Open Source, Open Weights, and the Five Layers of AI Openness
EXPLAINER – Governance. Research current to 19 July 2026. Companion to the Open Source Initiative’s Open Source AI Definition 1.0.
The phrase “open-source AI” is now doing too much work.
It is used for models anyone can try. For models whose weights can be downloaded. For models released under permissive licences. For systems whose architecture is described in a paper. And, occasionally, for systems whose training code and data information are open enough to let others study and reproduce how they were made.
Those are different conditions. Treating them as one hides where control remains.
The distinction has become politically important because China is presenting open-source AI as a global public good, while US frontier laboratories increasingly distribute their strongest systems through controlled APIs. The relevant question is not which side deserves the word “open.” It is what, exactly, has been opened.
Layer 1: access to the service
The first and weakest form of openness is the ability to use a system.
A public chatbot may be free. An API may be available in many countries. A provider may offer generous rate limits or prices low enough to support broad adoption.
This creates access, but the provider retains operational control. It can change the model behind the endpoint, alter the price, impose monitoring, restrict a use case, exclude a jurisdiction, or withdraw the service. The user cannot inspect the model parameters or guarantee that tomorrow’s system is the same as today’s.
Service access can be broad without being open source. It is permissioned use.
Layer 2: access to the weights
Open weights means the model’s learned parameters can be downloaded.
This is a substantial change in control. An organisation with sufficient infrastructure can run the model without sending prompts to the developer. It can preserve a version after the provider changes its product, fine-tune it, examine its behaviour, and remove dependence on an external API.
But weights do not reveal the full process that produced them. They do not necessarily include the training data, data filters, training code, post-training recipe, intermediate checkpoints, safety evaluations, or a licence permitting every use and redistribution.
Open weights are not a cosmetic distinction. They provide real operational independence. They are also not the whole of open-source AI.
Layer 3: freedom under the licence
A downloadable model can still carry legal restrictions.
The licence may limit commercial use, prohibit particular fields, require attribution, impose conditions above a user threshold, restrict redistribution, or reserve rights that make the model unsuitable for a regulated or public deployment.
This is why “the weights are on a repository” is not enough. A serious access assessment asks:
Who is permitted to use them?
For which purposes?
May a modified version be redistributed?
Do the terms discriminate between users or fields of endeavour?
Can the licence change for later versions?
What obligations survive after local deployment?
The Open Source Initiative’s definition begins from four freedoms: to use, study, modify, and share the system for any purpose without asking permission. A release that fails those freedoms may still be valuable and open-weight. It should not be described imprecisely.
Layer 4: transparency of training
The next layer concerns whether outsiders can understand how the model was made.
The OSI definition requires the preferred form for modification, including sufficiently detailed data information, model parameters, and the code used to process data, train, validate, test, and run the system.
This layer matters for more than reproduction. It supports questions that weights alone cannot answer:
Which languages, regions, and institutions are represented in the data?
Which material was excluded?
What political, safety, and commercial objectives shaped post-training?
Which evaluations were run before release?
Which capabilities were deliberately suppressed or strengthened?
Weights can be inspected behaviourally. Training transparency makes institutional choices inspectable.
Layer 5: practical reproducibility
Even full documentation does not guarantee that another actor can reproduce or maintain the system.
A frontier-scale model may require rare expertise, thousands of accelerators, specialised networking, large energy contracts, data pipelines, and software optimised for particular hardware. The code may be public while the practical ability to exercise it remains concentrated.
This is the layer most often missing from claims of AI sovereignty. A country may legally possess the weights and still depend on foreign chips, foreign cloud infrastructure, foreign serving engines, foreign updates, or a small external team capable of keeping the deployment working.
Practical openness therefore includes the means to use what has been disclosed.
The five-layer test
| Layer | What is open? | Control that may remain |
| Service access | Chat or API use | price, monitoring, version, jurisdiction, shutdown |
| Weights | learned parameters | training process, licence, hardware, expertise |
| Licence | legal use, modification, sharing | later versions, infrastructure, technical barriers |
| Training transparency | data information, code, process, evaluations | cost and material ability to reproduce |
| Practical reproducibility | operational ability to rebuild or sustain | upstream global supply dependencies |
The purpose of the test is not to award a purity label. Different deployments need different layers.
A hospital may primarily need local inference and stable versioning. A research institution may need training transparency. A public administration may need licence certainty, independent evaluation, and an exit path. A state may need the ability to replace critical upstream components.
The mistake is to claim that one layer provides all the others.
Why open weights change governance
Open weights redistribute power in two directions at once.
They move power away from the original provider. There is no universal API switch after the weights have been downloaded. Users can inspect, adapt, preserve, and deploy the model privately.
They also move power away from the provider’s safety controls. Refusal behaviour can be altered, monitoring removed, and a released capability spread irreversibly. The UK AI Security Institute notes that open-weight systems create benefits for research and decentralised access while being harder to patch, monitor, or safeguard after release.
The governance problem is therefore not open versus safe. It is how authority, responsibility, and risk change when operational control moves from one provider to many deployers.
That is an admissibility question. The same model may be admissible through a hosted service for one task, admissible with limits as a local deployment for another, and held from release in a third context because its capabilities cannot be contained once distributed.
The vocabulary rule
For Institute publications, the editorial rule should be simple:
Say publicly accessible when anyone can use a service.
Say API-accessible when the provider retains the model.
Say open-weight when parameters can be downloaded under identified terms.
Say open-source AI only when the release has been assessed against a stated definition.
Say reproducible only when the practical claim is supported, not merely the code repository.
Precision here is not pedantry. The word chosen tells the reader where power remains.
FAQ
Is an open-weight model open source?
Not necessarily. Open weights provide the learned parameters. Open-source AI, under the OSI definition, also requires the freedoms to use, study, modify, and share, plus access to the preferred form for modification, including data information and relevant code.
Can an open-weight model be switched off?
Downloaded weights cannot normally be remotely withdrawn in the way an API account can. The deployment can still depend on licences, chips, serving software, energy, updates, and local infrastructure.
Does local hosting create AI sovereignty?
It creates stronger data and operational control. Full sovereignty requires a wider stack: hardware, energy, software, talent, maintenance, legal freedom, and an exit path from upstream suppliers.
Are open models safer because they can be inspected?
They can support broader independent testing and research. They can also be modified to remove safeguards and used outside provider monitoring. Openness changes the risk structure; it does not settle safety by itself.
Sources
Open Source Initiative, The Open Source AI Definition 1.0.
Open Source Initiative, Open Weights: not quite what you’ve been told.
UK AI Security Institute, Open technical problems in open-weight AI model risk management.
UK AI Security Institute, Frontier AI Trends Report.
Stanford HAI, 2026 AI Index: Research and Development.
This is Article 2 of Open-Weight Power: Models, Access, and the Emerging AI Order.
