Defining Open Source AI: The OpenWaldo Framework
Gregory Kurtzer outlines the OpenWaldo framework, arguing that true open source AI requires open weights, artifacts, licenses, data, and origins. The discussion highlights the critical role of AI Bills of Materials in mitigating enterprise risk and ensuring accountability in agentic workflows.
The Redefinition of Open Source in AI
The current AI landscape suffers from a fundamental misalignment between marketing terminology and technical reality. Many models labeled as "open source" only release weights, ignoring the critical components of data, licensing, and origins. Gregory Kurtzer, founder of CIQ and OpenWaldo, argues that this partial transparency creates a "black box" that undermines trust and hinders enterprise adoption. The OpenWaldo framework proposes a rigorous standard: Open Weights, Open Artifacts, Open Licenses, Open Data, and Open Origins. By demanding full visibility into the training corpus and build processes, this approach restores the core tenets of open source: auditability, collaboration, and shared ownership.
Enterprise Risk and Compliance
For enterprise leaders, the lack of transparency in AI models presents a significant compliance and security risk. Without knowing what data a model was trained on, organizations cannot assess potential biases, copyright infringements, or security vulnerabilities. The introduction of an AI Bill of Materials (AI BOM) addresses this by providing a verifiable inventory of training resources. This allows companies to move from unmanageable uncertainty to a structured risk assessment. Just as Software Bills of Materials (SBOMs) are now standard for software supply chain security, AI BOMs are becoming essential for governing AI deployments in regulated industries.
Accountability in Agentic Workflows
As AI agents become more autonomous, the question of responsibility becomes critical. Legal frameworks like the Computer Fraud and Abuse Act do not recognize AI as a liable entity. Therefore, human accountability must be explicitly assigned to agentic actions. Data from recent benchmarks shows that agentic pull requests merge at a much lower rate than human-written code, often because they lack a human owner to advocate for their integration. This highlights a operational gap: while AI can generate code, it cannot navigate the social and political dynamics of code review. Leaders must establish clear protocols for human oversight to ensure that AI-generated work is vetted, owned, and aligned with business goals.
Strategic Implications
The shift toward fully transparent AI models creates new opportunities for community-driven innovation. By opening up the entire stack, organizations can leverage diverse talent pools to improve model performance and security. For businesses, adopting frameworks like OpenWaldo is not just a technical choice but a strategic move to build trust with customers and regulators. The future of AI adoption depends on moving beyond opaque weights to a fully open, auditable, and accountable ecosystem.
Key insights
-
Current "open source" AI models often only release weights, failing to meet the true definition of open source which requires access to data, licenses, and origins. This partial transparency prevents proper auditing and community collaboration.
Impact: Enterprises face higher risk when adopting models that lack full transparency, as they cannot verify training data or licensing compliance.
-
The AI Bill of Materials (AI BOM) serves as a critical tool for risk management, allowing organizations to inventory and audit the training data and processes used to build AI models.
Impact: Implementing AI BOMs transforms unmanageable black-box risks into auditable compliance items, facilitating safer enterprise adoption.
-
AI systems cannot bear legal or ethical responsibility, making human accountability essential for all agentic actions. Legal frameworks do not provide carve-outs for AI liability.
Impact: Organizations must assign clear human ownership to AI actions to avoid legal liability and ensure compliance with existing laws.
-
Agentic pull requests have significantly lower merge rates than human-written code, primarily due to the lack of human advocacy and ownership in the review process.
Impact: Without human oversight, AI-generated code may stagnate in review queues, reducing the efficiency gains expected from agentic workflows.
-
Open source communities thrive on diversity of skills, including non-technical contributions such as marketing, documentation, and community management. This inclusivity accelerates project growth and sustainability.
Impact: Leveraging diverse talent pools in open source projects reduces dependency on single maintainers and fosters more robust, scalable ecosystems.
Action items
-
Audit current AI model deployments to identify gaps in transparency, specifically checking for the availability of training data, licenses, and build processes.
Impact: Identifying transparency gaps allows organizations to prioritize models that meet higher standards of open source compliance, reducing risk.
-
Develop and implement an AI Bill of Materials (AI BOM) process to document and verify the training data and processes for all AI models used in production.
Impact: An AI BOM provides a verifiable record of model origins, enabling better risk assessment and compliance with regulatory requirements.
-
Establish clear protocols for human accountability in agentic workflows, ensuring that every AI-generated action has a designated human owner responsible for its outcomes.
Impact: Assigning human ownership to AI actions ensures legal compliance and improves the quality and adoption of AI-generated work.
-
Enhance code review processes for agentic pull requests by requiring human advocacy and detailed review, rather than relying solely on automated checks.
Impact: Human advocacy for AI-generated code increases merge rates and ensures that AI contributions are aligned with business goals and quality standards.
-
Foster a diverse open source community by actively recruiting contributors with non-technical skills, such as marketing, documentation, and community management.
Impact: Diverse communities drive faster innovation and more sustainable project growth, reducing the risk of burnout and dependency on single maintainers.
Quotes
“The source is whatever is required to create a particular artifact.”
“I don't think an AI can be responsible, which means I don't think the AI should be alone making these decisions.”
“If you have an AI bill of materials that is signed with your weights that you're downloading, and you can go and validate everything in that corpus, everything that that model was trained on.”