Open source gets partial relief from the EU AI Act, not a free pass. Article 2 excludes free and open-source systems unless they are high-risk, prohibited or subject to Article 50 transparency. Article 53 waives two documentation duties for open general-purpose models, but never for models with systemic risk.
Two separate exceptions
The Act treats systems and models differently.
For AI systems, Article 2(12) excludes systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk systems or fall under Article 5 (prohibited practices) or Article 50 (transparency).
For general-purpose AI models, Article 53(2) waives the technical documentation duty and the downstream information duty for models under a free and open-source licence that allows access, use, modification and distribution, with parameters, architecture information and usage information public.
What stays in force
- Prohibited practices apply to everyone, free or paid.
- Putting an open source system into a high-risk use brings high-risk duties.
- Transparency duties, such as telling people they talk to an AI, still apply.
- An open general-purpose model must still have a copyright compliance policy and publish a training content summary.
- The exception does not apply to general-purpose models with systemic risk.
Who bears the duties when you build on open source
If you take an open model and ship a product, you are probably the provider of the product, with duties set by your use case. The model's open licence does not carry your product out of Annex III. Article 25(4) also says written agreements with suppliers of tools and components need not cover free and open-source tools, other than general-purpose models, so you cannot count on a vendor style contract. You must do your own diligence.
Diligence for open models
Open weights still need supply chain care:
- Record source, version and hash.
- Check the licence for use restrictions and obligations.
- Scan files and surrounding code for vulnerabilities and unsafe formats.
- Read the model card for limits and known issues.
- Test it for your use, since nobody else has.
Safeguard scans dependencies and generates SBOMs for the code around a model, and the free scan is at gold.safeguard.sh/scan.
For people who publish open models
Check whether your release counts as a general-purpose model, whether it could be classed as systemic risk, and prepare the copyright policy and training summary even if documentation is waived. Whether a specific licence meets the Act's open-source definition is a legal question.
In short, treat the open-source label as a licensing fact, not a compliance conclusion. Ask three questions each time: what is the use, what is the role, and which article applies to that use. The answers, written down with dates, will serve you better than any assumption that open means exempt.
Quick check
If I use an open model in hiring software, am I exempt?
No. A hiring use is Annex III, so the exclusion for open source systems does not apply to high-risk use.
Do open models need a training summary?
Yes. The copyright policy and training content summary still apply under Article 53.
Sources
Last reviewed: 19 October 2026.
