Open-source stakeholders want EU AI Act edit access

Between testimony on Capitol Hill from AI’s household names and the recent set of voluntary safety agreements signed by tech bigwigs, the conversation around how to regulate artificial intelligence might be overlooking a key element: open-source models.

Open-source code—freely available to use, share, or modify—is a component in around 96% of all software today, but is invisible to most of the public, Peter Cihon, senior policy manager at software collaboration platform GitHub, told Tech Brew. “Too often people don’t really understand the role that open-source is playing in their lives,” he said.

“We have had our work cut out for us in terms of educating policymakers about the contributions that open-source software and AI models and components are making to people’s daily lives, the innovation ecosystem, and more,” Cihon said.

In a policy paper published last week, GitHub and a coalition of stakeholders, including open-source machine learning platform Hugging Face and nonprofit AI research group EleutherAI, outlined suggestions for how the European Union’s AI Act could better protect open-source innovation.

Three European institutions will ultimately come together to agree on the final legislation: the European Commission, European Parliament, and the Council of the European Union. The European Commission introduced the AI Act in 2021, and the European Parliament passed its draft version in June. Along with the Council of the European Union, the institutions aim to negotiate a final version later this year.

That draft, which includes a “risk-based exemption for open-source software and AI components,” is the basis for the open-source stakeholders’ recommendations, Cihon said.

“The purpose of this paper is really to offer some recommendations to improve that text...so that we can see a final AI Act that really reflects the needs of open-source developers and ultimately can turbocharge open-source innovation in the EU and beyond,” he said.

Those recommendations include clarifying that the act of sharing components on open repositories (like GitHub or Hugging Face) doesn’t constitute “commercial activities subject to market regulations,” and loosening a proposed ban on “red-teaming” (simulating scenarios to test model weaknesses) to allow for limited real-world testing in certain scenarios.

The paper also addresses what Cihon called a “controversial” provision: requiring foundation model developers to demonstrate “full control of the development chain,” per the policy paper. As written, that provision creates “insurmountable barriers” for open-source developers, the paper said.

Instead, stakeholders are suggesting a “tiered approach” that “distinguish[es] between a set of baseline obligations that should apply to all foundation models...while limiting some more far-reaching obligations to a subset of models that are commercially deployed or reach a particular threshold meriting additional scrutiny.”

A history of advocacy: Cihon pointed to the 2019 passage of the EU Copyright Directive as a “wake-up call” for the open-source ecosystem about the potential impact of regulation.

“A lot of folks got involved as the EU worked on that copyright directive, and ultimately the text was passed with a clear distinction between expectations on platforms that were hosting copyrighted content…and platforms hosting and enabling open-source collaboration,” Cihon said.

In the intervening years, the open-source community has been keeping an eye on policy development and weighing in to improve laws for open-source development, including in the US, he added. He’s hoping Majority Leader Chuck Schumer’s “Insight Forums” with AI experts this fall will allow regulators to hear from open-source developers.

“As the debate moves from Brussels to DC, we’re hopeful that open-source developers will be given a seat at that table as well,” Cihon said. “It’s important to recognize that they’ve been shaping some of these responsible practices for years,” he added.