The EU AI Act’s Open-Source Exemption: What Article 53 Actually Carves Out

Article 53(2) of the EU AI Act waives two of the four baseline provider obligations — technical documentation for regulators and downstream-integration information — for general-purpose AI (GPAI) models released under a genuine free and open-source licence with publicly available weights, architecture, and usage information. The waiver has one hard limit: it switches off the moment a model is classified as posing systemic risk under Article 51, regardless of licence or release format.

What every GPAI provider owes under Article 53(1)

Article 53(1) sets four baseline obligations for every provider of a general-purpose AI model placed on the EU market, open-source or not:

• (a) Technical documentation. Draw up and keep current technical documentation — training and testing process, evaluation results — to the level of detail in Annex XI, for the AI Office and national authorities on request.
• (b) Downstream integration information. Provide information and documentation (to the Annex XII level) to providers of AI systems who want to integrate the model, sufficient for them to understand its capabilities and limitations and meet their own obligations.
• (c) Copyright policy. Put in place a policy to comply with EU copyright law, including honoring rights reservations under Article 4(3) of the 2019 Copyright Directive.
• (d) Training-content summary. Publish a sufficiently detailed summary of the content used to train the model, using the AI Office’s template.

What paragraph 2 actually exempts

Article 53(2) is narrow and conditional, not a blanket open-source carve-out. Its exact text:

“The obligations set out in paragraph 1, points (a) and (b), shall not apply to providers of AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available. This exception shall not apply to general-purpose AI models with systemic risks.”

Two things follow directly from that wording:

• Only (a) and (b) are waived. The copyright-policy obligation (c) and the training-data summary obligation (d) still apply to open-source GPAI providers — the exemption does not touch either.
• The exemption is conditional on four things being true together: a free and open-source licence permitting access, use, modification, and distribution; publicly available model weights; publicly available architecture information; and publicly available usage information. A model released with open weights but a restrictive or non-OSI-style licence, or with weights public but architecture undocumented, does not automatically qualify.

The limit: systemic-risk classification overrides the exemption

Article 51 classifies a GPAI model as carrying systemic risk through either of two tests: a Commission determination that it has “high impact capabilities,” or a rebuttable presumption that triggers automatically once cumulative training compute exceeds 10²⁵ floating-point operations. Classification adds four further obligations under Article 55 — model evaluation, systemic-risk assessment and mitigation, serious-incident reporting, and adequate cybersecurity protection.

Article 53(2)’s last sentence means an open-source release does not shield a model from any of this. A provider that open-weights a model exceeding the Article 51 compute threshold, or that the Commission otherwise designates high-impact, owes the full Article 53(1) baseline and the Article 55 systemic-risk obligations — the same as a closed model at the same classification. License and release format are not a scope test in Article 51; compute and capability are.

Atomic facts

• Article 53(2) exempts only Article 53(1)(a) (technical documentation) and (b) (downstream integration information).
• Article 53(1)(c) (copyright policy) and (d) (training-content summary) apply to open-source GPAI providers regardless of the exemption.
• The exemption requires four conditions together: a qualifying free/open-source licence, public weights, public architecture information, and public usage information.
• Article 53(2)’s final sentence removes the exemption entirely for any model classified as posing systemic risk under Article 51.
• Article 51’s compute test is a rebuttable presumption at more than 10²⁵ FLOPs of cumulative training compute; the Commission can also designate a model high-impact independent of that threshold.
• License and openness are not inputs to the Article 51 scope test itself — an open-weight model above the compute threshold is in scope the same as a closed one.

CASRAI’s NIKOLAI project: a named gap in the field’s own crosswalks

NIKOLAI, CASRAI’s own independent, unendorsed reference dictionary for frontier-AI-safety terms, tracks exactly this kind of scope question under its N1 track element “Coverage scope threshold” — defined as the if-then test determining whether a framework, statute, or programme applies to a given developer or model. That element’s crosswalk records how Anthropic, OpenAI, Google DeepMind, xAI, Meta, Microsoft, the EU AI Act (Article 51), California SB 53, and the federal FRONTIER Act bill each define their own scope test, none of them declared mappings — NIKOLAI builds every row itself as a shadow mapping, not something any of those organizations has confirmed.

The honest finding worth stating plainly: as of this writing, that crosswalk contains no open-source or open-weight exemption language anywhere, including in its own EU AI Act row, which is scoped to the Article 51 compute/capability test rather than Article 53. That is a real, named blind spot in CASRAI’s own reference project, not a mapping NIKOLAI can claim credit for having already built. It surfaces the same structural point this guide makes from the statute directly: none of the scope tests NIKOLAI has catalogued so far carve out license or openness as a variable — Article 53’s licence-conditioned exemption sits one level below the scope test NIKOLAI’s element currently tracks, at the obligation level rather than the in-scope/out-of-scope level, and isn’t yet represented there.

Related reading

• What counts as “systemic risk” under the EU AI Act — the Article 51 compute threshold and Article 55 obligations this exemption’s limit refers to.
• CAISI vs. NTIA: Two US Playbooks for Open-Weight AI — how two US approaches to open-weight models compare with the EU’s licence-conditioned exemption model.

FAQ

Does releasing a model as open-source exempt it from the EU AI Act entirely?

No. Article 53(2) waives only two of the four baseline GPAI obligations (technical documentation and downstream-integration information). The copyright-policy and training-content-summary obligations still apply, and the exemption disappears entirely if the model is classified as posing systemic risk.

What counts as a qualifying open-source licence under Article 53(2)?

The text requires a free and open-source licence that allows access, usage, modification, and distribution of the model, combined with public availability of the model’s weights, architecture information, and usage information. All four elements have to be true together; the Act does not name specific licences.

Can an open-weight model still be classified as posing systemic risk?

Yes. Article 51’s scope test runs on training compute (a rebuttable presumption above 10²⁵ FLOPs) or a Commission high-impact-capability determination — neither test references licensing or release format. An open-weight model that crosses the compute threshold is in scope the same as a closed model.

Which article adds obligations on top of Article 53 once a model is classified as systemic risk?

Article 55, which adds standardized-protocol model evaluation, systemic-risk assessment and mitigation, serious-incident reporting to the AI Office, and adequate cybersecurity protection — on top of, not instead of, the Article 53(1) baseline.