Microsoft and Nvidia Name 30 Open-Weight AI Risk Types Enterprises Must Track

What happened

Why it matters

• ·Enterprises that self-host open-weight models bear direct regulatory responsibility for safety and compliance. The EU AI Act (Regulation (EU) 2024/1689) places conformity obligations on deployers. A modified model with degraded safety controls may no longer meet the requirements under which it was originally approved for use.
• ·Fine-tuning or compressing a model counts as a material change that resets the risk baseline. Without a formal re-assessment trigger in the model intake process, compliance teams may unknowingly operate a higher-risk system than was originally reviewed and approved.
• ·Gartner's 50-percent adoption projection means open-weight model governance is not a niche concern. Organizations without a model registry and provenance verification process face a growing inventory of untracked AI systems, each carrying unknown risk profiles that cannot be verified after the fact.

Governance controls affected

What to do now

• ☐Ask your AI or engineering team to list every open-weight model currently running in production or under development, including any that have been fine-tuned, compressed, or otherwise modified from their original published form.
• ☐Require that any modified open-weight model undergo a fresh risk assessment before deployment, specifically checking whether safety behaviors remain intact after the modification.
• ☐Confirm that your model intake process includes a step to verify the model file against the publisher's cryptographic signature, so you can detect whether the model was altered before you received it.
• ☐Update your AI model registry to record which models are open-weight, who modified them, when, and what testing was done after each modification.
• ☐Assign a named owner in your governance program who is responsible for triggering re-assessment when a model is fine-tuned or compressed, and document that trigger in your change management policy.

What to watch next

Gartner's 50-percent adoption projection will likely accelerate regulatory attention to open-weight model governance. The EU AI Act (Regulation (EU) 2024/1689) enforcement machinery is now active, and regulators have signaled interest in how deployers manage modified third-party models. Teams should monitor whether the EU AI Office issues specific guidance on post-modification conformity obligations for open-weight deployments. The NIST AI Risk Management Framework (AI RMF 1.0) and Playbook is also likely to see community guidance on provenance verification as adoption grows. This would give compliance teams a voluntary benchmark to reference in internal program documentation.