Why Open-Source Models Are Not Automatically Exempt in the EU
The short answer is that the EU AI Act does not make “open-source” a general exemption category. Article 53(2) can relieve a qualifying GPAI model provider from two specified documentation duties, but only when the release satisfies cumulative licence and public-information conditions, and not when the model has systemic risks. Copyright policy, a public training-content summary, cooperation with authorities, and the responsibilities created by later modification, integration, and deployment remain part of the picture.
That conclusion is narrower than both common slogans. It does not say that open-source models receive no special treatment. It does not say that every open release is regulated in exactly the same way as a closed commercial model. It says that openness has a conditional, limited legal effect. The decisive question is not whether a project carries an open-source label; it is which facts establish the exception, which duties it names, and which actors control what happens afterward.
The legal answer: conditional relief, not immunity
Article 53 begins with provider duties. The provider must maintain technical documentation about the model’s development, training, testing, and evaluation for the AI Office and national competent authorities. The provider must also make information available to downstream AI-system providers so they can understand the model’s capabilities and limitations and meet their own obligations. Separately, the provider must have a policy for complying with Union copyright law and publish a sufficiently detailed summary of training content.
Article 53(2) does not erase that baseline. It says that the obligations in paragraph 1, points (a) and (b), do not apply to a provider whose model is released under a free and open-source licence that allows access, usage, modification, and distribution, with the required parameters and information made public. In plain terms, the possible relief concerns the authority-facing technical documentation and the downstream information-and-documentation duty. The wording does not extend that relief to the copyright policy or the public training-content summary.
The licence condition is cumulative. A provider must not treat free download, public source code, or open weights as a substitute for checking whether the licence allows all four named activities. Access answers whether people can obtain the model. Usage concerns whether they can run it. Modification concerns whether they can change it. Distribution concerns whether they can pass it or a modified version onward. A release that fails to establish one permission has not established the full Article 53(2) condition on the available facts.
The public-information condition is separate. The parameters, including the weights, must be publicly available, along with information on architecture and usage. A permissive licence cannot make withheld weights public. Public weights cannot supply a licence permission that the terms reserve. A general description of the model cannot automatically substitute for architecture or usage information. The law connects legal openness with a technically and informationally meaningful release.
Even when both conditions appear satisfied, systemic risk is an express override. Article 53(2) says that its exception does not apply to GPAI models with systemic risks. The available evidence does not provide a complete current classification procedure, so it would be unsafe to turn a particular threshold or general description into a universal test here. The firm conclusion is the structural one: systemic risk prevents a provider from relying on openness as a categorical defence.
The cooperation duty reinforces the same point. Article 53(3) separately requires providers to cooperate as necessary with the Commission and national competent authorities. A qualifying provider may receive relief from specified ex ante documentation duties and still have a continuing relationship with authorities. “Exempt from points (a) and (b)” is not the same sentence as “immune from regulatory engagement.”