EU AI Act + Open-Source Models: Llama, Mistral, Falcon
TL;DR
- Art. 2(12) EU AI Act exempts open-source AI from many obligations — but GPAI obligations under Art. 53 still apply
- Open-source under the Act: model + weights + architecture freely accessible (Apache, MIT; Llama license partial)
- GPAI obligations apply to providers like Meta (Llama), Mistral, TII (Falcon)
- Fine-tuning risk: substantial adaptation makes you the Provider (Art. 25) — full obligations
- SME recommendation: self-host only with strong technical capability; otherwise use a managed GPAI Provider
1. Art. 2(12) exemption
Open-source AI models with publicly accessible weights are exempt from many EU AI Act obligations. The exemption does not apply when the model is placed on the market or put into service as a high-risk AI system, nor when the model qualifies as GPAI with systemic risk.
2. What counts as open-source under the Act
Model architecture, weights, and core configuration freely accessible. Clear-cut: Apache 2.0, MIT, BSD. Borderline: Llama license (commercial restrictions above 700M MAU) and Mistral non-production licenses. Read the license carefully — "open weights" is not always "open source" under the Act.
3. GPAI obligations still apply
Providers of open-source GPAI models (Meta for Llama 3, Mistral AI, TII for Falcon) must satisfy Art. 53: technical documentation summary, training-data summary, and copyright policy. The Code of Practice serves as compliance presumption.
4. Self-hosting and fine-tuning
If you substantially adapt an open-source model (e.g., domain-specific fine-tuning that materially changes its intended purpose), you may become the Provider under Art. 25 — inheriting the full Provider obligations including conformity assessment for high-risk uses.
5. SME recommendation
Self-hosting makes sense only for highly sensitive data combined with in-house ML expertise. For most SMEs, using a GPAI Provider wrapper (Aleph Alpha, Mistral La Plateforme, Anthropic, OpenAI) shifts the heavy obligations to the Provider while keeping you as a Deployer with lighter Art. 26-29 duties.
Summary
The open-source exemption is real but narrow. GPAI obligations apply regardless. The biggest practical risk is becoming an inadvertent Provider through fine-tuning. Document your role (Provider vs. Deployer) for every AI tool and re-assess after any model adaptation.
Frequently Asked Questions
Is self-hosting Llama permitted?
When do I become a provider?
Sources
- Regulation (EU) 2024/1689 — EU AI Act (Art. 2(12), Art. 25, Art. 53) (As of: 2026-05-02)
- EU AI Act Art. 51 — GPAI threshold (As of: 2026-05-02)
- European Commission — GPAI Code of Practice (As of: 2026-05-02)