Release of a 70-billion-parameter open-weights vision-language model for commercial download under a…

EU, US federalGeneral public2026-05-26

In accordance with our privacy statement.

Summary

Open-weights 70B VLM faces potential export control dealbreaker and layered GDPR and copyright liability.

The single most urgent issue is whether ECCN 4E091 prohibits or conditions unrestricted global download of these weights before launch day, because a public Hugging Face release that turns out to be an unlicensed export is not a documentation problem but a statutory violation. Layered on top of that, the web-scraped Common Crawl training corpus creates simultaneous GDPR lawfulness and copyright exposure, both of which are amplified rather than mitigated by the open-weights release because the weights cannot be recalled once distributed. The EU AI Act Art. 50 disclosure obligation and the 2024 Product Liability Directive add compliance overhead that is manageable but needs to be built into the model card and license before the Hugging Face page goes live.

1 dealbreaker9 obligations5 watch items
Top priorities
  1. 1Get a written export control opinion from outside counsel on ECCN 4E091 applicability before any Hugging Face publication, specifically addressing whether an unrestricted public download qualifies as an export and what license exception, if any, covers it.
  2. 2Document the legal basis for processing personal data in the Common Crawl training corpus under GDPR Art. 6 and record the data protection measures applied during training under Art. 25 and Art. 32, because this documentation is a prerequisite to any EU release and will be the first thing a regulator requests.
  3. 3Conduct a targeted audit of the training corpus to identify high-density copyrighted image and text sources, produce a fair-use analysis for the most material ones, and retain that analysis as litigation-ready documentation given the NYT v. OpenAI line of cases.
  4. 4Embed Art. 50 AI disclosure language and a right-of-publicity notice covering high-risk US state laws directly in the model card, README, and acceptable-use policy before launch, so EU and US compliance obligations are satisfied at the point of download rather than downstream.
  5. 5Retain and organize model development records, testing protocols, and known-limitation documentation now, while the information is accessible, to establish the defect baseline required under the EU 2024 Product Liability Directive.
Biggest open question

Whether unrestricted public download of model weights on Hugging Face constitutes a prohibited or licensable export under ECCN 4E091 such that the launch must be gated, delayed, or restructured before any weights become publicly accessible.

Dealbreakers1 surfaced. A thoughtful counsel would flag these as blocking and require remediation before launch in the indicated jurisdictions.
New AI model weights control (EAR)Settled rule, unsettled applicationVerified 2026-05-25
How this applies to your launch

This launch makes a 70-billion-parameter vision-language model available via Hugging Face for unrestricted global download by developers and companies. The EAR control on large AI model weights (ECCN 4E091) applies because the model meets the size threshold and is exported in downloadable form. The practical question is whether making weights available on a public platform accessible worldwide constitutes a "transfer" or "export" triggering the licensing requirement, or whether the decentralized nature of downloads to end-users falls outside the traditional export control framework designed for state-to-state transfers.

What to do before shipping
  • 1Determine the applicability criteria for ECCN 4E091 by contacting BIS directly or consulting with an export control counsel to confirm whether publicly accessible downloads on Hugging Face constitute controlled exports or fall within a carve-out for open-source or publicly available software.
  • 2Map the expected user population (5,000 downloads per month) against any restricted destination lists or end-use restrictions to identify whether downloads to certain jurisdictions would require a license.
  • 3Document the decision rationale on whether the model qualifies for any exemption (such as open-source or publicly available technology exceptions if they exist under this new rule) and retain this analysis for audit purposes.
  • 4If BIS clarification indicates licensing is required, establish a geo-blocking mechanism or terms-of-service language that prohibits downloads to restricted destinations or end-uses before launch.
Open questions for this launch

Interpretive points where reasonable counsel would disagree, applied to the specifics above.

  • Does the new EAR control on model weights distinguish between controlled transfers to specific foreign nationals or entities versus public, non-discriminatory downloads available to any global user, and does Hugging Face's platform model constitute 'export' under that standard.
  • Are there exemptions for open-weights models or publicly available software under ECCN 4E091, or does the control apply to all models meeting the parameter threshold regardless of licensing or accessibility.
  • If licensing is required, what is the scope of 'restricted destinations' that trigger the requirement, and whether the EU as a whole is treated as a single jurisdiction or whether member state-level distinctions apply.
Key risk if ignored

Downloading and distribution of a 70-billion-parameter model to restricted jurisdictions without proper licensing could expose the company to civil penalties and enforcement action under EAR, particularly given public visibility of the release and BIS's stated intent to control exports of large advanced AI models.

Why this was triggered›

Signals: export-ai-model-weights.

The provision text›

Commerce Department BIS added controls on exporting AI model weights for large models (ECCN 4E091) effective Jan 2025, requiring licenses for certain advanced AI model exports to restricted destinations.

Sources
[1]New AI model weights control (EAR)

AI laws that may apply

9 surfaced across 5 lenses

Grouped by legal lens. Click any provision to see how it applies to this launch specifically.

AI-specific

1
  • Disclosure of AI interaction (AI Act Art.50(1))Settled rule, unsettled applicationVerified 2026-05-25

    Providers must design AI systems interacting with people so that users are informed they are interacting with AI (not a human).

Privacy

3
  • Data protection by design and by default (GDPR Art.25)Settled rule, unsettled applicationVerified 2026-05-25

    Controllers must implement data-protection principles (e.g. minimization, pseudonymisation) into processing from the earliest design stages.

  • Security of processing (GDPR Art.32)Settled rule, unsettled applicationVerified 2026-05-25

    Controllers and processors must implement appropriate technical and organizational measures to secure personal data according to the risk (e.g. encryption, resiliency).

  • Lawfulness of processing (GDPR Art.6)Settled rule, unsettled applicationVerified 2026-05-25

    Personal data processing must fit at least one lawful basis (e.g. consent, contract performance, vital interests, public task, legitimate interest).

Accessibility

3
  • ADA Title II Digital Accessibility (DOJ rule)Settled rule, unsettled applicationVerified 2026-05-25

    DOJ Title II rule mandates that websites and mobile apps conform to WCAG 2.1 Level AA standards.

  • EU EN 301 549 / WCAG 2.1Settled rule, unsettled applicationVerified 2026-05-25

    Under the EU Web Accessibility Directive, public-sector websites and mobile apps must meet EN 301 549 incorporating WCAG 2.1 Level AA.

  • WCAG Multimedia AccessibilitySettled rule, unsettled applicationVerified 2026-05-25

    WCAG 2.1 requires captions for all prerecorded and live multimedia and requires content be accessible to screen readers.

Liability

1
  • EU Revised Product Liability Directive (2024)Settled rule, unsettled applicationVerified 2026-05-25

    The EU 2024 update to the Product Liability Directive extends strict liability to digital products including AI-based systems.

other

1
  • EU AI Act, Art. 50Settled rule, unsettled applicationPending · omnibus_viiVerified 2026-05-23

    Imposes transparency obligations on providers and deployers of AI systems. Providers must ensure persons interacting with AI systems are informed they are interacting with AI (unless obvious). Providers of generative AI…

Worth watching

5

Provisions that may not strictly apply today but are close enough to the launch shape that they are worth keeping an eye on. No per-launch analysis is generated for these.

  • Copyright and AI Training DataRecent court guidance indicates that copying copyrighted works into AI models may infringe unless clearly tran…skadden.com ↗
  • NYT v. OpenAI (Training Data)The New York Times has sued OpenAI, alleging that using its copyrighted articles to train ChatGPT without perm…theverge.com ↗
  • DMCA 512 Safe Harbor (AI Content)Under 17 USC 512, online service providers are shielded from liability for user-posted infringing content if t…copyright.gov ↗
  • AI-Related Copyright CasesCourts are grappling with AI and IP: e.g., in Thomson Reuters v. ROSS, a judge held that output of an AI model…skadden.com ↗
  • Right of Publicity for AI LikenessesState right-of-publicity laws can prohibit using a person likeness or voice without permission.leginfo.legislature.ca.gov ↗

Not legal advice. Structured analysis of what a thoughtful counsel would consider given the inputs above. Does not substitute for counsel review or certify compliance.