Downloadable AI models will raise approval costs through 2028 because a few suppliers still control the computing capacity

Open weights will increase enterprise governance costs through 2028, even when they reduce dependence on a model publisher. Open weights means your company can obtain a model’s learned parameters and run a copy. That access leaves the computing supply chain in place.

You’re the technology risk officer deciding whether such a model can enter production. If your approval covers only the model file, unclear hardware access or hosting terms can block launch. A release change can reopen the review. You can end up with idle infrastructure, repeated assessment costs and delayed revenue. Outage liability may also remain unresolved.

Every material model release needs its own approval

The SaaS Sentinel reports that MiniMax’s enterprise and developer customer base grew from approximately 200,000 at the end of 2025 to more than 1 million by June 2026, while its consumer products serve about 300 million users globally ¹.

The same report says MiniMax intends to direct about 80% of its $2 billion raise to infrastructure and research, and plans to open source M3 Pro with up to 2.7 trillion parameters in Q3 2026 ¹.

That schedule turns a model name into a moving target. Each material release changes the software covered by your risk decision. The model’s behavior around company policy can shift. Compatibility with other software can break, while changes to origin or usage rights can reopen legal review.

An approval labeled only with a model family doesn’t prove that earlier tests apply to the deployed release. Record the exact release and its cryptographic hash, a digital fingerprint of the model file. Tie allowed uses and security testing to that fingerprint.

The downloadable model still runs on rented infrastructure

TechCrunch describes Reflection as a startup in the United States developing open weight AI models and reports that it secured a $1 billion agreement with Nebius lasting multiple years, including access to NVIDIA’s latest graphics processing units, or GPUs ².

The Star reports that Reflection’s earlier SpaceX contract reportedly costs approximately $150 million per month through 2029 ³.

TechCrunch reports that Nebius was formerly part of Yandex and has agreements with Meta worth $27 billion over five years and Microsoft worth $19.4 billion across multiple years ².

These commitments expose dependencies beyond the model file. An enterprise may possess the files while lacking enough compatible hardware to run them at production scale. An interruption can delay an update or force a move after privacy approval is complete.

NVIDIA states that regional AI cloud operators can procure its infrastructure through revenue sharing and credit support arrangements ⁴. In NVIDIA’s announcement, Sharon AI plans to deploy up to 40,000 Grace Blackwell GB300 GPUs, while Firmus Technologies is targeting a 360 megawatt campus in Batam with up to 170,000 NVIDIA GPUs ⁴.

That financing structure belongs in your security review. Revenue sharing ties an operator’s finances to customer usage. Credit support deepens the contractual relationship behind capacity access. Availability can therefore depend on the operator’s financial health and its rules for deciding which customers receive capacity during a shortage.

For shared cloud infrastructure, require recent proof that one customer can’t access another customer’s workloads or data. This separation is called tenant isolation. Contracts should name who handles a security incident and who must notify you. They should also state your capacity priority and the time allowed to move elsewhere.

Hardware spending can crowd out approval controls

A report on IBM says customers prioritized spending on servers and storage, along with memory, because of AI hardware supply concerns, delaying software and consulting deals ⁵. The same report says IBM shares fell 23% after the company warned that second quarter revenue and earnings would miss analyst expectations ⁵.

A separate report says IBM’s Infrastructure revenue declined 7% as customers shifted spending from IBM Z mainframes toward AI servers and storage, with memory also drawing spending ⁶. The report also says weaker mainframe sales reduced associated software revenue for transaction processing ⁶.

InfotechLead reports that IBM’s preliminary second quarter 2026 revenue was $17.2 billion, up 1% from the prior year, alongside delays in securing large enterprise contracts ⁷.

For a technology risk officer whose company relies on those systems, this is a budget sequencing warning. A GPU reservation doesn’t fund identity integration or incident response. It doesn’t maintain the resilience of systems supporting payments or customer records.

New AI capacity can sit unused while approvals wait for integration work. Deferred maintenance on existing systems also raises the risk of service interruption. Before approving another hardware purchase, require a funded integration plan and a named owner for transaction system resilience.

Where AetherLab fits

AetherLab has no direct product connection to computing capacity, cloud supply, or hosting downloadable models. We are watching because infrastructure concentration changes the cost and continuity assumptions behind an AI approval. Capacity contracts, hardware selection, and model hosting remain with cloud operators, suppliers, and the institutions deploying the systems.

Change what your approval covers

An approval object is the exact system covered by a risk decision. Treat the model file as one part of it. Build four linked records:

1. Model record: Capture the exact release and cryptographic hash. Attach its origin history and license terms.
2. Deployment record: Name the hosting operator and region. Record the accelerator type, meaning the specialized AI chip used to run the model. State whether customers share the underlying infrastructure.
3. Capacity record: State your contractual priority during scarcity and the required recovery time. Include notice requirements for changes to financing or subcontractors.
4. Control record: Attach security test results for the intended use. Include red teaming, where authorized specialists challenge the system to find failures before release. Link adaptive guardrails, which use models to assess context while the system runs and contain risky behavior. Name the monitoring owner and the date when the supporting evidence expires.

Set mandatory triggers that reopen approval:

Model file or license change: Block automatic production release and repeat behavior testing.

Hosting operator or region change: Reopen the privacy review and vendor risk assessment.

Shared infrastructure design change: Inspect tenant isolation evidence and repeat the relevant security tests.

Capacity or financing change: Confirm reserved capacity rights and run a practical migration exercise.

Use or data sensitivity change: Recalculate business impact and adjust control thresholds.

Set evidence to expire at the next material model release rather than on an arbitrary annual date. An approval from a year ago may say little about the software entering production today.

Your computing contract should state capacity priority during scarcity and a restoration target after failure. Require notice before the operator or hosting region changes. Insist on a practical way to move model files and export logs within a defined period.

Dated benchmarks for auditability

Use dated benchmarks so management can test whether approval controls are keeping pace.

By December 31, 2026, most enterprise deployments of M3 Pro should either maintain separate approvals for each exact release or slow upgrades while risk teams catch up.

By December 31, 2027, approvals tied to exact releases and written computing dependency schedules should appear in more than half of new open weights procurement reviews across a representative sample of large enterprises. The schedule should name the hardware supplier and hosting operator. It should also record the deployment region and capacity rights.

By December 31, 2028, the median enterprise using MiniMax or Reflection in production should record at least 25% more annual governance hours per model family than it did in 2026. Count release testing, provider reviews, contract review and recovery drills while holding the use and data sensitivity constant.

My concentration benchmark for that date is that more than 50% of disclosed advanced model training and live request capacity supporting those providers will still use NVIDIA hardware through no more than five primary providers. A primary provider is a main hosting company supplying that capacity.

Treat the 2028 cost benchmark as missed if governance hours rise by less than 25%. Treat the concentration benchmark as missed if NVIDIA’s share falls below half or capacity spreads across more than five primary providers.