AI Act: The 4 Open-Source Exemptions and the Small Mid-Cap Companies

There are two gaps in English-language coverage of Regulation (EU) 2024/1689. One is a repeated myth: "open source is exempt from the AI Act". The other is a silence: Regulation (EU) 2026/1744 — the Digital AI Omnibus, in force since 27 July 2026 — introduced a new business category into the text, the small mid-cap company, and almost no-one has explained what it gains.

Both are resolved by reading the articles.

The myth, and where it comes from

The phrase comes from reading only Article 2, paragraph 12, and stopping at the first half:

"This Regulation shall not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as AI systems that fall within the scope of Article 5 or Article 50."

The exclusion exists, but it brings three back-doors within the same sentence. And it is not a general exemption for "open source": it is one of four distinct rules, each with its own scenario and condition.

Part 1 · The four exemptions that exist

After scanning every article of the Regulation and all 43 amendment points of the Omnibus, the provisions that make an obligation depend on a free licence number exactly four. There is no fifth.

ProvisionCoversExempts fromFalls away if…
Art. 2, para. 12AI systemsThe entire RegulationHigh risk, Art. 5 or Art. 50
Art. 25, para. 4Tools, services, processes or components that are not general-purpose AI modelsThe written agreement with the high-risk providerIt is a general-purpose AI model
Art. 53, para. 2General-purpose AI modelsOnly points (a) and (b) of Art. 53.1The model has systemic risk
Art. 54, para. 6General-purpose AI modelsNominating an authorised representative in the EUThe model has systemic risk

Article 2, paragraph 12. The only one that sets aside the entire Regulation, and only for systems.

Article 25, paragraph 4. Whoever supplies components to a third-party high-risk system must agree in writing what information and technical access they provide. The paragraph closes: "This paragraph shall not apply to third parties that make available to the public tools, services, processes or components, other than general-purpose AI models, under a free and open-source licence" — wording from point 12, point (b), of the Omnibus. Recital 89 recommends, without requiring, the use of model cards and data sheets.

Note the rebound: point 38, point (b), of the Omnibus inserted in Article 99, paragraph 4, a new point (d bis) that subjects non-compliance with Article 25, paragraphs 2 and 4, to fines of up to €15,000,000 or 3% of worldwide business volume. Before, it was not expressly typified: the exemption is worth more today than in 2024.

Article 53, paragraph 2. The most misinterpreted. It frees from points (a) and (b) of paragraph 1 — technical documentation under Annex XI and information for downstream providers under Annex XII — models released under a free licence "that allows access, use, modification and distribution of the model and whose parameters, including the weights, the model architecture information and the model usage information, are made publicly available". Two of four points. And paragraph 3, cooperating with the Commission and authorities, remains in force.

Article 54, paragraph 6. With the same condition of publicly available weights and architecture, a provider from a third country does not need to appoint an authorised representative in the Union.

Model or system: the distinction that decides which exemption applies

Article 2.12 speaks of systems. Articles 53.2 and 54.6, of general-purpose AI models. Art. 25.4, of components that are expressly not general-purpose AI models. Confusing them is invoking the wrong exemption.

Publishing weights in a repository is releasing a model. Wrapping it in an interface and offering it to users is putting into service a system: "the supply of an AI system for first use" (Art. 3, point 11). And placing on the market is "the first making available" (Art. 3, point 9), which point 10 defines as "whether for payment or free of charge": being free does not in itself take something out of scope. A single actor can accumulate roles — releasing the model under a free licence and also deploying a proprietary product that does fall within scope.

What no free licence exempts from

The two obligations that Article 53 does not forgive

These remain alive in all cases, for any provider of a general-purpose AI model released under a free licence.

Point (c), copyright: "shall establish a policy to comply with Union law on copyright and related rights, and in particular, to identify and comply, including through state-of-the-art technologies, with a rights reservation expressed pursuant to Article 4(3) of Directive (EU) 2019/790". Respect the text and data mining opt-out, and have a written policy explaining how.

Point (d), training summary: a "sufficiently detailed summary" of the content used for training, public, with the model, using the template provided by the AI Office.

Recital 104 explains why they survive: releasing an open model does not disclose the dataset or how copyright was respected.

Part 2 · "Small mid-cap company"

Point 4, point (b), of the Omnibus inserted two definitions into Article 3. The second is new in AI law:

"14b) 'small mid-cap company': a small mid-cap enterprise as defined in point 2 of the Annex to Commission Recommendation (EU) 2025/1099."

This is the translation of small mid-cap. It gives no figures: it refers. The thresholds are in Recommendation (EU) 2025/1099 of 21 May 2025, whose Annex point 2 requires three things simultaneously: not to be an SME under Recommendation 2003/361/EC, fewer than 750 employees, and no more than €150 million in annual turnover or €129 million in balance sheet total.

StaffTurnoverBalance sheet
SME (Art. 3, 14a)< 250≤ €50M or≤ €43M
Small mid-cap company (Art. 3, 14b)< 750≤ €150M or≤ €129M

It is a floor category, not a ceiling: you enter it by exceeding SME thresholds. Without it, the company that grew went straight to the large-company regime; Recital 6 of the Omnibus speaks of enabling "a seamless transition". A detail that rules out many subsidiaries: Annex point 3.3 excludes any company in which a public body controls 25% or more of the capital or voting rights, directly or indirectly.

Article 99, paragraph 6a: how far it reaches

Point 38, point (c), of the Omnibus inserted this paragraph:

"6a. In the case of small mid-cap companies, each fine referred to in paragraphs 4 and 5 shall not exceed the percentages or amounts referred to in those paragraphs, applying whichever of them is lower."

Paragraphs 4 and 5, and only those. Paragraph 6, for SMEs, was not amended and still reads "paragraphs 3, 4 and 5". The difference is not cosmetic.

InfringementArticle 99 tierSME (99.6)Small mid-cap (99.6a)
Prohibited practices (Art. 5)€35M or 7%, the higherMay apply the lowerNo lower-figure rule
Operator and notified body obligations€15M or 3%, the higherMay apply the lowerLower applies
Inaccurate information to authorities€7.5M or 1%, the higherMay apply the lowerLower applies

Faced with a prohibited practice, the small mid-cap company is left with the general rule of paragraph 3: up to €35,000,000 or 7% of worldwide business volume, "if this amount is higher". A company of 200 employees billing €90 million has no relief there; an SME does.

There is one more asymmetry, and this one favours the mid-cap. Paragraph 6 is worded as a discretion: the fine "may be" the lower. Paragraph 6a, as a mandatory ceiling: "shall not exceed… applying whichever is lower". In the tiers it covers, the small mid-cap has a firmer ceiling than the SME.

What else it gains, and what remains for SMEs only

The Omnibus extended nine more provisions to this category. Three are operational:

ProvisionWhat it gives
Art. 11, para. 1Simplified Annex IV technical documentation, with a Commission form that notified bodies must accept
Art. 17, para. 2Quality management system proportionate to size
Art. 57, para. 3aPriority access to the Union testing sandbox that the AI Office may create

The other six — Articles 1.2(g), 57.9(e), 70.8, 95.4, 96.1 and 99.1 — are mandates addressed to the Commission, the AI Office and Member States: innovation support, market access, guidance, codes of conduct, guidelines and consideration of their economic viability when sanctioning.

And what it does not reach:

Spain: the draft law is one step behind

The Draft Organic Law on the sound use and governance of artificial intelligence (121/000096, BOCG Series A No. 97-1, 12 June 2026) is under debate: amendment phase in the Committee on Economy, Commerce and Digital Transformation, extended until 2 September 2026. Nothing in it is in force.

Two checks on its published text. The expression "open source" does not appear even once: the free-licence regime remains entirely in the Regulation, which applies directly. And its Article 30, paragraph 8, replicates the lower-figure rule for SMEs only, citing Article 99.6, without mentioning small mid-cap companies. This is consistent with its date — it was published six weeks before the Omnibus entered into force — but today the Spanish draft does not incorporate paragraph 6a. The amendment period is still open.

Related

Frequently asked questions

Does charging for support invalidate the exemption?

According to Recital 103, yes: components supplied in exchange for consideration or otherwise monetised — including paid technical support — cannot rely on the open-source exceptions, except in transactions between micro-enterprises. Hosting the project in an open repository is not monetisation in itself.

My company has 400 employees and bills €110 million. Am I a small mid-cap company?

The figures fit the thresholds in point 2 of the Annex to Recommendation (EU) 2025/1099, but the calculation is done using the partner and linked enterprise rules in that same Annex, not with the company's standalone figures. It is also excluded if a public body controls 25% or more of the capital or voting rights (point 3.3).

Does the new category protect me against the maximum fine?

Not in the most expensive tier. Article 99, paragraph 6a, only covers paragraphs 4 and 5. For an Article 5 infringement, the general rule of paragraph 3 applies: up to €35,000,000 or 7% of worldwide business volume, whichever is higher.

Sources