The AI Act and the Exemptions for Open-Source Software
What do the new rules mean for Bulgarian companies and lawyers?
The European Union's Artificial Intelligence Act (AI Act) is now a reality, and a substantial part of it is already in force. This brings to the forefront the new provisions, rules, and procedures that developers, deployers, and users of artificial intelligence systems must keep in mind.
The Regulation, comprising more than 180 recitals and 113 articles, introduces a unified legal framework based on the principle of risk categorization. AI systems are classified according to the level of risk they may create - from minimal to unacceptable. The greater the risk, the stricter the requirements for their deployment, monitoring, and oversight, while systems posing an unacceptable risk are banned across the EU. Member States are also expected to adopt national legislation introducing more detailed rules and procedures for the use and development of AI systems. Italy is the first country in the Union to pass such a law, and one is under consideration in Bulgaria as well.
The exemptions for open-source systems - what they cover
One of the most interesting and, at the same time, most important topics in the Regulation is the exemption for open-source software. In line with the overall aim of the Act - to promote the development of trustworthy, human-centric artificial intelligence while ensuring the protection of people's health, safety, and fundamental rights - the exemption envisaged for open-source systems is intended to protect and encourage free innovation by easing the requirements on developers who share their technologies openly.
The Regulation sets out a definition of what "open source" means in Recital 102, defining it as "software and data, including models, released under a free and open-source license that allows them to be openly shared and where users can freely access, use, modify and redistribute them". This ensures that key technologies remain accessible to the academic community, small developers, and innovative start-ups. For general-purpose AI models (GPAI), the requirement also includes public access to the weights, the architecture, and the usage instructions, in order to ensure transparency and traceability. The definition is similar to the one established by the Open Source Initiative - OSAID-1.0 - which makes it easier for developers of AI systems to introduce open-source systems.
The exemption itself, as provided by the European legislator, states that the Act does not apply to systems released under a free and open-source license, unless they are high-risk, fall among the prohibited practices, or pose transparency risks.
Which models fall within the definition
At present, the models that meet the Regulation's definition are Pythia (Eleuther AI), OLMo (AI2), Amber and CrystalCoder (LLM360) and T5 (Google). They meet the licensing conditions and provide full access to their code and parameters.
On the other hand, Llama 4 (Meta), Grok (X/Twitter), Phi-4 (Microsoft) and Mixtral (Mistral) are not considered fully open due to licensing restrictions and therefore cannot benefit from the exemption.
The limitations remain - even for open source
As noted, the limitation on the Act's applicability to open-source AI systems is not absolute, and it has clear boundaries. The Regulation prohibits the use of AI to evaluate or classify people, to predict the likelihood of crimes, for biometric identification in public spaces, and for emotion analysis in the workplace. These practices are considered incompatible with fundamental rights, even when the technology is released under an open-source license.
The exemption also does not cover high-risk AI systems - those used in sectors such as critical infrastructure; emotion-recognition systems integrated into the employment or education environment; systems in the public-services, migration, and justice sectors; and others. In these sectors, even open-source AI systems released under an open license must comply with strict measures for conformity, risk management, the provision of technical documentation, and reporting to the relevant authorities.
Here, the only relief for developers and deployers concerns tools, services, components, or processes that are NOT general-purpose models and that are integrated into high-risk AI systems. In this case, if these tools are distributed under an open-source and open license, the reporting obligation for them is waived pursuant to Article 25(4) of the Regulation.
The exemption does not apply even to systems classified by the Act as limited-risk or as systems with "transparency-related risks" - systems that users interact with directly. Examples include chatbots or content generators (deepfakes). For these, no exemption is provided either, even where they are distributed under open source. Every interaction must be transparent: users must be informed in good time that they are communicating with an artificial intelligence, and the generated content must be clearly labeled as created by an artificial intelligence rather than a human.
What is required of providers of general-purpose models
The Artificial Intelligence Act sets out a special regime for providers of general-purpose AI models (GPAI). They must maintain detailed technical documentation, ensure transparency regarding training data, and comply with copyright requirements.
Providers of open-source GPAI models benefit from certain reliefs. They are exempt from the obligation to provide technical documentation for the model, as well as from the obligation to provide information and documentation to parties intending to integrate the GPAI model into their own AI systems. The requirement to appoint a representative in the EU is also waived where providers of open-source GPAI models are based outside the territory of the Union.
The situation is different, however, for GPAI models with systemic risks - that is, those
-
with a significant impact on the Union market due to their reach, or due to their actual or reasonably foreseeable negative effects on public health, safety, public security, or fundamental rights; or
-
whose computation used for training, measured in floating-point operations (FLOPS), is greater than 10^25.
For these models, no open-source exemptions are provided. Their providers must conduct testing, ensure a high level of cybersecurity, and report incidents to the European AI Office or the relevant national authority.
In brief: What this means for developers and deployers
-
If you develop an open-source AI system that constitutes an "unacceptable risk" under the AI Act, that system is banned for use in the EU, without exception.
-
If you develop and release an open-source AI system that is classified as "high-risk" under the AI Act, the open-source exemption does not apply. An exemption exists only for tools, services, components, or processes that are NOT general-purpose models and that are integrated into high-risk AI systems. These tools are exempt from reporting obligations if they are distributed under an open-source license.
-
If you develop and release an open-source AI system that falls into the "transparency-related risks" category under the AI Act, the open-source exemption does not apply.
-
If you develop an open-source AI system that constitutes minimal or no risk under the AI Act, the open-source exemption is not relevant, since no obligations are imposed. Nevertheless, developers are encouraged to follow codes of conduct for the voluntary application of some or all of the requirements for high-risk AI systems, which are currently being developed as harmonized standards by JTC21 CEN-CENELEC.
-
If you develop an open-source general-purpose AI (GPAI) model, you have the following reliefs:
-
You are exempt from providing (a) technical documentation for the model and (b) information and documentation to providers of AI systems intending to integrate the GPAI model into their own AI systems;
-
You are exempt from appointing an authorized representative in the EU if you are established in a country outside the Union.
-
-
If you develop an open-source general-purpose AI (GPAI) model with systemic risk, the open-source exemption does not apply, and you must comply with the obligations set out in the Regulation.
What this means for Bulgarian business
For Bulgarian companies and legal professionals, the new regulation creates both challenges and opportunities. Every business that uses or develops artificial intelligence technologies must carry out a risk assessment and determine whether it falls within the scope of the Artificial Intelligence Act and into which risk category its system falls. This applies to technology companies and start-ups as well as to law firms that use AI tools for legal analysis, automation, or client service.
This check is also important because of the different dates on which the Regulation's provisions take effect - the rules for high-risk systems enter into force on 2 August 2026, but those on prohibited practices are already in force as of 2 February 2025, while the rules for general-purpose models have been in force since 2 August 2025.
Practical steps for businesses and lawyers
The first step is to identify the AI systems in use and analyze whether they are high-risk. This should be followed by a review of the licensing terms - if the technology is open source, check whether the license genuinely permits free use and distribution and whether it matches the definition set out in the Regulation.
The next step is building internal policies for transparency, data protection, and responsible use of AI. Companies must keep documentation up to date to demonstrate compliance with the requirements and be ready for inspections by regulators. An important element is drawing up an internal policy for the ethical use of AI, including measures to protect personal data, avoid discrimination, and ensure transparency.
Maintaining legal and technical documentation that can be presented during a compliance check is also good practice.
How can Praven Intelekt help?
In the context of the new regulations, Praven Intelekt is establishing itself as a trusted partner for Bulgarian companies, lawyers, and technology firms. The platform offers intelligent legal assistance that combines artificial intelligence with expert knowledge of Bulgarian and European law.
Praven Intelekt can help you with:
-
determining which risk category your AI solution falls into under the Artificial Intelligence Act;
-
carrying out a legal analysis and assessing whether your AI solutions comply with the requirements of the Artificial Intelligence Act;
-
preparing internal policies and documentation for risk management and transparency.
