EU AI Act open-source exemption guidance clarifies rules for self-hosters

The European Commission has published guidance that clarifies how the EU AI Act treats open-source and open-weight AI models, including when self-hosted systems fall under lighter rules. For teams building or running AI systems in Europe, the practical question is no longer just what model they use, but how that model is released and whether it is being used internally or offered to others.

The guidance focuses on one of the more technical parts of the AI Act: the open-source exemption. Under the Commission’s interpretation, open-weight models released under open-source licenses can qualify for reduced compliance requirements, but only if they meet the conditions set out in the guidance. One key threshold mentioned in the source material is model size, with models under 10 billion parameters getting the clearest path to exemption.

That matters because the AI Act does not treat every model deployment the same way. A model that is downloaded and run privately inside a company is not the same as a model that is packaged into a product, exposed through an API, or sold as a service. The Commission’s guidance makes that distinction more explicit for self-hosters, who often use open models as internal infrastructure rather than public-facing products.

Open-weight models are models whose trained parameters are available for others to run, fine-tune, or inspect, even if the full training pipeline or data is not public. In practice, that has made them attractive for organizations that want more control over costs, data handling, and deployment. It has also made them harder to classify under regulation, because “open” does not always mean “outside the scope of compliance.”

The Commission’s clarification is meant to reduce that ambiguity. It gives a clearer signal on which models can benefit from lighter treatment and where the line is drawn between internal use and commercial distribution. For operators of private AI systems, that distinction affects whether the model is being used as an in-house tool, or as part of a service delivered to external users.

The EU AI Act is the bloc’s main law for regulating AI systems, and it takes a risk-based approach. Higher-risk systems face more obligations, while lower-risk or exempt categories face fewer. Open-source software has historically received special treatment in EU policy, but AI complicates that model because foundation models can be reused in many different ways, from chatbots to internal assistants to automated document analysis.

Self-hosting is part of that picture because it gives an organization direct control over where the model runs and what data it sees. That can make compliance simpler in some cases, but it does not automatically remove regulatory obligations. The Commission’s new guidance is aimed at clarifying where the open-source carve-out applies and where it does not, especially for teams that assume a model is exempt just because it is publicly available.

For companies that distribute models commercially, the rules are tighter. A model used only inside one organization is treated differently from one offered to customers, partners, or the general public. That split is central to how the guidance should be read, since the same underlying model can sit in either category depending on how it is deployed and who can access it.

The guidance is also likely to shape how vendors position their models. Some will emphasize open-source licensing and smaller parameter counts, while others will need to provide more formal compliance documentation if they want to serve customers in Europe. For the self-hosted AI market, the Commission has now put a firmer line around when open models get regulatory relief and when they do not.