- Microsoft and NVIDIA published joint guidance for managing enterprise risks in open-weight models, aligned with ISO standards and NIST’s AI Risk Management Framework.
- Model openness alone does not determine risk; the use case, deployment, users, and safeguards matter.
- The guidance groups risks into five areas—cybersecurity, data protection, content, human-AI interaction, and bias—and links them to evaluations that can provide risk evidence.
- Enterprises must assign and maintain safeguards across the model and deployment; future resources will expand guidance to runtime and application layers.
Make Risk Part of the Workday
Open-weight models offer choice. Teams can inspect, adapt, and run them in their own environments. That control can help meet business needs, but it also adds operational duties.
The model’s label tells us little on its own. Context matters. A tool that drafts internal notes carries different risks from one that serves customers or uses company data. So IT and security teams should ask practical questions: What can the model access? Who will rely on its answers? What could fail?
A shared risk map can help teams discuss cybersecurity, data protection, harmful content, human interaction, and bias in plain terms. Then they can test the risks that matter for each use. No single evaluation proves a system safe. Teams need evidence, clear owners, and ongoing checks.
Control Must Keep Pace with Change
Open weights do not automatically mean weaker security. However, when an enterprise runs its own deployment, its staff may need to provide safeguards that a managed service would otherwise handle. Controls might include access limits, input and output checks, monitoring, and human review.
Just as important, teams must assess the full system—not only the model. Applications, connected tools, data access, and runtime permissions can change the risk. A model update or new business use can change it again.
This approach takes work, yet it fits familiar IT practice: test before release, assign responsibility, monitor in production, and review after change. As open-weight models spread, that discipline can make adoption more practical—and strengthen the wider cybersecurity journey.
Expand Your Tech Knowledge
Advance your expertise through insights in Careers & Learning for cybersecurity professionals.
Discover archived knowledge and digital history on the Internet Archive.
Expert Insights Multi
