EU AI Act Rewrite Is Done. Open-Weight Models Get Carve-Outs.

On April 29, negotiators from EU member states and the European Parliament ended twelve hours of talks without reaching agreement. The trilogue on the AI Act Omnibus package, conceived as a straightforward simplification of the world's most ambitious AI rulebook, had collapsed over a single sticking point: which categories of high-risk AI should qualify for a regulatory reprieve, and which should not.

The deadlock, reported The Next Web, exposed deep divisions over whether high-risk AI systems embedded in consumer products should be exempt from the legislation. It also teed up a familiar dynamic, one that has shadowed European tech regulation since the DMA: the collision between Brussels' instinct to classify technology by risk category and the messy, distributed reality of how software actually ships.

Eight days later, the white smoke appeared. On May 7, Parliament and Council struck a provisional agreement that pushes the compliance deadline for high-risk AI systems to December 2027 and, in a separate provision, bans AI-powered nudification tools outright. The Next Web confirmed the terms, as did Computerworld: a softened timeline, a narrowed set of obligations, and a handful of new prohibitions that no negotiator in the room had campaigned against.

The Omnibus on AI, analysed by Orrick attorneys on JD Supra, modifies and simplifies several provisions of the original AI Act. Among the changes: clarifications on how the AI Act interacts with existing machinery and product-safety regulations, a recalibration of what counts as a high-risk use case, and, critically for the open-weight community, a reaffirmation that free and open-source models distributed without monetisation sit largely outside the Act's compliance obligations.

That carve-out is not an accident. The original AI Act, passed in 2024, included what Recital 102 called a "free and open-source licence" exception, designed to protect academic research, hobbyist experimentation, and community-driven model development from the same compliance burdens applied to proprietary, commercial systems. The Omnibus negotiations put that exception under real strain. Some member states, particularly those with strong domestic AI industries, wanted the open-source exemption narrowed. Others, including France, wanted it broadened. What emerged from the May 7 deal is a compromise that preserves the research and open-source safe harbour while tightening definitions around what counts as "placing on the market" for monetised open-weight releases.

Nobody has more riding on that definition than Mistral. The Paris-based lab, profiled by Forbes in April at a $14 billion valuation, has built its business on a simple thesis: enterprises, especially European ones, will pay for sovereignty and self-hosting even if the models are not bleeding-edge. Mistral releases weights openly, charges for managed access and enterprise deployment, and benefits enormously from the EU's cultural preference for non-American, non-Chinese infrastructure. The company's March release of Voxtral TTS, an open-weight text-to-speech model aimed squarely at ElevenLabs, was a case study in the playbook: ship the weights, let the community validate, and monetise the deployment layer.

A thousand miles away in Mountain View, Google made its own regulatory-era licensing move. On April 2, Ars Technica reported that Gemma 4, the latest iteration of Google's open-weight model family, was switching to the Apache 2.0 licence. That licence change matters because Apache 2.0 is an OSI-approved, permissive licence with an explicit patent grant, exactly the kind of licence the EU AI Act's open-source exemption was designed to recognise. Google, which could afford the compliance overhead of any regulatory regime, chose to make its open-weight models unmistakably, legally open. The subtext was clear: when you operate in the EU, the licence you pick is now a compliance decision, not just a community one.

What 'Open' Means in a Post-Omnibus Europe

The pattern is not unique to AI. Bloomberg reported on April 21 that digital finance providers, including Boerse Stuttgart Group and Nasdaq, were lobbying Brussels for a carve-out from forthcoming distributed-ledger legislation, arguing that Europe was losing ground to the United States. The arguments sounded familiar: over-regulation pushes innovation offshore, the compliance burden falls disproportionately on smaller players, and the US reaps the economic benefits while Europe drafts the rulebook. For open-weight AI labs, the same logic applies, just with model weights instead of blockchain nodes.

You can see the tension most clearly in the licensing. The EU AI Act draws a line between "free and open-source" and everything else, but the open-weight community has spent two years blurring that line. Meta's Llama models ship with a custom licence that prohibits certain use cases and caps deployment scale. Mistral's models come under a mix of Apache 2.0 for research and commercial licences for production. Even the term "open weights" emerged partly because calling these releases "open source" felt misleading when the training data, code, and methodology stayed closed. The Omnibus deal, by declining to define the boundary more precisely, leaves each lab to argue its case in the grey zone.

Here is the thing the leaderboards do not measure. When an open-weight model lands on Hugging Face, the download counter provides a public signal of interest. But many of the production deployments, inside air-gapped government servers, hospital networks, and on-prem enterprise clusters, never report back. The AI Act's open-source exemption was designed for the publicly visible distribution channel. The gap between what the regulation can observe and where the weights actually run is where much of the European market lives. Whether the Omnibus deal closes that gap is an open question, but the gap is where the market lives.

The open-weight movement is not exclusively a European story, but the EU's regulatory posture shapes its incentives. Arcee, a US-based lab, released its Trinity-Large-Thinking model in early April, VentureBeat noted, positioning it as one of the rare powerful American-made models that enterprises could download and customise. The framing of the release, "rare" and "US-made," reflected a market that now sorts models by geopolitical origin as much as by benchmark scores. In that sorting, the EU's regulatory carve-outs function as a trade policy by other means: a model released under Apache 2.0 by a French lab sails through, while a comparable model shipped under a custom restrictive licence by a Californian company hits a compliance review.

The Omnibus deal's headline concession, pushing the high-risk compliance deadline to December 2027, buys the open-weight ecosystem eighteen months it did not have under the original August 2026 timeline. For labs shipping weights today, that is an eternity. It means two more generations of Gemma, at least one more major Mistral architecture, and enough time for the compliance tooling industry, code-scanning startups, model-card generators, and licence-classification services, to mature to the point where meeting the AI Act's requirements becomes a CI/CD pipeline step rather than a legal project. Whether that tooling emerges in time is the kind of question that will determine whether the EU's open-weight carve-out becomes a genuine competitive advantage or a paper right.

The AI nudification ban, the one provision in the Omnibus deal that earned unanimous support, serves as political cover for the broader deregulatory thrust of the package. No lawmaker wants to be seen voting against protections for intimate-image abuse. By bundling the ban with the deadline extension and the high-risk recalibration, the negotiators ensured that the final text could be sold as a consumer-protection win even as the compliance burden on AI developers was materially reduced. For the open-weight community, the nudification provision is largely irrelevant; the models it targets are fine-tuned diffusion checkpoints, not the general-purpose LLMs and TTS systems that make up the bulk of open-weight releases.

The EU's regulatory framework rewards one thing above all: classification. If your model fits neatly into the open-source exemption box, you ship. If it does not, you hire compliance counsel. The problem is that the most interesting open-weight models of 2026 do not fit neatly into any box. They are released under licences like Gemma's Apache 2.0 that are legally open in one jurisdiction and commercially circumscribed in another. They are trained on datasets whose provenance is documented in model cards but not independently verified. They are downloaded by users whose identities the releasing lab will never know. The EU AI Act, even after the Omnibus revisions, has no category for this reality.

The Omnibus deal now goes to a formal vote in Parliament and Council. If adopted before the August 2 deadline, the revised AI Act will shape the regulatory environment for every open-weight release through at least the end of 2028. The checkpoint to watch is not the vote itself, which is widely expected to pass, but the technical standards that follow: the harmonised norms that will define what counts as a compliant high-risk AI system and, by extension, what counts as exempt. The open-weight community won the legislative battle. The standards battle, quieter and more consequential, is just beginning.