Last Sunday left a question hanging, about who governs a thing that cannot be forked. The thing in question sits one layer beneath the code most of us now write with, and we have grown rather comfortable not looking at it too closely. This Sunday it gets looked at.
Picture an ordinary scene in a European engineering meeting. A team would like the benefit of a large language model without renting one by the token from a data centre on another continent, so it reaches for a model described as open. The weights come down over the wire, run on the team's own hardware, inside its own network, tuned on its own data, and nothing at all leaves the building. For once the compliance officer has no notes. The team now has a working model it needed nobody's permission to use, which is a genuine and rather underrated freedom.
What it has not got is the recipe. There is the finished loaf, warm and edible and entirely its own, and then there is the near-total silence about how the loaf was made. That silence is the thing the word open, stretched over a model, quietly declines to mention.
What Open Weights Leaves Closed
A set of weights is an enormous array of numbers with a licence stapled to it. The numbers are where a long process came to rest; the process is where the model actually lived, and most of it never travels with the download.
Consider what the team was never told. It does not know what the model read, which texts, under which licences, carrying which biases, gathered with whose consent, and the weights are not about to say. Then there is the matter of building it again. Even handed the data in full, the team could not reproduce the model on anything resembling its own budget. Reproducing a frontier training run is, at present, not the sort of thing attempted with a laptop and a free weekend: by one careful reckoning the amortised cost of a final run has climbed roughly two-and-a-half fold every year since 2016, which puts Gemini Ultra somewhere near a hundred and ninety million dollars and sets the dearest run of early 2027 on course for a billion. Economics has locked that door, and economics is a good deal harder to pick than any licence.
The shaping stays shut as well. The training code, and the reinforcement learning from human feedback that turns a raw predictor into something answering civilly and declining sensibly, is the model's character, and it happens to be the piece laboratories are least inclined to publish. The record of what the model was tested against, and where it quietly failed, tends not to travel either, so its failures arrive without the map to them.
To fork a system, in the sense the word carried long before machine learning, is to hold both the right and the ability to take it apart and build it anew. Here the right is occasionally granted; the ability almost never is. One can run the thing and adjust it at the edges, which is some distance from being able to remake it, and that distance is the whole of the matter.
The Fork That Isn't One
The line being drawn here is the one the previous Bow spent three Sundays on, moved up a storey. That series pulled ownership apart from openness at the licence, at the architecture, and down at the silicon; the model is simply the next floor up, and the vocabulary has grown conveniently vague on the climb. “Open weights” now does for artificial intelligence what “source-available” once did for software, lending the comforting adjective while keeping quietly back the thing the adjective was supposed to promise.
The Open Source Initiative, which has spent a quarter of a century adjudicating what the word open may sit in front of, put the matter plainly in October 2024. To count as open source, it held, a model must ship rather more than its weights: the code that trains and runs it, the parameters themselves, and, most tellingly, enough detail about the training data for a skilled person to build a substantially equivalent system. Ship the weights alone, and the definition has not been met, which is precisely what most of the models marketed as open go on to do.
The academic reading is less diplomatic. A 2024 paper in Nature, written by researchers at Cornell, the Signal Foundation and the AI Now Institute, found that the language of openness is often deployed in ways that concentrate power among a few large firms rather than loosening it, and that a model amounting to little beyond downloadable weights under pointedly un-open terms is better read as closed, scarcely anyone else being in a position to train such a thing from scratch in any case. Their word for the manoeuvre, openwashing, was not selected to flatter.
Meta's Llama is the example everyone reaches for, and its own terms make the argument unaided. The weights are there for the downloading. The licence, though, is not one the Open Source Initiative would bless: it lapses the moment a company passes seven hundred million monthly active users, at which point any continued use waits upon Meta's express and wholly discretionary permission, with an acceptable-use policy folded into the contract besides. All of which leaves the weights available, a word that has been doing a quiet amount of work lately, and some way short of open.
The European Question
It would be convenient, and mistaken, to file this under the failings of one company or one continent. The sharpest case is the friendly one. Mistral, the Paris laboratory to which Europe gestures whenever sovereignty comes up, releases its 2026 flagship models, Large 3 among them, under the Apache 2.0 licence, which is properly permissive and asks nothing whatever about your monthly active users. That is a real good, and rather more than most manage, and it still does not add up to a fork. Apache covers the numbers you were handed and says nothing of the training data, the pipeline that shaped them, the compute to run a rebuild, or the evaluations that would tell you where the thing breaks; so even the most conscientious European release leaves four doors much as it found them.
Which points somewhere slightly awkward. Sovereignty at this layer has remarkably little to do with owning a model that happens to be European. It rests on being able to inspect and carry the layer one leans on, and that turns out to be a property of information rather than of geography. A training corpus kept secret is no more legible for sitting in a rack in Frankfurt than for sitting in one in Virginia. Brussels has grasped the near end of this, if not yet the far one: the AI Act now obliges providers of general-purpose models to publish a sufficiently detailed summary of their training content, to a template the AI Office issued in July 2025, and the duty falls on open-licensed models as squarely as on closed ones. What that buys is disclosure, some way short of reproducibility, the first few inches of a very long line. The first few inches are not nothing.
The Limit
The honest position is not that open weights are a confidence trick, since they are plainly no such thing. Weights you can run on your own hardware are a real advance on an interface metered by the token: the data stays in the building, the model does not evaporate when a subscription lapses, it can be tuned to a purpose it was never sold for, and under a licence like Apache all of that proceeds without asking a soul. A team choosing local open weights over a rented endpoint has moved itself nearer to sovereignty, and pretending otherwise for the sake of a tidier definition would be a small dishonesty of its own.
Two concessions are owed. Full reproducibility is expensive and genuinely uncommon, and not only among the cynical; a laboratory acting in complete good faith may still be unable to release a training set whose rights it does not cleanly hold, or to make anyone a present of the hundred million dollars a rebuild would cost. Sovereignty here arrives by degrees rather than at the flick of a switch, and the sensible engineering question is less whether one could rebuild the thing from nothing than how far down one can actually see, and how much of what one leans on one could carry unaided. The second concession runs deeper. Even the most open model imaginable, the rare one publishing its data and its code and its full documentation besides, will not do the reading on your behalf. A coherent tree of source, the kind one team writes and tends, can at least be read to the bottom; a heap of weights, however freely licensed, cannot be read at all. Openness sets the material on the table and then leaves the understanding, every last page of it, to you.
The Point
The model comes down easily enough; the account one has to give of it does not, and neither does the source one was never shown, that being a poor thing to try to fork. You may hold the weights in both hands and still not, in any sense that pays the rent, have taken possession of them.
The licence, three Sundays ago, was the layer with the most words. The silicon was the layer with the fewest. The model is the layer with the most of both power and opacity at once, and one door remains below it. If the model writes the code, and then explains the code, and answers the questions an engineer once had to sit with alone, the thing being depended on was never quite the model.
Next Sunday: what happens to the engineer who no longer needs to understand it?