Sources: the US' AI framework excludes open models and defines a covered frontier model as closed source with SOTA capabilities and national security risks (Maria Curi/Axios)

The framework draws a bright line between open and closed models. Closed models that meet a threshold of capability and risk will be subject to testing, reporting, and possibly mitigation requirements. Open models, regardless of their performance, are not covered. This division means engineers working on open-source projects can continue development without navigating the same regulatory hurdles as those building proprietary systems. The trade-off is that open models may lack the safeguards the framework aims to enforce, potentially increasing misuse risks without oversight.

Adopting the framework’s requirements will impose costs on developers of closed frontier models. These costs include building or integrating testing infrastructure, documenting model behavior, and potentially delaying deployment to comply with reporting timelines. Smaller teams or startups may struggle to absorb these costs, while larger organizations with existing compliance teams will find the transition more manageable. The framework’s effectiveness hinges on how clearly the government defines 'state-of-the-art' and 'national-security risks,' as ambiguity could lead to inconsistent application or legal challenges.

The framework’s exclusion of open models stops working where open and closed systems converge in capability. If an open model achieves performance comparable to a regulated closed model, its unregulated status could create a loophole for bad actors to exploit. Additionally, the framework does not address hybrid models or those that start closed but later release weights or code. Engineers working in these gray areas may face uncertainty about whether their work falls under the rules, complicating compliance planning.