Where the Weight Lies: A Balancing Act for the Governance of Open-Weight AI Models
On July 23, at the Asia-Pacific Economic Cooperation (APEC) forum’s first digital and artificial intelligence (AI) ministerial meeting, hosted by China in Chengdu, Washington and Beijing signed onto the same statement. In doing so, they joined 19 other economies in support of “open-source models and projects” that employ “strong security assurance.” That very week, American industry urged Washington against sweeping open-weight restrictions, and Beijing reportedly debated export curbs of its own. The two states most responsible for the world’s open weights are simultaneously their loudest patrons and their most plausible restrictors.
What set this off was Chinese startup Moonshot AI’s July 16 launch of Kimi K3—a new AI model that claims to close the gap with leading U.S. equivalents and even surpass them on some benchmarks. Within days, this was followed by the public release of its weights, the trained parameters of an AI model, so that others can fine-tune, adapt, or deploy it for their own projects. In response, observers have speculated that the U.S. government will adopt Entity List designations (the Commerce Department blacklist that cuts a firm off from U.S. suppliers), an executive order to make U.S. companies liable for hosting Chinese models and/or sanctions, which the Treasury secretary emphasizes are “on the table.” Over 230 U.S. tech companies and organizations, including most AI heavyweights (though Anthropic and Amazon abstained), have signed an industry letter entreating the U.S. government against such sweeping restrictions. The letter argues that open-weight distribution restrictions threaten security by granting adversaries exclusive access to cutting-edge model capabilities while denying the same to defenders and stifle innovation by locking buyers into single providers. All of this builds on a joint investigation into Chinese AI models that chairs of two House committees had launched in April.
Commentators have documented China’s open-weight surge and warn that the real contest for geopolitical influence is “not unfolding behind closed doors, but in the open-source ecosystem.” They are right about the venue for this power play, but the arguably harder question remains. Openness does not abolish power; it relocates it. Both sides propose solutions built on the same flawed premise: that power goes wherever the weight file goes. To the hawks, allowing open Chinese model weights inside the American ecosystem is akin to inviting Chinese power inside; to them, a ban keeps foreign influence out. To governments embracing open-weight models, control over a weight file is akin to independence from foreign influence.
Publishing weights moves power, but it does not deliver it wholesale to whoever downloads the weight file. The publisher may cede control over the weights, but the power they surrender gets redistributed to the rest of the AI stack: who owns the compute, hosting, standards, talent, law, and the weights need to function, and who sets the agenda under which openness is negotiated, as Beijing did in Chengdu, where it wrote the agenda and Washington signed on. These players now have more power to dictate whose systems become the default that others build on and, in doing so, grow dependent on. That is why both the U.S. and China patronize and contest open-weight models.
The supposed binary driving the debate, “closed America versus open China,” misdescribes a contest in which both capitals are trying to pull power back with tools that cannot grip a file. Those restrictive trade tools, built for chips, machine tools, and munitions, have been aimed at open technology before, and the record shows the seemingly counterproductive effects: push the file, and the influence that travels with it, beyond the restrictor’s reach. And because the file settles nothing about where power lands, the fight over it has become a fight over “digital sovereignty,” a phrase that means at least four different things to the four blocs invoking it, none of which a download alone delivers.
Moving Beyond Binaries: Chinese Open Versus U.S. Closed
Open weights are not open-source software. An open-weight model publishes its trained parameters, usually under a license of the developer’s choosing; “open-source AI” also publishes the training code and data where legally possible, which few labs do. Neither is the same thing as free and open-source software (FOSS), the code that runs most of the world’s computers. All sides of the debate blur the term, likely motivating Group of 7 digital and technology ministers to adopt their first high-level “vision for openness,” calling for “greater clarity in the use of terminology describing AI openness.” The vision stops short of a single definition. It treats openness as existing “on a spectrum” and offers a nonbinding typology that separates “Open Weights AI,” released under a license that permits use “without restrictions,” from “Weights Available AI,” released “under a license which includes restrictions on how they can be used.” That line places some of the best-known “open” models, such as Meta’s Llama, on the restricted side. Despite these distinct definitions, open technologies share a common feature that is central to this article’s thesis: They may meaningfully disrupt but also preserve concentrations of power.
Policymakers, hawks, and much of the press frame the open-weight debate as a simple binary. Open-weight models are often portrayed in a way that flatters a favored narrative: two superpowers locked in an epic technology trade war with the U.S. as champion of its closed models (e.g., Anthropic, OpenAI) versus China as the insurgent pushing for openness (e.g., Moonshot AI, DeepSeek). Even those resisting restrictions accept the frame: Industry voices insist the geopolitical question and the open-versus-closed question “have nothing to do together.”
Yet those binaries reflect neither the history nor the current reality of open technologies. The FOSS movement grew out of American academic and hacker culture, with a strong civil-libertarian streak: “Free” stands for free speech, not free beer. Many of the largest FOSS foundations—Linux, Apache, Mozilla—are U.S.-headquartered institutions; the U.S. has long led the global ranking for country-specific GitHub commits by a wide margin; Meta, Google, and Nvidia have released open-weight models of their own (Llama, Gemma, Nemotron); and President Trump’s AI Action Plan encourages open-weight AI. China’s record, meanwhile, is relatively mixed. Several of its firms have a litigated record—in software, not yet in weights—of embedding open-source code into proprietary products without honoring copyleft licenses, which require that derivative works stay open (though Chinese courts have recently begun to enforce these licenses). Scholars further contrast the FOSS movement’s ethos of freedom and transparency with China’s deployment of open source in service of surveillance and centralized control.
The binaries also obscure similarities between the superpowers’ reactions. As of July 2026, both the U.S. and China were weighing restrictive trade measures—such as export controls, sanctions, entity lists—on open technologies, including the open weights behind their most advanced AI models. Nor are proprietary models safe. China has reportedly held meetings with its leading labs over such potential curbs. In June, the U.S. briefly used export controls to suspend access to Anthropic’s Fable 5 and its restricted counterpart, Mythos 5, for any foreign national—including Anthropic’s own employees—and then lifted that order weeks later.
Admittedly, like many popular binaries, this one carries an echo of truth. The Trump administration’s register frequently favors protection and dominance; China, by contrast, is going “all in” on open-weight AI, closing performance gaps with top U.S. labs and setting de facto technical standards. A December 2025 longitudinal study by MIT and Hugging Face researchers documents “a fundamental rebalancing of economic power” toward Chinese industry. By August 2026, Alibaba’s Qwen had become the world’s most downloaded open-model family, passing Meta and Google. The state is leaning in: China’s 14th Five Year Plan (2021-2025) was the first to name open source a national priority. The 15th (2026-2030) version builds on that foundation especially through the “AI Plus” initiative, which supports open-source models, tools, datasets, and communities. Despite the seemingly asymmetrical sentiments, both capitals are drafting from the same restrictive playbook, each trying to pull back power that openness has already moved: Washington from the Chinese models that have become the world’s defaults; Beijing, apparently, to retain this position even as foreign developers develop their own open models. That playbook was written for a different technological ecosystem.
Hard Tools, Open Technologies
As the open-model debate escalates toward nationality-based restrictions, one is reminded of the refrain, apocryphally attributed to Mark Twain, that “history doesn’t repeat itself, but it often rhymes.” The proposals bandied about for weights have been aimed at open technologies before. For three decades, states have tried export controls, bans, and sanctions on FOSS—typically, to no avail. For one, analog, territorially based tools of restriction cannot contain a borderless, fluid technology. Second, even if they could, they would not achieve the geopolitical goal: Restrictions tend to strengthen the very rivals they target and erode the restrictor’s own influence.
The 1990s “crypto wars” prove the first point. Encryption was long legally designated as a “munition,” and, after 1996, it became strictly licensed as a dual-use technology under the U.S. Export Administration Regulations (EAR) to “preserve a competitive security advantage” for the U.S. It did not work because code could not be contained. Strong encryption was already circulating abroad, and foreign developers copied American work into their own products. The courts reached the same conclusion under different logic: not that code could not be contained, but that it should not be. In the celebrated First Amendment case of Bernstein v. U.S. Department of Justice, the U.S. Court of Appeals for the Ninth Circuit held that encryption source code was constitutionally protected expressive conduct and “prior restraints” on expression, such as licensing rules, are anathema to the First Amendment. The opinion was withdrawn for rehearing and the government rewrote its rules before any binding ruling issued, but the recognition stuck. The controls did not keep strong encryption at home. They left the field open to developers abroad, along with the advantage the rules were written to preserve.
Restrictions can inadvertently strengthen the institutions of the governments they target. When restricting code fails, turning to restrictions on code-hosting platforms does not reclaim power—it simply drives people to other options or to build their own. Even the U.S.-China Economic and Security Review Commission—no dove on Chinese AI—concedes that U.S. export controls are “not well suited” to the deployment-driven loop that it warns about. Open-source policy advocate Ben Brooks describes mooted U.S. bans as “pull[ing] up the drawbridge”—leaving a vacuum that China and other states will fill. A hosting ban would remove weights from U.S.-headquartered platforms like Hugging Face without removing the copies available elsewhere. It could push distribution, and the default-setting power that comes with it, onto foreign platforms.
The legacy of the crypto wars runs through domestic export control law today—an “ill-fitting framework” forced to accommodate FOSS—and its track record proves the second point. In 2019, GitHub restricted services for users in U.S.-sanctioned states including Iran and Syria, with some restrictions remaining in force. This, of course, did not erase the code from all targeted recipients, and, ultimately, its effects clearly manifested in a country that the restrictions did not target. Beijing took heed of the warning that the GitHub policies reflected: America could shut off access to a critical platform overnight. In response, China invested in Gitee, founded in 2013 and elevated in 2020 into the state-designated GitHub alternative, to minimize its dependence on foreign platforms. In doing so, a geopolitical adversary did not lose power—it amassed power. Similarly, in 2024, the Linux kernel’s leadership reportedly removed certain Russian kernel maintainers to comply with sanctions and, days later, Russia’s digital ministry announced it would “build an alternative structure” with “countries that are ready to work with us.” U.S. policy not only failed to weaken foreign powers it perceived as risks, it actually spurred their development, arguably undermined its own global influence, and gave them a reason to work together.
A drawbridge of this kind has been pulled up before, though in mirror image: Then, Washington restricted a Chinese company’s access to American software and services, whereas today’s debate is about restricting American access to Chinese-developed open weights. In May 2019, the U.S. Bureau of Industry and Security added Huawei and 68 of its non-U.S. affiliates to the Entity List. The immediate practical effect was Google’s withdrawal of Huawei’s license for Google Mobile Services—eroding Huawei’s international handset business. The Entity List did not take FOSS away from Huawei. It accelerated China’s embrace of open source for digital self-sufficiency. Huawei donated the core of its in-house HarmonyOS to the OpenAtom Foundation as the open-source project “OpenHarmony,” promoted domestically as a "national operating system." The restrictions pushed Chinese open source toward Chinese institutions, OpenAtom and Gitee among them, reducing reliance on American firms.
Restrictions can also cost the U.S. the soft power that it gains from supporting the free flow of information. In informal conversations that one co-author has had with past members of Mil-OSS—a community interested in both the U.S. military and FOSS—there was nearly zero support for avoiding “foreign” open source. Many free-speech advocates and open-source institutions view restrictions as anathema to the movement’s ethos and to long-held U.S. aims of promoting human rights through the free flow of information abroad—an instinct that runs through policy, as Treasury’s loosening of Iran internet sanctions amid the protests that followed Mahsa Amini’s death has shown. Restrictions that push developers toward foreign platforms risk surrendering that influence. American firms could lose relationships with developers, while the platforms receiving them could gain influence over what they build.
“Foreign” Open Source, “Foreign” Open Weights
Advisability of hard restrictions on foreign model weights aside, we hardly have a good rubric for what even qualifies as “foreign”—or, at least the kind of “foreign” powers these measures are aimed at. Nationality generally is an unreliable guide to where power sits after release. Within some American national security circles, recurring fears have been aired over so-called foreign FOSS, alongside calls to ban or avoid it. In June 2026, the cyber and digital policy advisor for the U.S. Mission to NATO called for “software ecosystems built upon open-source dependencies” to be “evaluated for geopolitical risk.” He cited a widely circulated report by Hunted Labs regarding “easyjson,” a popular open-source library with maintainers associated with VK, a Russian state-linked technology firm. One of us broached this topic in the 2022 Lawfare article “Should Uncle Sam Worry About ‘Foreign’ Open-Source Software?”
Determining whether a FOSS project is “Chinese” or “Russian” or “Western” is hard, conceptually and empirically. That is why venture-backed startups and Defense Advances Research Projects Agency research programs are devoted to the question. No simple designation exists for a project whose ever-shifting maintainers span multiple jurisdictions, and even linking those maintainers to a specific country is a hard data problem. This is especially true when a malicious maintainer obfuscates their identity. In the 2024 XZ Utils attack, someone using the alias “Jia Tan” spent more than two years earning maintainer rights to a compression tool found on most Linux systems, then slipped a backdoor into it—one that allows malicious actors to take control of affected systems without a password. An engineer caught it by chance; the person behind the alias remains unknown. Attributing open-weight models seems easier at first glance, but attribution will likely grow murkier when it matters: In the face of a ban, models could emerge with no provenance and no obvious association with any entity or country, or be “smuggled” through new ones. The field of model forensics is burgeoning, but it is unclear whether it could translate into practical tools for engineering teams. Nor does a model’s origin tell you who runs it: Russian developers have built on Western open weights such as Llama and Mistral, as well as on Chinese ones such as Qwen and DeepSeek. An “allow list” of approved models, the obvious workaround, only moves the problem. Someone must decide who is approved, and on what theory of nationality. These uncertainties will likely disrupt any plan to ban foreign models—and invite overbreadth in the attempt. A rule keyed to where a file came from cannot track where the power over it has gone.
The case for restriction should be examined. Export controls do not need to be airtight to work. The semiconductor controls are defended on precisely that ground: that they are leaky, yet effective, because they force costly workarounds at chokepoints where a handful of firms control the machines that make advanced chips and exactly one company—the Dutch firm ASML—sells the most advanced lithography tools. Released weights have no such chokepoint, no ASML through which every copy must pass. The chokepoint comes earlier, in the advanced chips needed to train a frontier model, and Washington already restricts those. Once weights are published, the marginal copy costs nothing, crosses borders as data, and, as Bernstein suggests, may attract First Amendment protection for Americans who republish and build on it. (The Supreme Court’s decision upholding the TikTok divest-or-ban law shows that foreign-adversary distribution can be regulated; yet it did not bless prohibitions on what Americans may possess or publish.) Serious proponents know this: They target hosting and commercial deployment—and hosting, unlike copying, typically runs through concentrated, U.S.-jurisdiction chokepoints. That is the layer whose restriction gave China Gitee. Nor would a standing liability regime necessarily stop the next Chinese release: It could put those releases beyond American platforms while penalizing American developers for touching them. The hawks’ preferred analogy is the chip controls. The reality is likely closer to the crypto wars. Foreign platforms could gain control over distribution and defaults, leaving users less dependent on American hosts and Washington with less influence.
Where Does the Power Lie?
Adopting open-weight models gives governments control over one layer of the AI stack without touching other dependencies. Whoever holds the keys to infrastructure retains power over how weights are used. Open technologies, including open weights, can mitigate power concentrations and supply chain dependencies. But openness can also help firms and states to accumulate power. States that ignore this “risk misunderstanding both their own dependencies and their own leverage.” Power lies in becoming the default, and in compatibility: Google engineers have attested that steering open development frameworks gives “substantial indirect power” over the ecosystem. FOSS can disrupt concentrations of power while leaving firms that steer its development with influence over what others build. Open weights can preserve the same influence, for states as well as firms. The question for a government building on another’s weights is who steers the development of the commonly traveled open “roads and bridges” of our digital world.
An AI system depends on a stack—compute, software, data, energy, talent, standards, and the legal regimes governing them—whose openness and control, as one of us has argued at length, come apart layer by layer. A model can be free to download while the chips it runs on are export controlled, the cloud that hosts it answers to another country’s law, and the standards it must meet are written by a closed body, whether formal government committees or exclusive industry coalitions, in which most users have no seat. The levers of influence, even if weights are made open, include development financing, chips and data centers, electricity, immigration rules that welcome or repel engineers, sway over the standards that decide what interoperates, and liability regimes that decide who answers when AI fails and so which models deployers dare use. Any of these can shift dependence more durably than the model everyone is arguing about. Governments seeking independence need to identify which of these dependencies a download changes and which remain.
If openness relocates power, the pertinent question is to whom. The debate answers it with a single word doing too much of the work: sovereignty. Nearly everyone in the open-weight race eventually reaches for “digital sovereignty,” whether to defend or to oppose restriction. But “digital sovereignty” is not one concept. As one of us has written, its meaning remains vague and contested within and across borders. It is at least four different projects using the same name—call them dominance, autonomy, control, and ownership—and the strategies built on each diverge accordingly. They divide, roughly, along an old line: sovereignty as the authority to rule, which every state already enjoys under international law, and sovereignty as the capability to act, which many do not fully have.
Washington almost never uses the term “digital sovereignty.” It assumes that it has it. Instead, its register favors dominance, while its own recent redefinition of “sovereign AI” in the stack-export program conveniently stops short of independence from American suppliers. When the word is spoken with an American tenor, it is usually for marketing. For example, Nvidia’s sovereign-AI business grew more than 300 percent in a year, and the hyperscalers now offer “sovereign clouds” for Europe that, as Stanford researchers observe, “often reconfigure, rather than eliminate, dependence on these companies.” Critics have a name for many such pitches: “sovereignty washing.”
The European Union seeks autonomy, meaning independence from those vendors, among others. But debate persists within and between member states. The European Parliament passed its technological-sovereignty resolution 471 to 68, with 71 abstaining. The French delegation splintered, and member states have spent years deadlocked over whether “sovereign” cloud requires immunity from foreign law at all.
China seeks control at home while promoting access abroad: Its Global AI Governance Action Plan calls AI “an international public good” and demands respect for “national sovereignty.” Openness can serve a government that seeks centralized control.
For much of the Global South, the aim is ownership—the difference between renting intelligence and controlling a copy of it. To many, digital sovereignty means cutting a cord of dependence that was often laid by design. Several capitals—Delhi, Abu Dhabi, Seoul—also invoke more than one definition of sovereignty in their discourse. New Delhi is backing 20 homegrown models under its IndiaAI Mission, an ownership project, while billing its 2026 AI Impact Summit as the first global AI summit “hosted in the Global South,” a bid to speak for that bloc. Abu Dhabi built its Falcon models as a free alternative to American and Chinese ones, while its flagship data center will run on Nvidia chips. Seoul wants a “sovereign AI ecosystem” and a place among “the world’s top three AI powers,” and has secured 260,000 Nvidia GPUs to get there. Each pairs the language of ownership or autonomy with an ambition to lead
Open weights can serve each of these definitions without delivering on any one of them in full. To Brussels, they offer an exit ramp from American clouds (if not yet from American chips). To Beijing, they are a global public good to invest in and a means of advancing control at home. To Washington, they are simultaneously a geostrategic asset “founded on American values” and a candidate for prohibition when they seem too “foreign.” And to governments building on a budget, they offer more control over deployment—most documented sovereign-AI initiatives build on open weights.
What matters is the baggage that follows the download. The file itself removes one dependence: A government holding the weights no longer needs the developer’s hosted service to run the model and cannot be cut off from it the way users of a hosted model can be. Whether the government ends up less dependent on any one state turns on the rest of the stack. Where it can supply the other layers itself, or source them from more than one country, the download begins to cut away at the cord of dependency. Where it cannot, the dependence stays where it was: A government that fine-tunes someone else’s weights inherits that developer’s architecture, license, and release cadence, and usually runs the result on chips and clouds it does not control. And where the weights come from one capital and the compute from the other, the download might divide the dependence between them rather than ending it.
Singapore’s SEA-LION models are built on Llama, Gemma, Qwen, and Nemotron; Saudi Arabia’s Humain-m3 is built on a MiniMax model, by a state company that has computing-capacity deals with Nvidia. Both governments gain the ability to adapt models to their own needs, but neither has truly cut the cord. Singapore’s models rest on American and Chinese developers simultaneously; Saudi Arabia builds on Chinese weights while relying on American compute. Beijing’s offer of AI as “an international public good” is default-setting power at work: A government that builds on Chinese weights takes on Chinese developers’ choices about what it can build next. The dependence, and the power it surrenders, is not eroded; it has shifted. Openness relocates power. It does not abolish it.
Conclusion
The debate will keep asking whether to restrict Chinese or American open weights, and both sides will keep assuming that power goes wherever the weight file goes. A ban would move distribution beyond American reach and weaken the influence it is meant to protect; a download leaves the stack around the file where it was. For governments building on other people’s weights, that means resilience to geopolitical flux requires reducing dependence across the stack. Keeping more than one supplier at layers that can be diversified is one way to do that. Brazil plans separate supercomputers from Huawei and Nvidia on the stated principle of not depending “on a single company, technology or country.” There is also leverage in being courted by both capitals, which governments can use to seek alternatives. Both give them more bargaining power, even as they continue to rely on foreign suppliers. Their independence depends on the choices available at each layer and the terms on which they can use them. That is a balancing act. And the first rule of balance is knowing where the weight lies.
