The critical element that's missing from the article--but which likely motivated the article--is that the EU's new AI regulation proposal
mandates compliance all along the supply chain (for regulated applications of AI).
In practice, this will likely mean that using open source for these AI applications will become a lot more difficult in a legal sense, perhaps impossible, because there's no single entity that can speak to compliance of open source components (vetting each commit, etc.). Perhaps some orgs will emerge who are willing to monitor and oversee open source software and certify that it meets the requirements of the legislation, but it's unclear how that would work.
I'm not endorsing this model, just explaining the concern. I don't think the tech community really fully appreciates how misguided a lot of the current approaches to AI regulation among policymakers are right now. (Not just this, but initiatives like the current CAHAI work towards a binding international law instrument on AI.)
And yes, like the GDPR, the proposed EU AI regulation has an extraterritorial effect. Under the proposed AI regulation, if you're selling into the EU or to any EU customers but don't have an establishment in the EU, you have to actually appoint a representative to comply with these requirements.