Open-Source Exemptions in the EU AI Act

Article 2(12) excludes certain free and open-source AI systems from the Regulation only where they are released under qualifying licences and are not placed on the market or put into service as high-risk systems, prohibited practices, or systems subject to specified transparency obligations. This provision is limited: it does not mean that every open-source project falls outside the Act, and it does not remove duties that may attach when another actor integrates a component into a regulated product or use. The Act has a separate, narrower rule for providers of general-purpose AI models. Some documentation and downstream-information obligations in Article 53(1)(a) and (b) do not apply when model parameters, including weights, architecture information, and usage information are publicly available under a free and open-source licence. The exemption does not cover the copyright-policy and training-content-summary duties in Article 53(1)(c) and (d). It also does not apply to a GPAI model presenting systemic risk; the systemic-risk obligations remain relevant. “Free” licensing is not the only condition. Public availability and what is actually released matter. A model card alone is not the weights; a source-code repository may not include model parameters. The legal treatment can also differ between a model and an AI system built using that model. Commercial distribution does not always erase every open-source provision, but monetized components and service arrangements can affect whether a condition is met. Read the relevant article and recitals rather than relying on a project’s label. Regulation 2026/1744 also amended Article 25(4): its written-information and assistance agreement duty does not apply to third parties publicly providing tools, services, processes, or components (but not GPAI models) under a free and open-source licence. This narrow exception does not exempt the integrated high-risk system provider; track each component and role separately.