Open Source AI vs Closed Infrastructure

In AI, “open source” is often used loosely. A system may publish code but not weights. It may release weights but not training data. It may allow research use but restrict commercial use. It may describe itself as open while using a custom licence that does not match traditional open-source software norms. For readers, the practical question is simple: can independent users inspect, run, modify, evaluate, and deploy the system without needing permission from one controlling provider?

The NTIA report on dual-use foundation models with widely available model weights frames the debate correctly: open model weights can support innovation, competition, research, transparency, and reproducibility, while also raising misuse, security, and societal risks. That dual-use framing matters. The strongest argument for openness is not romantic. It is that concentrated AI control can weaken competition, reduce independent scrutiny, and turn public capability into rented access.

Closed infrastructure is not only about secret model weights. It includes the physical and commercial systems required to build and run AI: advanced chips, data centres, cloud contracts, model-hosting platforms, API gateways, app stores, enterprise procurement channels, identity verification systems, payment rails, and security review processes. A model can be technically available while practical deployment remains dependent on infrastructure owners.

The case against unrestricted openness is strongest when models approach dual-use capability. Executive Order 14110 defined dual-use foundation models around broad training, large scale, general applicability, and possible performance on tasks that create serious security, economic, health, or safety risks. That framing moved the policy debate away from ordinary software openness and toward national security, biosecurity, cyber misuse, and strategic competition.

The national security concern is not fictional. Powerful models can lower barriers for malicious users, including in cyber operations, fraud, deception, surveillance, influence operations, and technical misuse. Open weights can be copied, modified, fine-tuned, and redistributed beyond the original provider’s control. Once released, they cannot be recalled in the same way an API can be restricted.

But the security argument also has a danger. If every advanced capability is kept behind a small group of approved providers, then national security becomes a route to centralised AI licensing by default. Public safety can become the language of market concentration. The challenge is to protect against real misuse without turning the future of AI into a closed club of state-approved infrastructure holders.

Open model weights can help smaller firms, universities, civil society groups, public-interest researchers, local governments, and independent developers build without renting every capability from a dominant provider. They can also allow outside experts to test systems, identify weaknesses, benchmark performance, and develop specialised tools for local languages, niche sectors, and underserved communities.

This competition argument matters because closed AI markets tend to compound advantage. The firms with the most users collect more feedback. The firms with the biggest cloud partnerships get more compute. The firms with the strongest distribution gain more enterprise deals. The firms with the deepest legal and compliance teams can survive regulation that smaller competitors cannot. In that environment, openness can act as a counterweight.

But open systems do not automatically solve concentration. A startup using an open model may still rent GPUs from the same cloud providers, rely on the same app stores, use the same payment processors, depend on the same chip supply, and face the same procurement barriers. Open weights can lower one wall while other walls remain standing.

The EU AI Act separates general-purpose AI obligations from high-risk use cases and adds extra duties for models with systemic risk. Its treatment of open-source general-purpose models shows the tension: regulators want to avoid crushing open development, but they also want stronger duties when powerful models could create broad harm. The result is not a simple open-good, closed-bad structure. It is a risk-tiered regime.

NIST’s AI Risk Management Framework and its generative AI profile provide another route: risk management rather than direct licensing. This approach is voluntary in the U.S. context, but it gives institutions a vocabulary for mapping, measuring, managing, and governing AI risk. For open systems, frameworks can support evaluation and transparency. For closed systems, they can pressure providers to document risks and mitigation.

The unresolved issue is enforcement. A framework can describe good practice. A law can impose obligations. A procurement contract can demand compliance. But infrastructure owners may still become de facto regulators if they control who gets cloud access, who can deploy at scale, and which models are considered safe enough for commercial use.

This map explains the core verdict. The open-source AI debate matters, but it is incomplete without the infrastructure layer. A society can release more open models and still centralise practical AI power if the cost of serious deployment is controlled by a small number of chip, cloud, and distribution companies.