Open-Weight AI Fell to 11%. Rewrite Your Model Portfolio.

Enterprise open-source AI usage dropped from 19% to 11% in a single year, according to Menlo Ventures' State of Generative AI in the Enterprise. The models got better. The portfolios didn't.

Open-weight models now match proprietary ones on most coding and reasoning benchmarks. Yet enterprise adoption collapsed. The problem is not performance. It is the two layers that sit beneath performance: total cost of ownership and runtime governance.

If your organization built its AI model portfolio in Q1, the assumptions behind it have changed. The market moved. The frameworks caught up. The decision layer you need exists now. This piece updates the model portfolio strategy we published in April with the three decision tools that shipped since: Forrester's Model Openness Framework for scoring, the OECD's break-even math for cost, and Gartner's TRiSM architecture for governance.

In this article:

• What Changed Since the Original Portfolio Framework
• The TCO Break-Even That Most Enterprises Get Wrong
• Score Every Model Before You Deploy It
• Governance Is the Missing Layer
• The Model Portfolio Decision Tree
• FAQ

What Changed Since the Original Portfolio Framework

In April I published Why Enterprise AI Programs Stall Without a Model Portfolio Strategy. The argument was structural: enterprises running a single model vendor carry concentration risk, and those running several without a model portfolio discipline waste compute and create governance blind spots. A model portfolio, at its core, is a managed inventory of every AI model in your organization, scored and governed like any other technology asset.

Three months later, the data says the argument was right but incomplete. The model portfolio concept holds. What broke was the assumption that enterprises could navigate the open-weight-vs-proprietary decision on instinct. They cannot. The decision requires three inputs that did not exist in April: a standardized scoring framework, a quantified cost model, and a runtime governance architecture.

Menlo Ventures tracked the shift: open-source models' share of enterprise LLM usage fell from 19% in 2024 to 11% in 2025. The report pins most of the decline on Llama's stagnation, but the pattern is broader. Open-weight models improved. Enterprises still pulled back.

At the same time, McKinsey QuantumBlack found that 40% of enterprise leaders still prefer models they can self-host for privacy and security control. The demand is there. The execution is not.

What changed between April and now: three frameworks shipped that close the execution problem. Forrester published an openness scoring model. The OECD quantified the self-hosting break-even curve. Gartner formalized the runtime governance stack. Together, they give you the decision layer the original portfolio framework was missing.

The TCO Break-Even That Most Enterprises Get Wrong

The first question in any build-vs-buy decision is cost. For open-weight AI, cost means GPU infrastructure against API pricing. And the math depends almost entirely on one variable: how many tokens you process per month.

The OECD's Benefits of AI Openness report published the break-even analysis that most vendor pitches leave out:

At 1 billion tokens a month, self-hosting takes two and a half years to pay for itself. At 10 billion, two months. That 15x difference in break-even time is why "open-weight is cheaper" fails as a blanket statement. It is cheaper for high-volume production workloads. It is more expensive for everything else.

Consider a concrete example. An enterprise runs three workloads: a customer support chatbot at 200M tokens per month, an internal document summarizer at 3B tokens per month, and a code generation pipeline at 12B tokens per month. The chatbot should stay on a proprietary API. It will never break even on self-hosted infrastructure, and the vendor handles compliance and monitoring. The document summarizer sits in the uncertain middle zone: it could break even in roughly 10 months, but only if the team maintains GPU utilization above 80%. The code generation pipeline is the clear self-hosting candidate. At 12B tokens per month, it breaks even in under two months, and the data sovereignty requirements for proprietary code make API access a compliance risk.

Three workloads, three different answers. A model portfolio strategy that treats them all the same is a model portfolio strategy that overallocates capital on at least two of the three. The token-volume audit surfaces this kind of mismatch in days. Without it, the mismatch surfaces in quarterly budget reviews, when it is already too expensive to reverse.

If your portfolio strategy does not start with a token-volume audit across every use case, you are building your cost model on assumptions. The audit itself is straightforward: tag every production workload by use case, measure actual token consumption for 30 days, and map each workload onto the OECD table. The result tells you which workloads justify self-hosting and which should stay on APIs. Without this step, the "open-weight is cheaper" claim is a hunch, not a strategy.

For the full open-weight adoption analysis, see Open-Weight Models Caught Up. Adoption Fell to 11%.

Score Every Model Before You Deploy It

Cost alone does not determine whether a model belongs in your portfolio. You also need a standardized scoring system. Forrester's AI Model Openness Framework (MOF), published April 2026, provides one.

MOF scores any model, open or closed, on three dimensions:

1. Reproducibility. Can you rebuild the model's results from its published artifacts? Full weight access scores high. API-only access scores low. This matters for audit trails and for debugging production failures.
2. Usage rights. What can you legally do with the model's outputs and derivatives? Apache 2.0 and MIT impose no MAU caps or field-of-use limits. Meta's Llama license requires a separate agreement above 700 million monthly active users and bans training competing models. That distinction matters at enterprise scale.
3. Community momentum. How active is the ecosystem around the model? A model with strong community momentum gets faster patches, more fine-tuning recipes, and broader third-party tooling. A model whose community has stalled, as Menlo flagged with Llama, carries upgrade risk.

One regulatory note that changes model portfolio decisions directly: open-weight models with use restrictions typically do not qualify as OSI-approved open source. Under the EU AI Act, that distinction determines whether your deployment gets the open-source exemption or falls under the full compliance regime (QubitTool). If your model portfolio includes an open-weight model deployed in the EU, confirm its OSI status before relying on the exemption. A model that looks open but carries use restrictions may trigger the same compliance obligations as a fully proprietary system.

In practice, run the MOF scoring during your model evaluation cycle, not after deployment. For each candidate model, document the three scores in a decision record: where the weights are hosted (reproducibility), what the license permits and restricts (usage rights), and the release cadence and contributor activity over the past 6 months (community momentum). A model that scores high on one dimension and fails another is a calculated risk. A model you deployed without scoring is an unpriced one.

Score every model in your portfolio on all three dimensions before it enters production. If you cannot answer one of the three, that model carries a risk you have not measured.

Governance Is the Missing Layer

Here is the core argument of this update.

Open-weight adoption did not fall because the models got worse. It fell because enterprises tried to deploy them without the governance layer that proprietary vendors bundle by default.

When you call GPT-4 through an API, OpenAI handles monitoring, abuse detection, version management, and compliance logging. When you self-host an open-weight model, you own all of that. Every update, every patch, every safety evaluation, every audit trail. The teams that pulled back from open-weight in 2025 were not staffed for it. They treated self-hosting as a deployment problem when it is, first and foremost, a governance problem.

The model portfolio itself becomes harder to manage without this layer. Each model in the fleet has its own version cycle, its own failure modes, its own data access patterns. Without unified governance, the portfolio fragments into a collection of standalone deployments that no one can audit as a system. That is the state of affairs in 2025, and it is the state of affairs the 11% number reflects.

Gartner's AI TRiSM framework (Trust, Risk, and Security Management) formalizes the four pillars that self-hosted and multimodel deployments need:

1. Explainability and Model Monitoring. Continuous surveillance of model behavior. Not a one-time audit. Runtime anomaly detection, drift alerts, output tracing.
2. ModelOps. End-to-end lifecycle management: deployment, versioning, performance tracking, deprecation. Every model, open or closed, gets the same pipeline.
3. AI Application Security. Protection against prompt injection, adversarial inputs, data corruption. Agentic workflows multiply the attack surface.
4. Privacy and Data Protection. Access control, data classification, and handling of sensitive inputs and outputs across every model in the fleet.

The risk of skipping this layer is now quantified. Gartner predicts that poor governance may force enterprises to decommission up to 40% of their AI agents by 2027. That is not a warning about model quality. It is a warning about the missing governance infrastructure. Every ungoverned model in your portfolio is a potential rollback. And a rollback is not free: it is sunk compute, retraining costs, and credibility lost with the teams that built on top of it.

Static policies, the kind most enterprises have today, cannot enforce rules at runtime. TRiSM operationalizes governance: real-time, continuous, embedded in the deployment pipeline. If your portfolio strategy has a model selection checklist but no runtime enforcement plan, you have half a strategy.

Consider two VPs of AI at comparable enterprises. Both deploy a fine-tuned open-weight model for document processing. Both chose the model because it scored well on Forrester's MOF and their token volume cleared the OECD break-even threshold. The model portfolio decision was sound. The governance decision was not.

VP A treats the deployment like an API integration: the model runs, the team moves on to the next project. VP B builds a TRiSM-aligned wrapper first: model monitoring on day one, versioned rollback, data classification on every input. The upfront cost for VP B is higher. The team spends three extra weeks on infrastructure before the model serves a single production request.

Six months in, VP A's model drifts. Outputs degrade quietly for weeks before anyone notices. When the team finally spots the problem, they cannot determine when the drift started or which outputs were affected. VP B's monitoring flags the drift on day two. The team rolls back to the last known-good checkpoint while they diagnose the cause. Same model. Same data. The difference is the governance layer that one VP invested in and the other skipped.

Agent production failures trace to this same missing infrastructure, as we documented in AI Agents in Production Succeed 56.6% of the Time.

The Model Portfolio Decision Tree

Gartner frames the deployment choice as build, buy, or blend. The data we have now makes each path concrete. Your model portfolio strategy should route every workload through three gates before assigning it to a path: token volume (the economics), governance readiness (the risk), and data sovereignty requirements (the compliance). If a workload clears all three for self-hosting, build. If it clears none, buy. If the answer is mixed across your workloads, blend.

Build (self-host open-weight models) when all three conditions hold:

• Token volume exceeds 10B/month (break-even under 2 months).
• You have a governance team that can operate the TRiSM stack.
• The use case requires data sovereignty that API access cannot satisfy.

Buy (use proprietary APIs) when any of these apply:

• Token volume is under 1B/month (self-hosting will never break even).
• You need the fastest time-to-deploy and accept vendor lock-in.
• Your team lacks MLOps capacity for self-hosted inference.

Blend (the realistic default):

• Run proprietary APIs for general workloads and rapid prototyping.
• Self-host open-weight models for high-volume, data-sensitive production tasks.
• Apply TRiSM governance uniformly across both. One standard, two deployment modes.

Blending is where the 40% of leaders who prefer self-hosting (McKinsey QuantumBlack) actually get what they want, because few organizations have uniform workloads. Your customer-facing chatbot might run on a proprietary API for speed and safety. Your internal document-processing pipeline, at 10B+ tokens a month, might self-host an open-weight model at a fraction of the API cost. Both run through the same TRiSM governance layer.

The catch: blending only works if your data layer is ready for it. When the models differ, the data classification, access controls, and audit trails must be uniform. A model portfolio that blends without uniform governance is just two ungoverned systems instead of one. See Only 7% of Enterprises Have AI-Ready Data for the data-readiness baseline that makes or breaks the blend path.

The downside of the blend path is operational complexity. You are maintaining two inference environments, two monitoring configurations, and two vendor relationships. That complexity is worth paying when the TCO savings on high-volume workloads justify it. It is not worth paying when your entire model portfolio fits comfortably under the API break-even line. Run the numbers before committing to the blend.

FAQ

How do you build an AI model portfolio strategy?

Start with an inventory of every model in use, including shadow AI. Score each on Forrester's MOF (reproducibility, usage rights, community). Match token volume per use case to the OECD break-even curve. Wrap the entire fleet in Gartner TRiSM governance. Review quarterly.

Should enterprises use open-weight or proprietary AI models?

It depends on token volume and governance capacity. Enterprises processing 10B+ tokens a month with a governance team should build. Those under 1B tokens a month, or without MLOps capacity, should buy. Most will blend both, governed under a single TRiSM standard.

What is the total cost of self-hosting open-weight AI?

The OECD reports that self-hosting breaks even against API pricing in roughly 30 months at 1B tokens per month, 2 months at 10B, and under 1 month at 50B. Below 100M tokens, self-hosting is not economical. GPU requirements scale from one L4 to eight H100s.

What is Gartner's AI TRiSM framework?

Trust, Risk, and Security Management. It comprises four pillars: explainability and model monitoring, ModelOps, AI application security, and privacy/data protection. TRiSM embeds governance at runtime, replacing static policies with continuous enforcement across all deployed models.

How do you govern a multimodel AI deployment?

Catalog all models, including third-party APIs and self-hosted weights. Apply TRiSM runtime enforcement uniformly. Standardize data classification and access control across model types. Assign dedicated AI governance leadership. Audit continuously, not annually.

What is the difference between open-weight and open-source AI models?

Open-weight means the trained parameters are available to download and run. Open source, in the OSI sense, grants broad commercial rights with no field-of-use or scale limits. Most open-weight models carry license restrictions that make them technically not open source, which matters for regulatory exemptions under the EU AI Act.

How often should you review your AI model portfolio?

Quarterly at minimum, aligned to your enterprise's planning cycle. The open-weight landscape shifts fast: new models release monthly, licensing terms change, and break-even economics shift with GPU pricing. A model portfolio reviewed annually is a model portfolio that drifts. Tie reviews to token-volume audits and governance compliance checks.

What to Do This Quarter

Your model portfolio strategy is now a living document. The April version assumed a stable open-weight trajectory. The data broke that assumption. The 19%-to-11% drop is not a failure of open-weight models. It is a failure of model portfolio management without the right decision infrastructure. Update yours with three steps:

1. Audit your token volume per use case against the OECD break-even curve.
2. Score every model on Forrester's MOF. Flag any that fail on usage rights or community momentum.
3. Map your governance stack against TRiSM's four pillars. Every missing pillar is a reason the 11% number exists.

The next inflection point is Q4 2026, when the EU AI Act general-purpose model rules take full effect. Models that currently sit in a licensing gray zone will need a clear classification. Governance layers that are optional today will become audit requirements. Your model portfolio will need another revision then, and the teams that have already adopted MOF scoring and TRiSM governance will absorb the change in days. The teams that skipped those layers will be rebuilding under regulatory pressure. Subscribe to the newsletter to get the quarterly portfolio update when it ships.

For governance-specific board questions, see 5 Questions Every Board Should Ask About AI Agent Governance.