Why the US Is Reviewing 'Closed' AI Models - and Letting 'Open' Ones Go Free

The U.S. AI Review Isn't About Risk

• It's About Who You Can Actually Reach Here's what's actually happening underneath the "closed vs open" language: the U.S. government just built a security review process that only works on companies it can summon to a meeting and hold accountable - not on the AI systems that are actually hardest to control once released.

The Mechanism: Reviewability, Not Danger

A "closed" AI model - OpenAI's, Anthropic's, Google's - stays on the company's own servers. The government can inspect it, delay its release or demand changes, because the company remains the single point of control even after launch.

An "open-weight" model - Meta's or China's DeepSeek - is published for anyone to download, copy and modify. Once it's out, there is no single company left to regulate; the model itself has escaped the control point. The 30-day review applies exactly where regulators can still act and skips exactly where they can't.

That is a review built around enforceability, not around which models are actually more capable of causing harm.

The India-Relevant Bet Underneath This

The declared reason for exempting open models is competitive: China's DeepSeek and Moonshot are open, so regulating U.S. open models too heavily risks ceding that entire lane to Chinese developers. But this creates an asymmetry India will have to reckon with directly.

India currently has no dedicated AI-specific statute - governance runs through general IT rules and the Digital Personal Data Protection Act, 2023. If India copies the U.S. approach and reviews only closed, India-based commercial models while leaving open-weight models - many of them foreign-built - entirely outside scrutiny, it inherits the same structural gap: real oversight only where enforcement is administratively convenient, not where actual capability risk sits.

Where the Analogy Breaks Down

It's tempting to read this as pure U.S.-China competition, but Rasser's actual criticism is sharper than that: even for the models this framework does cover, there's still no statutory backing - it's a voluntary process a future administration could simply drop.

India's own AI governance choice isn't really "closed versus open." It's whether to build enforceable, legislated review triggered by actual capability thresholds or to default - as the U.S. just has - to reviewing whichever companies happen to be reachable in a room.

For the exam, the sharper insight isn't "the U.S. is regulating AI"

• it's that a governance framework built around control points rather than risk levels will always leave exactly the hardest-to-regulate technology unregulated.