Start a trial

Operational notes Observatory

If the rules on open models change, what happens to the one you have already installed?

6 min read

Industrial workshop shelving holding metal press dies arranged on racks marked with letters and numbers, in black and white
Dies stay in the workshop even when whoever built them no longer makes them: continuity depends on what you hold in-house and on how you catalogued it.

On 24 July 2026 twenty-five companies and organisations signed the open letter “Open Weights and American AI Leadership”: signatories include NVIDIA, Microsoft, Meta, IBM, Dell Technologies, Palantir, Mistral, Hugging Face, Mozilla, CrowdStrike and the Linux Foundation. OpenAI, Anthropic and Google are not on the list.

It is worth being precise, because the difference is substantive: it is not a comment filed in a consultation, it does not respond to a proposed rule, it does not challenge any act. It is a public letter addressed to “policymakers”, hosted on the website of one of the signatories. The ask is one: keep “the frontier plural by avoiding premature restrictions on open models that stifle competition or drive innovation overseas”.

The context is hotter than the document. According to Lawfare, on that same 24 July the director of the Office of Science and Technology Policy, Michael Kratsios, wrote on X that Moonshot AI had “developed a sophisticated internal platform to conduct large scale distillation against U.S. models”, and Treasury Secretary Scott Bessent that “sanctions and Entity List designations will be on the table”. Statements on a social platform, not acts: as at 27 July no measure has been published and no consultation opened.

Both positions, as written

Those who fear restrictions argue on four points, in the letter’s order: access, economic sustainability (the right model for the right job, not the frontier model for everything), competition, and control for adopters, who do not want to “become locked into a single provider”. On risk the text does not look away: “Once released, the weights are beyond the original developer’s control, and modified versions are difficult to trace or reverse”. The proposed answer is not prohibition, but giving defenders models of capability comparable to the attackers’.

Those proposing restrictions have fewer public documents, and that should be said. The most reasoned position comes not from a company but from the UK AI Security Institute, which writes the same sentence from the opposite angle — “Once a system is released with open weights, it cannot be rolled back” — and observes that defences added through fine-tuning “can be easily undone using just dozens of training examples”. Among its risk-management options the institute lists the most drastic one too: not deploying high-risk systems with open weights. On 17 July 2026 it measured the stakes: on cyber capabilities recent open models sit “4 to 7 months” behind frontier closed models, against 6-10 months through most of 2025.

On the US legislative side the most advanced instrument remains the No Adversarial AI Act (S. 2177), introduced on 25 June 2025 by Senator Rick Scott with one Democratic co-sponsor and still at first stage: it would bar federal agencies from acquiring or using AI developed by foreign adversary entities. Press accounts report pressure from frontier labs for a broader ban, but with unnamed sources: we do not treat those as facts. And no public position from OpenAI, Anthropic or Google favouring restrictions on open weights as such.

The asymmetry that concerns you

For anyone who has already installed an open model the question is not who is right. It is: what happens to the one running inside our infrastructure?

A weights file copied inside your perimeter has no remote switch. If the provider changes strategy, if a repository removes it, if a government limits its distribution, the copy you hold keeps working as it did yesterday. A service reached through a remote interface can instead stop or change behaviour without your consent and without usable notice.

The precedent is recent. On 31 October 2025 Google announced it was pulling Gemma from AI Studio, hours after a letter from Senator Marsha Blackburn to Sundar Pichai; as Ars Technica reported, “the models are available for download if you want to develop with them locally”. The public surface vanished in one evening. The weights already downloaded did not. It is the same irreversibility that worries the British institute, seen by whoever must keep a service running.

It is worth understanding what the named instruments do. An Entity List designation acts on exports, re-exports and transfers to the listed party: it limits what can be sent to them, it does not order the deletion of copies already distributed. A procurement ban binds the buyer. These are levers on future flows, not on existing archives. Your risk is called supply, not seizure, and it is managed in advance.

The other side: weights do not age, everything else does

Stopping here would be dishonest. A frozen model does not improve: no new checkpoints, no corrections to unwanted behaviour, no adaptation to new formats and languages. And if the gap between open and closed is measured in months, the one between your copy and the state of the art two years from now will be measured differently.

The security fixes that matter are almost never in the weights: they are in the engine that runs them. CVE-2025-32444 affects vLLM, CVSS score 9.8, remote code execution on installations with the Mooncake integration, through pickle deserialisation over unsecured ZeroMQ sockets; fixed in 0.8.5. Freezing the environment so nothing breaks also freezes its defects. And an archive of weights alone, without the environment that runs them, is in two years a block of numbers nobody knows how to restart.

What to archive today

  • The weights with a cryptographic digest of every file and the exact reference of the revision you took them from. “Latest version” is not a reference.
  • Alongside the weights: tokeniser, configurations, chat template, model card and the licence text as it stood on the day of download.
  • The environment, not just the binary image: the recipe to rebuild it — engine, driver and library versions, launch parameters, quantisation.
  • Your own evaluation set: real prompts, real documents, expected answers. It is the only proof that a replacement does the same job.
  • A second candidate from another jurisdiction, already downloaded and already tested. Weights ending up inside export controls is not a textbook hypothesis.
  • In the contract or tender: delivery of the artefacts on media, and the right to keep them beyond expiry. A limit that is not written does not exist.

Continuity is not a property of the model but of the infrastructure it runs in. Our technical set-up offers two modes: on-premise in the client’s own environment, or a dedicated cloud reserved for the single client, with a dedicated VPN, data centre resident in Italy and premises staffed directly by us. In both, weights, artefacts and environment stay where you can inventory them, and a change of rules elsewhere becomes a procurement decision, not a production stoppage.

An open model in production and no inventory of what it takes to stand it up elsewhere? Half an hour with one of our specialists: we rebuild the list of artefacts to archive and the replacement plan.

Sources