Certain general-purpose AI models released under a free and open-source licence, with parameters including weights and architecture publicly available, benefit from a limited exception to some Article 53 duties and to the Article 54 representative duty. The copyright policy and training summary duties remain relevant, the exception does not apply in the same way to models with systemic risk, and the conditions must be checked against the actual licence and release rather than assumed from an open label.
What conditions define the open-source treatment?
The treatment in Article 53 turns on a model being released under a free and open-source licence that allows access, usage, modification and distribution of the model, and on the parameters, including weights, information on model architecture, and information on model usage, being made publicly available. Both the licence terms and the actual public availability matter. A licence that restricts commercial use, modification or redistribution, or a release that withholds weights or architecture, may not meet the conditions even if the project is described as open. Teams should record the licence text and version, the location and date of the public release, and exactly what was made available. That record is the evidence for the treatment claimed, and it should be updated if the licence or the release changes.
Which duties are limited, and which remain?
For qualifying models, Article 53(2) provides that the duties in Article 53(1)(a) and (b), concerning technical documentation and information for downstream providers, do not apply in the same way. The duties in Article 53(1)(c) and (d), concerning the copyright policy and the public summary of training content, remain. Article 54 contains a corresponding limited provision for the authorised representative duty. The distinction is deliberate: openness can reduce the need for a private documentation flow, but it does not remove the transparency and rights-related duties that protect readers and rights holders. A provider should therefore plan for a copyright policy and a training summary even where it claims the documentation exception, and should not present the model as exempt from Chapter V as a whole.
For the broader regulatory framework, see General-purpose AI models overview.
How does systemic risk change the position?
A general-purpose AI model with systemic risk is treated differently. The limited open-source exception does not remove the Article 55 duties for such a model, and the classification question under Articles 51 and 52 must be addressed on the same basis as for any other model. A widely distributed open model can have significant reach, and reach is relevant to systemic-risk assessment. An open-source provider should therefore carry out the classification analysis, keep evaluation and incident evidence where Article 55 is engaged, and record why the open release does or does not affect the risk picture. Describing a model as open does not answer the classification question, and a classification file that omits deployment scale because the model is open will be incomplete.
What about downstream modifications of an open model?
Downstream providers who modify a general-purpose AI model can, in some circumstances, become providers of the modified model, with duties that follow from that role. Modification, fine-tuning and integration decisions should therefore be recorded, including what was changed, whether the change affects generality, capabilities or systemic risk, and whether the original provider's information remains accurate for the modified version. A downstream team that relies on the original open release should check whether the licence conditions still hold for its version, whether new documentation or information is needed, and whether the modified model needs its own classification assessment. The original release and the modified version should have separate version records, so that a question about one does not contaminate the evidence for the other.
How should an open release be documented?
A useful open-release file contains the licence, the release location and date, the artefacts made public, the model version, the training summary, the copyright policy, and the classification reasoning. It should also record any known limitations, any conditions on use, and the channel for reporting issues. The file should be public-facing where the duties require publication, and internally controlled where it contains assessment reasoning. Teams should avoid claiming openness in public material that the release file does not support, because the gap between the claim and the release is itself a transparency problem. A periodic check should confirm that the public artefacts remain available at the stated location and that the version described matches the version actually distributed.
Continue with Article 53 duties for model providers.
What does this guide not decide?
This guide does not decide whether a particular licence qualifies as free and open-source, whether a release meets the public availability conditions, whether a model presents systemic risk, or whether a downstream modification creates a new provider. It does not interpret a licence, assess a repository, or determine the effect of a fork or fine-tune. Those questions depend on the licence text, the artefacts actually released, the model's capabilities and reach, and the consolidated legal text. A provider should confirm its position with a competent authority or legal adviser, keep the release file current, and revisit the treatment when the licence, the release or the classification changes.
Frequently asked questions
Is every model on a public repository exempt?
No. The limited treatment depends on the licence allowing access, usage, modification and distribution, and on the public availability of parameters including weights and architecture information, as set out in Article 53. A public download alone, without meeting those conditions, does not establish the treatment.
Do open-source systemic-risk models escape Article 55?
No. Systemic-risk models face the additional duties in Article 55, and openness does not remove that layer. Classification under Articles 51 and 52, evaluation, risk mitigation, incident reporting and cybersecurity protection must still be addressed where Article 55 is engaged.
Must an open-source provider still publish a training summary?
In outline, yes. The copyright policy and training summary duties in Article 53 remain relevant for qualifying open-source models. The provider should draw up the summary using the AI Office template, make it publicly available, and keep it matched to the model version.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk Article 53 ↗European Commission AI Act overview ↗