Open weight models: a third of the work, 4 per cent of the spend

In September 2026, Enterprise Technology Research asked 200 enterprises where their AI tokens go. Open-weight models took 34 per cent of them, up from 23 per cent a year earlier, and respondents expected 41 per cent within twelve months. Forty-two per cent already had open-weight models in production, against 31 per cent in July, with another 43 per cent running pilots. Mozilla's inaugural State of Open Source AI report, published in July 2026, found that open models carry roughly a third of real-world AI usage and capture about 4 per cent of the revenue.

A third of the work for a twenty-fifth of the money. The price is the least interesting part of that gap. An organisation that builds its operations on a model it can only call has a dependency it cannot see.

Open models match closed on coding

For three years the debate was whether open models could keep up. On most production work it is over. Mozilla's survey of more than 950 developers put the average gap to the leading closed models at 3.3 points on Chatbot Arena, with open models at or near parity in coding, instruction-following and general knowledge.

The average hides the shape of it. Closed models still hold an edge in hard reasoning, long-context retrieval and agentic tool use. The open frontier is real, though. DeepSeek V4 Pro reports 80.6 on SWE-Bench Verified and 90.1 on GPQA Diamond, both vendor-reported figures to read as directional rather than audited. Llama 4 Scout carries a 10 million token context window. OpenAI released gpt-oss in August 2025 under Apache 2.0, its first open-weight release since GPT-2, which ended the argument that open weights were a non-American curiosity.

The practical reading for an Australian buyer is narrower than the benchmark tables suggest. If your workload is classification, extraction, summarisation, retrieval, code completion or document processing, the open tier has been good enough for about a year. If it is a multi-step agent making judgement calls across a long context, the closed frontier still earns its premium. Almost nobody runs one or the other exclusively. The ETR data says so directly: 60 per cent of enterprises running open models in production have moved some work off proprietary models, and 93 per cent report their proprietary usage is still growing.

The token bill: 29 per cent of the work, 4 per cent of the spend

The token bill is easy to overstate, so it is worth being precise about what has fallen. Demirer, Fradkin and Tadelis, publishing in the Journal of Economic Perspectives in 2026, measured the quality-adjusted price of AI capability. It fell roughly a thousandfold between late 2023 and late 2025, from about $30 per million tokens to about $0.03 for the same level of intelligence. Raw token prices did not fall a thousandfold. What collapsed was the cost of buying a fixed amount of capability, because each generation did more per token and the open ecosystem put a floor under the tier below the frontier.

Production traffic shows the same thing. Vercel routes AI requests for thousands of applications. In June 2026 it reported that open-weight models were handling 29 per cent of the tokens through its gateway, up from about one-ninth two months earlier, while accounting for under 4 per cent of total spend. Self-hosted inference for open models runs somewhere between $0.17 and $1.00 per million tokens against $5 to $15 for frontier APIs, and the spread widens with volume.

The agent era is what makes this bite. A chat user asks a question and reads an answer. An agent reads files, calls tools, retries, and burns tokens the whole way. Metered pricing on a looping workload produces a cost finance cannot forecast, and it grows fastest in exactly the behaviour you want more of.

Two caveats. The saving is not free: self-hosting cost was the second-biggest obstacle to production for organisations piloting open models, cited by 50 per cent, up from 40 per cent in the previous survey. You trade a variable cost for capital, headcount and operational risk. The discount is also not automatic. Moonshot's Kimi K2.7 Code costs $0.95 per million input tokens on its own API, more per token than several proprietary models. Open weights give you the option of a low cost base. They do not hand you one.

Vendor control: the model you validated is not the model running next quarter

Vendor control survives a price war, because prices can be matched and a deprecation notice cannot be un-sent. Build on a closed API and you inherit dependencies that never appear in the contract. What you validated in March is not what runs in June. The version you tuned prompts against gets retired on the vendor's schedule. The price can move and the terms can change. The exit cost is not the API call; it is the prompts, the evaluation harness, the fine-tunes and the institutional knowledge built around one vendor's quirks.

Download the weights and three things change. You can pin the exact version, so the model that passed your validation is the model in production until you decide otherwise. You can fine-tune on your own data and keep the result, which for many organisations becomes intellectual property in its own right. And you can run it wherever the hardware exists, including on-premises and at the edge.

Mozilla's report is sharpest on a second dependency. The layer that matters most is not the model but the harness around it: the software that decides what the model can see, remember and do. Changing the harness can move performance more than changing the model. Whoever controls that layer controls how the AI behaves. If the harness is proprietary and hosted, you have outsourced the part of the system that determines outcomes.

Satya Nadella made a version of this argument in July 2026. He wrote that enterprises using AI pay for intelligence twice: once in cash, and again in the proprietary knowledge they reveal to make the intelligence useful. He runs the company selling Copilot to hundreds of millions of seats, which is what makes the point worth repeating. Do-not-train clauses are a contractual commitment. They are not a control.

Sovereignty: the CLOUD Act reaches an Australian region

For Australian organisations the sovereignty argument has a legal edge it does not have in most markets. Hosting in an Australian AWS, Azure or Google Cloud region gives you data residency. It does not give you sovereignty, because those are US companies and the US CLOUD Act can compel them to produce data they hold wherever it is stored. If the model API runs offshore, inference leaves the country as well, and the prompts carry the content.

The obligations stack up. Australian Privacy Principle 8 requires reasonable steps to ensure an overseas recipient does not breach the APPs, and section 16C keeps the disclosing organisation accountable for the recipient's breaches. Since December 2022 the maximum civil penalty for a company is the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover. APRA's CPS 234 extends information security requirements to third parties managing your information assets, and CPS 230 can treat an AI provider your critical operations depend on as a material service provider. For non-corporate Commonwealth entities, PSPF Release 2026 requires an Authorising Officer to authorise each technology system, AI tools included, before it handles government information. From 10 December 2026, the Privacy Act's transparency rule requires an APP entity's privacy policy to explain where a computer program makes or substantially contributes to decisions affecting individuals.

Australia's National AI Plan, released in December 2025, chose not to introduce a standalone AI Act and instead to uplift existing law, with a focus on high-risk uses. That choice puts the weight on the regulators and frameworks already in place, which is exactly the set above.

No government-endorsed list of sovereign AI providers exists. The Hosting Certification Framework, now with Home Affairs, paused new registrations on 3 November 2025 while it is reformed, and certifying the hosting does not certify the AI system built on top of it. Sovereignty in the full sense means running the system on hardware you own. Certified hosting plus a written commitment to Australian-only processing is the next best thing.

Open weights are the only practical foundation for that requirement. Sovereignty over a model you can reach only through someone else's API is not sovereignty. This is not a fringe position. Forty-seven countries now restrict foreign processing for critical workloads. The Open Secure AI Alliance, formed in July 2026 by NVIDIA and more than 120 companies, argues that open models and open harnesses are defensive assets to run on your own infrastructure.

What open weights cost you: guardrails, patching, provenance

None of the above is free, and the costs land in three places: guardrails, patching and provenance. When the weights land on your infrastructure, you inherit everything the hosted provider used to do: the safety stack, the abuse monitoring, the patching, the incident response. Open-weight safety alignment can be stripped. Abliteration and small fine-tunes remove refusal behaviour in minutes. Research published through the Combating Terrorism Center at West Point documents low-rank adaptation on a single graphics card, for under $200, cutting the refusal rate of a 70 billion parameter model to roughly one per cent. No vendor patch pipeline sits behind a downloaded model. You own every future vulnerability in it.

Open weight is also not open source, a distinction that gets blurred in vendor decks. You hold the finished parameters, but the training data, training code and process that produced their behaviour usually stay unpublished, so there is nothing to audit about provenance. That matters for regulated sectors that have to explain model behaviour to a regulator.

Among organisations piloting open models, incomplete security and compliance review was the leading obstacle to production at 62 per cent, up nine points. Model quality was a concern for 10 per cent. Governance is the blocker.

What to do: a portfolio, a gateway, a model inventory

Four moves, ordered by how much they cost to get wrong.

• →
  Run a portfolio, not a bet. Route high-volume, well-understood work to an open model you host or rent cheaply, and keep the closed frontier for the hardest reasoning and agentic tasks. The frontier labs recommend the split themselves, and the ETR data shows enterprises running it.
• →
  Put an abstraction layer in front of every model. An OpenAI-compatible gateway makes switching providers a base URL and a key, not a rewrite. The layer costs little to build. Without it, a provider change costs you a quarter.
• →
  Treat model artifacts like software dependencies. Pin versions, record hashes, keep an inventory of what runs where, and know which workloads would break if a provider retired a model tomorrow. If you cannot answer that in an afternoon, you have a dependency you have not measured.
• →
  Budget the operating cost, not just the GPU. The organisations getting value from open weights staffed the security review, the evaluation harness and the upgrade path before the first model went into production.

A model you can download is an asset you can keep

The open-weight argument started as a price argument and is now a structural one. A third of enterprise AI work already runs on weights somebody downloaded, for a fraction of the spend, and the capability gap that justified renting has narrowed to single digits on the benchmarks that predict production performance.

For an Australian organisation the question has changed. The test is no longer capability. It is whether you can afford to have no exit. Weights you hold are an asset you can pin, audit, tune and keep. Rent the model instead and you carry a dependency with a renewal date somebody else sets.