Open-Weight Model Risk: Microsoft and NVIDIA's New Guide

Open-weight AI models give enterprises something closed APIs cannot: the ability to download, inspect, fine-tune and run a model entirely inside their own environment. That flexibility also moves responsibility. On October 16, Microsoft and NVIDIA published Risk Management for Open-Weight Models in Enterprise, a joint paper meant to help security, legal and engineering teams decide how to deploy these models safely. Its central message is refreshingly practical: whether a model is open or closed does not decide its risk. The deployment does.

• What it is: the first in a planned series of joint Microsoft and NVIDIA resources, with a companion GitHub repository co-maintained by both companies
• Grounding: built on ISO standards and the NIST AI Risk Management Framework
• Taxonomy: five risk categories, Cybersecurity, Data Protection, Content, Human-AI Interaction and Bias, which Help Net Security reports break down into 30 specific risk types
• Core advice: establish provenance before behavior, then map each risk to evaluations and controls

Why Open-Weight Model Risk Is Different

The same model can carry very different risk depending on where it runs. Michael Scovetta, Partner Security Assurance Manager at Microsoft, notes that a model helping an employee draft a document is not the same as that model sitting in a customer-facing workflow, or one wired up to external data and tools. The difference with open weights is who provides the guardrails. A managed service often ships safety filtering and monitoring by default. When an enterprise hosts the model itself, those controls become its job.

The paper looks past the open or closed label to provenance, intended use, users, deployment conditions and surrounding controls. It also makes an important point for anyone building AI agents: evaluating a model alone does not establish that an agent or application is safe. Teams must also assess its permissions, data access, tools, runtime and operational controls.

What Does "Provenance Before Behavior" Mean?

An open-weight model can be modified, repackaged or redistributed before it reaches you, so safeguards its original developer built in may be missing. According to Help Net Security's reading of the paper, fine-tuning, merging or compressing a model can weaken built-in protections while leaving task performance intact. The recommended first step is to confirm, using cryptographic signing, that the file you received is the one originally published. The paper's framing is memorable: behavioral testing tells you how a model behaves, not what the artifact is. Models that arrive unsigned should have their integrity logged as an open risk.

It is the same supply-chain discipline security teams already apply to software packages, now extended to model weights.

How Should Security Teams Use the Guide?

The taxonomy is explicitly not a checklist. Microsoft and NVIDIA want enterprises to adapt it to their own systems, then connect each relevant risk to evaluations, mitigations and an accountable owner. A practical starting sequence looks like this:

• Inventory and verify: list every open-weight model in use and check signatures or hashes against the publisher's release
• Classify by deployment: note whether each model is internal or customer-facing and what tools and data it can reach
• Pick evidence: use the paper's mapping of evaluations to risks to choose tests for the risks that matter most
• Layer controls: depending on the risk, apply model changes, access controls, input and output filtering, monitoring or human review
• Revisit regularly: reassess as models are updated or deployments change

Microsoft points to tools such as Microsoft Foundry for built-in and custom evaluations, automated red teaming and content-safety controls, while advising teams to confirm feature availability and preview status for their specific model.

What Comes Next?

This first paper focuses on the model layer. Future installments are planned to extend the approach to runtime, harness and application layers, with more technical guidance on evaluation and mitigation, and the shared repository will collect additional evaluation resources, including community contributions.

For organizations running the growing wave of open-weight models, this is a welcome, practical starting point that pairs well with our prompt injection defense guide. More defensive security coverage lives in our AI security section.

Sources: Microsoft Security Blog — October 16, 2026; Help Net Security — October 19, 2026; NVIDIA on GitHub — companion repository.