Openness Solved Access. It Did Not Solve Trust.

The centre of gravity in language-model usage has moved faster than the conversation about it. We are still debating who wins at the frontier, while most of the actual production workload has already gone somewhere else.

The figures are public. In its own report, “State of Open Source on Hugging Face: Spring 2026,” Hugging Face states that over the past year models of Chinese origin accounted for forty-one per cent of downloads — a larger share than any other country's. An independent measurement points the same way from a different angle: the ATOM Report puts cumulative downloads of Chinese-developed models at 1.15 billion by March 2026, against 723 million for the United States and 163 million for the European Union, and finds that Chinese models reached 72.7 per cent of open-model tokens on the router OpenRouter by January 2026. Estimates of the overall OpenRouter share vary with methodology — roughly forty-six to sixty-one per cent — but every measure points the same way.

This is not a story about geopolitics. It is a story about deployment mode. What that looks like in practice is visible in Uganda's Sunflower service: agricultural and weather advice in thirty-one of the country's languages, built on the open Qwen 3 model — chosen for cost, for handling local languages, and for the ability to fine-tune on the developers' own data.

What actually changed

A closed model behind an API is a service. It has a provider, a contract, terms of use, and a party you can put a question to. Open weights are not a service; they are an artefact. You download it, fine-tune it on your own data, run it on your own hardware — and from that moment there is no provider inside your perimeter at all.

For an institution that needs independence from someone else's cloud, this is an enormous gain. You get deployment sovereignty: data stays inside, cost is predictable, availability does not depend on another party's commercial or sanctions decisions.

But when the provider disappears, so does something the provider supplied incidentally — a party accountable for origin. You own the weights. You do not own their history. What the model was trained on, what was built into it, how it behaves at the edges: all of that stayed with whoever made it, and that maker is not a party to your obligations.

Openness solved access. It did not solve trust — it transferred trust to the deployer, who had not prepared for it.

Provenance is a property of the deployment, not of the model

From this follows the point that is easy to miss.

Almost all existing trust infrastructure for generated content assumes that the model provider participates: signs the output, publishes a model card, embeds a marker, declares training-data composition. That works as long as a provider exists and sits within reach of your regulator.

In a local open-weight deployment there is nobody to sign. The model's author does not know your instance exists, does not see your prompts, and owes nothing to your supervisory authority. A mechanism that requires the author's cooperation simply does not start in this mode.

So the evidence of origin has to be produced where the output arises — on the deployer's side, without the model author's participation, and irrespective of whose model it is. Provenance is not a certificate that ships with the weights file. It is a property of your deployment that you either can produce or cannot.

The asymmetry worth naming

Now the uncomfortable part. Whoever needs evidence of origin most has the least leverage to demand it.

A large corporation can buy a closed model with contractual warranties, legal indemnity and audit access. A ministry in a small state, a university, a public hospital, a municipal administration cannot. They take what is free to download and runs on the hardware they already have. And they are precisely the ones operating in settings where explaining the origin of a conclusion is not a preference but a duty: decisions about people, public money, medical data, educational assessment.

A precision is needed here: almost nowhere outside the European Union has that duty yet been framed as a requirement about the origin of an output specifically. Kenya's draft artificial-intelligence policy requires disclosure when a person is interacting with a system, and requires explainability and auditability; a rule obliging anyone to document the provenance of generated material exists neither there nor elsewhere in the region. This is not an existing requirement, then, but a gap that will be filled over the coming years — and filled in countries where open weights are already the default way to deploy.

The result is a structure in which the duty to explain will most likely fall on those least equipped to discharge it. If the evidentiary layer costs as much as an enterprise contract, or requires the model author's cooperation, it reproduces the very barrier that open weights had just removed. The barrier has simply moved from access to the model to access to trust.

The requirement here is therefore not abstract. Such a layer has to be model-agnostic, able to run locally, and cheap to deploy — not as good engineering practice, but because otherwise it never reaches the people it exists for.

A continuation, not a new story

I have argued before that a connector needs a measure, not an adapter: interoperability decides whether systems can exchange data, not whether they should be trusted. Open weights are the same story one level down. They settled the question of access to capability. They did not settle — and were never designed to settle — the question of what substantiates the origin of what that capability produces.

This is not an argument against open models. It is an argument that something has to sit beside them which does not belong to them. Evidence of origin cannot depend on the party whose origin it attests.