Legal Analysis: EU AI Act Likely Covers Internal AI Model Deployments, Not Just Public Releases
Summary
- • EU AI Act's 'own use' language likely captures internal model deployments, not just public products
- • OpenAI's Hugging Face breach spotlights internal model EU compliance question
- • Research exemptions probably too narrow to shield commercial AI companies from the Act
- • EU enforcement powers active since August 2026; companies face real fines risk now
Details
OpenAI Internal Model at Center of Hugging Face Breach Incident
OpenAI's technical report on the Hugging Face incident revealed an 'internal-only research model had the broadest confirmed role,' prompting legal analysis of whether the EU AI Act governs non-public internal deployments.
EU AI Act 'Own Use' Definition Likely Captures Internal Deployments
'Putting into service' under the Act explicitly includes supplying an AI system 'for own use in the Union for its intended purpose,' meaning internal deployments by companies operating in the EU are likely in scope.
GPAI Model Underlying Internal System Also Falls Under the Act
Once an internal AI system is within scope, the GPAI model underlying it is considered 'placed on the EU market' and subject to full GPAI obligations — including systemic-risk provisions — regardless of public release.
'Sole Scientific R&D' Exemption Unlikely to Shield Commercial AI Firms
The first research carve-out requires the 'sole purpose' be scientific research; commercial AI companies' product incentives almost certainly disqualify them, making this exemption effectively unavailable.
Pre-Market Exemption Only Covers Genuine Pre-Deployment Testing Activity
The second carve-out covers R&D activity prior to market placement; once a model is deployed internally — even for own use — this exemption no longer applies and the deployment falls in scope.
AI Self-Improvement Makes Internal Deployment Question Urgent: ~80% of Code Is AI-Written
Anthropic and OpenAI report AI writes approximately 80% of their code; as autonomous AI R&D grows, such internal deployments may increasingly trigger EU AI Act obligations at scale.
EU Commission Enforcement Powers Active Since August 2, 2026
The European Commission gained enforcement authority under the EU AI Act in August 2026, including the ability to impose fines — making internal deployment compliance immediately actionable and not merely theoretical.
Source: Lawfare, September 16, 2026. Legal analysis by Google News AI Policy source.
What This Means
A Lawfare analysis argues that EU AI Act compliance obligations likely extend beyond publicly released models to internal deployments — a reading grounded in the Act's own 'put into service for own use' language. The timing is significant: EU enforcement powers became active in August 2026, and the OpenAI Hugging Face breach has already put internal model use under public scrutiny. Commercial AI companies cannot rely on the Act's research exemptions because their mixed scientific and commercial motivations almost certainly disqualify them. As AI systems increasingly write and develop each other's code, the line between 'development' and 'internal deployment' is blurring — and this analysis suggests regulators may draw it in ways that surprise the industry.