Open-source and fine-tuned models

Overview

A downloaded or fine-tuned model puts more of the responsibility on you than a hosted product does. Check provenance and licence terms, test the adapted model yourself, and note that your changes can change which rules apply to you.

Key risks

• Unknown training data and licences
• Fine-tuning data leaking into outputs
• No vendor to hold responsible
• Security of weights and pipelines

What to do now

• Record the model, its licence and its source.
• Document the fine-tuning data and its lawful basis.
• Test for leakage and misuse.
• Own the monitoring and updates.

Questions to ask

• Where did the model and its training data come from?
• What does the licence allow and forbid?
• Have we re-tested the model after fine-tuning?
• Who patches and monitors it over time?
• Did our changes move us from user to provider under any law?

Related tools

• Data lineage mapper
• System card builder

Region rules: EU · US · UK · India · Global standards.

Reviewed 3 Oct 2026. Sources: European Commission: AI Act overview.