The question is usually asked as open source against proprietary, and the first useful answer is that most models described as open source are not open source. They are open weights, which is a different and considerably weaker claim.
This is not pedantry. The distinction determines what you may legally do with a model, whether you can inspect what it learned from, and whether the terms can change under you. Getting it wrong produces procurement decisions made on a property the model does not have.
Four terms, in order of strength
Open source has a definition maintained by the Open Source Initiative, which has stewarded The Open Source Definition for software since 1998. It requires, among other things, free redistribution, that the program include source code, and that derived works be permitted under the same terms.
For AI systems the OSI published The Open Source AI Definition, version 1.0, which sets out what the preferred form to make modifications to a machine learning system has to include. It names three elements: Data Information, sufficiently detailed information about the training data that a skilled person could build a substantially equivalent system; Code, the complete source used to train and run it; and Parameters, the weights and configuration.
Open weights means the parameters have been published and nothing else has. You can download and run the model. You cannot reproduce it, and you generally cannot establish what it was trained on. Under the definition above, publishing only Parameters does not make a system open source, and the great majority of models marketed as open fall into this category.
Source available means you can read something, usually inference code, under terms that restrict use. Reading is not the same as the freedoms the definition requires.
Proprietary means the model is reached as a service under a commercial agreement, with no weights published.
Why the difference has practical consequences
Three of them, and each shows up in real procurement.
Use restrictions. Several widely used open weights licences are not OSI approved because they restrict use: acceptable use policies attached to the licence, thresholds above which separate terms apply, or field of use limits. A licence that forbids certain applications is a licence your legal team needs to read, and it is not what open source means.
Provenance you cannot examine. Where training data is undisclosed, you cannot assess what the model learned from. For an organization with obligations about the provenance of the material it relies on, that is a real gap, and it is exactly the gap Data Information exists to close.
Terms that can change. Weights already downloaded under a given licence remain under it, but future versions can arrive under different terms. A strategy that assumes continuity of licensing across versions is assuming something the publisher has not promised.
How to check, rather than assume
Licence terms change often enough that any table published here would be misleading within months. The durable skill is the check.
- Read the licence at the primary source, meaning the model publisher's own repository or licence page, not a summary, an aggregator or a blog post.
- Note whether it is OSI approved. The OSI maintains the list of approved licences. A licence not on it may still be perfectly acceptable to you; it is simply not open source.
- Look for use restrictions specifically. Acceptable use policies, user or revenue thresholds, and field of use limits are the clauses that turn a permissive looking licence into a conditional one.
- Check what is published besides weights. Training code, data description, evaluation results. This is what separates the categories.
- Record the version and the date you read it, because that is what makes the decision auditable later.
None of that requires specialist knowledge. It requires ten minutes and a written note, and it is the difference between a defensible decision and a repeated assumption.
What actually differs for an enterprise
Control
Open weights let you run the model where you choose, pin a version indefinitely, and continue if the publisher loses interest. That is genuine and is the strongest argument for the category. Proprietary services can change or retire a model on their own schedule, and dedicated capacity mitigates but does not remove that.
Capability
Open weights models are entirely capable for most enterprise tasks, particularly narrow ones. For the hardest reasoning the leading commercial models generally remain ahead, though the gap moves and any specific claim about it dates quickly. Evaluate on your own tasks; a benchmark on work unlike yours has told you little.
Operational responsibility
The largest practical difference, and the one most often left out of the comparison. Running your own model means serving, capacity, availability, upgrades, evaluation and staffing. A proprietary service means paying somebody else to carry that. This is a staffing decision as much as a technical one, and it is covered in more detail in what a private LLM actually is.
Cost
Proprietary is consumption priced: small to start, growing with use. Self hosted open weights is committed capacity plus people: larger up front, flatter after. The crossover depends on volume, and a comparison that omits staff time is not a comparison.
Security
Neither category is inherently safer, and both claims are made confidently. Published weights can be examined, which is a real advantage, and they can also be studied by an attacker with the same access you have. A model obtained from an unofficial mirror is a supply chain risk regardless of its licence, which OWASP tracks as LLM03:2025 Supply Chain in its Top 10 for LLM Applications. Obtain weights from the publisher and verify them.
What actually decides the security posture is the architecture around the model, not the licence attached to it.
Where the weights came from
Downloading published weights introduces a supply chain question that a hosted service does not have, and it is straightforward to handle if it is handled at all.
Weights are large binary artifacts, frequently mirrored across community hosts and aggregators. A file obtained from an unofficial mirror may differ from what the publisher released, and the difference is not something you can inspect by reading it. The mitigations are ordinary: obtain from the publisher's own distribution, verify checksums where published, record which version and revision you deployed, and treat a model file with the same change control as any other production dependency.
The same applies to what runs the model. Serving frameworks, tokenizers and quantized conversions produced by third parties are all components entering your environment, and a quantized build from an unknown source is an executable dependency wearing a model's name.
None of this argues against open weights. It argues that self hosting adds a dependency management responsibility which is usually absorbed by the provider, and which needs an owner once it is yours.
A framing that usually helps
The decision is rarely one or the other across a whole organization. Different workloads justify different answers, and mixing them is normal rather than indecisive.
- A narrow, high volume, well defined task is where a smaller open weights model most often wins, on cost and on control.
- Open ended reasoning over varied material is where a leading commercial model most often earns its price.
- An obligation that requires processing inside your boundary removes options rather than informing a preference.
- No operational capacity to run model serving is a legitimate and sufficient reason to choose a service.
Keeping the option open is worth more than choosing correctly at the outset. An abstraction between the application and the model, and an evaluation set you can re run, make a later switch a project rather than a rebuild.
Where to go next
The arrangements a model can be deployed under are in what a private LLM actually is, and where an environment should run is on premises and cloud AI. If the goal is to use the model on your own material, what enterprise RAG is is more relevant than the licence question. And a licence that permits self hosting still leaves the question of who actually runs it, which is AI model hosting options for enterprise.
LABUSA evaluates models against the tasks an organization actually has, as part of LABUSA's enterprise AI architecture practice. Get in touch to discuss a specific comparison.
Sources and further reading
- Open Source Initiative, The Open Source Definition. The definition of the term for software.
- Open Source Initiative, The Open Source AI Definition, version 1.0. Names Data Information, Code and Parameters as the elements of the preferred form to make modifications to a machine learning system.
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications, 2025, including LLM03 Supply Chain.
Every source above was opened and read on 20 August 2026. No specific model licence is characterized on this page, because licence terms change and a claim about a named model would date faster than this page is reviewed.