Microsoft and NVIDIA publish a five-category risk taxonomy for open-weight models in enterprise
Microsoft and NVIDIA say weight openness alone does not determine AI risk, in a joint paper grounded in ISO standards and NIST's AI framework. Microsoft says enterprises should adapt its taxonomy and tie each risk to evaluations, mitigations and an accountable owner.
The Watch · Security desk
Enterprises adapt the taxonomy, tying risks to evaluations and owners. Open weights give more control over evaluation. Controls may sit in inference, apps or operations. Agent and app teams also assess permissions, tools and runtime. Foundry users validate control availability.
- Who has to decide decision Enterprises Adapt the taxonomy to their systems and use cases, then tie risks to evaluations, mitigations and owners, claim 5
- What's now possible capability Enterprises with open weights Greater control over how a model is evaluated, modified and deployed, claim 9
- Who's exposed exposure Inference, apps and operations A risk may originate in the model while the most effective control sits here, claim 8
- What it limits constraint Agent and application teams Model evaluation alone does not establish safety; must also assess permissions, data access, tools, runtime, claim 14
- What's now possible capability Microsoft Foundry users Built-in and custom evaluations, automated red teaming; validate availability, including preview status, claim 12
| Who | How | Kind | Claim |
|---|---|---|---|
| Enterprises | Adapt the taxonomy to their systems and use cases, then tie risks to evaluations, mitigations and owners | decision | 5 |
| Enterprises with open weights | Greater control over how a model is evaluated, modified and deployed | capability | 9 |
| Inference, apps and operations | A risk may originate in the model while the most effective control sits here | exposure | 8 |
| Agent and application teams | Model evaluation alone does not establish safety; must also assess permissions, data access, tools, runtime | constraint | 14 |
| Microsoft Foundry users | Built-in and custom evaluations, automated red teaming; validate availability, including preview status | capability | 12 |
What happened
- The paper, Risk Management for Open-Weight Models in Enterprise, is the first in a planned series of joint Microsoft and NVIDIA resources.
- The taxonomy sorts risks into five categories: Cybersecurity, Data Protection, Content, Human-AI Interaction and Bias.
- The paper maps evaluations to a selection of risks across those categories, so a team can start from one risk and find evidence for it.
- This first paper focuses primarily on model-layer risks.
- Microsoft says a risk may originate in the model while the most effective control sits in the inference environment, the application or operational processes.
Why it matters
- Who has to decide decision Before the open-or-closed question can be answered, an enterprise has to define what the model is for and what could go wrong in that use.
- What it limits constraint A clean model evaluation covers the model only. An agent or application's permissions, data access, tools and runtime each need their own assessment.
- Who's exposed exposure Teams should check that Foundry's controls cover their model and deployment. Microsoft says to validate availability, including preview status.
Microsoft's post is guidance for teams that host model weights themselves.
The stated idea is short. The post says: "Risk depends on the model, use case, deployment, and safeguards." [3] Its example is one model used two ways. Helping an employee draft a document is a different case from running a customer-facing workflow [13].
The post still gives the open or closed label a role. It says open weights let an enterprise control more of how it evaluates, modifies and deploys a model, and it describes model access and deployment as separate choices [9]. It also says that access affects where safeguards are implemented and who is responsible for maintaining them over time [10]. In our view, the label still matters for who holds the controls, even where it says little about how risky the model is.
On owners, Microsoft describes the taxonomy as material each enterprise adapts, and distinguishes it from a policy or deployment checklist. Enterprises are meant to adapt it to their own systems, use cases and risk criteria, then connect each relevant risk to evaluations, mitigations and accountable owners [5]. The assignment of owners is left to each enterprise.
The sentence on grounding names ISO standards generally and the NIST AI Risk Management Framework [2]. It does not number the ISO documents. The evaluation tooling the post names is Foundry, Microsoft's own product, and the account throughout is Microsoft's, published on its security blog [12].
What to watch
- Whether the joint Microsoft and NVIDIA repository adds evaluations beyond the first set the paper maps.
- Whether later papers in the series cover agent and application layers, since this one focuses primarily on model-layer risks.
- Which ISO standards the paper cites by number, and how enterprises map them to accountable owners.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−5
- Incentives55
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft and NVIDIA published 'Risk Management for Open-Weight Models in Enterprise', the first in a planned series of joint resources intended to help enterprises assess model risk.
- [2]
The paper introduces a shared risk taxonomy and an approach to managing model risks grounded in established standards and frameworks, including ISO standards and the NIST AI Risk Management Framework.
- [3]
The paper reflects a core idea that weight openness alone does not determine an AI system's risk: "Risk depends on the model, use case, deployment, and safeguards."
- [4]
The initial Microsoft and NVIDIA taxonomy organizes risks into five categories: Cybersecurity, Data Protection, Content, Human-AI Interaction, and Bias.
- [5]
The taxonomy is not a policy or deployment checklist; enterprises should adapt it to their own systems, use cases and risk criteria, then connect relevant risks to evaluations, mitigations and accountable owners.
- [6]
The paper maps evaluations to a selection of risks across the five categories, giving teams a way to start with a risk that matters for their deployment and identify evaluations that can produce relevant evidence about it.
- [7]
This first paper focuses primarily on model-layer risks.
- [8]
A risk may originate in the model while the most effective control may sit in the inference environment, application, or surrounding operational processes.
- [9]
Open-weight access gives enterprises greater control over how a model is evaluated, modified, and deployed; model access and deployment are separate choices.
- [10]
Access to open weights affects how enterprises evaluate models, where they implement safeguards, and who is responsible for maintaining those safeguards over time.
- [11]
Microsoft and NVIDIA plan to use a joint repository to share additional evaluations and point to existing resources that can help enterprises assess specific risks.
- [12]
Microsoft Foundry offers built-in and custom evaluations and automated red teaming; teams should validate control availability for their model and deployment, including preview status.
- [13]
A model used to help an employee draft a document presents different considerations than the same model used in a customer-facing workflow.
- [14]
Evaluating a model alone does not establish the safety of an agent or application; teams must also assess its permissions, data access, tools, runtime, and operational controls.
- [15]
Enterprises need to understand what they are using the model for, what could go wrong in that context, and what evidence and controls they need to manage risks.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- microsoft.comManaging open-weight model risk in enterprise deployments
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Open-Weight Model PublishingFollow
- AI risk managementFollow
- Enterprise AI GovernanceFollow