# Microsoft and NVIDIA: a shared risk taxonomy for open-weight models

> Microsoft and NVIDIA argue that whether a model's weights are open says little about its risk, and offer a taxonomy to judge the rest.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Microsoft
- **Disclosed:** 2026-10-16
- **Affects:** Open-weight models
- **Research by:** Michael Scovetta, Andrew Berkley, April Chen, Michael Boone (NVIDIA), Eileen Long (NVIDIA), Arun Rao (NVIDIA)
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/
- **Page:** https://theinjection.dev/items/microsoft-nvidia-open-weight-model-risk/

Microsoft and NVIDIA published joint guidance for enterprises that deploy open-weight AI models, built on a five-category risk taxonomy that ties each risk to evaluations that measure it and controls that reduce it.

## What happened

Microsoft published Risk Management for Open-Weight Models in Enterprise on October 16, 2026, a paper written with NVIDIA and released as a PDF in a shared GitHub repository that also holds evaluations and technical resources. Michael Scovetta of Microsoft introduced the work on the Microsoft Security Blog. Andrew Berkley and April Chen of Microsoft and Michael Boone, Eileen Long and Arun Rao of NVIDIA led the paper.

## How it works

The taxonomy sorts open-weight model risk into the five categories listed below, then connects each risk to evaluations that produce evidence about it and to safeguards that can reduce it. Control coverage spans model changes, access controls, input and output filtering, monitoring and human review, with the paper concentrating on the model layer. The authors ground the structure in ISO standards and the NIST AI Risk Management Framework, and say runtime, harness and application layers are left for later work.

## Who is affected

Enterprise teams choosing, hosting or fine-tuning open-weight models are the intended readers, in particular those who self-host. Microsoft and NVIDIA state that a team which runs a model itself takes on controls a managed service would otherwise provide, so the owner of each safeguard changes with the deployment.

## What to do

Pair every risk you identify with an evaluation, a mitigation and an accountable owner, and assess the whole system rather than the model alone, including agent permissions, data access, tools and runtime. Microsoft and NVIDIA also advise checking that each control is actually available for your model and deployment, including whether it is still in preview, and revisiting the decisions whenever a model or deployment changes.

## Quick facts

- **Published:** October 16, 2026
- **Authors:** Microsoft and NVIDIA, jointly
- **Risk categories:** Cybersecurity, Data Protection, Content, Human-AI Interaction, Bias
- **Grounded in:** ISO standards and the NIST AI Risk Management Framework
- **Scope:** Model layer; runtime, harness and application layers deferred
- **Format:** PDF paper plus a public GitHub resource repository

## Sources

1. [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/)
2. [Whitepaper PDF](https://github.com/NVIDIA/OpenEnterpriseRiskManagementGuidance/blob/main/Papers/Risk%20Management%20Guidance.pdf)
3. [Resource Repository](https://github.com/NVIDIA/OpenEnterpriseRiskManagementGuidance)