Open Source Developers Guide to the EU AI Act

Overview

The EU AI Act is now in force and affects open source developers who release AI models or systems that impact people in the EU. The guide provides a non‑legal‑advice introduction to the regulation, explains which activities are covered, and lists practical steps and Hugging Face tools that can help meet the requirements.

Scope

The AI Act sets rules that depend on the role (provider, deployer, distributor) and on whether the artifact is an AI model or an AI system.

  • Model: only general purpose AI (GPAI) models are directly regulated. GPAI models are trained on large data, show significant generality, can perform many tasks, and can be used in systems (e.g., a large language model). Fine‑tuned versions also need to comply.
  • System: any artifact that can infer from inputs, such as a chatbot that uses an LLM or a Gradio app on Hugging Face Spaces. Risk tiers:
  • Unacceptable risk: prohibited systems (e.g., facial image scraping).
  • High risk: systems affecting safety or fundamental rights (e.g., critical infrastructure).
  • Limited risk: systems that interact directly with people and could cause impersonation, manipulation, or deception (most generative AI integrations). These need transparency measures.
  • Minimal risk: the majority of systems; only existing laws apply. For GPAI models there is an additional systemic risk category: models trained with over 10^25 FLOPs or with high‑impact capabilities. A Stanford study cited in the guide estimates that, as of August 2024, only eight models (Gemini 1.0 Ultra, Llama 3.1‑405B, GPT‑4, Mistral Large, Nemotron‑4 340B, MegaScale, Inflection‑2, Inflection‑2.5) from seven developers meet the default systemic risk threshold.

How to prepare for compliance

The guide focuses on limited‑risk AI systems and open source non‑systemic‑risk GPAI models, which cover most publicly available models on the Hub.

Limited risk AI systems

Developers of limited‑risk AI systems must:

  • Disclose to users that they are interacting with an AI system unless this is obvious, using clear and thorough language.
  • Mark synthetic content (audio, image, video, text) as artificially generated or manipulated in a machine‑readable format; tools such as Gradio’s built‑in watermarking can help. If acting as a deployer (using an AI system professionally), additional duties include informing individuals about emotion recognition or biometric systems and disclosing deepfakes or AI‑generated content in artistic works without spoiling the experience. The AI Office expects to publish codes of practice by May 2025, with enforcement starting August 2026.

Open source non‑systemic risk GPAI models

For open source GPAI models that do not present systemic risk, the AI Act defines open source as software and data released under a free and open source license that allows sharing, use, modification, and redistribution. Developers should pick a license that fits this definition (the Hub provides a list). Obligations are:

  • Draft and make available a sufficiently detailed summary of the training data, using a template to be provided by the AI Office (detail level still under discussion).
  • Implement a policy to comply with EU copyright law, respecting rightsholder opt‑outs. Training on copyrighted material is permissible only if the rightsholder has not opted out; developers can start by honoring robots.txt signals and using tools like Spawning’s API. The guide notes that existing Hugging Face integrations—such as model cards, dataset cards, Gradio watermarking, the BigCode “Am I In The Stack” opt‑out app, personal data redaction tools, and license handling—can support these tasks. Codes of practice for copyright compliance are expected by May 2025.

If a model is released in a way that does not meet the AI Act’s open source definition, other obligations apply. Should a GPAI model meet the systemic risk criteria, developers must notify the EU Commission; they may argue the model lacks systemic risk, but if the Commission rejects the claim the model will face further duties such as providing full technical documentation. Obligations for GPAI models take effect in August 2025.

Get involved

Much of the AI Act’s practical application is still being shaped through public consultations and working groups. The guide encourages developers to participate now to influence how provisions for SMEs and researchers are operationalized.

Disclaimer: The information provided in this guide is for informational purposes only, and should not be considered as any form of legal advice.

@misc{eu_ai_act_for_oss_developers,
  author    = {Bruna Trevelin and Lucie-Aimée Kaffee and Yacine Jernite},
  title     = {Open Source Developers Guide to the EU AI Act},
  booktitle = {Hugging Face Blog},
  year      = {2024},
  url       = {},
  doi       = {}
}

Sources