POLICY + TECHNOLOGY BRIEFING · NO ML BACKGROUND REQUIRED

Open models are not one policy category.

“Open source,” “open weights,” and “free to download” describe different levels of access, rights, and responsibility. The distinction determines who can inspect a model, who can change it, who bears operating risk, and what can—or cannot—be recalled.

THE OPENNESS SPECTRUM · 01

Start with what is actually released.

The Open Source Initiative’s definition centers the freedoms to use, study, modify, and share an AI system. Weight access is important, but it is only one layer of the system.

Closed model

You access a hosted service. The provider keeps the weights and usually the training process private.

Where control sits

Provider controls availability, changes, monitoring, and most safeguards.

Open-weight model

You can download the learned parameters and run the model, subject to its license.

Where control sits

You can inspect, adapt, and host it—but may not receive the training data, full recipe, or broad reuse rights.

Open-source AI

The system is released with the freedoms and materials needed to use, study, modify, and share it.

Where control sits

Meaningful modification requires more than weights: architecture, code, and sufficient information about the data and training process matter.

Definition reference: Open Source AI Definition 1.0 ↗ Terminology remains contested across institutions and jurisdictions; this guide reports licenses and released artifacts separately.

MODEL ANATOMY · 02

What “weights” actually means.

PLAIN LANGUAGEWeights are billions of learned numerical settings that shape what a model does with an input.

During training, software repeatedly shows the model examples, measures its errors, and adjusts numerical parameters. The resulting values are called weights. Together they encode patterns the model learned—language relationships, visual features, problem-solving tendencies, and also defects or biases present in the training process.

A weight file is therefore closer to the learned state of a complex instrument than to readable program instructions. Possessing it allows the model to be run and modified, but does not necessarily reveal which examples produced a behavior or make the original training reproducible.

Architecture

The blueprint: how layers, attention, routing, memory, and other components are arranged.

Parameters

The adjustable numerical values inside that blueprint. A model may contain billions or trillions.

Weights

The parameter values learned during training. They encode statistical patterns, not a readable database of facts.

Checkpoint

A saved package of weights at a particular moment in training or fine-tuning—the file people usually download.

Inference code

The software that loads a checkpoint and turns an input into an output.

Training recipe

The data selection, objectives, filtering, compute, optimization, and evaluation choices used to produce the weights.

DISTILLATION · 03

A smaller model learns from a larger one.

TEACHERLarger model

Produces answers or probability patterns across many examples.

TRAINING SIGNALImitation data

The student learns from the teacher’s outputs, often alongside original labels.

STUDENTSmaller model

Aims to preserve useful behavior with less memory, latency, and cost.

Why organizations use it

Distillation can move some capabilities into a model suitable for phones, vehicles, private clouds, or lower-cost services.

What it is not

It does not usually copy the teacher’s weights. It trains a new model to imitate selected behavior.

What can be lost—or inherited

Rare skills, calibration, and safety behavior may degrade. Biases, errors, and policy-sensitive outputs may also transfer.

Why provenance matters

The student’s lineage should identify its teachers, generated training data, licenses, evaluations, and any behavior changes.

Technical origin: Hinton, Vinyals, and Dean, “Distilling the Knowledge in a Neural Network” ↗

WORKING VOCABULARY · 04

Nine terms that change the decision.

These are not implementation trivia. Each changes cost, control, evidence quality, or accountability.

Token

A small unit of text or media processed by a model. In text, a token may be a word, part of a word, punctuation, or whitespace.

Context window

The amount of information the model can consider in one interaction. A larger window is capacity, not proof that every detail will be used reliably.

Inference

Running a trained model to produce an answer, prediction, image, or action. Training creates the weights; inference uses them.

Fine-tuning

Additional training on a narrower dataset to change behavior or specialize a model. It changes the weights and can also weaken prior safeguards.

Quantization

Storing and calculating weights with fewer bits—often 8 or 4 instead of 16—to reduce memory and cost. Efficiency improves; quality may change.

Mixture of experts

A model with many specialist parameter groups, only some of which activate for each token. This is why total and active parameter counts can differ.

RAG

Retrieval-augmented generation fetches documents at answer time and gives them to the model as context. It can improve grounding without changing the base weights.

Guardrail

A control around or inside a model: safety training, filters, permissions, monitoring, or policy checks. Weight access can make some controls removable.

Evaluation

A structured test of capability, reliability, bias, security, or safety. Results only compare cleanly when the model, version, tools, prompts, and scoring match.

MERITS + DEMERITS · 05

The same property can create value and risk.

Wider access shifts power from the original provider toward deployers, researchers, citizens—and malicious actors. The relevant question is not whether openness is good or bad, but under what capability, license, deployment, and governance conditions it changes outcomes.

Potential merits

Control and continuity

Organizations can choose when to upgrade, keep a validated version, and avoid a provider withdrawing a critical API.

Data locality

Sensitive inputs can stay inside an approved environment instead of crossing into a third-party model service.

Audit and research

Independent teams can inspect behavior, probe vulnerabilities, reproduce findings, and develop mitigations.

Customization

Models can be tuned, quantized, or integrated for a specific language, domain, device, or public service.

Competition

Shared building blocks can lower downstream entry barriers and reduce dependence on a small number of model vendors.

Resilience and access

Local or offline deployment can support low-connectivity, sovereign, regulated, or emergency environments.

−

Potential demerits

Irreversible distribution

Once capable weights are widely copied, recalls and centralized safety updates become difficult or impossible.

Safeguards can be removed

A downstream actor can alter safety tuning, filters, or usage controls that accompanied the original release.

Accountability fragments

The original developer, modifier, host, integrator, and end user may each control a different part of the resulting system.

Operational burden moves inward

Security patching, evaluation, capacity planning, monitoring, incident response, and model retirement become the deployer’s work.

Provenance may remain opaque

Open weights do not by themselves disclose training data, labor conditions, copyright treatment, or the complete development process.

Capability can travel with risk

Fine-tuning and low-cost deployment can broaden beneficial access while also lowering barriers for abuse, cyber operations, or harmful content.

Evidence synthesis: U.S. NTIA report on widely available model weights ↗

POLICY LENS · 06

Regulate the risk pathway, not the marketing label.

Separate model from use

A general model and a system used in hiring, health, policing, or critical infrastructure create different obligations and evidence needs.

Track the chain of responsibility

Name the model provider, modifier, host, integrator, and deployer. “Open” should not become an accountability vacuum.

Use capability-sensitive release tests

Consider misuse potential, ease of removing safeguards, reversibility, and available mitigations before distributing high-capability weights.

Require useful disclosure

Licenses, lineage, known limitations, evaluations, training-content summaries, and system cards matter more than a broad openness label.

Preserve independent scrutiny

Policy should leave room for legitimate security research, bias testing, interoperability, local-language development, and public-interest use.

Do not confuse exemption with absence of risk

Legal treatment can vary by jurisdiction and capability. Open release does not remove downstream duties or systemic-risk concerns.

Current EU example

The EU AI Act provides conditional exceptions from some documentation duties for qualifying free and open-source general-purpose models, but not a blanket exemption. Copyright policy and training-content summary duties remain, and systemic-risk models face additional obligations regardless of openness.

Read the European Commission’s GPAI Q&A ↗

BOARD + PROCUREMENT TEST · 07

Eight questions before choosing a model.

“Can we download it?” is question one, not the decision.

01
What exact artifact is available: API, weights, architecture, code, data information, or a full reproducible recipe?
02
What does the license permit for commercial use, modification, redistribution, and high-risk domains?
03
Must sensitive data remain in a controlled environment—and who operates that environment?
04
Can the organization reproduce the model’s claimed evaluations on its own tasks and languages?
05
Who owns security updates, misuse monitoring, incident response, and retirement of derivative versions?
06
What hardware, energy, specialized talent, and support costs replace the API bill?
07
Can the organization identify the base model, modifications, evaluation record, and deployment owner for every production instance?
08
Would a smaller model, retrieval system, or conventional software solve the problem with less risk?

PRIMARY SOURCES · 08

Go beyond the label.

DEFINITIONOpen Source Initiative

Open Source AI Definition 1.0

POLICY EVIDENCEU.S. NTIA

Risks and benefits of widely available weights

RISK PRACTICEU.S. NIST

Generative AI Profile, NIST AI 600-1

REGULATORY CONTEXTEuropean Commission

Guidelines for GPAI model providers

Educational briefing, not legal advice. Regulatory obligations depend on jurisdiction, role, capability, and use.