Microsoft and NVIDIA Publish a Risk Guide for Open-Weight Models in Enterprise

Microsoft and NVIDIA have published a joint paper to help companies manage the risks of open-weight AI models, the kind whose weights anyone can download, inspect and run. Its central argument is that whether a model’s weights are open does not, on its own, decide how risky it is. The paper is the first of a planned series.

What was published

In a Microsoft Security Blog post on 16 October, Microsoft said: “Today, Microsoft and NVIDIA are publishing Risk Management for Open-Weight Models in Enterprise, the first in a planned series of joint resources”. The paper is hosted in a joint GitHub repository.

According to Microsoft, the paper “introduces a shared risk taxonomy and an approach to managing model risks grounded in established standards and frameworks, including International Organization for Standardization (ISO) standards and the National Institute of Standards and Technology (NIST) AI Risk Management Framework.” Microsoft names Andrew Berkley and April Chen of Microsoft, and Michael Boone, Eileen Long and Arun Rao of NVIDIA, as the people who led its development and editing.

The core idea

“Weight openness alone does not determine an AI system’s risk,” the blog says. “Risk depends on the model, use case, deployment, and safeguards.” It gives an example: the same model helping an employee draft a document raises different issues from that model running a customer-facing workflow. A standalone model endpoint is also different from one connected to external data or tools.

The paper’s taxonomy sorts risks into five broad categories: “Cybersecurity, Data Protection, Content, Human-AI Interaction, and Bias.” Microsoft stresses that “it is not a policy or deployment checklist”. Instead, companies are expected to adapt it to their own systems and link each risk to evaluations, mitigations and an accountable owner. The paper maps evaluations to a selection of risks in each category, so teams can start from a risk that matters to them and find tests that produce evidence about it.

What it does not cover yet

Microsoft is clear about the limits. “This first paper focuses primarily on model-layer risks. Evaluating a model alone does not establish the safety of an agent or application,” the blog says. Teams also need to assess an agent’s permissions, data access, tools, runtime and operational controls. Future papers are meant to extend the approach “across the runtime, harness, and application layers”. The joint repository will collect more evaluations, including contributions from the wider community.

The blog also notes a practical shift in responsibility: “enterprises that operate their own model deployments may take on controls otherwise provided by a managed service.” Open-weight models can also be used through managed platforms, so who maintains which safeguards depends on how a model is deployed.

Microsoft’s product pitch

The blog also promotes Microsoft’s own tools. It says Microsoft Foundry “helps enterprises assess quality, groundedness, and safety with built-in and custom evaluations and automated red teaming”, and offers configurable content-safety controls. That is Microsoft’s description of its product, not a finding of the joint paper. Microsoft itself advises teams to check which controls are available for their model and deployment, including preview status, and to combine them with their own testing, monitoring and human oversight.

Why it matters

Open-weight models are increasingly part of company AI plans, with recent releases such as NVIDIA’s Nemotron 3.5 Super VL and Meta’s Muse Spark Open. A shared vocabulary from two big suppliers could shape how companies’ security, legal and engineering teams discuss these models. But the paper is guidance from vendors, not a standard or a regulation.

What this means

• Microsoft and NVIDIA argue that the risk of an open-weight model depends on how and where it is used, not just on whether its weights are public.
• The first paper covers the model layer only. Agent, runtime and application risks are left for later papers.
• Companies that run open models themselves may take on safeguards that a managed service would otherwise provide.

Sources

• Microsoft Security Blog: Managing open-weight model risk in enterprise deployments
• Microsoft and NVIDIA: Risk Management for Open-Weight Models in Enterprise (PDF, GitHub)
• NVIDIA/OpenEnterpriseRiskManagementGuidance repository (GitHub)

Related stories

• NVIDIA Releases Nemotron 3.5 Super VL, an Open 120B Multimodal MoE for Agents
• Meta Releases the Weights for Muse Spark Open, and Apple Shows It Running Across Two to Four Mac Studios
• Microsoft AI Finishes Pre-Training MAI-Base-2, a 2.8-Trillion-Parameter Model, and Starts Preparing MAI-Base-3
• ServiceNow Announces AI Passport to Limit What AI Agents and MCP Servers May Do at Runtime