Open vs. closed AI models

Any steady piece of AI work can be bought two ways. Send every request to a lab’s API and pay per call, or download a model file, run it on machines the company controls, and pay for the machines. The second is what people usually mean by “open-source AI”. The phrase covers several different things at once, and what is actually published is a file of numbers.

What is open when a model is open

Training leaves behind a very large set of numbers: the connection strengths inside the network, holding everything the model picked up from the text it was shown. Nothing else in the model is doing the work. The numbers are the model. Save them and you have a file, tens or hundreds of gigabytes of it, that runs on any machine big enough to hold it.

Publishing that file is what open weights means. It is a decision about distribution. It says nothing about how the file was built.

Open is a spectrum

Fully open. Weights public, training data described or released, training code public. Anyone can run it, change it, and in principle build it again from scratch. Very few significant models clear this bar.

Open weights. The file is downloadable. It can run on hardware the company controls, be fine-tuned on private material, be embedded in a product, be passed on within the licence terms. Rebuilding it from scratch is usually impossible: the training data and most of the training code stay private.

Closed. The model stays on the lab’s machines. Access is through an API or a product. The file never leaves.

So “open-source AI is catching the closed labs” is almost always a claim about open weights, not about open source in the sense software people mean. An open-weights model is runnable. It is generally not auditable in how it was trained, and not reproducible.

The licence matters as much as the download. Some files ship under ordinary permissive software licences that ask for attribution and nothing else. Others carry the lab’s own terms: acceptable-use rules, naming requirements, size thresholds above which a separate agreement is needed. Both get called open. Only one behaves like open source in a contract review.

What each side trades in

Closed. Nothing to buy up front, and the bill runs per call, priced by the token, the small chunk of text a model reads and writes in. The lab owns the machines and retires older versions on its own schedule, so a newer model arrives whether or not the team wanted it that week. That is its own thing to manage in production. Every input travels to the lab’s servers. Business plans normally commit that inputs are not used for training and are not kept long, though the terms differ by lab and by tier. Changes are limited to what the API exposes: system instructions, prompts, sometimes a light layer of fine-tuning.

Open weights. The model runs on machines the company controls and inputs never leave them. The file can be fine-tuned on private material, shrunk to run cheaper, or wrapped in whatever checks the business wants. No vendor sits in the path, so there is no price rise to absorb and no policy change to swallow mid-deployment. What the company takes on is running it. The specialised chips are paid for whether or not anything is going through them, and capacity gets sized for the busiest hour rather than the average one. Somebody owns the decision to move to a newer file, and somebody is on call when it stops answering at 2am. Nothing updates until a person deploys the new version. Over a week that reads as stability. Over a year it reads as falling behind what the labs have shipped since. This is the sharpest case of build versus buy in the landscape, and the one version of building whose bill stops tracking usage: the machines cost the same every month whatever the load. Building on a lab’s API is the opposite shape, a bill that grows with every request.

The middle option

Between the two sits a third shape, and it is where a lot of regulated businesses end up. The large cloud platforms carry open-weight models alongside closed ones and serve them two ways.

Shared: the platform hosts the model for all its customers and bills per token, much like a lab’s API. What changes is the surrounding paperwork, because the billing relationship, the compliance certifications and the network are the cloud account the company already runs on.

Reserved: the model runs on capacity held for one customer, reachable only from inside that company’s own network, billed for the time the capacity exists rather than per call. Some platforms will also take a weights file the company brings itself and serve it the same way.

Reserved capacity takes most of the operating burden off the business and keeps inputs inside a boundary it already governs. In exchange the hourly bill runs whether the queue is busy or not, and the choice of model narrows to what that platform carries. Where rules dictate which country the data sits in, this is often what ends up in production.

Where the money crosses over

The two cost shapes differ in kind, not degree, which is why “which is cheaper” has no general answer.

Per-call pricing starts at zero and grows with use. It suits work that is bursty, varied, or still being worked out, and stays cheap while volume is low. Reserved capacity, whether the company’s own chips or a held slot on a platform, is a fixed monthly figure that does not care how busy it is. It pays back only when the work is steady enough to keep it full.

The crossover between the two lands much further out than people expect.

Example

Let’s say a support queue reads each ticket, tags it, routes it and drafts the first reply: a page of text in, a paragraph out. On a mid-tier hosted model that costs a fraction of a cent per ticket. One always-on machine with the chips to serve a large open-weight model costs four figures a month whether it handles one ticket or a million. Divide the second by the first and the queue has to run into the millions of tickets a month before owning the machine is the cheaper way to buy the same work.

Token prices keep falling, which pushes that line further out rather than nearer. Real support queues sit well short of it, by a factor of ten or more. Tens of thousands of tickets a month is a per-call bill in the tens of dollars, and no machine of your own competes with that. What sends a queue like that onto the company’s own machines is not the money. It is where the inputs are allowed to sit, what the licence permits, and whether an outside vendor may be in the path at all. A sales team drafting a few dozen emails a week is shorter still, and money is not the argument there either.

Where the capability difference sits now

Leading open-weight models sit alongside the strongest closed models on general capability rankings, and the order changes several times a year in both directions. Any specific ranking is a snapshot, not a fact about the two categories.

The direction is clearer than the table. For everyday business text work, drafting, summarising, extraction, classification, structured output, the choice stopped being about quality some time ago. What is left sits at the harder end: long multi-step work where a model has to hold a plan together across many moves, and the strongest multimodal work. Closed models have tended to hold an edge there, and it has narrowed with each release cycle rather than widened. Read it as workload-specific and moving, not as a fixed gap between two camps.

Who publishes the strongest open weights

Mostly Chinese labs. DeepSeek and Alibaba’s Qwen are the two a business is likeliest to meet by name, and several others publish at the same level. Western labs still release open weights, OpenAI, Google, Meta, Mistral and Nvidia among them, but the top of the open-weight rankings has not been theirs for a while. The model families chapter has the wider cast.

Running a downloaded file on the company’s own systems sends nothing back to the lab that made it, wherever that lab sits. The restrictions that have appeared so far, mostly bans on government devices in several countries, target the hosted app and API, where inputs do travel to the lab’s servers. Same brand name, two different data paths, and the two get run together by mistake all the time.

What no file comes with is an account of what it was trained on, or of how it behaves on subjects its makers are sensitive about. That is equally true of a closed model. The difference is that a downloaded file can be tested directly and at length on the company’s own material, where a hosted one can only be observed from outside. And some procurement policies and customer contracts name permitted vendors or countries of origin, in which case the file’s origin is a contractual fact and not only a technical one.

What the rules say

Europe’s AI Act treats models published under a genuinely free and open licence more lightly. Whoever publishes one is relieved of some documentation duties: the technical file kept for regulators, the pack handed to downstream builders, the requirement to appoint a representative inside the EU. They are not relieved of holding a copyright policy or of publishing a summary of what the model was trained on. Models judged to carry systemic risk, decided on the sheer scale of the training run, get no relief at all. A company that fine-tunes somebody else’s published model takes on the publisher’s obligations only if it does so at a scale approaching the original training, which almost no business does. These obligations are now enforceable. Rules elsewhere differ, and this is the part of the picture most likely to move.

The mixed picture in practice

Most operations that use both end up mixed. Closed for work that genuinely benefits from the best available model: research, hard drafting, exploratory product work. Open weights, self-hosted or on reserved platform capacity, for work where running it yourself pays: high-volume classification or extraction, anything inside a regulated boundary, internal tools where the data path matters more than the last few percent of quality.

A team that has run both learns which side a job belongs on faster than any comparison table would tell it. That judgement is mostly not about which model is smarter. It is about where the data may sit, what the licence permits, which cost shape fits the volume, and who picks up the phone when it stops answering.