confirming that the exemption analysis runs licence by licence and channel by channel, and that providers should keep evidence of the conditions being met at the time of each release. Open-source communities with distributed maintainership should designate who, legally, is the provider placing the model on the market — the question becomes acute the moment anything goes wrong.

A Concrete Example

A European research lab releases a 7-billion-parameter model under a permissive licence, with weights on a public repository, an architecture paper, usage documentation and no paid offering. It qualifies for the Article 53(2) exemption, so it skips Annex XI and XII, but it publishes a training data summary using the AI Office template and adopts a copyright policy covering its crawl pipeline. A year later, a commercial spin-off launches a paid hosted API for an improved version of the model. For that monetised channel the exemption no longer applies, so the spin-off prepares full technical documentation and a downstream information package before launch. Neither model approaches the systemic-risk threshold, so Article 55 remains out of scope for both.

Action Plan

Treat the open-source exemption as a precise legal category, not a community label. Check the licence, the public availability of weights and information, and the absence of monetisation; comply with the copyright and training-summary duties regardless; and re-run the analysis whenever your distribution model or training compute changes. For most genuine open releases the regulation is lighter than commonly feared — the cost of getting the boundary wrong is what providers need to manage.

A final note on strategy: the exemption analysis should be revisited at every release, because the conditions are evaluated per model and per distribution channel, not per organisation. A lab can be exempt for its research releases, fully obligated for its commercial line, and on the systemic-risk track for its frontier programme — three regimes inside one company, each needing its own documentation posture and its own owner.

For teams deciding between open and closed release in 2026, the regulatory delta is therefore modest below the frontier: two universal duties either way, plus documentation work that well-run projects largely produce anyway. The decision should rest on strategy and safety considerations, not on the assumption that the AI Act makes open release prohibitively burdensome — for non-systemic-risk models, it deliberately does not. Where doubt remains after that analysis, the conservative path — preparing the documentation as if no exemption applied — costs little for a small model and preserves every distribution option later.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.