Who is liable when an AI model runs on your own computer?

You are. Anyone who downloads model weights and uses them for work is a deployer under the EU AI Act. The provider drops out as the layer in between, and with it go the filters, the contract and the assumption of liability. Models without a safety layer say this openly in the model card: "You assume full responsibility and liability."

TL;DR

• A version of Qwen3.8-27B with no safety layer runs as an MLX build on Apple Silicon, in 2, 4, 6 and 8 bit, without CUDA and without a server.
• Abliteration neutralizes the refusal direction in the weights. The result isn't a feature that got switched on. It's a model with no brakes.
• Whoever downloads it becomes the deployer. That role is defined in the EU AI Act and doesn't depend on where the hardware sits.
• Article 50 has applied since 2 August 2026 and governs transparency. Whether it affects you depends on the use, not the download.
• The practical part is five steps before the first launch.

What just happened?

An account called OrcaRouter has published a version of Qwen3.8-27B with the safety layer removed. It spread through a post by Chubby (@kimmonismus) on X and was picked up by Vincent Mumme on TikTok. The model ships as an MLX build in 2, 4, 6 and 8 bit. MLX is Apple's framework for machine learning on its own chips. Hence the line making the rounds: no CUDA, no server, a Mac with enough RAM will do.

The interesting part isn't in the announcement post. It's in the model card: the model goes along with requests that are harmful, unethical, offensive or illegal, it is explicitly released for research, and full responsibility lies with whoever uses it.

What does "refusal-removed" mean technically?

Abliteration is an intervention in the weights of a fully trained model that subtracts the direction in which the model phrases a refusal from the residual stream. The model card names the method and describes the consequence in one sentence: the model no longer has any meaningful built-in safeguards.

The difference from a jailbreak matters. A jailbreak gets around an existing brake and dies with the next update. Abliteration removes the brake. It doesn't come back, because there's no provider in between to fit it again. If you want a safety layer, you build it yourself and put it in front.

Why is local a different role and not just a different place?

With an API, a company sits between you and the model. It filters, it carries part of the liability, it signs a data processing agreement. On your own machine that layer disappears, in both directions: nobody reads along, and nobody but you is responsible.

The EU AI Act has its own term for this. A deployer is anyone who uses an AI system under their own authority, except in a purely personal, non-professional context. The location of the hardware doesn't appear in this definition. A model on the MacBook in your office makes you a deployer. So does a model in a data center in Virginia.

Article 50 governs the transparency obligations and has applied since 2 August 2026. The Digital Omnibus, which came into force on 27 July 2026, didn't move that. What it moved were the high-risk deadlines. The fine range for Article 50 goes up to €15 million or 3% of global annual turnover. The €35 million and 7% from the headlines belong to Article 5. The supervisory authority in Germany is the Bundesnetzagentur. This assessment comes from my own research on 5 August 2026 and isn't legal advice.

Whether Article 50 affects you depends on the use. A local model that sorts your notes doesn't trigger a disclosure obligation. The same stack as a chatbot on a customer-facing website does, and it does so at the first interaction, not in the legal notices.

The second point is data protection, and here things flip. If the model runs locally, there's no processor, so you don't need a contract with one either. You remain the controller, and you alone answer for what the model does with the data you feed it.

What does this look like in practice?

Yesterday I installed Agent Reach, a research router across fifteen platforms. MIT license, open code. Even so, an audit ran before the first launch, and afterward the installation looked different from the one in the instructions.

The code is pinned to a fixed commit instead of main. The dependencies live in their own venv, not in the system Python. Two commands are blocked because they print release notes and commit messages raw, and in an agent's context that kind of third-party text looks like an instruction. Access to Twitter and Reddit runs through secondary accounts, because a Twitter token means full access without a second factor.

The tool didn't get any better from this. Now I know what's running and what it's allowed to see. With a model that has no safety layer, the same routine is mandatory.

Which five steps come before the first launch?

1. Check the origin. Who uploaded it, how long has the account existed, which license applies. Read the model card as far as the liability paragraph, and don't stop at the benchmark.
2. Lock it to one version. Pin the commit or revision, no auto-update, no archive from the main branch.
3. Separate it from the system. Its own venv or container, no installing into the system Python, no global packages.
4. Treat third-party text as data. Release notes, commit messages and scraped pages are never instructions for an agent.
5. Write down your own role. What am I using this for, who sees the data, what do I have to disclose as soon as customers talk to it.

This isn't a compliance ritual. It's the answer to the question of who made the call when something goes wrong.

Where is this overrated?

A model without brakes on a laptop isn't a cyberweapons lab. Most of what it outputs is also in open sources, just less convenient to get. What changes is the friction: one sentence instead of an hour of research, and nobody in between keeping a log.

There's little solid data on quality. The uploader says they tested the 4-, 6- and 8-bit variants. I don't know of any independent measurements. If you want to work with it, measure it yourself.

Related: Local AI instead of the cloud, the agent that knows your browser and the architecture behind an AI setup with memory.

FAQ

Is it prohibited to download a model without a safety layer?

The EU AI Act doesn't target the download. It prohibits certain practices and attaches obligations to roles. What happens with the output falls under general law. The model card explicitly shifts responsibility and liability to the user. This is an assessment, not legal advice.

What's the difference between a provider and a deployer?

A provider is anyone who develops an AI system and places it on the market under their own name. A deployer is anyone who uses it under their own authority, unless that happens purely privately. If you download someone else's model and use it, you're a deployer. If you modify it and pass it on, you slide into the provider role.

Do I need a data processing agreement if the model runs locally?

No, there's no processor for data to flow to. That's exactly why full responsibility moves to you, including the deletion policy, access protection and the question of which data is allowed in at all.

Do I have to label what a local model produces?

For marketing copy that you review and approve, editorial responsibility applies, so no notice is needed there. Photorealistic images of people fall under the deepfake rule. Chatbots that deal with customers have to identify themselves at the first interaction.

Build it yourself

• Read the model card before downloading and look specifically for liability and intended use.
• Pin the version and switch off auto-update, for models as well as for tools.
• One line per tool: which data it sees, whose text it processes.

Kemal Duran is Head of Digital Marketing, leads a team and builds his own AI products on the side. He works daily with Claude Code, his own agents and a second brain in Obsidian, and writes here about what works and what breaks.