Opening article
The EU AI Act has entered force, setting risk‑based rules for AI systems and models worldwide. Open source developers, especially those publishing general‑purpose AI models, must now provide clear documentation, disclose model information at first user interaction, and comply with existing copyright and data protection laws. Hugging Face offers tools such as model and dataset cards, watermarking, opt‑out mechanisms, and personal data redaction to aid compliance.
The EU AI Act, the world’s first comprehensive legislation on artificial intelligence, has officially come into force, and it’s set to impact the way we develop and use AI – including in the open source community. If you’re an open source developer navigating this new landscape, you’re probably wondering what this means for your projects. This guide breaks down key points of the regulation with a focus on open source development, offering a clear introduction to this legislation and directing you to tools that may help you prepare to comply with it.
Disclaimer: The information provided in this guide is for informational purposes only, and should not be considered as any form of legal advice.
TL;DR: The AI Act may apply to open source AI systems and models, with specific rules depending on the type of model and how they are released. In most cases, obligations involve providing clear documentation, adding tools to disclose model information when deployed, and following existing copyright and privacy rules. Fortunately, many of these practices are already common in the open source landscape, and Hugging Face offers tools to help you prepare to comply, including tools to support opt-out processes and redaction of personal data. Check out model cards , dataset cards , Gradio watermarking , support for opt-out mechanisms and personal data redaction , licenses and others!
The following obligations apply if you are developing open source GPAI models, e.g. LLMs, that do not present systemic risk. Open source for the AI Act means “software and data, including models, released under a free and open source license that allows them to be openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof”. Developers can select from a list of open licenses on the Hub . Check if the chosen license fits the AI Act’s open source definition .
Also, note that if a given GPAI model meets the conditions to pose systemic risks, its developers must notify the EU Commission. In the notification process, developers can argue that their model does not present systemic risks because of specific characteristics. The Commission will review each argument and accept or reject the claim depending on whether the argument is sufficiently substantiated, considering the model’s specific characteristics and capabilities. If the Commission rejects the developers’ arguments, the GPAI model will be designated as posing systemic risk and will need to comply with further obligations, such as providing technical documentation on the model including its training and testing process and the results of its evaluation.
The EU AI Act is a binding regulation that aims to foster responsible AI. To that end, it sets out rules that scale with the level of risk the AI system or model might pose while aiming to preserve open research and support small and medium-sized enterprises (SMEs). As an open source developer, many aspects of your work won’t be directly impacted – especially if you’re already documenting your systems and keeping track of data sources. In general, there are straightforward steps you can take to prepare for compliance.
The EU AI Act also ties into existing regulations on copyright and personal data, such as copyright directive and data protection regulation . For this, look to Hugging Face-integrated tools that support better opt-out mechanisms and personal data redaction , and stay updated on recommendations from European and national bodies like CNIL .
The regulation takes effect over the next two years and applies broadly, not just to those within the EU. If you’re an open source developer outside the EU but your AI systems or models are offered or impact people within the EU, they are included in the Act.
The regulation works at different levels of the AI stack, meaning it has different obligations if you are a provider (which includes the developers), deployer, distributor etc. and if you are working on an AI model or system.
In the AI Act, rules scale with the level of risk the AI system or model might pose. For all AI systems, risks may be:
Compliance with the EU AI Act will shape how open source AI projects are documented, shared, and deployed globally, influencing innovation, legal risk, and market access for developers and users alike.