The EU AI Act's Open-Source Exemption Survives the Omnibus Rewrite, For Now

On 7 May 2026, the European Parliament and the Council of the European Union reached a provisional political agreement on the Digital Omnibus on AI, pushing the compliance deadline for high-risk AI systems to December 2027 and banning so-called nudification apps outright. The deal, reported by The Next Web, ended a negotiating deadlock that had dragged through April and exposed deep rifts among co-legislators over how far the world's strictest AI rulebook should be thinned. For the open-weights community, the Omnibus outcome matters less for what it changed than for what it left untouched: the original Act's exemption for free and open-source AI models survived the rewrite without meaningful narrowing.

That exemption has been the quiet engine underneath the European open-weights economy since the AI Act's text was finalised in 2024. Article 2(12) of the original regulation carved out AI systems released under free and open-source licences from most obligations, provided they were not monetised and not classified as high-risk. It was the provision that let Mistral ship Mistral Large weights to Hugging Face without running a conformity assessment, and it gave Meta enough legal comfort to release Llama 3 and Llama 4 into the European market. Without it, every open-weights release touching EU users would theoretically need a risk classification, technical documentation, and a registered authorised representative in the bloc. Nobody was going to do that.

The carve-out was always more fragile than its supporters admitted. The AI Act's definition of 'free and open-source' never mapped cleanly onto how frontier labs actually release weights. A model distributed under a custom licence that prohibits commercial use above a certain revenue threshold, like Meta's LLAMA 3.2 Community License, sits in a grey zone between genuinely open and restricted. The Act's recitals gestured toward OSI-approved licences as a reference point, but stopped short of requiring them. Legal scholars and compliance teams spent two years arguing about whether 'open weights, restricted use' counted as open source for regulatory purposes, and the Omnibus process was the obvious moment to settle the question. It did not.

What the Omnibus deal delivered instead was a delay. The high-risk deadline, originally set for August 2026, was pushed to December 2027, buying everyone breathing room. The JD Supra analysis by Orrick, Herrington & Sutcliffe published the day after the agreement catalogued seven key changes, most of them procedural: the Act's overlap with sectoral product-safety regulations was clarified, certain documentation requirements were simplified, and the governance structure was adjusted. The open-source exemption was not among the seven items listed as materially altered. For the maintainers of open-weights models, that is both a victory and a deferral. The exemption holds, but the ambiguity that makes it legally precarious has not been resolved.

The Omnibus negotiations themselves demonstrated how narrow the political coalition behind the carve-out actually is. In late April, after twelve hours of trilogue talks, Parliament and Council failed to reach agreement, with one flashpoint being whether high-risk AI systems embedded in consumer products should be exempt from the Act's requirements. The open-source question was not the headline dispute, but it sat inside the same structural argument: how much regulatory relief is too much, and who gets it. When the deal finally landed in May, the open-source exemption remained, but so did the fundamental tension between Europe's ambition to regulate AI by risk level and its desire to avoid kneecapping the only European AI champion that matters, Mistral.

Mistral's trajectory is instructive here. The Paris-based company, which Forbes recently valued at $14 billion, built its business on a hybrid strategy: proprietary APIs for paying customers alongside open-weights releases that kept the developer ecosystem warm and the regulatory conversation friendly. Mistral lobbied hard for the open-source exemption during the Act's original drafting, and its continued existence is a direct legacy of that effort. Arthur Mensch, Mistral's CEO, has framed open-weight releases as a European strategic asset, and the Omnibus outcome suggests that argument still carries weight in Brussels.

But the regulatory environment is not the only force shaping release strategies. Meta's decision in April 2026 to launch Muse Spark, a fully proprietary model developed by its newly formed Superintelligence Labs division, reported by VentureBeat, signalled that even the strongest advocates of open weights are recalibrating. Meta had been the loudest corporate voice arguing for open-source AI, releasing Llama models under increasingly permissive terms. The Muse Spark launch does not mean Llama is dead, but it does mean Meta is no longer betting exclusively on the open-weights playbook. When the company that coined 'open source AI for all' starts shipping proprietary models, you pay attention.

The timing matters. Meta's shift came weeks before the Omnibus deal was struck, and it is hard to read it as anything other than a hedge against regulatory uncertainty. If the EU had narrowed the open-source exemption during the Omnibus rewrite, Meta's proprietary pipeline would already be in place. If the exemption had been expanded, the Llama programme would continue to benefit. Either way, Meta insulated itself. The same calculus is visible across the industry: the Forbes analysis by Ron Schmelzer in April argued that open-source AI is moving 'from sideshow to strategy,' citing adoption data showing that enterprises are increasingly running open-weight models in production alongside proprietary APIs. But running models in production is not the same as releasing them. The strategic question for labs is whether the EU's regulatory environment rewards openness or quietly penalises it.

The parallel lobbying effort by digital-finance providers, reported by Bloomberg's Lyubov Pronina on 21 April, offers a useful comparison. Thirty-nine signatories including Boerse Stuttgart Group and Nasdaq asked the European Commission to fast-track a review of the EU's distributed-ledger-technology pilot regime as standalone legislation, arguing that Europe was losing ground to the United States. The letter did not mention AI, but the rhetorical structure was identical to what the open-weights camp has been saying for two years: regulate too heavily, and the technology will simply be built elsewhere, by someone else, under a different set of rules. Brussels heard that argument from the crypto and digital-assets sector and agreed to consider a carve-out. It heard the same argument from Mistral and Meta during the AI Act's original drafting and carved out open source. The question now is whether that argument retains its force as the technology matures and the risks become harder to dismiss.

What makes the open-source exemption different from the DLT carve-out request is that it is already law. The Omnibus process could have narrowed it, and did not. That is a meaningful data point. It suggests that the coalition defending the exemption, anchored by France and supported by a loose alliance of developer-community advocates, academic groups, and industry trade bodies, still has enough political capital to protect it. But the Omnibus deal also demonstrated that the political centre in Brussels is not static. The April deadlock over high-risk AI in consumer products showed that MEPs are willing to walk away from a deal if they believe the simplification goes too far. The open-source exemption could become a bargaining chip in the next round of reform.

The most consequential unresolved question is definitional. The AI Act's open-source exemption applies to models released under 'free and open-source' licences, but the Act itself does not provide an exhaustive list of qualifying licences. The Open Source Initiative published its Open Source AI Definition in October 2024, requiring that all data used to train the model be made available under open terms, a standard that almost no frontier open-weights release actually meets. Meta's Llama models do not meet it. Mistral's do not meet it. If the EU were to adopt the OSI definition as the regulatory standard, the carve-out would effectively collapse for frontier models, leaving only truly open research projects like Allen AI's OLMo inside the exemption. The Omnibus deal did not adopt the OSI definition, but neither did it foreclose the possibility. This is the sword hanging over every open-weights release strategy aimed at European users.

The compliance community has been mapping the terrain with increasing urgency. The IAPP's AI Governance Center, led by Ashley Casovan, assessed the post-Omnibus landscape at the end of April and urged governance professionals to treat the legal uncertainty as a planning assumption rather than a reason to pause. The practical advice circulating among compliance teams is to assume the open-source exemption will hold in its current form through the December 2027 deadline, but to prepare documentation as though it might not. For companies distributing open-weights models into the EU, that means maintaining records of which licence applies, which training data was used, and which risk classification the model would fall under if the exemption were removed. It is not full conformity assessment, but it is not nothing either.

For the fine-tuners and downstream deployers who make up the bulk of the open-weights economy, the Omnibus deal is mostly good news. The high-risk deadline extension to December 2027 means they can continue building on Llama, Mistral, Qwen, and DeepSeek weights without immediate regulatory exposure. The continued existence of the open-source exemption means the models themselves are not going to be pulled from European distribution. And the fact that the Omnibus process clarified the Act's overlap with sectoral product-safety regulations, as the IAPP reported, reduces the risk that a downstream application inadvertently triggers high-risk classification through a back channel. If you are running a small fine-tuning shop in Berlin or a startup in Tallinn that ships a Mistral-based chatbot, the regulatory environment just got slightly more predictable.

But predictability for deployers is not the same as stability for releasers. The labs that actually produce and distribute open-weights models are operating in a regulatory environment where the rules could shift under them with relatively little notice. The Omnibus deal proved that Brussels can move fast when it wants to. The April deadlock lasted less than two weeks before a deal was struck in May. The next round of AI Act reform, whatever form it takes, will not take years. The open-source exemption that survived this round may not survive the next one, particularly if a high-profile incident involving an open-weights model creates a political opening for restriction.

The Bloomberg report on the DLT carve-out request noted that the 39 signatories argued Europe was 'losing out to the US.' The same anxiety courses through every conversation about open weights and EU regulation. If the exemption narrows, the weights do not disappear: they shift jurisdiction. Meta releases from Menlo Park. Mistral, despite its Paris headquarters, could choose to distribute future models through a non-EU entity. The developers who want the weights will find them regardless. The only thing Brussels controls is whether European companies can build on those weights without legal exposure. The Omnibus deal kept the door open. The next test is whether the EU can define 'open source' in a way that preserves the exemption without letting every restricted-licence model sail through. Nobody in the open-weights community should assume the answer will be favourable.

Watch the next trilogue, whenever it convenes. Watch whether the European Commission issues interpretative guidance on the open-source definition before the December 2027 deadline. And watch what Meta does with Llama 5. If the next Llama ships under a licence that is even slightly more restrictive than the current one, it will be a signal that the regulatory calculus has shifted. The Omnibus deal was not the end of the open-weights regulatory story. It was a stay of execution, and everyone in the ecosystem knows it.